SecurityTrails is a cybersecurity platform providing comprehensive domain, IP, DNS, and WHOIS intelligence data. It offers historical DNS records, subdomain discovery, WHOIS history, associated domains, passive DNS datasets, and website technology detection to support threat hunting, brand protection, cyber forensics, and attack surface management.
SecurityTrails is a cybersecurity platform providing comprehensive domain, IP, DNS, and WHOIS intelligence data. It offers historical DNS records, subdomain discovery, WHOIS history, associated domains, passive DNS datasets, and website technology detection to support threat hunting, brand protection, cyber forensics, and attack surface management. On Nagent, Securitytrails is exposed as a fully-configurable security & identity tools integration that any agent can call — 12 actions, and API key authentication. No code is required to wire Securitytrails into your workflow — connect it once via the External Integrations panel and reuse it across every agent you build.
Agent builders use Securitytrails to automate the kinds of tasks security & identity tools teams previously handled manually. Concrete examples — each one is a single agent step in Nagent — include:
Every action and trigger is paired with a structured input/output schema (visible in the sections below), so when you wire Securitytrails into Helix — our agentic agent builder — the editor knows exactly what each step expects and produces. Configure once, deploy anywhere across your Nagent agents.
Every operation an agent can call against Securitytrails, with input parameters and output schema. Drop these into any step of an agent built in Helix.
SECURITYTRAILS_BULK_STATIC_ASSET_RULESBulk add or remove static asset rules for a SecurityTrails ASI project. Static asset rules define which domains/IPs are included or excluded from the project's monitoring scope. This operation processes up to 1000 rules (combined add + remove) per request. The API processes rules asynchronously, waiting up to 2 seconds for completion. If processing takes longer, task_ids are returned for status polling. Note: Requires a valid project_id from the List Projects endpoint. Use the Get Static Assets endpoint to verify changes after bulk operations complete.
Input parameters
List of static asset rules to add. Each rule must include asset, membership, and static_type
List of static asset rules to remove. Each rule must include asset, membership, and static_type
ASI project identifier
Output
Data from the action execution
Error if any occurred during the execution of the action
Whether or not the action execution was successful or not
SECURITYTRAILS_GET_COMPANY_ASSOCIATED_IPSTool to retrieve IPs associated with a company domain. Use when you need to find all IP addresses linked to an organization's domain name.
Input parameters
Company domain to retrieve associated IP addresses for. Omit protocol (e.g., 'https://') and any trailing slash.
Output
Data from the action execution
Error if any occurred during the execution of the action
Whether or not the action execution was successful or not
SECURITYTRAILS_GET_DOMAINRetrieves comprehensive domain information from SecurityTrails including current DNS records, infrastructure details, and statistics. This tool fetches detailed DNS data (A, AAAA, MX, NS, SOA, TXT records) along with metadata about when records were first seen, which organizations own the infrastructure, and how many other domains share the same servers. Useful for domain reconnaissance, infrastructure mapping, security analysis, and understanding domain configurations. Returns structured data with typed fields for easy programmatic access by AI agents.
Input parameters
The domain/hostname to retrieve DNS and statistical data for. Must be a valid domain name without protocol or path (e.g., 'example.com', not 'https://example.com'). For internationalized domain names (IDNs), use punycode encoding. Do not include trailing dots.
Output
Data from the action execution
Error if any occurred during the execution of the action
Whether or not the action execution was successful or not
SECURITYTRAILS_GET_DOMAIN_SSLTool to fetch current and historical SSL certificate details for a hostname. Use when you need to retrieve SSL data after identifying the domain. Coverage limited to certificates indexed by SecurityTrails; private, internally-issued, or very recently issued certificates may be absent.
Input parameters
The domain or subdomain to query for SSL certificate information. Must be a bare domain or subdomain without URL scheme or path — omit `https://`, trailing slashes, and path segments.
Output
Data from the action execution
Error if any occurred during the execution of the action
Whether or not the action execution was successful or not
SECURITYTRAILS_IP_SEARCH_STATISTICSFetch aggregated statistics for IP addresses matching a DSL query. Returns top open ports by frequency, common reverse DNS patterns, and total count. Useful for analyzing IP infrastructure patterns, port distributions, and PTR records across specific IP ranges or reverse DNS domains.
Input parameters
DSL query string for IP statistics. Supports SQL-like syntax with fields: ip (with CIDR notation), ptr_part (reverse DNS pattern), port (numeric), and operators: =, !=, AND, OR. Use parentheses for grouping complex queries.
Output
Data from the action execution
Error if any occurred during the execution of the action
Whether or not the action execution was successful or not
SECURITYTRAILS_LIST_PROJECTSTool to list ASI projects available to the account. Use when you need project IDs for subsequent ASI operations.
Output
Data from the action execution
Error if any occurred during the execution of the action
Whether or not the action execution was successful or not
SECURITYTRAILS_PINGTool to test authentication and connectivity with the SecurityTrails API. Use after configuring API key.
Output
Data from the action execution
Error if any occurred during the execution of the action
Whether or not the action execution was successful or not
SECURITYTRAILS_SCROLLTool to continue scrolling through DSL search results. Use after receiving a scroll_id from SECURITYTRAILS_SEARCH_IPS or SECURITYTRAILS_SQL_API_EXECUTE_QUERY to fetch the next batch of data. Call iteratively until no scroll_id is returned to retrieve all pages.
Input parameters
Identifier returned from a previous DSL search to fetch the next batch of results.
Output
Data from the action execution
Error if any occurred during the execution of the action
Whether or not the action execution was successful or not
SECURITYTRAILS_SEARCH_IPSTool to search IP addresses via SecurityTrails DSL. Use when you need to filter IPs with custom DSL queries. Results are paginated; use SecurityTrails scroll mechanisms for large result sets to avoid missing assets.
Input parameters
Page number for paginated results (1-indexed). Defaults to 1.
DSL query expression to execute against SecurityTrails IP index. Supports fields: ip, ptr, ptr_part, port.
Output
Data from the action execution
Error if any occurred during the execution of the action
Whether or not the action execution was successful or not
SECURITYTRAILS_SQL_API_EXECUTE_QUERYExecute SQL-like queries against SecurityTrails data. Query the 'hosts' table for domain/DNS information or the 'ips' table for IP address/ASN/port data. Returns up to 100 records per request with a scroll ID for pagination. Supports standard SQL syntax (SELECT, WHERE, AND, OR, IN, IS NULL) but does NOT support LIMIT clause.
Input parameters
SQL-like query string to execute. Query the 'hosts' table (domains/DNS data) or 'ips' table (IP addresses/ASN/ports). Returns max 100 records per request; use scroll ID for pagination. NOTE: LIMIT clause is not supported by the API.
Output
Data from the action execution
Error if any occurred during the execution of the action
Whether or not the action execution was successful or not
SECURITYTRAILS_SQL_API_SCROLL_RESULTSTool to fetch next page of SQL query results. Use after obtaining scroll_id from initial SQL API response.
Input parameters
Unique scroll identifier returned by the initial SQL API POST /query request. Use this to fetch the next page of results.
Output
Data from the action execution
Error if any occurred during the execution of the action
Whether or not the action execution was successful or not
SECURITYTRAILS_TEMP_SCRAPE_SECURITYTRAILS_USAGERetrieve account usage information from the SecurityTrails API. This action fetches the current monthly usage and allowed monthly usage limits for your SecurityTrails API account. Use this to monitor your API quota consumption. Returns: On success (200): - current_monthly_usage: Your current API usage for the month - allowed_monthly_usage: Your total allowed monthly API quota On error: - status_code: HTTP status code - response_text: Error message from API
Output
Data from the action execution
Error if any occurred during the execution of the action
Whether or not the action execution was successful or not
No publicly available marketplace agent is found using this tool yet. There are 75 agents privately built on Nagent that already use Securitytrails.
Build on Nagent
Connect Securitytrails to any Nagent agent in minutes — no API key management, no boilerplate. Just configure and deploy.
The five questions agent builders ask before adopting a new integration.
Open the External Integrations panel inside Nagent (app.nagent.ai/externalIntegration), find Securitytrails, and click "Connect Now." You'll authenticate with an API key — Nagent handles credential storage and refresh automatically. Once connected, Securitytrails is available to any agent in your workspace.
No. Nagent provides no-code integration for every tool. Once Securitytrails is connected, you configure its 12 actions directly in the agent builder UI — no API calls, no boilerplate, no schema management.
Helix — Nagent's agentic agent builder — lets you drop Securitytrails steps into any workflow visually. Pick an action (e.g., one of those listed above), fill in the inputs (Helix knows the required vs. optional schema for each parameter), and connect it to upstream/downstream steps. Triggers run as the entry point of an agent, so when a Securitytrails event fires, the agent kicks off automatically.
Every Securitytrails action and trigger ships with a fully-typed schema — input parameters with name, type, required flag, and description, plus the output payload shape. The schemas are documented in the sections above. Helix uses these schemas to validate your configuration at build time and to type-check the data flowing between steps.
Yes. While Securitytrails ships with 12 pre-built security & identity tools actions, you can layer custom logic around them inside Helix — pre/post-processing steps, conditional branches, retries, or stitching Securitytrails together with other connected tools. For deeper customization, talk to our team about Nagent's Agentic AI Lab — forward-deployed engineers who build Securitytrails-based workflows tailored to your business.