Domain-Related Foundational Data

About XLab

XLab is a research team under QiAnXin focused on large-scale network security, threat analysis and attribution, and the development of multidimensional security data platforms.

As one of the earliest teams in China to conduct security research and threat intelligence production using large-scale data, XLab has built the country’s first PassiveDNS system. It has also developed several leading foundational data systems, including those for Netflow, Whois, digital certificates, IP addresses, and malicious samples.

Domain-Related Foundational Data

These tools are used to query domain-related data within the broader scope of foundational network security data. This includes co-occurring domains, domain popularity rankings, webpage content, and domain intelligence from the Libra data platform.

Tools

1. codomain
   • Codomain, or co-occurring domains, refers to domain names that appear together with the queried FQDN during the same or adjacent network requests — essentially, a co-occurrence list.
   • Returns: related domains, domain tags, frequency of co-occurrence with the queried domain, and descriptions of the related domains.
2. float_fqdn
   • Calculates the popularity ranking of a domain based on PassiveDNS data.
   • Returns: evaluation date, computed popularity score, and ranking based on the score. Scores range from 0 to 10, with higher scores indicating greater domain popularity.
3. webdb
   • Retrieves webpage content associated with a domain.
   • Returns: page title, page content, HTTP response code, and any tags assigned to the page.
4. libra
   • Libra is a domain analysis system developed by QiAnXin XLab. It aggregates multiple types of domain-related cybersecurity data, including PassiveDNS records, Whois data, certificate information, webpage content, sandbox sample associations, and more. By analyzing this data, the system can help assess the general status and characteristics of a domain.
   • Returns: associated PassiveDNS data, Whois records, certificate data, webpage content, sandbox sample data, and other relevant security information.

Installation & Usage

Notes

This toolset is currently in its trial version for basic security data queries. Under high-concurrency conditions, the backend may throttle network access.

For high-frequency or production-level use cases, please switch to the official version.

MCP Service Endpoint

The endpoint for QiAnXin XLab's remote MCP service is: https://fdp.qianxin.com/mcp/v1/domain/mcp/

Official Version Installation Guide

1. The official version supports streamable-http access.
2. When using the tool, you must include two HTTP headers: fdp-access and fdp-secret.
   • To obtain these credentials, please contact QiAnXin XLab.
3. When writing agent code to connect with the MCP service, include the fdp-access and fdp-secret headers in your HTTP requests. Here's an example using smolagents:

   from smolagents import ToolCollection
   from smolagents.agents import ToolCallingAgent
   from smolagents.models import OpenAIServerModel
   
   def main():
   	with ToolCollection.from_mcp(
   		{
   			"url": "https://fdp.qianxin.com/mcp/v1/domain/mcp/",
   			"transport": "streamable-http",
   			"headers": {
   				"fdp-access": "xxxx",
   				"fdp-secret": "yyyy",
   			},
   		},
   		trust_remote_code=True,
   	) as tools:
   		agent = ToolCallingAgent(
   			tools=[*tools.tools],
   			model=OpenAIServerModel(
   				model_id="YOUR-LLM-MODEL-ID",
   				api_base="YOUR-LLM-MODEL-API-URL",
   				api_key="YOUR-LLM-MODEL-API-KEY",
   			),
   		)
   		agent.run("Query the domains associated with www.example.com, and based on the associated domain data, provide an assessment of the possible business nature or purpose of the queried domain.")
   
   if __name__ == "__main__":
   	main()
   

4. If you are using Claude Desktop, you can leverage the mcp-remote library for proxy forwarding. During the forwarding process, configure the necessary HTTP headers as shown below:

   {
   	"mcpServers": {
   		"fdp_domain": {
   			"command": "npx",
   			"args": [
   				"-y",
   				"mcp-remote@latest",
   				"https://fdp.qianxin.com/mcp/v1/domain/mcp/",
   				"--header",
   				"fdp-access:xxxx",
   				"--header",
   				"fdp-secret:yyyy"
   			]
   		}
   	}
   }