# HackNotice

> External threat-intelligence and cyber-risk platform (Austin, Texas, founded 2018). Monitors
> ransomware groups, infostealer logs, breached data, dark-web marketplaces and hacker forums, and
> matches that intelligence against the domains, employees, customers and vendors a company asks it
> to watch. Four services: first-party domain monitoring, third-party vendor risk monitoring,
> end-user credential monitoring, and threat research — plus AI-assisted vendor security assessments.

This file was GENERATED by API Evangelist from HackNotice's public surface on 2026-08-22.
HackNotice serves no llms.txt of its own (hacknotice.com/llms.txt -> HTTP 404).

## How to reach it programmatically

- REST API base: https://extensionapi.hacknotice.com
- API documentation: https://api-docs.hacknotice.com (a Postman collection, 262 requests; 301s to documenter.getpostman.com/view/806684/2sBXiri7pT)
- MCP server (remote, Streamable HTTP, JSON-RPC 2.0): https://mcp.hacknotice.com:13330/mcp
- Help centre: https://hacknotice.zendesk.com/hc/en-us
- GitHub organization: https://github.com/HackNotice

## Access

- API access is granted to approved accounts only, after a 30-minute consultation call: https://hacknotice.zendesk.com/hc/en-us/articles/13540425661844-API
- Auth is header API keys, three ways: `Authorization: JWT <token>` (from POST /auth/sign_in), an `apikey` header, or a single `X-HackNotice-Integration-Key` (prefix `hn_ik_`).
- Note the literal `JWT ` prefix — this is not RFC 6750 Bearer.
- Published rate limit: 1 query per second, global. No rate-limit response headers are documented.
- Content-Type is required; most operations take application/x-www-form-urlencoded, not JSON.

## Agent surface

- 80 MCP tools, grouped: assessments (49), assessments-invited (6), end-user (6), third-party (5), first-party (4), research (2), general (8).
- `tools/list` and `initialize` answer ANONYMOUSLY with HTTP 200, so the full tool catalogue and every JSON Schema inputSchema are public. `tools/call` requires an integration key.
- Cross-cutting search tools with no REST equivalent: search_global_breaches, search_exposure, search_chatter, search_credential_leaks, search_leaked_files, search_correlated_leaks.
- Every tool accepts a `debug` boolean that returns request/response traces with secrets redacted.
- No A2A agent card is published on any HackNotice host.

## Specs and artifacts (API Evangelist profile)

- OpenAPI (derived from the published Postman collection): openapi/hacknotice-openapi.yml — 205 paths, 249 operations, 8 tags
- MCP manifest: mcp/hacknotice-mcp.yml
- MCP tools verbatim (live tools/list): mcp/hacknotice-mcp-tools.json
- MCP-to-REST tool crosswalk: mcp/hacknotice-tool-crosswalk.yml — 54 of 80 tools bind to a REST operation
- Authentication: authentication/hacknotice-authentication.yml
- Conventions incl. reversibility: conventions/hacknotice-conventions.yml
- Errors: errors/hacknotice-problem-types.yml
- Rate limits: rate-limits/hacknotice-rate-limits.yml
- Plans and pricing: plans/hacknotice-plans-pricing.yml
- Webhooks: asyncapi/hacknotice-webhooks.yml
- Data model: data-model/hacknotice-data-model.yml
- Lifecycle: lifecycle/hacknotice-lifecycle.yml
- Conformance: conformance/hacknotice-conformance.yml
- Packages: packages/hacknotice-packages.yml
- Agent skills: skills/_index.yml

## First-party packages

- n8n-nodes-hacknotice-api (npm, 3.0.4, 2026-06-05) — REST API node
- n8n-nodes-hacknotice-mcp (npm, 1.0.6, 2026-07-07) — MCP client node for n8n AI Agents

## Events

- Webhook notifications per monitoring service, evaluated on a 12-hour batch cadence.
- Payload carries an alert COUNT and a platform link only — no usernames, domains, breach details, passwords or threat context. Call the API to learn what happened.
- Destinations: Slack incoming webhook, Splunk HTTP Event Collector, ticketing systems via alert email address.
- No AsyncAPI document, no payload schema, no webhook signature.

## Known gaps (measured, not inferred)

- No OpenAPI published by HackNotice.
- No /.well-known document on any host; no security.txt; no OAuth/OIDC metadata.
- No A2A agent card.
- No status page, no SLA, no API changelog.
- No deprecation policy, though a "Deprecated" folder exists in the published collection.
- No idempotency contract, and no reversal operation or window for any destructive operation.
- No published compliance program, trust centre or vulnerability-disclosure policy.
- Errors are a flat {"message": "..."} string, not RFC 9457.
- No STIX, TAXII, MISP, OpenC2 or CVE/CVSS interchange in the contract.

## Company

- Website: https://hacknotice.com/
- Pricing: https://hacknotice.com/pricing/ — Starter $15,000/yr (50 vendors), Growth $30,000/yr (150), Business $70,000/yr (500), Enterprise $120,000/yr (1,000)
- Blog: https://hacknotice.com/category/blog/ (RSS: https://hacknotice.com/feed/)
- Terms: https://hacknotice.com/businesstandc/ | Privacy: https://hacknotice.com/privacy/ | Use policy: https://hacknotice.com/use-policy/
- Support: support@hacknotice.com

---
This profile is maintained independently by API Evangelist (https://apievangelist.com) from
publicly reachable material. It is not operated or endorsed by HackNotice.