# Qi An Xin Technology Group (QAX / 奇安信)

> Beijing-headquartered cybersecurity vendor founded in 2014, listed on the Shanghai
> Stock Exchange STAR Market (688561), with 10,000+ employees across 65 branches.
> Its public developer surface is the QAX Threat Intelligence Center: an Api-Key
> authenticated REST reputation API and a hosted Model Context Protocol server.

This file was GENERATED by API Evangelist from the artifacts in this repository and
from QAX's own published documentation. QAX does not serve an llms.txt of its own —
probed 2026-08-26: https://www.qianxin.com/llms.txt 404, https://en.qianxin.com/llms.txt
404, https://ti.qianxin.com/llms.txt returns the site's SPA shell (not a document).

## Agent access at a glance

- Hosted MCP server: https://mcp.ti.qianxin.com/ti-stream-mcp (Streamable HTTP, preferred)
- Deprecated MCP transport: https://mcp.ti.qianxin.com/ti-mcp/sse (SSE, no longer maintained)
- Local stdio MCP: NOT offered. The provider explicitly does not support stdio.
- REST API host: https://webapi.ti.qianxin.com
- Auth on every surface: static API key in the `Api-Key` request header.
- Keys are NOT self-service. Register at https://user.ti.qianxin.com/login, then
  request API access from ti_support@qianxin.com.
- No OpenAPI, no GraphQL, no AsyncAPI, no A2A agent card, no /.well-known documents.

## APIs

- [QAX Threat Intelligence API](https://ti.qianxin.com/help): REST lookup API for IP
  reputation, domain and URL reputation, file/hash verdicts, compromise detection and
  vulnerability intelligence. HTTP GET, indicator passed as `?param=`, JSON response.
  Example: `curl 'https://webapi.ti.qianxin.com/ip/v3/reputation?param=<indicator>' -H 'Api-Key: <key>'`
- [QAX Threat Intelligence MCP Service](https://github.com/RedDrip7/qax-ti-mcp): hosted
  MCP server exposing 16 threat-intelligence tools to AI clients.

## MCP tools (16, provider-published names and descriptions)

- query_vuln_by_id: vulnerability detail by CVE / CNNVD / CNVD identifier
- batch_query_vulns: batch vulnerability lookup, up to 5 identifiers
- query_vuln_list_by_keyword: fuzzy vulnerability search by product or component name
- query_vuln_list: multi-criteria vulnerability search across 20+ dimensions
- query_ip: single-IP reputation and attacker-group attribution
- batch_query_ips: batch IP profiling, up to 5 addresses
- query_domain: domain threat-label verification and resolution tracking
- batch_query_domains: batch domain detection, up to 5 domains
- query_hash: file-hash verdict with sandbox behavioural analysis
- batch_query_hashes: batch sample comparison, up to 5 hashes
- query_ioc_graph: IOC relationship graph across IP / domain / URL / hash
- query_domain_graph: domain attack-chain visualisation
- query_ip_graph: IP asset profiling and lateral-movement paths
- query_hash_graph: sample-hash relationships exposing C2 infrastructure
- query_threat_actor_by_ioc: threat-actor profile from an IOC
- query_threat_actor_list: multi-criteria threat-actor search

Input schemas are not published; they require an authenticated tools/list call.

## Runtime semantics

- Read-only. Every documented operation is a lookup. There is no write surface, so
  idempotency, dry-run and reversibility are all not-applicable for this API.
- Versioning is per-interface in the URL path (/ip/v3/..., /api/v2/compromise).
- Error envelope is vendor JSON: {"message": "..."} — not RFC 9457 problem+json.
- Rate limits are enforced but no number, window or response header is published.
- No pricing or plan tiers are published; access is arranged with ti_support@qianxin.com.
- Batch MCP tools are capped at 5 items per call.
- Streamable HTTP MCP sessions carry an `Mcp-Session-Id`; the REST surface returns no
  correlation identifier.

## Company

- [Corporate site (Chinese)](https://www.qianxin.com/)
- [Corporate site (English)](https://en.qianxin.com/)
- [About](https://en.qianxin.com/about/index)
- [Products](https://en.qianxin.com/product/index)
- [News](https://en.qianxin.com/news/list)
- [Support](https://www.qianxin.com/support/index)
- [Contact](https://en.qianxin.com/about/contactus) — +86 (10) 5783 6300, GlobalPartner@qianxin.com

## Security

- [Butian Vulnerability Response Platform](https://www.butian.net/) — QAX-operated public
  vulnerability submission platform with a researcher reward programme.
- [QAX on Butian](https://qianxin.butian.net/)
- [QAX Intelligence Sandbox](https://sandbox.ti.qianxin.com/sandbox/page) — hosted file
  detonation and behavioural analysis (a product, not an API test environment).

## Known gaps

- No machine-readable API contract of any kind (no OpenAPI/Swagger/GraphQL/AsyncAPI/gRPC/WSDL).
- The API reference at https://ti.qianxin.com/help is a JavaScript-rendered single-page
  application; every path under ti.qianxin.com returns an identical 1,647-byte HTML shell
  to non-browser clients, so no agent can read the documentation without executing JS.
- No STIX/TAXII interchange, the interchange standard of this provider's own market.
- No /.well-known/security.txt, no status page, no published SLA, no first-party SDK.