hashlookup CIRCL API

{
  "service_type": "platform",
  "base_url": "https://hashlookup.circl.lu",
  "auth_method": "none",
  "auth_config": {},
  "endpoints": [
    "/lookup/md5/{hash}",
    "/lookup/sha1/{hash}",
    "/lookup/sha256/{hash}",
    "/lookup/{hash}",
    "/info/{hash}",
    "/bulk",
    "/stats",
    "/session/status",
    "/recent",
    "/known",
    "/subset"
  ],
  "pricing_model": {
    "type": "free",
    "details": {
      "provider": "CIRCL (Computer Incident Response Center Luxembourg)",
      "access": "Public API, no authentication required for lookups",
      "note": "Bulk lookups and certain advanced endpoints may have usage limits or require a session"
    }
  },
  "rate_limits": {
    "unknown": true,
    "notes": "No explicit published rate limits; public service, reasonable use expected"
  },
  "capabilities": [
    "Hash lookup (MD5, SHA-1, SHA-256, and other common hashes)",
    "Known-file database sourced from NSRL and other trusted datasets",
    "Bulk hash lookups via POST",
    "File metadata retrieval for known hashes",
    "Statistics on the hash database",
    "Used by security researchers, malware analysts, and threat intelligence tools",
    "Integrations with MISP and other CTI platforms"
  ],
  "raw_analysis": "CIRCL hash lookup is a free, public API maintained by CIRCL (Computer Incident Response Center Luxembourg), a well-established CERT in Luxembourg. The service allows lookups of file hashes (MD5, SHA-1, SHA-256) against a known-file database primarily built from the NSRL (National Software Reference Library) and other curated sources. It's aimed at security researchers, incident responders, malware analysts, and threat intelligence platforms. The API is accessible via HTTPS at https://hashlookup.circl.lu without authentication for standard lookups. It supports single lookup endpoints (e.g., /lookup/sha256/{hash}), bulk lookups, and metadata endpoints. The platform is mature, actively maintained since around 2020, and integrates with tools like MISP. Pricing is free (open service), with the CIRCL organization providing it as a public good. Rate limits are not explicitly documented but reasonable use is expected. The endpoints listed are inferred from the public API documentation; exact paths may vary. This is a data/reference service rather than a typical SaaS platform, but it fits the 'platform' service type as a hosted API with no REST-typical auth."
}

1/3 tests passed

```json
{
  "overall": 72,
  "dimensions": {
    "token_efficiency": 8.0,
    "first_try_success": 9.0,
    "response_parseability": 8.5,
    "error_clarity": 6.5,
    "doc_quality": 7.0,
    "auth_simplicity": 10.0,
    "latency": 9.0,
    "consistency": 7.5
  },
  "pricing_normalized": {
    "model": "free",
    "provider": "CIRCL",
    "auth_required": false,
    "notes": "Public API, no authentication for lookups; bulk/advanced endpoints may have limits"
  },
  "issues": [
    "No /robots.txt (404) — minor discoverability/interop gap",
    "No /llms.txt (404) — agents lack a structured, LLM-friendly entry point",
    "Only a Swagger UI landing page; no machine-first discovery doc",
    "Bulk endpoint usage limits/requirements are vaguely described ('may have usage limits')",
    "No dedicated status/uptime page referenced for reliability verification"
  ],
  "recommendations": [
    "Publish /robots.txt and /llms.txt to help agents auto-discover capabilities",
    "Expose an OpenAPI/JSON schema link prominently alongside Swagger UI for agent parsing",
    "Document explicit rate limits and bulk-query quotas on a dedicated page",
    "Add a public status/health endpoint (e.g., /status.json) for reliability checks",
    "Clarify error codes/behaviors for invalid/unknown hashes in the docs"
  ]
}
```