StyxView MCP server

Let Claude, Cursor, VS Code, and other AI assistants read your StyxView data and act on findings, with your permissions.

The StyxView MCP server connects an AI assistant to your StyxView data through the Model Context Protocol. Ask about your findings, your Digital Risk Score, your attack surface, or your third parties in the assistant you already use, and it answers from StyxView's own records.

The assistant signs in as you. It sees the accounts and projects you can see in StyxView, and nothing changes until you confirm it.

Server URLhttps://api.styxview.com/api/v1/mcp

Remote MCP server over Streamable HTTP, signed in with OAuth. Version 0.2.0. Protocol revisions 2026-07-28, 2025-11-25, 2025-06-18, 2025-03-26.

Connect your assistant

Claude

In Claude (claude.ai or the desktop app), open Settings, then Connectors.
Select Add custom connector, name it StyxView, and enter the server URL.
Select Connect and sign in to StyxView in the window that opens.

Claude Code

Add the server, then run /mcp in Claude Code and choose StyxView to sign in.

claude mcp add --transport http styxview https://api.styxview.com/api/v1/mcp

Cursor

Add the server to ~/.cursor/mcp.json, or to .cursor/mcp.json in one project. Cursor asks you to sign in the first time it connects.

{
  "mcpServers": {
    "styxview": {
      "url": "https://api.styxview.com/api/v1/mcp"
    }
  }
}

VS Code

Add the server to .vscode/mcp.json in your workspace, then start it from the file and sign in when asked.

{
  "servers": {
    "styxview": {
      "type": "http",
      "url": "https://api.styxview.com/api/v1/mcp"
    }
  }
}

The assistant signs in with your StyxView account, single sign-on included, and receives a token for this server alone. It reaches the same accounts and projects you can open in StyxView, and the server checks every request against them.

Start a conversation with whoami: it lists the accounts and projects you can reach, and most tools need an account_id from it.

Permissions

When you sign in, you grant the assistant one or more permissions. A tool works only with the permission it needs, shown on each tool.

read lets the assistant read your data.
act lets it propose and confirm changes to findings and assets.
iris lets it ask Iris and read AI Overviews. Iris also needs the account's AI features turned on.

Permission	What it allows
`read`	Read findings, the Digital Risk Score, the attack surface, Notifications, Response Actions, third parties, and account settings.
`act`	Propose and confirm changes to findings and assets, such as a status change, a comment, an assignment, or an asset's criticality.
`iris`	Ask Iris, StyxView's assistant, and read the AI Overview of a finding.

Acting on findings

Changing a finding takes two steps, so nothing changes without you. propose_finding_action pins up to 50 findings and returns what it would do, without writing anything. confirm_finding_action carries it out once you approve it: in a confirmation form where your assistant shows one, otherwise by telling the assistant to go ahead.

One proposal can hold up to 10 groups, each with its own action and comment, so you can close some findings, accept the risk on others, and confirm them all at once. A finding that already has the change, such as one already marked as a false positive, is left as it is and listed in the result.

If a finding changed after the proposal, it is not written, and a fresh proposal comes back for you to check. A confirmed action runs as you, through the same checks as the page, and its comment starts with [via connector] so your team can tell where it came from.

Reading results

Every list says how many items matched and what it left out, such as closed findings or false positives, so the assistant can tell you when an answer covers part of the data. Dates and times are in UTC.

Lists return 25 items at a time, and the assistant can ask for the next page. Finding searches return a short row per finding; the assistant can ask for any other field, such as the full subject or the finding's link, when it needs it.

Text StyxView collected from the internet, such as a page title or a post, is marked as external. The assistant treats it as data, never as instructions.

Tools

The 68 tools the server offers, by area. Read-only tools never change anything. A tool that prepares a change writes nothing; the change happens only when you confirm it.

Getting started

Who you are, what you can reach, and the lists other tools take their ids from.

`whoami`

Who am IreadRead-only

The signed-in person, their client, every account and project they can reach, and whether each account is available through this connector. Its connector block gives the server version and, when known, whether the tool list this connection holds is up to date and how to reconnect if not. Call this first.

No parameters.

`list_accounts`

List accountsreadRead-only

The accounts you can reach, with their projects and solutions. search narrows them by account name or exact account id.

Parameter	Type	Description
`search`	string	From 1 to 100 characters.

`list_finding_types`

List finding typesreadRead-only

The finding types with their sub-solution, so filters use the platform ids.

No parameters.

`list_finding_statuses`

List finding statusesreadRead-only

The eight statuses, which are active, and which a person may set.

No parameters.

`list_users`

List usersreadRead-only

Users on an account, to resolve an assignee by name.

Parameter	Type	Description
`account_id`required	integer	At least 1.

Findings

Search, count, and read findings across every solution.

`search_findings`

Search findingsreadRead-only

A filtered, ordered page of findings of every type, for Company Protection (the default), Executive Protection (every active executive, or one, each finding carrying its executive_project_id, named in the result's executives) or third parties (every third party, or one, read from its shared record, each finding carrying its third_party_project_id, named in third_parties). Defaults to the five active statuses and excludes false positives; the result names what it excluded, so say so when answering. Pages hold 25 findings unless limit says otherwise. Each row is compact: id, type id (finding_types names them), the subject collected from the internet (its first 100 characters), severity, status, the date last seen and only the flags that are set; pass fields for other keys. A Company Protection page carries web_url, the same findings on StyxView's Findings page. asset_association_id narrows it to one asset. Where asset management is available, each row also carries effective_severity, and suppressed when it is set. Use summarize_findings for counts, which covers the whole population rather than one page.

Parameter	Type	Description
`account_id`required	integer	The account, from whoami. At least 1.
`solution`	string	Defaults to company_protection, or to the solution of the project id passed. One solution per call, because Executive Protection reuses the same finding types. One of: company_protection, executive_protection, third_party.
`project_id`	integer	The Company Protection project. Optional when the account has exactly one. At least 1.
`executive_project_id`	integer	One executive, from whoami. Omit it to cover every active executive. At least 1.
`third_party_project_id`	integer	One third party, from list_third_parties. Omit it to cover every one. At least 1.
`finding_type_ids`	list of integer	Finding types, from list_finding_types. At most 25 items. Each value from 1 to 99.
`severities`	list of string	One of: Critical, Very High, High, Medium, Low, Very Low, Unassigned. At most 7 items.
`statuses`	list of string	Defaults to the five active statuses. Pass Resolved, Closed Without Action or No Longer Seen explicitly to include closed findings. One of: New, Analyzing, On Watchlist, Response In Progress, Resolved, Closed Without Action, No Longer Seen, Reappeared. At most 8 items.
`false_positive`	string	Defaults to exclude. One of: exclude, include, only.
`first_seen_from`	date (YYYY-MM-DD)
`first_seen_to`	date (YYYY-MM-DD)
`last_seen_from`	date (YYYY-MM-DD)
`last_seen_to`	date (YYYY-MM-DD)
`assignee_user_id`	integer	A user id from list_users. At least 1.
`watchlist`	boolean	Only findings on, or off, the watchlist.
`brand_infringement`	boolean	Only findings marked, or not marked, Brand Infringement Detected.
`legitimate`	boolean	Only findings marked, or not marked, Legitimate.
`accepted_risk`	boolean	Only findings whose risk is, or is not, accepted.
`sub_solutions`	list of string	Sub-solution names exactly as findings report them, such as Brand Protection. At most 10 items.
`search`	string	Matches part of the subject (a host, domain, email or title) or an exact finding id. Letters, digits, spaces and _ . @ : / - + ' , & # ( ) only, so leave out a URL's query string; there are no wildcards. At most 100 characters.
`asset_association_id`	integer	Only the findings linked to this asset: an association_id from list_assets. Company Protection only, and only where asset management is available. At least 1.
`order_by`	string	Defaults to priority. One of: priority, first_seen, last_seen.
`limit`	integer	Defaults to 25. From 1 to 100.
`offset`	integer	At least 0.
`fields`	list of string	Return finding_id and these keys instead of the compact row, at full detail: the subject up to 4000 characters, dates with their time, every flag true or false, and url, the finding page link (third_party_url, the third party's page, on a third party). A key a finding does not carry is left out, such as assignee and url on a third party. One of: finding_type_id, finding_type, sub_solution, subject, severity, effective_severity, suppressed, status, first_seen, last_seen, assignee, false_positive, accepted_risk, legitimate, brand_infringement, on_watchlist, project_id, executive, third_party, shared_record, url, third_party_url. From 1 to 22 items.

`summarize_findings`

Summarize findingsreadRead-only

Counts of findings grouped by finding type, severity, status, sub-solution, executive, third party, effective severity or suppressed, over every matching finding. Takes the same filters and solution as search_findings.

Parameter	Type	Description
`account_id`required	integer	The account, from whoami. At least 1.
`solution`	string	Defaults to company_protection, or to the solution of the project id passed. One solution per call, because Executive Protection reuses the same finding types. One of: company_protection, executive_protection, third_party.
`project_id`	integer	The Company Protection project. Optional when the account has exactly one. At least 1.
`executive_project_id`	integer	One executive, from whoami. Omit it to cover every active executive. At least 1.
`third_party_project_id`	integer	One third party, from list_third_parties. Omit it to cover every one. At least 1.
`finding_type_ids`	list of integer	Finding types, from list_finding_types. At most 25 items. Each value from 1 to 99.
`severities`	list of string	One of: Critical, Very High, High, Medium, Low, Very Low, Unassigned. At most 7 items.
`statuses`	list of string	Defaults to the five active statuses. Pass Resolved, Closed Without Action or No Longer Seen explicitly to include closed findings. One of: New, Analyzing, On Watchlist, Response In Progress, Resolved, Closed Without Action, No Longer Seen, Reappeared. At most 8 items.
`false_positive`	string	Defaults to exclude. One of: exclude, include, only.
`first_seen_from`	date (YYYY-MM-DD)
`first_seen_to`	date (YYYY-MM-DD)
`last_seen_from`	date (YYYY-MM-DD)
`last_seen_to`	date (YYYY-MM-DD)
`assignee_user_id`	integer	A user id from list_users. At least 1.
`watchlist`	boolean	Only findings on, or off, the watchlist.
`brand_infringement`	boolean	Only findings marked, or not marked, Brand Infringement Detected.
`legitimate`	boolean	Only findings marked, or not marked, Legitimate.
`accepted_risk`	boolean	Only findings whose risk is, or is not, accepted.
`sub_solutions`	list of string	Sub-solution names exactly as findings report them, such as Brand Protection. At most 10 items.
`search`	string	Matches part of the subject (a host, domain, email or title) or an exact finding id. Letters, digits, spaces and _ . @ : / - + ' , & # ( ) only, so leave out a URL's query string; there are no wildcards. At most 100 characters.
`asset_association_id`	integer	Only the findings linked to this asset: an association_id from list_assets. Company Protection only, and only where asset management is available. At least 1.
`group_by`	list of string	Defaults to finding_type. effective_severity and suppressed need asset management on the account. One of: finding_type, severity, status, sub_solution, executive, third_party, effective_severity, suppressed. From 1 to 3 items.

`get_finding`

Get a findingreadRead-only

One finding with everything its StyxView page shows: the type-specific Finding Information in the page's own sections (WHOIS, DNS and MX records, ports, certificates, posts, breach details and so on), the images it holds, assignee, flags and latest comments, for any solution. Where asset management is on, linked_assets lists the assets of the finding's project that it touches, each with its role, criticality, scope and page; the first in scope is the one whose criticality sets effective_severity. A third party finding is its shared record, so it carries no assignee, comments or linked assets. Secrets, card numbers and stealer-log credentials are masked; text collected from the internet is marked external.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`finding_id`required	integer	At least 1.
`include_descriptions`	boolean	Adds what each of a lookalike domain's inspection checks means. Defaults to false: the text is the same on every lookalike.

`get_finding_image`

Get a finding imagereadRead-only

One image from a finding's page, such as a lookalike domain's screenshot for a locale, an impersonating profile's screenshot or a detected logo, returned as an image for reports. get_finding lists image_ids.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`finding_id`required	integer	At least 1.
`image_id`required	string	At most 40 characters.

`list_finding_comments`

List finding commentsreadRead-only

Every comment on a finding, newest first, with the platform prefixes such as [Status Changed -> Analyzing].

Parameter	Type	Description
`account_id`required	integer	At least 1.
`finding_id`required	integer	At least 1.

Digital Risk Score

Your score, its indicators, its history, and what to fix first.

`get_risk_posture`

Get risk posturereadRead-only

The Digital Risk Score (higher is worse, 0 to 1000), its rating, the industry average and every category with its weight, share of the score and cap, plus the key risk indicators. For a third party it is the score StyxView shows for it. Latest by default; as_of or run_id give a past one.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`project_id`	integer	A Company Protection project, or a third party from list_third_parties. Optional when the account has exactly one Company Protection project. At least 1.
`third_party_project_id`	integer	A third party, from list_third_parties: its parent's score is read. At least 1.
`as_of`	date (YYYY-MM-DD)	The score as it stood on this date: the latest scored run on or before it.
`run_id`	integer	One scored run, from get_risk_score_runs. At least 1.

`list_risk_indicators`

List risk indicatorsreadRead-only

Risk indicators from a scored run, ranked by score contribution, each with its description, grade, remediation status and whether its category is at its cap. Remediation in a capped category does not lower the score yet.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`project_id`	integer	A Company Protection project, or a third party from list_third_parties. Optional when the account has exactly one Company Protection project. At least 1.
`third_party_project_id`	integer	A third party, from list_third_parties: its parent's score is read. At least 1.
`top_n`	integer	From 1 to 100.
`as_of`	date (YYYY-MM-DD)	The score as it stood on this date: the latest scored run on or before it.
`run_id`	integer	One scored run, from get_risk_score_runs. At least 1.

`get_risk_score_history`

Get risk score historyreadRead-only

The score over time, one point per scored day, including days before runs were numbered.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`project_id`	integer	A Company Protection project, or a third party from list_third_parties. Optional when the account has exactly one Company Protection project. At least 1.
`third_party_project_id`	integer	A third party, from list_third_parties: its parent's score is read. At least 1.
`from`	date (YYYY-MM-DD)
`to`	date (YYYY-MM-DD)

`get_risk_score_runs`

Get risk score runsreadRead-only

Every numbered scored run, and the suggested pair to compare: the latest against the most recent earlier run where anything changed.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`project_id`	integer	A Company Protection project, or a third party from list_third_parties. Optional when the account has exactly one Company Protection project. At least 1.
`third_party_project_id`	integer	A third party, from list_third_parties: its parent's score is read. At least 1.

`compare_risk_score_runs`

Compare risk score runsreadRead-only

Why the score moved between two runs: per-indicator change and the findings that entered and left. With no runs given, uses the suggested pair.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`project_id`	integer	A Company Protection project, or a third party from list_third_parties. Optional when the account has exactly one Company Protection project. At least 1.
`third_party_project_id`	integer	A third party, from list_third_parties: its parent's score is read. At least 1.
`run_a`	integer	At least 1.
`run_b`	integer	At least 1.

`get_indicator_findings`

Get indicator findingsreadRead-only

The active findings behind a named risk indicator or category.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`project_id`	integer	A Company Protection project, or a third party from list_third_parties. Optional when the account has exactly one Company Protection project. At least 1.
`third_party_project_id`	integer	A third party, from list_third_parties: its parent's score is read. At least 1.
`indicator`required	string	From 1 to 120 characters.
`limit`	integer	From 1 to 100.
`as_of`	date (YYYY-MM-DD)	The score as it stood on this date: the latest scored run on or before it.
`run_id`	integer	One scored run, from get_risk_score_runs. At least 1.

`get_recommendations`

Get recommendationsreadRead-only

Quick wins: the indicators where remediating a finding lowers the score most, only in categories below their cap, with the assets involved and playbook remediation for each finding type.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`project_id`	integer	A Company Protection project, or a third party from list_third_parties. Optional when the account has exactly one Company Protection project. At least 1.
`third_party_project_id`	integer	A third party, from list_third_parties: its parent's score is read. At least 1.
`top_n`	integer	From 1 to 10.

`get_executive_risk`

Get executive riskreadRead-only

Each executive's risk rating in Executive Protection and the two exposures it comes from. Executives have a rating, not a Digital Risk Score.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`executive_project_id`	integer	One executive, from whoami. Omit it for every one. At least 1.

Actions

Change findings in two steps, propose then confirm.

`propose_finding_action`

Propose a finding actionactPrepares a change

Prepares actions on up to 50 Company Protection or Executive Protection findings (a third party's findings take none). Each action is one of eight: comment, false_positive, accept_risk, legitimate, brand_infringement, watchlist, status (argument: the status) or assign (argument: a name or email). Pass one action and comment with the findings as finding_ids or criteria, or pass groups (at most 10), each with its own finding_ids, action, argument and comment, so one confirmation covers them all. Writes nothing: it pins the findings, and returns the restatement to show the person. Every comment must be the person's own words.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`action`	string	One of: comment, false_positive, accept_risk, legitimate, brand_infringement, watchlist, status, assign.
`finding_ids`	list of integer	From 1 to 50 items. Each value at least 1.
`comment`	string	From 1 to 2000 characters.
`argument`	string	At most 255 characters.
`criteria`	object
`criteria.solution`	string	Defaults to company_protection, or to the solution of the project id passed. One solution per call, because Executive Protection reuses the same finding types. One of: company_protection, executive_protection, third_party.
`criteria.project_id`	integer	The Company Protection project. Optional when the account has exactly one. At least 1.
`criteria.executive_project_id`	integer	One executive, from whoami. Omit it to cover every active executive. At least 1.
`criteria.third_party_project_id`	integer	One third party, from list_third_parties. Omit it to cover every one. At least 1.
`criteria.finding_type_ids`	list of integer	Finding types, from list_finding_types. At most 25 items. Each value from 1 to 99.
`criteria.severities`	list of string	One of: Critical, Very High, High, Medium, Low, Very Low, Unassigned. At most 7 items.
`criteria.statuses`	list of string	Defaults to the five active statuses. Pass Resolved, Closed Without Action or No Longer Seen explicitly to include closed findings. One of: New, Analyzing, On Watchlist, Response In Progress, Resolved, Closed Without Action, No Longer Seen, Reappeared. At most 8 items.
`criteria.false_positive`	string	Defaults to exclude. One of: exclude, include, only.
`criteria.first_seen_from`	date (YYYY-MM-DD)
`criteria.first_seen_to`	date (YYYY-MM-DD)
`criteria.last_seen_from`	date (YYYY-MM-DD)
`criteria.last_seen_to`	date (YYYY-MM-DD)
`criteria.assignee_user_id`	integer	A user id from list_users. At least 1.
`criteria.watchlist`	boolean	Only findings on, or off, the watchlist.
`criteria.brand_infringement`	boolean	Only findings marked, or not marked, Brand Infringement Detected.
`criteria.legitimate`	boolean	Only findings marked, or not marked, Legitimate.
`criteria.accepted_risk`	boolean	Only findings whose risk is, or is not, accepted.
`criteria.sub_solutions`	list of string	Sub-solution names exactly as findings report them, such as Brand Protection. At most 10 items.
`criteria.search`	string	Matches part of the subject (a host, domain, email or title) or an exact finding id. Letters, digits, spaces and _ . @ : / - + ' , & # ( ) only, so leave out a URL's query string; there are no wildcards. At most 100 characters.
`groups`	list of object	Several actions in one proposal: at most 50 findings in all, each finding in one group only. From 1 to 10 items.
`groups[].action`required	string	One of: comment, false_positive, accept_risk, legitimate, brand_infringement, watchlist, status, assign.
`groups[].finding_ids`required	list of integer	From 1 to 50 items. Each value at least 1.
`groups[].comment`required	string	From 1 to 2000 characters.
`groups[].argument`	string	At most 255 characters.

`confirm_finding_action`

Confirm a finding actionactChanges data

Carries out a proposal once the person confirms it. Clients that support forms show the person a confirmation form, and only the form confirms there. Other clients pass confirmed_by_user true only after the person has said to go ahead in the conversation. Findings that changed since the proposal are never written; a fresh proposal comes back instead.

Parameter	Type	Description
`proposal_id`required	string
`confirmed_by_user`	boolean
`comment`	string	Leave out. A different comment is refused: propose again so the person sees the new restatement. From 1 to 2000 characters.

Finding screenshots

Give a lookalike domain, an impersonating social profile, or a potential employee profile your own screenshot when automated capture failed, in two steps, propose then confirm.

`propose_finding_screenshot`

Propose a finding screenshotactPrepares a change

Prepares a screenshot for one lookalike domain, impersonating social profile or potential employee profile finding, for when automated capture failed or shows a login wall. Pass the image file (JPEG, PNG, GIF or WebP, at most 4 MB) as image_base64: its bytes base64 encoded, nothing else. Stores the image but changes nothing on the finding, and returns the restatement to show the person with the current screenshot where there is one. confirm_finding_screenshot applies it.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`finding_id`required	integer	At least 1.
`image_base64`required	string	The image file, base64 encoded. From 1 to 5600000 characters.

`confirm_finding_screenshot`

Confirm a finding screenshotactChanges data

Sets the screenshot a proposal prepared once the person confirms it. Clients that support forms show the person a confirmation form, and only the form confirms there. Other clients pass confirmed_by_user true only after the person has said to go ahead in the conversation.

Parameter	Type	Description
`proposal_id`required	string
`confirmed_by_user`	boolean

Iris

Ask StyxView's assistant, and read AI Overviews of findings.

`ask_iris`

Ask IrisirisRead-only

Ask StyxView's own assistant anything it answers in the web panel, including recall of your earlier conversations. Prefer the structured tools for data; use this for the long tail. Needs the account's AI features enabled. Returns a request_id when the answer takes longer than 20 seconds.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`question`required	string	From 1 to 4000 characters.
`session_id`	string	Pass the session_id from an earlier answer to keep Iris's own memory.
`attachments`	list of object	At most 8 items.
`attachments[].kind`required	string	One of: finding, host, ip.
`attachments[].value`required	string	From 1 to 253 characters.
`language`	string	The language Iris writes in. Defaults to your StyxView language setting, or English when none is set. One of: en, es, fr, pt, ar.

`get_iris_answer`

Get Iris answeririsRead-only

The answer to an ask_iris question that returned a request_id.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`request_id`required	string

`get_finding_overview`

Get finding overviewirisRead-only

The AI Overview shown on a finding's page: what it is, whether it applies, and how to fix it. If none has been written yet, or the finding changed since, this call starts writing one, exactly as opening the page does, and waits up to 20 seconds; if it returns pending, call again. Needs the account's AI features enabled.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`finding_id`required	integer	At least 1.
`language`	string	The language Iris writes in. Defaults to your StyxView language setting, or English when none is set. One of: en, es, fr, pt, ar.

Notifications and Response Actions

Notifications raised on your findings, and takedowns and other Response Actions.

`search_notifications`

Search NotificationsreadRead-only

Notifications raised on an account by its alert rules, most recent first, with the finding each points at when it has one. Defaults to Open and Acknowledged; the result names what it excluded.

Parameter	Type	Description
`limit`	integer	Defaults to 25. From 1 to 100.
`offset`	integer	At least 0.
`account_id`required	integer	At least 1.
`project_id`	integer	Only this project, of any solution. At least 1.
`statuses`	list of string	One of: Open, Closed, Acknowledged, Resolved. At most 4 items.
`solution`	string	One of: company_protection, executive_protection, third_party.
`severities`	list of string	One of: Critical, Very High, High, Medium, Low, Very Low, Info. At most 7 items.
`category_ids`	list of integer	At most 25 items. Each value at least 1.
`since`	date (YYYY-MM-DD)
`until`	date (YYYY-MM-DD)
`search`	string	Matches the ticket number, the rule name or the indicator. At most 100 characters.

`get_notification`

Get a NotificationreadRead-only

One Notification with its rule, the risk and recommendation the rule carries, its content and its notes. StyxView does not record an ITSM ticket reference against a Notification.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`notification_id`	integer	At least 1.
`ticket_number`	string	At most 64 characters.

`list_notifications_for_finding`

List Notifications for a findingreadRead-only

Every Notification raised on one finding, of any status.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`finding_id`required	integer	At least 1.

`list_response_actions`

List Response ActionsreadRead-only

Response Actions (takedowns and suspensions) on a Company Protection project, most recently started first. Read-only: requesting one stays in StyxView.

Parameter	Type	Description
`limit`	integer	Defaults to 25. From 1 to 100.
`offset`	integer	At least 0.
`account_id`required	integer	At least 1.
`project_id`	integer	The Company Protection project. Optional when the account has exactly one. At least 1.
`statuses`	list of string	One of: Draft, New, In Progress, Resolved, Closed without Action, Re-opened. At most 6 items.
`types`	list of string	One of: Takedown, Account Suspension, Domain Suspension. At most 3 items.

`get_response_action`

Get a Response ActionreadRead-only

One Response Action with its history, the providers contacted, the finding it concerns, and the names of the evidence files attached in StyxView.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`project_id`	integer	At least 1.
`response_action_id`required	integer	At least 1.

`get_response_action_quota`

Get takedown quotareadRead-only

Takedowns used and remaining on the account's subscription. A takedown counts once it is resolved.

Parameter	Type	Description
`account_id`required	integer	At least 1.

Attack surface

Hosts, domains, DNS records, open ports, technologies, certificates, and vulnerabilities.

`list_hosts`

List hostsreadRead-only

Monitored hosts with their IP addresses, open ports, highest vulnerability risk, and first and last seen.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`project_id`	integer	A Company Protection or third-party project. Optional when the account has exactly one Company Protection project. At least 1.
`limit`	integer	Defaults to 25. From 1 to 100.
`offset`	integer	At least 0.
`domain`	string	At most 253 characters.
`host_type`	string	One of: Host, Mail Server, Name Server, SaaS Application.
`search`	string	Part of a host name or IP address. At most 100 characters.
`order_by`	string	Defaults to risk. One of: risk, name, last_seen, first_seen.

`get_host`

Get a hostreadRead-only

One host assembled: its IPs, open ports, technologies and versions, certificates, vulnerabilities and DNS records, up to 50 of each.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`project_id`	integer	A Company Protection or third-party project. Optional when the account has exactly one Company Protection project. At least 1.
`host`required	string	At most 253 characters.

`list_owned_domains`

List owned domainsreadRead-only

Owned domains with registrar and expiry, email-security records (SPF, DKIM, DMARC) and their severity.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`project_id`	integer	A Company Protection or third-party project. Optional when the account has exactly one Company Protection project. At least 1.
`limit`	integer	Defaults to 25. From 1 to 100.
`offset`	integer	At least 0.

`list_dns_records`

List DNS recordsreadRead-only

DNS records for the monitored hosts, optionally for one domain or one record type.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`project_id`	integer	A Company Protection or third-party project. Optional when the account has exactly one Company Protection project. At least 1.
`limit`	integer	Defaults to 25. From 1 to 100.
`offset`	integer	At least 0.
`domain`	string	At most 253 characters.
`name`	string	One host name. At most 253 characters.
`record_types`	list of string	One of: a, aaaa, mx, ns, soa, txt, spf, dmarc, dkim, ptr, cname. At most 11 items.

`list_open_ports`

List open portsreadRead-only

Open ports across the estate or on one host, potentially insecure ones first.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`project_id`	integer	A Company Protection or third-party project. Optional when the account has exactly one Company Protection project. At least 1.
`limit`	integer	Defaults to 25. From 1 to 100.
`offset`	integer	At least 0.
`host`	string	At most 253 characters.
`insecure_only`	boolean

`list_technologies`

List technologiesreadRead-only

Detected technologies and versions with the hosts carrying each, most widespread first.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`project_id`	integer	A Company Protection or third-party project. Optional when the account has exactly one Company Protection project. At least 1.
`limit`	integer	Defaults to 25. From 1 to 100.
`offset`	integer	At least 0.
`technology`	string	At most 100 characters.

`list_certificates`

List TLS certificatesreadRead-only

TLS certificates with issuer, expiry, days left, the hosts presenting them and their issues.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`project_id`	integer	A Company Protection or third-party project. Optional when the account has exactly one Company Protection project. At least 1.
`limit`	integer	Defaults to 25. From 1 to 100.
`offset`	integer	At least 0.
`expiring_within_days`	integer	Negative values reach already expired ones. From -3650 to 3650.

`list_vulnerabilities`

List vulnerabilitiesreadRead-only

CVEs on the monitored hosts with CVSS base score and EPSS, highest score first. Filter by host or CVE.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`project_id`	integer	A Company Protection or third-party project. Optional when the account has exactly one Company Protection project. At least 1.
`limit`	integer	Defaults to 25. From 1 to 100.
`offset`	integer	At least 0.
`host`	string	At most 253 characters.
`cve`	string	At most 20 characters.
`min_cvss`	number	From 0 to 10.
`include_inactive`	boolean

Asset inventory

Your monitored assets with their criticality, scope, and tags, and the severity matrix that sets each finding's effective severity from the criticality of the assets it touches. These tools need Asset Management turned on for your account.

`list_assets`

List assetsreadRead-only

A Company Protection project's asset inventory (Monitored Assets, Asset Inventory): hosts, domains, IP addresses, certificates, websites, apps, social accounts and the rest, each with its criticality, scope, tags, a few attributes and its count of open findings. Filters by asset type, criticality, scope, tag and text, and pages with limit and offset. association_id is what get_asset, propose_asset_changes and search_findings take. Needs asset management on the account.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`project_id`	integer	The Company Protection project. Optional when the account has exactly one. At least 1.
`asset_types`	list of string	One of: host, subdomain, owned_domain, ip_address, dedicated_ip_range, tls_certificate, website, saas_application, mobile_application, social_media_account, crown_jewel_asset, data_leak_asset, executive_person, cloud_resource, third_party_asset. At most 15 items.
`criticalities`	list of string	Matches the criticality in force, so medium also matches assets following a Medium project default; project_default matches only those. One of: very_low, low, medium, high, very_high, project_default. At most 6 items.
`in_scope`	boolean
`tag`	string	One tag name, exactly. From 1 to 100 characters.
`search`	string	Part of the identifier, such as a host name or address. At most 100 characters.
`order_by`	string	Defaults to asset_type: the Monitored Assets tab order, then identifier. One of: asset_type, last_seen, criticality, identifier.
`limit`	integer	Defaults to 50. From 1 to 100.
`offset`	integer	At least 0.

`get_asset`

Get an assetreadRead-only

One asset as its StyxView page shows it: identifier and type, description, criticality (its own or the project default), scope, highest severity, tags, the attributes that are set and who set them, and counts of its linked findings by severity and finding type. search_findings with asset_association_id lists the findings themselves. Needs asset management on the account.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`project_id`	integer	The Company Protection project. Optional when the account has exactly one. At least 1.
`association_id`required	integer	The asset, from list_assets. At least 1.

`get_severity_matrix`

Get the severity matrixreadRead-only

The severity matrix in force for a project: for each base severity and asset criticality, the severity a finding is shown at, and which cells this tenant changed from the Styx default. Administrators and analysts. Needs asset management on the account.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`project_id`	integer	The Company Protection project. Optional when the account has exactly one. At least 1.

Changing assets

Set an asset's criticality, scope, description, attributes, or tags, or a cell of the severity matrix, in two steps, propose then confirm. Changing an asset takes an administrator or analyst role, and the severity matrix an administrator. These tools need Asset Management turned on for your account.

`propose_asset_changes`

Propose asset changesactPrepares a change

Prepares up to 10 changes on one Company Protection project for the person to confirm: set_criticality, set_scope, set_description, set_attributes, add_tag, remove_tag, and set_matrix_cell (administrators only). Writes nothing: it checks each change as StyxView would, pins the value it changes and returns the restatement to show the person. Read get_asset, and get_severity_matrix for a cell, first. Administrators and analysts, where asset management is available.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`project_id`	integer	The Company Protection project. Optional when the account has exactly one. At least 1.
`changes`required	list of object	From 1 to 10 items.
`changes[].kind`required	string	One of: set_criticality, set_scope, set_description, set_attributes, add_tag, remove_tag, set_matrix_cell.
`changes[].association_id`	integer	The asset, from list_assets. Every kind but set_matrix_cell. At least 1.
`changes[].criticality`	string	set_criticality: the new criticality, or project_default to follow the project's default again. set_matrix_cell: the column, a criticality code. One of: very_low, low, medium, high, very_high, project_default.
`changes[].in_scope`	boolean	set_scope: false takes the asset out of scope, true brings it back.
`changes[].description`	string	set_description: the new text, up to 1024 characters; null clears it. At most 4000 characters.
`changes[].attributes`	object	set_attributes: the attributes to set; null clears this tenant's value.
`changes[].attributes.operating_system`	string	At most 128 characters.
`changes[].attributes.operating_system_version`	string	At most 64 characters.
`changes[].attributes.hosting_model`	string	on_premise, cloud, third_party_hosted or unknown At most 80 characters.
`changes[].attributes.environment`	string	production, staging, development, test or unknown At most 80 characters.
`changes[].attributes.owner`	string	At most 255 characters.
`changes[].attributes.physical_location_region`	string	At most 255 characters.
`changes[].attributes.lifecycle_status`	string	active, decommissioning, decommissioned or unknown At most 80 characters.
`changes[].attributes.data_classification`	string	public, internal, confidential, restricted or unknown At most 80 characters.
`changes[].attributes.internet_facing`	boolean
`changes[].attributes.business_unit`	string	At most 255 characters.
`changes[].tag`	string	add_tag or remove_tag: the tag name. A name the tag library lacks becomes a new tag. From 1 to 100 characters.
`changes[].base_severity`	string	set_matrix_cell: the row, a severity name as get_severity_matrix shows it. At most 20 characters.
`changes[].effective_severity`	string	set_matrix_cell: the severity those findings show at, or default to remove this project's change to the cell. At most 20 characters.

`confirm_asset_changes`

Confirm asset changesactChanges data

Makes the changes in a proposal once the person confirms it, each through StyxView as the asset page makes it, and reports each one. Clients that support forms always show the person a confirmation form. Other clients pass confirmed_by_user true only after the person has said to go ahead in the conversation. Proposals last 30 minutes. If any value changed since the proposal, nothing is written.

Parameter	Type	Description
`proposal_id`required	string
`confirmed_by_user`	boolean

Third parties

Third parties, their risk, their questionnaires, and the risk register.

`list_third_parties`

List third partiesreadRead-only

Third parties on the account with business criticality, lifecycle status, and the Digital Risk Score from the dashboard snapshot. A third party has no score of its own: it is the score of its shared record.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`lifecycle_statuses`	list of string	At most 14 items.
`criticalities`	list of string	One of: Very Low, Low, Medium, High, Very High. At most 5 items.

`get_third_party`

Get a third partyreadRead-only

One third party: its profile, score, industry average, combined risk score (external exposure and questionnaire), breach and data leakage summary, latest questionnaires and the count of open risks. Fields with no recorded value are left out rather than returned blank.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`project_id`required	integer	The third party, from list_third_parties. Its shared parent id works too. At least 1.

`get_third_party_risk_overview`

Get third party risk overviewreadRead-only

The third party portfolio: counts by rating, the business criticality by risk rating matrix, automated risk exposure, high-risk and breach counts, questionnaire totals and each third party's score over time.

Parameter	Type	Description
`account_id`required	integer	At least 1.

`list_questionnaires`

List questionnairesreadRead-only

Questionnaires sent to third parties, most recent first, with status, progress, reviewers and the latest score. Questionnaires have no due date in StyxView; use sent_before to find old ones still open.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`project_id`	integer	The third party, from list_third_parties. Its shared parent id works too. At least 1.
`limit`	integer	Defaults to 25. From 1 to 100.
`offset`	integer	At least 0.
`statuses`	list of string	One of: Sent, In Progress, Under Review, Sent Back, Completed. At most 5 items.
`sent_before`	date (YYYY-MM-DD)

`get_questionnaire`

Get a questionnairereadRead-only

One questionnaire: its sections with each answer, the evidence file names, the reviewer's feedback, and the score with its category breakdown.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`project_id`required	integer	The third party, from list_third_parties. Its shared parent id works too. At least 1.
`questionnaire_id`required	integer	At least 1.

`list_risk_register`

List the risk registerreadRead-only

Tracked third-party risks with likelihood, impact, score, treatment, owner and approval state, highest score first. Defaults to the open statuses; the result names what it excluded.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`project_id`	integer	The third party, from list_third_parties. Its shared parent id works too. At least 1.
`limit`	integer	Defaults to 25. From 1 to 100.
`offset`	integer	At least 0.
`statuses`	list of string	One of: Open, Assessed, Treatment In Progress, Mitigated, Accepted, Closed, Reopened. At most 7 items.
`treatments`	list of string	One of: Accept, Mitigate, Transfer, Avoid. At most 4 items.

Social & News Monitoring

The posts and articles collected about you in a period, by platform and sentiment.

`get_social_news_coverage`

Get Social & News Monitoring coveragereadRead-only

Every post and article collected for an account in a fixed period, all sentiments, beside the period of the same length before it: mentions by platform and sentiment, the biggest news sources, monitored profiles, new negative sentiment findings, and each monitored person and brand project with its own counts. Covers every project you reach unless project_id or executive_project_id names one. Built for client digests.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`project_id`	integer	One Company Protection project. At least 1.
`executive_project_id`	integer	One monitored executive. At least 1.
`start_date`required	date (YYYY-MM-DD)	First day, YYYY-MM-DD, UTC.
`days`	integer	Defaults to 7. From 1 to 31.

`list_social_news_posts`

List Social & News postsreadRead-only

The posts and articles collected in a period, newest first, with platform, sentiment, link, text and the finding a post became, if any. not_findings keeps only posts that are not findings, for a digest's posts to review.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`project_id`	integer	One Company Protection project. At least 1.
`executive_project_id`	integer	One monitored executive. At least 1.
`start_date`required	date (YYYY-MM-DD)	First day, YYYY-MM-DD, UTC.
`days`	integer	Defaults to 7. From 1 to 31.
`sentiments`	list of string	One of: Negative, Neutral, Positive. At most 3 items.
`type`	string	One of: social, news.
`platform`	string	A platform as get_social_news_coverage names it, such as X Mentions. At most 60 characters.
`not_findings`	boolean
`search`	string	Words in the text or title. At most 100 characters.
`limit`	integer	Defaults to 10. From 1 to 25.
`offset`	integer	From 0 to 1000.

Adding Social & News items

Add a post or article by hand to a brand project or a monitored person, with its sentiment, in two steps, propose then confirm. Adding an item takes an administrator or analyst role, and a Negative one also raises a finding.

`propose_social_news_items`

Propose Social & News itemsactPrepares a change

Prepares up to 10 Social & News items to add by hand to one brand project or one monitored person, as the Add manual finding dialog on that page does. Writes nothing: it checks each item as StyxView would and returns the restatement to show the person. Every item needs a title, a link and a sentiment, and a Negative one also raises a finding. The platform comes from the link itself. Read list_social_news_posts first so an item already collected is not added again. Administrators and analysts.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`project_id`	integer	The Company Protection project. Pass this or executive_project_id. At least 1.
`executive_project_id`	integer	One monitored executive. At least 1.
`items`required	list of object	From 1 to 10 items.
`items[].title`required	string	From 1 to 250 characters.
`items[].url`required	string	The post or article link. Its host decides the platform and the social/news split. At most 500 characters.
`items[].sentiment`required	string	Required. Negative also raises a finding. One of: Negative, Neutral, Positive.
`items[].keywords`	string	Detection keywords. Defaults to Manual Entry. At most 150 characters.
`items[].text`	string	The post or article text. At most 20000 characters.
`items[].language`	string	An ISO 639 code or a language name StyxView holds, such as es or Spanish. At most 30 characters.
`items[].date_posted`	string	When it was posted, YYYY-MM-DD. Not in the future. Defaults to now. At most 30 characters.

`confirm_social_news_items`

Confirm Social & News itemsactChanges data

Adds the items in a proposal once the person confirms it, through the endpoint the page itself posts to, and reports what was added. Clients that support forms always show the person a confirmation form. Other clients pass confirmed_by_user true only after the person has said to go ahead in the conversation. Proposals last 10 minutes and are confirmed once; a confirmation that fails adds nothing, so propose the items again. An item already on the page is skipped.

Parameter	Type	Description
`proposal_id`required	string
`confirmed_by_user`	boolean

Disinformation Monitoring

Narratives, coordinated clusters, and amplifiers around the people and brands you monitor. These tools need the Disinformation Monitoring add-on.

`list_disinformation_monitoring`

List Disinformation Monitoring projectsreadRead-only

The executives and brand projects monitored by the Disinformation Monitoring add-on, each with its Disinformation Risk Score (0 to 1000), active narratives, threats or violence, high-risk clusters, automated share and shares per hour. Disinformation Monitoring writes no findings, so the finding tools cannot see it.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`project_id`	integer	A monitored executive or Company Protection project, from list_disinformation_monitoring. Optional when only one is monitored. At least 1.
`period`	string	The window ending now, as on the dashboard. Defaults to 7d. One of: 4h, 12h, 24h, 48h, 7d, 14d, 21d, 30d.
`traffic_type`	string	All authors, likely automated ones (bot) or the rest (human). Defaults to all. One of: all, bot, human.

`get_disinformation_summary`

Get a Disinformation Monitoring summaryreadRead-only

One monitored project's dashboard: the score and what drives it (the breakdown covers seven days at most), the metric tiles, the top clusters and narratives, mentions over time, platforms, locations, hashtags, authors and the most engaged posts.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`project_id`	integer	A monitored executive or Company Protection project, from list_disinformation_monitoring. Optional when only one is monitored. At least 1.
`period`	string	The window ending now, as on the dashboard. Defaults to 7d. One of: 4h, 12h, 24h, 48h, 7d, 14d, 21d, 30d.
`traffic_type`	string	All authors, likely automated ones (bot) or the rest (human). Defaults to all. One of: all, bot, human.

`list_disinformation_narratives`

List disinformation narrativesreadRead-only

Active narratives for a monitored project, one row per narrative with its posts, reach and sentiment split. get_disinformation_narrative reads the posts behind one.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`project_id`	integer	A monitored executive or Company Protection project, from list_disinformation_monitoring. Optional when only one is monitored. At least 1.
`period`	string	The window ending now, as on the dashboard. Defaults to 7d. One of: 4h, 12h, 24h, 48h, 7d, 14d, 21d, 30d.
`traffic_type`	string	All authors, likely automated ones (bot) or the rest (human). Defaults to all. One of: all, bot, human.
`sentiment`	string	One of: Negative, Neutral, Positive, Other.
`limit`	integer	Defaults to 25. From 1 to 50.

`get_disinformation_narrative`

Get a disinformation narrativereadRead-only

The posts behind one narrative, most engaged first, with author, sentiment, engagement, bot score and text. Pass the narrative exactly as list_disinformation_narratives gave it.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`project_id`	integer	A monitored executive or Company Protection project, from list_disinformation_monitoring. Optional when only one is monitored. At least 1.
`narrative`required	string	From 1 to 300 characters.
`period`	string	The window ending now, as on the dashboard. Defaults to 7d. One of: 4h, 12h, 24h, 48h, 7d, 14d, 21d, 30d.
`traffic_type`	string	All authors, likely automated ones (bot) or the rest (human). Defaults to all. One of: all, bot, human.
`limit`	integer	Defaults to 10. From 1 to 25.
`offset`	integer	A multiple of limit. At least 0.

`get_disinformation_trend`

Get disinformation volume and sentiment over timereadRead-only

Analysed posts per hour (periods up to 48h) or per day, split by sentiment, with engagement.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`project_id`	integer	A monitored executive or Company Protection project, from list_disinformation_monitoring. Optional when only one is monitored. At least 1.
`period`	string	The window ending now, as on the dashboard. Defaults to 7d. One of: 4h, 12h, 24h, 48h, 7d, 14d, 21d, 30d.
`traffic_type`	string	All authors, likely automated ones (bot) or the rest (human). Defaults to all. One of: all, bot, human.

`get_disinformation_period_report`

Get a Disinformation Monitoring period reportreadRead-only

A fixed period (start_date and days, UTC) beside the period of the same length before it, across every monitored project or one: posts analysed, sentiment, automated and threat counts, clusters against the high-risk threshold, narratives marked new, growing, steady or fading, and the threat and most engaged posts with links to cite. Built for client digests.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`project_id`	integer	A monitored executive or Company Protection project, from list_disinformation_monitoring. Optional when only one is monitored. At least 1.
`start_date`required	date (YYYY-MM-DD)	First day, YYYY-MM-DD.
`days`	integer	Defaults to 7. From 1 to 31.

`list_disinformation_clusters`

List disinformation clustersreadRead-only

Coordinated clusters of similar posts for a monitored project, highest cluster score first, with size, average bot score, sentiment and bot to human ratio. Filter with min_score (the dashboard calls above 800 high risk).

Parameter	Type	Description
`account_id`required	integer	At least 1.
`project_id`	integer	A monitored executive or Company Protection project, from list_disinformation_monitoring. Optional when only one is monitored. At least 1.
`period`	string	The window ending now, as on the dashboard. Defaults to 7d. One of: 4h, 12h, 24h, 48h, 7d, 14d, 21d, 30d.
`min_score`	integer	From 0 to 1000.
`limit`	integer	Defaults to 10. From 1 to 25.
`offset`	integer	A multiple of limit. At least 0.

`get_disinformation_cluster`

Get a disinformation clusterreadRead-only

One cluster and its member posts, with each author's bot score and the text.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`project_id`	integer	A monitored executive or Company Protection project, from list_disinformation_monitoring. Optional when only one is monitored. At least 1.
`cluster_id`required	integer	At least 1.
`limit`	integer	Defaults to 10. From 1 to 25.
`offset`	integer	A multiple of limit. At least 0.

`list_disinformation_authors`

List prolific disinformation authorsreadRead-only

The authors posting most about the monitored target (the top amplifiers), with post counts and whether each is likely automated.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`project_id`	integer	A monitored executive or Company Protection project, from list_disinformation_monitoring. Optional when only one is monitored. At least 1.
`period`	string	The window ending now, as on the dashboard. Defaults to 7d. One of: 4h, 12h, 24h, 48h, 7d, 14d, 21d, 30d.
`traffic_type`	string	All authors, likely automated ones (bot) or the rest (human). Defaults to all. One of: all, bot, human.
`limit`	integer	Defaults to 10. From 1 to 25.
`offset`	integer	A multiple of limit. At least 0.

`get_disinformation_post`

Get a disinformation postreadRead-only

One collected post: text and translation, narrative, sentiment, fact assessment, engagement, location and link.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`project_id`	integer	A monitored executive or Company Protection project, from list_disinformation_monitoring. Optional when only one is monitored. At least 1.
`post_id`required	string	From 1 to 40 characters.

Impersonation

Profiles impersonating your monitored people or brand, period over period.

`get_impersonation_report`

Get an account impersonation reportreadRead-only

Impersonating profiles first seen in a fixed period beside the period before it, per monitored person (or for the brand): counts by severity and platform, how many are Very Low automatic name matches and how many still await review, and the profiles needing attention with URL, platform, severity, status and link. Built for client digests; summarize_findings and search_findings give other cuts of the same findings.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`start_date`required	date (YYYY-MM-DD)	First day, YYYY-MM-DD, UTC.
`days`	integer	Defaults to 7. From 1 to 31.
`solution`	string	Defaults to executive_protection: every monitored person you reach. One of: executive_protection, company_protection.
`executive_project_id`	integer	One monitored executive. At least 1.
`project_id`	integer	A Company Protection project, for the brand. At least 1.

Account

Your subscription, policy configuration, and audit log.

`get_subscription`

Get the subscriptionreadRead-only

The account's subscription: the current term and whether it is live, the products on it, and usage against each entitlement with what remains.

Parameter	Type	Description
`account_id`required	integer	At least 1.

`get_policy_configuration`

Get the policy configurationreadRead-only

What a project monitors, section by section: domains, hosts, IP ranges, keywords, social accounts, mobile apps and job posting channels, split into monitored and pending approval. Account administrators only.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`project_id`	integer	Any project. Optional when the account has exactly one Company Protection project. At least 1.
`sections`	list of string	One of: identity, domains, hosts, ip_ranges, keywords, social_accounts, mobile_apps, job_posting_channels. At most 8 items.

`get_audit_log`

Get the audit logreadRead-only

Audit entries for the account, most recent first. via_connector marks finding actions confirmed through this connector. Account administrators only.

Parameter	Type	Description
`account_id`required	integer	At least 1.
`since`	date (YYYY-MM-DD)
`until`	date (YYYY-MM-DD)
`user_id`	integer	A user id from list_users. At least 1.
`audit_types`	list of string	At most 10 items.
`connector_only`	boolean
`limit`	integer	Defaults to 25. From 1 to 100.
`offset`	integer	At least 0.

StyxView MCP server

Connect your assistant

Claude

Claude Code

Cursor

VS Code

Sign-in and access

Permissions

Acting on findings

Reading results

Tools

Getting started

Findings

Digital Risk Score

Actions

Finding screenshots

Iris

Notifications and Response Actions

Attack surface

Asset inventory

Changing assets

Third parties

Social & News Monitoring

Adding Social & News items

Disinformation Monitoring

Impersonation

Account