Uncover Provider & API Key Reference

Generated from projectdiscovery/uncover source code analysis. Supported agents: 19 total (18 requiring API keys + 1 anonymous)

Provider Overview

#	Provider	Engine Name	API Keys Required	Config Format	Free Tier
1	Shodan	`shodan`	1	`SHODAN_API_KEY`	Yes (limited)
2	Shodan InternetDB	`shodan-idb`	None	(anonymous)	Unlimited
3	Censys	`censys`	2	`CENSYS_API_TOKEN:CENSYS_ORGANIZATION_ID`	Yes (250/mo)
4	FOFA	`fofa`	2	`FOFA_EMAIL:FOFA_KEY`	Yes
5	Quake (360)	`quake`	1	`QUAKE_TOKEN`	Yes
6	Hunter (Qianxin)	`hunter`	1	`HUNTER_API_KEY`	Yes
7	ZoomEye	`zoomeye`	1	`ZOOMEYE_API_KEY`	Yes
8	Netlas	`netlas`	1	`NETLAS_API_KEY`	Yes (250/mo)
9	CriminalIP	`criminalip`	1	`CRIMINALIP_API_KEY`	Yes
10	PublicWWW	`publicwww`	1	`PUBLICWWW_API_KEY`	Yes
11	HunterHow	`hunterhow`	1	`HUNTERHOW_API_KEY`	Yes
12	Google CSE	`google`	2	`GOOGLE_API_KEY:GOOGLE_API_CX`	Yes (100/day)
13	ODIN	`odin`	1	`ODIN_API_KEY`	Yes
14	BinaryEdge	`binaryedge`	1	`BINARYEDGE_API_KEY`	Yes (limited)
15	Onyphe	`onyphe`	1	`ONYPHE_API_KEY`	Yes
16	Driftnet	`driftnet`	1	`DRIFTNET_API_KEY`	Yes
17	GreyNoise	`greynoise`	1	`GREYNOISE_API_KEY`	Yes (community)
18	DayDayMap	`daydaymap`	1	`DAYDAYMAP_API_KEY`	Yes
19	NerdyData	`nerdydata`	1	`NERDYDATA_API_KEY`	Yes

Provider Details

1. Shodan

Field	Value
Website	https://www.shodan.io
Engine Name	`shodan`
Signup URL	https://account.shodan.io/register
API Key Page	https://account.shodan.io/ (logged in)
Required Credentials	1 API key
Config Format	`SHODAN_API_KEY_1`
Env Variable	`SHODAN_API_KEY`
Free Tier	Yes — 50 credits/month, limited results
Paid Plans	Developer ($59/mo), Business ($399/mo), Enterprise ($999/mo)
Rate Limits	1 request/sec (free), higher on paid plans
Registration	Email + password required
Notes	Most widely used internet device search engine. Queries use Shodan search filters.

2. Shodan InternetDB

Field	Value
Website	https://internetdb.shodan.io
Engine Name	`shodan-idb`
API Keys Required	None (anonymous)
Free Tier	Unlimited
Notes	Queries IP/CIDR for open ports only. No API key required. Used as default engine when IP/CIDR is provided as input. Only returns ports, no search filtering.

3. Censys

Field	Value
Website	https://search.censys.io
Engine Name	`censys`
Signup URL	https://censys.io/register
Required Credentials	API Token + Organization ID
Config Format	`CENSYS_API_TOKEN:CENSYS_ORGANIZATION_ID`
Env Variables	`CENSYS_API_TOKEN`, `CENSYS_ORGANIZATION_ID`
Free Tier	Yes — 250 queries/month
Paid Plans	Explore ($69/mo), Enterprise (custom)
Registration	Email, Google, or GitHub auth
Notes	API Token is found in Account > API. Organization ID is in Account > Workspace. Format is colon-separated: `token:org_id`.

4. FOFA

Field	Value
Website	https://fofa.info
Engine Name	`fofa`
Signup URL	https://fofa.info/toLogin
Required Credentials	Email + Key
Config Format	`FOFA_EMAIL:FOFA_KEY`
Env Variables	`FOFA_EMAIL`, `FOFA_KEY`
Free Tier	Yes — limited results
Paid Plans	Member, Professional, Enterprise (pricing varies)
Registration	Email + phone verification required (China-based)
Notes	Popular Chinese asset search engine. Registration requires Chinese phone number or international option. Format is colon-separated: `email:key`.

5. Quake (360)

Field	Value
Website	https://quake.360.net/quake/#/index
Engine Name	`quake`
Signup URL	https://quake.360.net/quake/#/index (register)
Required Credentials	1 API token
Config Format	`QUAKE_TOKEN_1`
Env Variable	`QUAKE_TOKEN`
Free Tier	Yes — daily limited queries
Paid Plans	Subscription-based (360.cn platform)
Registration	Phone number required (China-based)
Notes	Operated by 360.cn. API token available in user settings after login.

6. Hunter (Qianxin)

Field	Value
Website	https://hunter.qianxin.com
Engine Name	`hunter`
Signup URL	https://user.skyeye.qianxin.com/user/register
Required Credentials	1 API key
Config Format	`HUNTER_API_KEY_1`
Env Variable	`HUNTER_API_KEY`
Free Tier	Yes — limited monthly queries
Paid Plans	Subscription-based (Qianxin platform)
Registration	Phone number required (China-based)
Notes	Chinese attack surface mapping platform. Also known as “SkyEye”.

7. ZoomEye

Field	Value
Website	https://www.zoomeye.ai
Engine Name	`zoomeye`
Signup URL	https://www.zoomeye.ai (register)
Required Credentials	1 API key
Config Format	`ZOOMEYE_API_KEY_1`
Env Variable	`ZOOMEYE_API_KEY`
Free Tier	Yes — limited results
Paid Plans	Member, Professional, Enterprise
Registration	Email required
Notes	Asset discovery engine by Knownsec. API key in personal center after login.

8. Netlas

Field	Value
Website	https://netlas.io
Engine Name	`netlas`
Signup URL	https://app.netlas.io/registration/
Required Credentials	1 API key
Config Format	`NETLAS_API_KEY_1`
Env Variable	`NETLAS_API_KEY`
Free Tier	Yes — 250 requests/month
Paid Plans	Researcher ($9/mo), Business ($99/mo), Enterprise (custom)
Registration	Email + password required
Notes	Internet OSINT search engine. API key in profile settings.

9. CriminalIP

Field	Value
Website	https://www.criminalip.io
Engine Name	`criminalip`
Signup URL	https://www.criminalip.io/register
Required Credentials	1 API key
Config Format	`CRIMINALIP_API_KEY_1`
Env Variable	`CRIMINALIP_API_KEY`
Free Tier	Yes — limited monthly queries
Paid Plans	Pro, Business, Enterprise
Registration	Email required
Notes	Cyber threat intelligence search engine. API key in My Page > API Settings.

10. PublicWWW

Field	Value
Website	https://publicwww.com
Engine Name	`publicwww`
Signup URL	https://publicwww.com/profile/signup.html
Required Credentials	1 API key
Config Format	`PUBLICWWW_API_KEY_1`
Env Variable	`PUBLICWWW_API_KEY`
Free Tier	Yes — limited queries
Paid Plans	Personal (€19/mo), Professional, Enterprise
Registration	Email required
Notes	Website source code search engine. Finds sites containing specific HTML/JS/CSS.

11. HunterHow

Field	Value
Website	https://hunter.how
Engine Name	`hunterhow`
Signup URL	https://hunter.how (register/login)
Required Credentials	1 API key
Config Format	`HUNTERHOW_API_KEY_1`
Env Variable	`HUNTERHOW_API_KEY`
Free Tier	Yes — limited
Paid Plans	Varies
Registration	Email or social login
Notes	Asset discovery platform by “Hunter How”. API key from dashboard.

12. Google Custom Search

Field	Value
Website	https://programmablesearchengine.google.com
Engine Name	`google`
Console URLs	API Key, CX
Required Credentials	API Key + Search Engine ID (CX)
Config Format	`GOOGLE_API_KEY:GOOGLE_API_CX`
Env Variables	`GOOGLE_API_KEY`, `GOOGLE_API_CX`
Free Tier	100 queries/day
Paid Plans	$5 per 1K queries beyond free tier
Registration	Google Cloud Platform account required
Notes	Google Custom Search API. Requires: (1) API key from Google Cloud console, and (2) Programmable Search Engine ID (cx) created via control panel. Format is colon-separated: `api_key:cx`.

13. ODIN

Field	Value
Website	https://odin.io
Engine Name	`odin`
Signup URL	https://odin.io (register)
Required Credentials	1 API key
Config Format	`ODIN_API_KEY_1`
Env Variable	`ODIN_API_KEY`
Free Tier	Yes — limited
Paid Plans	Varies
Registration	Email required
Notes	Cyber asset attack surface management platform. API key from dashboard. Note: Not shown in README but present in source code.

14. BinaryEdge

Field	Value
Website	https://www.binaryedge.io
Engine Name	`binaryedge`
Signup URL	https://app.binaryedge.io/register
Required Credentials	1 API key
Config Format	`BINARYEDGE_API_KEY_1`
Env Variable	`BINARYEDGE_API_KEY`
Free Tier	Yes — 100 requests/month
Paid Plans	Pro (€49/mo), Premium (€199/mo), Enterprise
Registration	Email required
Notes	Threat intelligence and internet scanning platform. API key in account settings. Note: Not shown in README but present in source code.

15. Onyphe

Field	Value
Website	https://www.onyphe.io
Engine Name	`onyphe`
Signup URL	https://search.onyphe.io/signup
Required Credentials	1 API key
Config Format	`ONYPHE_API_KEY_1`
Env Variable	`ONYPHE_API_KEY`
Free Tier	Yes — limited
Paid Plans	Web ($25/mo), Researcher ($50/mo), Enterprise
Registration	Email required
Notes	Cyber threat intelligence search engine. API key in account settings. Supports full-text search on internet-sourced data.

16. Driftnet

Field	Value
Website	https://driftnet.io
Engine Name	`driftnet`
Signup URL	https://driftnet.io/auth?state=signup
Required Credentials	1 API key
Config Format	`DRIFTNET_API_KEY_1`
Env Variable	`DRIFTNET_API_KEY`
Free Tier	Yes — limited
Paid Plans	Varies
Registration	Email required
Notes	Internet scanning and asset discovery API. Fast lookup of open ports for IP/CIDR ranges.

17. GreyNoise

Field	Value
Website	https://www.greynoise.io
Engine Name	`greynoise`
Signup URL	https://www.greynoise.io/signup
Required Credentials	1 API key
Config Format	`GREYNOISE_API_KEY_1`
Env Variable	`GREYNOISE_API_KEY`
Free Tier	Yes — Community (500 queries/month)
Paid Plans	Pro ($99/mo), Enterprise
Registration	Email required
Notes	Noise/censor alerting for internet scanning. Filters benign from malicious. Note: Not shown in README but present in source code.

18. DayDayMap

Field	Value
Website	https://www.daydaymap.com
Engine Name	`daydaymap`
Signup URL	https://www.daydaymap.com (register)
Required Credentials	1 API key
Config Format	`DAYDAYMAP_API_KEY_1`
Env Variable	`DAYDAYMAP_API_KEY`
Free Tier	Yes — limited
Paid Plans	Varies
Registration	Required (platform in Chinese)
Notes	Chinese asset mapping platform. May require phone verification.

19. NerdyData

Field	Value
Website	https://www.nerdydata.com
Engine Name	`nerdydata`
API Page	https://www.nerdydata.com/api
Required Credentials	1 API key
Config Format	`NERDYDATA_API_KEY_1`
Env Variable	`NERDYDATA_API_KEY`
Free Tier	Yes — limited
Paid Plans	Pro ($49/mo), Agency ($99/mo), Enterprise
Registration	Email required
Notes	Technology lookup and website code search engine. Search by HTML, JavaScript, CSS patterns.

Configuration Systems

Uncover supports two configuration methods:

Method 1: YAML Config File (`provider-config.yaml`)

Default location: ~/.uncover-config/provider-config.yaml

# Single key format (most providers):
shodan:
  - "your-shodan-api-key"

# Colon-separated format (requires two values):
censys:
  - "your-censys-token:your-censys-org-id"
fofa:
  - "your-email:your-fofa-key"
google:
  - "your-google-api-key:your-google-cx"

# Multiple keys per provider (random selection):
shodan:
  - "key1"
  - "key2"
  - "key3"

Method 2: Environment Variables

Every provider can be configured via individual environment variables. These are read at runtime by LoadProviderKeysFromEnv().

Environment Variable Reference

Provider	Env Variable(s)	Required
Shodan	`SHODAN_API_KEY`	Yes
Censys	`CENSYS_API_TOKEN` + `CENSYS_ORGANIZATION_ID`	Both required
FOFA	`FOFA_EMAIL` + `FOFA_KEY`	Both required
Quake	`QUAKE_TOKEN`	Yes
Hunter	`HUNTER_API_KEY`	Yes
ZoomEye	`ZOOMEYE_API_KEY`	Yes
Netlas	`NETLAS_API_KEY`	Yes
CriminalIP	`CRIMINALIP_API_KEY`	Yes
PublicWWW	`PUBLICWWW_API_KEY`	Yes
HunterHow	`HUNTERHOW_API_KEY`	Yes
Google	`GOOGLE_API_KEY` + `GOOGLE_API_CX`	Both required
ODIN	`ODIN_API_KEY`	Yes
BinaryEdge	`BINARYEDGE_API_KEY`	Yes
Onyphe	`ONYPHE_API_KEY`	Yes
Driftnet	`DRIFTNET_API_KEY`	Yes
GreyNoise	`GREYNOISE_API_KEY`	Yes
DayDayMap	`DAYDAYMAP_API_KEY`	Yes
NerdyData	`NERDYDATA_API_KEY`	Yes

Engine Names for `-e` / `--engine` Flag

Use these with the Uncover CLI or SDK:

shodan, shodan-idb, censys, fofa, quake, hunter, zoomeye,
netlas, criminalip, publicwww, hunterhow, google, odin,
binaryedge, onyphe, driftnet, greynoise, daydaymap, nerdydata

Uncover SDK Configuration Behavior

When uncover.New() is called:

Creates a new Provider via sources.NewProvider()
NewProvider() loads the YAML config from DefaultProviderConfigLocation
Then overlays environment variables via LoadProviderKeysFromEnv()
Env vars append to any keys loaded from YAML (don’t override)
Multiple keys for same provider are randomized on each execution

Important note for Docker/distroless: The init() function in provider.go attempts to create ~/.uncover-config/provider-config.yaml if it doesn’t exist. In distroless containers running as nonroot, this will log a warning but not crash. Configuration via environment variables is the recommended approach for containerized deployments.

Usage Notes

Shodan InternetDB (shodan-idb) is the only engine that requires no API key and works out of the box.
Multiple API keys for the same provider enable automatic key rotation (random selection).
Results are limited to 100 by default; use -limit flag for more.
The query flag supports all and only filters supported by the target search engine.
Chinese platforms (FOFA, Quake, Hunter) typically require phone number verification.

Recon Service Integration

The recon service and the MCP server run uncover through the Go SDK (RunUncoverSDK() in packages/go-shared/pd/runner.go). They get provider keys from environment variables only. No image carries a provider-config.yaml file, and no manifest mounts one. Set the keys per environment:

Environment	Where the keys come from
Docker Compose (dev)	`env_file: .env.local` — `SHODAN_API_KEY` and the other provider variables
Kubernetes (stage + production)	`envFrom` on the deployment, backed by the `env-local-secret` Secret

uncover.New() reads the environment through LoadProviderKeysFromEnv(). If the default config file is missing, the SDK logs one warning and continues with the environment keys. The empty /home/nonroot/.uncover-config directory in the recon image lets that template write succeed.

Start here

MCP server setup

Platform

Surface monitoring

Settings surfaces

Reference

API reference

API endpoints

Uncover providers

Uncover Provider & API Key Reference

Provider Overview

Provider Details

1. Shodan

2. Shodan InternetDB

3. Censys

4. FOFA

5. Quake (360)

6. Hunter (Qianxin)

7. ZoomEye

8. Netlas

9. CriminalIP

10. PublicWWW

11. HunterHow

12. Google Custom Search

13. ODIN

14. BinaryEdge

15. Onyphe

16. Driftnet

17. GreyNoise

18. DayDayMap

19. NerdyData

Configuration Systems

Method 1: YAML Config File (`provider-config.yaml`)

Method 2: Environment Variables

Environment Variable Reference

Engine Names for `-e` / `--engine` Flag

Uncover SDK Configuration Behavior

Usage Notes

Recon Service Integration

​Uncover Provider & API Key Reference

​Provider Overview

​Provider Details

​1. Shodan

​2. Shodan InternetDB

​3. Censys

​4. FOFA

​5. Quake (360)

​6. Hunter (Qianxin)

​7. ZoomEye

​8. Netlas

​9. CriminalIP

​10. PublicWWW

​11. HunterHow

​12. Google Custom Search

​13. ODIN

​14. BinaryEdge

​15. Onyphe

​16. Driftnet

​17. GreyNoise

​18. DayDayMap

​19. NerdyData

​Configuration Systems

​Method 1: YAML Config File (provider-config.yaml)

​Method 2: Environment Variables

​Environment Variable Reference

​Engine Names for -e / --engine Flag

​Uncover SDK Configuration Behavior

​Usage Notes

​Recon Service Integration

Uncover Provider & API Key Reference

Provider Overview

Provider Details

1. Shodan

2. Shodan InternetDB

3. Censys

4. FOFA

5. Quake (360)

6. Hunter (Qianxin)

7. ZoomEye

8. Netlas

9. CriminalIP

10. PublicWWW

11. HunterHow

12. Google Custom Search

13. ODIN

14. BinaryEdge

15. Onyphe

16. Driftnet

17. GreyNoise

18. DayDayMap

19. NerdyData

Configuration Systems

Method 1: YAML Config File (`provider-config.yaml`)

Method 2: Environment Variables

Environment Variable Reference

Engine Names for `-e` / `--engine` Flag

Uncover SDK Configuration Behavior

Usage Notes

Recon Service Integration