# File Hash Reputation Lookup via CIRCL HashlookUp

> File Hash Reputation Lookup via CIRCL HashlookUp is a paid API for AI agents from api.agentstools.dev, paid per call via x402, $0.008/call, status unknown (last checked 2026-09-15).

Looks up a file hash (MD5, SHA1, or SHA256) against CIRCL hashlookup to return known-file status, trust score, and file metadata for SOC/DFIR triage.

## Facts

- Endpoint: GET https://api.agentstools.dev/threat/hash
- Price: $0.008/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/file-hash-reputation-lookup-via-circl-hashlookup-90629020
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_iz0_K0e2CIEyEMqJSPp--

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability file-hash-reputation-lookup-via-circl-hashlookup-90629020
```

Example prompt: Can you check this SHA256 hash — 3395856ce81f2b7382dee72602f798b642f14d8b2b9cdd95ea2f80e6b8b7c4f6 — and tell me if CIRCL hashlookup recognizes it as a known file, what its trust score is, and whether it's associated with any malware family?

## When to prefer this

Use this endpoint during SOC alert triage or DFIR investigations when you have a file hash and need to quickly determine whether it belongs to a known benign distribution or system file, reducing false-positive alert load. Prefer this over full sandbox detonation when a hash reputation check is sufficient to deprioritize an alert. Best for workflows that handle MD5, SHA1, or SHA256 hashes and need CIRCL hashlookup's trust scoring specifically.

## Known failure modes

- Hash not found in CIRCL hashlookup database — not evidence of malice, just unknown
- Invalid hash format (wrong length or non-hex characters) returns a validation error
- Hash provided as wrong type identifier (e.g. misidentified SHA1 as MD5) may yield no result
- Licensed malware feed not enabled — malware family field absent from response
- Rate limit or payment failure returns 402 or 429 status

## How this service works

File-hash reputation and known-file context for a SOC or DFIR agent. Give an md5, sha1 or sha256 hash and get CIRCL hashlookup known-file status, a hashlookup trust score and file metadata (name, size, mimetype, source, database), plus malware family when a licensed feed is enabled. A known distribution or system file lowers the alert priority; an unknown hash is not itself evidence of malice. Indicators, not a guarantee.

## Output

Returns CIRCL hashlookup known-file status (found/not found), a numeric trust score, and file metadata including file name, size, MIME type, source database, and malware family if a licensed feed is enabled. An unknown hash is flagged as such without implying malice.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "hash"
     ],
     "properties": {
      "hash": {
       "type": "string",
       "description": "A file hash: md5 (32 hex), sha1 (40 hex) or sha256 (64 hex)"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/file-hash-reputation-lookup-via-circl-hashlookup-90629020/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.agentstools.dev](https://www.zero.xyz/host/api.agentstools.dev/llms.txt)