# ThreatPulse full capability reference

https://threatpulse.platphormnews.com parses IP, domain, URL, MD5, SHA-1, and SHA-256 indicators and queries configured abuse.ch adapters. Fixture mode is explicitly degraded and labels replayed records. Results preserve feed, match precision, timing, references, confidence factors, and caveats.

MCP tools:
- enrich_indicators: Enrich a bounded set of IP, domain, URL, or file-hash indicators using the configured abuse.ch feed mode.
- get_enrichment_status: Return the current live or fixture feed mode without performing a lookup.

External enrichment cannot establish attacker intent or replace Evidence verification.