# IBM X-Force Exchange

```json
{
  "name": "IBM X-Force Exchange",
  "slug": "ibm_x_force_exchange",
  "url": "https://composio.dev/toolkits/ibm_x_force_exchange",
  "markdown_url": "https://composio.dev/toolkits/ibm_x_force_exchange.md",
  "logo_url": "https://logos.composio.dev/api/ibm_x_force_exchange",
  "categories": [
    "analytics & data"
  ],
  "is_composio_managed": false,
  "updated_at": "2026-03-29T06:38:05.210Z"
}
```

![IBM X-Force Exchange logo](https://logos.composio.dev/api/ibm_x_force_exchange)

## Description

Securely connect your AI agents and chatbots (Claude, ChatGPT, Cursor, etc) with IBM X-Force Exchange MCP or direct API to search threats, enrich indicators, analyze threat intelligence, and manage collections through natural language.

## Summary

IBM X-Force Exchange is a threat intelligence sharing platform for researching security threats. It helps security teams aggregate and collaborate on the latest cybersecurity insights.

## Categories

- analytics & data

## Toolkit Details

- Tools: 7

## Images

- Logo: https://logos.composio.dev/api/ibm_x_force_exchange

## Authentication

- **Api Key**
  - Type: `api_key`
  - Description: Api Key authentication for IBM X-Force Exchange.
  - Setup:
    - Configure Api Key credentials for IBM X-Force Exchange.
    - Use the credentials when creating an auth config in Composio.

## Suggested Prompts

- Get threat intelligence for domain example.com
- Enrich this hash with threat context
- Search for recent malware collections

## Supported Tools

| Tool slug | Name | Description |
|---|---|---|
| `IBM_X_FORCE_EXCHANGE_GET_CASEFILES_PUBLIC` | Get Latest Public Collections | Tool to retrieve latest public Collections from IBM X-Force Exchange. Use when you need to access publicly available collections without pagination. For fetching all public collections, consider using the paginated endpoint instead. |
| `IBM_X_FORCE_EXCHANGE_GET_CASEFILES_PUBLIC_PAGINATED` | Get Public Collections Paginated | Tool to retrieve all public Collections using pagination from IBM X-Force Exchange. Use when you need to access publicly available collections with pagination support. Returns a list of publicly accessible case files with pagination metadata. |
| `IBM_X_FORCE_EXCHANGE_GET_IPR_CATEGORIES` | Get IPR Category List | Tool to retrieve the complete list of IP reputation categories from IBM X-Force Exchange. Use when you need to understand available IPR classification categories used by XFE. |
| `IBM_X_FORCE_EXCHANGE_GET_URL_CATEGORIES` | Get URL Category List | Tool to retrieve the complete list of URL categories from IBM X-Force Exchange. Use when you need to understand available URL classification categories used by XFE. |
| `IBM_X_FORCE_EXCHANGE_GET_USER_PROFILE_INFORMATION` | Get User Profile Information | Tool to retrieve authenticated user's profile information from IBM X-Force Exchange. Use when you need to access user account details, membership statistics, or integration configurations. |
| `IBM_X_FORCE_EXCHANGE_GET_CURRENT_API_VERSION` | Get Current API Version | Tool to retrieve current running API version information from IBM X-Force Exchange. Use when you need to check the API version, build number, or creation date. |
| `IBM_X_FORCE_EXCHANGE_GENERATE_API_KEY_AND_PASSWORD` | Generate API Key and Password | Tool to generate a new API key and password pair for IBM X-Force Exchange authentication. Use when you need to create new credentials for API access. The generated credentials do not expire and can be used with Basic Authentication. |

## Supported Triggers

None listed.

## Installation and MCP Setup

### Path 1: SDK Installation

#### Path 1, Step 1: Install Composio

Install the Composio SDK
```python
pip install composio_openai
```

```typescript
npm install @composio/openai
```

#### Path 1, Step 2: Initialize Composio and Create Tool Router Session

Import and initialize Composio client, then create a Tool Router session
```python
from openai import OpenAI
from composio import Composio
from composio_openai import OpenAIResponsesProvider

composio = Composio(provider=OpenAIResponsesProvider())
openai = OpenAI()
session = composio.create(user_id='your-user-id')
```

```typescript
import OpenAI from 'openai';
import { Composio } from '@composio/core';
import { OpenAIResponsesProvider } from '@composio/openai';

const composio = new Composio({
  provider: new OpenAIResponsesProvider(),
});
const openai = new OpenAI({});
const session = await composio.create('your-user-id');
```

#### Path 1, Step 3: Execute IBM X-Force Exchange Tools via Tool Router with Your Agent

Get tools from Tool Router session and execute IBM X-Force Exchange actions with your Agent
```python
tools = session.tools
response = openai.responses.create(
  model='gpt-4.1',
  tools=tools,
  input=[{
    'role': 'user',
    'content': 'Get threat intelligence on IP 8.8.8.8 from IBM X-Force Exchange.'
  }]
)
result = composio.provider.handle_tool_calls(
  response=response,
  user_id='your-user-id'
)
print(result)
```

```typescript
const tools = session.tools;
const response = await openai.responses.create({
  model: 'gpt-4.1',
  tools: tools,
  input: [{
    role: 'user',
    content: 'Get threat intelligence on IP 8.8.8.8 from IBM X-Force Exchange.'
  }],
});
const result = await composio.provider.handleToolCalls(
  'your-user-id',
  response.output
);
console.log(result);
```

### Path 2: MCP Server Setup

#### Path 2, Step 1: Install Composio

Install the Composio SDK for Python or TypeScript
```python
pip install composio claude-agent-sdk
```

```typescript
npm install @composio/core ai @ai-sdk/openai @ai-sdk/mcp
```

#### Path 2, Step 2: Initialize Client and Create Tool Router Session

Import and initialize the Composio client, then create a Tool Router session for IBM X-Force Exchange
```python
from composio import Composio
from claude_agent_sdk import ClaudeSDKClient, ClaudeAgentOptions

composio = Composio(api_key='your-composio-api-key')
session = composio.create(user_id='your-user-id')
url = session.mcp.url
```

```typescript
import { Composio } from '@composio/core';

const composio = new Composio({ apiKey: 'your-api-key' });
const session = await composio.create('your-user-id');
console.log(`Tool Router session created: ${session.mcp.url}`);
```

#### Path 2, Step 3: Connect to AI Agent

Use the MCP server with your AI agent (Anthropic Claude or Mastra)
```python
import asyncio

options = ClaudeAgentOptions(
    permission_mode='bypassPermissions',
    mcp_servers={
        'tool_router': {
            'type': 'http',
            'url': url,
            'headers': {
                'x-api-key': 'your-composio-api-key'
            }
        }
    },
    system_prompt='You are a helpful assistant with access to IBM X-Force Exchange tools.',
    max_turns=10
)

async def main():
    async with ClaudeSDKClient(options=options) as client:
        await client.query('Search for recent malware collections related to Emotet on IBM X-Force Exchange.')
        async for message in client.receive_response():
            if hasattr(message, 'content'):
                for block in message.content:
                    if hasattr(block, 'text'):
                        print(block.text)

asyncio.run(main())
```

```typescript
import { openai } from '@ai-sdk/openai';
import { experimental_createMCPClient as createMCPClient } from '@ai-sdk/mcp';
import { generateText } from 'ai';

const client = await createMCPClient({
  transport: {
    type: 'http',
    url: session.mcp.url,
    headers: {
      'x-api-key': 'your-composio-api-key',
    },
  },
});

const tools = await client.tools();
const { text } = await generateText({
  model: openai('gpt-4o'),
  tools,
  messages: [{
    role: 'user',
    content: 'Search for recent malware collections related to Emotet on IBM X-Force Exchange.'
  }],
  maxSteps: 5,
});

console.log(`Agent: ${text}`);
```

## Why Use Composio?

### 1. AI Native IBM X-Force Exchange Integration

- Supports both IBM X-Force Exchange MCP and direct API based integrations
- Structured, LLM-friendly schemas for reliable tool execution
- Rich coverage for reading, writing, and querying your IBM X-Force Exchange data

### 2. Managed Auth

- Built-in OAuth handling with automatic token refresh and rotation
- Central place to manage, scope, and revoke IBM X-Force Exchange access
- Per user and per environment credentials instead of hard-coded keys

### 3. Agent Optimized Design

- Tools are tuned using real error and success rates to improve reliability over time
- Comprehensive execution logs so you always know what ran, when, and on whose behalf

### 4. Enterprise Grade Security

- Fine-grained RBAC so you control which agents and users can access IBM X-Force Exchange
- Scoped, least privilege access to IBM X-Force Exchange resources
- Full audit trail of agent actions to support review and compliance

## Use IBM X-Force Exchange with any AI Agent Framework

Choose a framework you want to connect IBM X-Force Exchange with:

- [OpenAI Agents SDK](https://composio.dev/toolkits/ibm_x_force_exchange/framework/open-ai-agents-sdk)
- [Claude Agent SDK](https://composio.dev/toolkits/ibm_x_force_exchange/framework/claude-agents-sdk)
- [Claude Code](https://composio.dev/toolkits/ibm_x_force_exchange/framework/claude-code)
- [Claude Cowork](https://composio.dev/toolkits/ibm_x_force_exchange/framework/claude-cowork)
- [Codex](https://composio.dev/toolkits/ibm_x_force_exchange/framework/codex)
- [OpenClaw](https://composio.dev/toolkits/ibm_x_force_exchange/framework/openclaw)
- [Hermes](https://composio.dev/toolkits/ibm_x_force_exchange/framework/hermes-agent)
- [Google ADK](https://composio.dev/toolkits/ibm_x_force_exchange/framework/google-adk)
- [LangChain](https://composio.dev/toolkits/ibm_x_force_exchange/framework/langchain)
- [Vercel AI SDK](https://composio.dev/toolkits/ibm_x_force_exchange/framework/ai-sdk)
- [Mastra AI](https://composio.dev/toolkits/ibm_x_force_exchange/framework/mastra-ai)
- [LlamaIndex](https://composio.dev/toolkits/ibm_x_force_exchange/framework/llama-index)
- [CrewAI](https://composio.dev/toolkits/ibm_x_force_exchange/framework/crew-ai)
- [Pydantic AI](https://composio.dev/toolkits/ibm_x_force_exchange/framework/pydantic-ai)
- [AutoGen](https://composio.dev/toolkits/ibm_x_force_exchange/framework/autogen)

## Related Toolkits

- [Firecrawl](https://composio.dev/toolkits/firecrawl) - Firecrawl automates large-scale web crawling and data extraction. It helps organizations efficiently gather, index, and analyze content from online sources.
- [Tavily](https://composio.dev/toolkits/tavily) - Tavily offers powerful search and data retrieval from documents, databases, and the web. It helps teams locate and filter information instantly, saving hours on research.
- [Exa](https://composio.dev/toolkits/exa) - Exa is a data extraction and search platform for gathering and analyzing information from websites, APIs, or databases. It helps teams quickly surface insights and automate data-driven workflows.
- [Serpapi](https://composio.dev/toolkits/serpapi) - SerpApi is a real-time API for structured search engine results. It lets you automate SERP data collection, parsing, and analysis for SEO and research.
- [Peopledatalabs](https://composio.dev/toolkits/peopledatalabs) - Peopledatalabs delivers B2B data enrichment and identity resolution APIs. Supercharge your apps with accurate, up-to-date business and contact data.
- [Snowflake](https://composio.dev/toolkits/snowflake) - Snowflake is a cloud data warehouse built for elastic scaling, secure data sharing, and fast SQL analytics across major clouds.
- [Posthog](https://composio.dev/toolkits/posthog) - PostHog is an open-source analytics platform for tracking user interactions and product metrics. It helps teams refine features, analyze funnels, and reduce churn with actionable insights.
- [Amplitude](https://composio.dev/toolkits/amplitude) - Amplitude is a digital analytics platform for product and behavioral data insights. It helps teams analyze user journeys and make data-driven decisions quickly.
- [Bright Data MCP](https://composio.dev/toolkits/brightdata_mcp) - Bright Data MCP is an AI-powered web scraping and data collection platform. Instantly access public web data in real time with advanced scraping tools.
- [Browseai](https://composio.dev/toolkits/browseai) - Browseai is a web automation and data extraction platform that turns any website into an API. It's perfect for monitoring websites and retrieving structured data without manual scraping.
- [ClickHouse](https://composio.dev/toolkits/clickhouse) - ClickHouse is an open-source, column-oriented database for real-time analytics and big data processing using SQL. Its lightning-fast query performance makes it ideal for handling large datasets and delivering instant insights.
- [Coinmarketcal](https://composio.dev/toolkits/coinmarketcal) - CoinMarketCal is a community-powered crypto calendar for upcoming events, announcements, and releases. It helps traders track market-moving developments and stay ahead in the crypto space.
- [Control d](https://composio.dev/toolkits/control_d) - Control d is a customizable DNS filtering and traffic redirection platform. It helps you manage internet access, enforce policies, and monitor usage across devices and networks.
- [Databox](https://composio.dev/toolkits/databox) - Databox is a business analytics platform that connects your data from any tool and device. It helps you track KPIs, build dashboards, and discover actionable insights.
- [Databricks](https://composio.dev/toolkits/databricks) - Databricks is a unified analytics platform for big data and AI on the lakehouse architecture. It empowers data teams to collaborate, analyze, and build scalable solutions efficiently.
- [Datagma](https://composio.dev/toolkits/datagma) - Datagma delivers data intelligence and analytics for business growth and market discovery. Get actionable market insights and track competitors to inform your strategy.
- [Delighted](https://composio.dev/toolkits/delighted) - Delighted is a customer feedback platform based on the Net Promoter System®. It helps you quickly gather, track, and act on customer sentiment.
- [Dovetail](https://composio.dev/toolkits/dovetail) - Dovetail is a research analysis platform for transcript review and insight generation. It helps teams code interviews, analyze feedback, and create actionable research summaries.
- [Dub](https://composio.dev/toolkits/dub) - Dub is a short link management platform with analytics and API access. Use it to easily create, manage, and track branded short links for your business.
- [Elasticsearch](https://composio.dev/toolkits/elasticsearch) - Elasticsearch is a distributed, RESTful search and analytics engine for all types of data. It delivers fast, scalable search and powerful analytics across massive datasets.

## Frequently Asked Questions

### Do I need my own developer credentials to use IBM X-Force Exchange with Composio?

Yes, IBM X-Force Exchange requires you to configure your own API key credentials. Once set up, Composio handles secure credential storage and API request handling for you.

### Can I use multiple toolkits together?

Yes! Composio's Tool Router enables agents to use multiple toolkits. [Learn more](https://docs.composio.dev/tool-router/overview).

### Is Composio secure?

Composio is SOC 2 and ISO 27001 compliant with all data encrypted in transit and at rest. [Learn more](https://trust.composio.dev).

### What if the API changes?

Composio maintains and updates all toolkit integrations automatically, so your agents always work with the latest API versions.

---
[See all toolkits](https://composio.dev/toolkits) · [Composio docs](https://docs.composio.dev/llms.txt)