GreyNoise API — GNQL

naftiko: 1.0.0-alpha2
info:
  label: GreyNoise API — GNQL
  description: 'GNQL surface of GreyNoise API. 3 operations. Lead operation: GNQL V3 Query. Self-contained Naftiko capability covering one GreyNoise business surface.'
  tags:
    - GreyNoise
    - Security
    - GNQL
  created: '2026-05-30'
  modified: '2026-05-30'
binds:
  - namespace: env
    keys:
      GREYNOISE_API_KEY: GREYNOISE_API_KEY
capability:
  consumes:
    - type: http
      namespace: greynoise-gnql
      baseUri: https://api.greynoise.io
      description: GreyNoise API — GNQL business capability. Self-contained, no shared references.
      authentication:
        type: apikey
        key: key
        value: '{{env.GREYNOISE_API_KEY}}'
        placement: header
      resources:
        - name: v3-gnql
          path: /v3/gnql
          operations:
            - name: gnqlV3Query
              method: GET
              description: GNQL V3 Query
              inputParameters:
                - name: query
                  in: query
                  type: string
                  required: true
                  description: GNQL query string
                - name: size
                  in: query
                  type: integer
                  required: false
                  description: The number of results provided per page for paginating through all results of a query
                - name: scroll
                  in: query
                  type: string
                  required: false
                  description: Scroll token to paginate through results. Incompatible with `format=csv`.
                - name: quick
                  in: query
                  type: boolean
                  required: false
                  description: If true, the response will only include the IP address and the classification or trust level.
                - name: format
                  in: query
                  type: string
                  required: false
                  description: Specifies the desired format of the results. Must be either csv or json.
                - name: exclude
                  in: query
                  type: string
                  required: false
                  description: Comma-separated list of fields to exclude from the response.
              outputRawFormat: json
              outputParameters:
                - name: result
                  type: object
                  value: $.
        - name: v3-gnql-metadata
          path: /v3/gnql/metadata
          operations:
            - name: gnqlV3MetadataQuery
              method: GET
              description: GNQL V3 Metadata Query
              inputParameters:
                - name: query
                  in: query
                  type: string
                  required: true
                  description: GNQL query string
                - name: size
                  in: query
                  type: integer
                  required: false
                  description: The number of results provided per page for paginating through all results of a query
                - name: scroll
                  in: query
                  type: string
                  required: false
                  description: Scroll token to paginate through results
                - name: quick
                  in: query
                  type: boolean
                  required: false
                  description: If true, the response will only include the IP address and the classification or trust level.
                - name: exclude
                  in: query
                  type: string
                  required: false
                  description: Comma-separated list of additional fields to exclude from the response.
              outputRawFormat: json
              outputParameters:
                - name: result
                  type: object
                  value: $.
        - name: v3-gnql-stats
          path: /v3/gnql/stats
          operations:
            - name: gnqlV3Stats
              method: GET
              description: GNQL V3 Stats
              inputParameters:
                - name: query
                  in: query
                  type: string
                  required: true
                  description: GNQL query string
                - name: count
                  in: query
                  type: integer
                  required: false
                  description: Number of top aggregates to grab
              outputRawFormat: json
              outputParameters:
                - name: result
                  type: object
                  value: $.
  exposes:
    - type: rest
      namespace: greynoise-gnql-rest
      port: 8080
      description: REST adapter for GreyNoise API — GNQL. One Spectral-compliant resource per consumed operation, prefixed with /v1.
      resources:
        - path: /v1/gnql
          name: v1-gnql
          description: REST surface for GNQL V3 Query.
          operations:
            - method: GET
              name: gnqlV3Query
              description: GNQL V3 Query
              call: greynoise-gnql.gnqlV3Query
              with:
                query: rest.query
                size: rest.size
                scroll: rest.scroll
                quick: rest.quick
                format: rest.format
                exclude: rest.exclude
              outputParameters:
                - type: object
                  mapping: $.
        - path: /v1/gnql/metadata
          name: v1-gnql-metadata
          description: REST surface for GNQL V3 Metadata Query.
          operations:
            - method: GET
              name: gnqlV3MetadataQuery
              description: GNQL V3 Metadata Query
              call: greynoise-gnql.gnqlV3MetadataQuery
              with:
                query: rest.query
                size: rest.size
                scroll: rest.scroll
                quick: rest.quick
                exclude: rest.exclude
              outputParameters:
                - type: object
                  mapping: $.
        - path: /v1/gnql/stats
          name: v1-gnql-stats
          description: REST surface for GNQL V3 Stats.
          operations:
            - method: GET
              name: gnqlV3Stats
              description: GNQL V3 Stats
              call: greynoise-gnql.gnqlV3Stats
              with:
                query: rest.query
                count: rest.count
              outputParameters:
                - type: object
                  mapping: $.
    - type: mcp
      namespace: greynoise-gnql-mcp
      port: 9090
      transport: http
      description: MCP adapter for GreyNoise API — GNQL. One tool per consumed operation, routed inline through this capability's consumes block.
      tools:
        - name: gnql-v3-query
          description: GNQL V3 Query
          hints:
            readOnly: true
            destructive: false
            idempotent: true
          call: greynoise-gnql.gnqlV3Query
          with:
            query: tools.query
            size: tools.size
            scroll: tools.scroll
            quick: tools.quick
            format: tools.format
            exclude: tools.exclude
          outputParameters:
            - type: object
              mapping: $.
        - name: gnql-v3-metadata-query
          description: GNQL V3 Metadata Query
          hints:
            readOnly: true
            destructive: false
            idempotent: true
          call: greynoise-gnql.gnqlV3MetadataQuery
          with:
            query: tools.query
            size: tools.size
            scroll: tools.scroll
            quick: tools.quick
            exclude: tools.exclude
          outputParameters:
            - type: object
              mapping: $.
        - name: gnql-v3-stats
          description: GNQL V3 Stats
          hints:
            readOnly: true
            destructive: false
            idempotent: true
          call: greynoise-gnql.gnqlV3Stats
          with:
            query: tools.query
            count: tools.count
          outputParameters:
            - type: object
              mapping: $.