> ## Documentation Index
> Fetch the complete documentation index at: https://docs.calseta.com/llms.txt
> Use this file to discover all available pages before exploring further.

# enrich_indicator

> MCP tool to trigger on-demand enrichment for an indicator.

## enrich\_indicator

Trigger enrichment for any indicator value. The enrichment runs asynchronously — the tool returns immediately with the indicator's current state.

### Parameters

| Parameter | Type   | Required | Description                                                                                       |
| --------- | ------ | -------- | ------------------------------------------------------------------------------------------------- |
| `type`    | string | Yes      | Indicator type: `ip`, `domain`, `hash_md5`, `hash_sha1`, `hash_sha256`, `url`, `email`, `account` |
| `value`   | string | Yes      | The indicator value to enrich                                                                     |

### Example

```json theme={null}
{
  "type": "ip",
  "value": "185.220.101.47"
}
```

### Return Value

If enrichment results are already cached:

```json theme={null}
{
  "type": "ip",
  "value": "185.220.101.47",
  "malice": "Malicious",
  "enrichment_results": {
    "virustotal": {
      "extracted": { "malicious_count": 14 },
      "success": true
    },
    "abuseipdb": {
      "extracted": { "abuse_confidence_score": 97 },
      "success": true
    }
  }
}
```

If enrichment is in progress:

```json theme={null}
{
  "type": "ip",
  "value": "185.220.101.47",
  "malice": "Pending",
  "status": "enriching"
}
```

<Tip>
  If the indicator has been previously enriched and the cache is still valid, results are returned immediately without re-querying providers.
</Tip>

### Required Scope

`enrichments:read`