mcp-threatintel — Claude Code MCP server: IP and hash lookups
One request checks an IP, domain, hash or URL against OTX, AbuseIPDB, GreyNoise, abuse.ch and Feodo Tracker. Handy during incident response and security research.
claude mcp add mcp-threatintel -e OTX_API_KEY=<OTX_API_KEY> -e ABUSEIPDB_API_KEY=<ABUSEIPDB_API_KEY> -e GREYNOISE_API_KEY=<GREYNOISE_API_KEY> -e ABUSECH_AUTH_KEY=<ABUSECH_AUTH_KEY> -- npx -y mcp-threatintel-serverWhat mcp-threatintel does
Point the server at an indicator and it queries every source you configured at once, so you stop juggling browser tabs. Each service has its own tool: abuseipdb_check, otx_get_pulses, greynoise_ip, urlhaus_lookup, malwarebazaar_hash, threatfox_iocs. Tools appear based on the keys you supply, and threatintel_status lists what is live.
Keys are optional. Feodo Tracker reads public JSON feeds with no authentication, so botnet C2 data is there right after setup. The rest wait on OTX_API_KEY, ABUSEIPDB_API_KEY, GREYNOISE_API_KEY and ABUSECH_AUTH_KEY. Node.js 18 or newer is required.
When one source fails, the combined lookup still returns whatever the others found. A 401 means the key is stale; a 429 means you hit the free-tier ceiling. Worth installing if you triage suspicious traffic or file hashes and would rather not visit each site by hand.
What it helps with
- check an IP against several reputation databases at once
- find a file hash in MalwareBazaar
- pull the latest IOCs from ThreatFox
- list active botnet C2 servers
- see whether a URL sits in any blocklist
Example prompts for the agent
- Check 185.220.101.1 across all threat intel sources
- Is this SHA256 a known malware sample?
- Show active Emotet C2 servers from Feodo Tracker
How to install mcp-threatintel
Platform CLI
claude mcp add mcp-threatintel -e OTX_API_KEY=<OTX_API_KEY> -e ABUSEIPDB_API_KEY=<ABUSEIPDB_API_KEY> -e GREYNOISE_API_KEY=<GREYNOISE_API_KEY> -e ABUSECH_AUTH_KEY=<ABUSECH_AUTH_KEY> -- npx -y mcp-threatintel-serverReplace <…> with your own values
Platform CLI
codex mcp add mcp-threatintel --env OTX_API_KEY=<OTX_API_KEY> --env ABUSEIPDB_API_KEY=<ABUSEIPDB_API_KEY> --env GREYNOISE_API_KEY=<GREYNOISE_API_KEY> --env ABUSECH_AUTH_KEY=<ABUSECH_AUTH_KEY> -- npx -y mcp-threatintel-serverReplace <…> with your own values
Config file
{
"mcpServers": {
"mcp-threatintel": {
"command": "npx",
"args": [
"-y",
"mcp-threatintel-server"
],
"env": {
"OTX_API_KEY": "<OTX_API_KEY>",
"ABUSEIPDB_API_KEY": "<ABUSEIPDB_API_KEY>",
"GREYNOISE_API_KEY": "<GREYNOISE_API_KEY>",
"ABUSECH_AUTH_KEY": "<ABUSECH_AUTH_KEY>"
}
}
}
}Replace <…> with your own values
Config file
{
"servers": {
"mcp-threatintel": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"mcp-threatintel-server"
],
"env": {
"OTX_API_KEY": "<OTX_API_KEY>",
"ABUSEIPDB_API_KEY": "<ABUSEIPDB_API_KEY>",
"GREYNOISE_API_KEY": "<GREYNOISE_API_KEY>",
"ABUSECH_AUTH_KEY": "<ABUSECH_AUTH_KEY>"
}
}
}
}Replace <…> with your own values
Platform CLI
gemini mcp add -e OTX_API_KEY=<OTX_API_KEY> -e ABUSEIPDB_API_KEY=<ABUSEIPDB_API_KEY> -e GREYNOISE_API_KEY=<GREYNOISE_API_KEY> -e ABUSECH_AUTH_KEY=<ABUSECH_AUTH_KEY> mcp-threatintel npx -y mcp-threatintel-serverReplace <…> with your own values
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about mcp-threatintel
How do I install mcp-threatintel in Claude Code?
Run `claude mcp add mcp-threatintel -e OTX_API_KEY=<OTX_API_KEY> -e ABUSEIPDB_API_KEY=<ABUSEIPDB_API_KEY> -e GREYNOISE_API_KEY=<GREYNOISE_API_KEY> -e ABUSECH_AUTH_KEY=<ABUSECH_AUTH_KEY> -- npx -y mcp-threatintel-server`.
What does mcp-threatintel do?
It gives the agent tools to look up IPs, domains, hashes and URLs across several threat intelligence sources and returns the findings in one response.
Does it work without API keys?
Yes. Feodo Tracker uses public feeds and needs no authentication; other sources activate as you add their keys.
