AbuseIpDB MCP Server

A Model Context Protocol (MCP) server implementation that provides seamless integration with the AbuseIPDB API for IP reputation checking and abuse report management.

This MCP server enables AI assistants and automated systems to query AbuseIPDB's threat intelligence database, allowing you to check IP addresses for malicious activity, retrieve abuse confidence scores, and access detailed historical report data through a standardized protocol interface.

- IP Reputation Checks- Query any IPv4 or IPv6 address for abuse reports
- Confidence Scoring- Get abuse confidence scores (0-100) based on report frequency and severity
- Detailed Reporting- Access comprehensive abuse report metadata and categories
- Historical Data- Query abuse reports within configurable time windows (up to 365 days)
- Flexible Output- Toggle between concise summaries and verbose detailed responses
- Standards-Based- Built on the Model Context Protocol for seamless integration

- Python: 3.13 or higher
- AbuseIPDB API Key:Register for a free API key

git clone https://github.com/Salmanwz/mcp-abuseipdb.git cd mcp-abuseipdb

curl -LsSf https://astral.sh/uv/install.sh | sh

export ABUSEIPDB_API_KEY="your_api_key_here"

{ "mcpServers": { "abuseipdb": { "command": "uv", "args": [ "--directory", "/absolute/path/to/mcp-abuseipdb", "run", "abusedb.py" ], "env": { "ABUSEIPDB_API_KEY": "your_api_key_here" } } } }

Important: Replace/absolute/path/to/mcp-abuseipdbwith the actual path andyour_api_key_herewith your API key.

Queries AbuseIPDB for abuse reports associated with a given IP address.

# Basic check - last 30 days { "ipAddress": "1.2.3.4" } # Check with custom time window { "ipAddress": "1.2.3.4", "maxAgeInDays": 90 } # Verbose output with full details { "ipAddress": "1.2.3.4", "maxAgeInDays": 90, "verbose": true }

{ "data": { "ipAddress": "1.2.3.4", "abuseConfidenceScore": 75, "totalReports": 42, "lastReportedAt": "2025-10-13T14:23:01+00:00", "isWhitelisted": false, "countryCode": "US", "usageType": "Data Center/Web Hosting/Transit", "isp": "Example Hosting Inc", "domain": "example-host.com", "reports": [...] // Only included when verbose=true } }

- Security Operations: Integrate IP reputation checks into SOC workflows
- Incident Response: Quickly assess threat levels during investigations
- Threat Intelligence: Enrich security alerts with abuse data
- Network Monitoring: Automate suspicious IP detection and blocking
- Log Analysis: Cross-reference connection logs with known malicious IPs

Free tier API keys are limited to1,000 checks per day. Upgrade to a premium plan for higher limits.

# Verify your API key is set echo $ABUSEIPDB_API_KEY # Test connectivity curl -G https://api.abuseipdb.com/api/v2/check \ --data-urlencode "ipAddress=8.8.8.8" \ -H "Key: $ABUSEIPDB_API_KEY"

- Verify the config file path and JSON syntax
- Restart Claude Desktop after configuration changes
- Check the MCP server logs for connection errors

mcp-abuseipdb/ ├── abusedb.py # Main MCP server implementation ├── pyproject.toml # UV/Python dependencies ├── README.md # This file └── LICENSE # License information

# Add test dependencies uv add pytest pytest-asyncio httpx # Run tests uv run pytest

Contributions are welcome! Please feel free to submit a Pull Request. For major changes, please open an issue first to discuss what you would like to change.
- Fork the repository
- Create your feature branch (git checkout -b feature/AmazingFeature)
- Commit your changes (git commit -m 'Add some AmazingFeature')
- Push to the branch (git push origin feature/AmazingFeature)
- Open a Pull Request

This server handles sensitive threat intelligence data. Best practices:

- Never commit API keysto version control
- Store API keys in environment variables or secure vaults
- Use HTTPS for all API communications (enforced by default)
- Implement rate limiting in production deployments
- Monitor API usage for anomalies

- AbuseIPDB Official Documentation
- Model Context Protocol Specification
- UV Package Manager Docs

This project is licensed under the MIT License - see theLICENSEfile for details.

- Built on theModel Context Protocol
- Powered byAbuseIPDB
- UsesUVfor dependency management

Real-time CVE lookup via NIST NVD 2.0, CISA KEV alerts, EPSS exploitation probability, and MITRE ATT&CK mappings. 7 tools for AI-powered vulnerability assessment.