Ioc Search MCP Server
Provides tools for threat intelligence analysis by searching for Indicators of Compromise (IOCs) such as IP addresses, file hashes, domains, and URLs to identify malicious activity and assess security risks via the Ioc Search API.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Ioc Search MCP Servercheck the reputation of this IP address: 117.131.215.118"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Ioc Search MCP Server
用于访问 Ioc Search API 的 MCP 服务器。
🚀 使用 EMCP 平台快速体验
EMCP 是一个强大的 MCP 服务器管理平台,让您无需手动配置即可快速使用各种 MCP 服务器!
快速开始:
🌐 访问 EMCP 平台
📝 注册并登录账号
🎯 进入 MCP 广场,浏览所有可用的 MCP 服务器
🔍 搜索或找到本服务器(
bach-ioc_search)🎉 点击 "安装 MCP" 按钮
✅ 完成!即可在您的应用中使用
EMCP 平台优势:
✨ 零配置:无需手动编辑配置文件
🎨 可视化管理:图形界面轻松管理所有 MCP 服务器
🔐 安全可靠:统一管理 API 密钥和认证信息
🚀 一键安装:MCP 广场提供丰富的服务器选择
📊 使用统计:实时查看服务调用情况
立即访问 EMCP 平台 开始您的 MCP 之旅!
Related MCP server: FastMCP ThreatIntel
简介
这是一个 MCP 服务器,用于访问 Ioc Search API。
PyPI 包名:
bach-ioc_search版本: 1.0.0
传输协议: stdio
安装
从 PyPI 安装:
pip install bach-ioc_search从源码安装:
pip install -e .运行
方式 1: 使用 uvx(推荐,无需安装)
# 运行(uvx 会自动安装并运行)
uvx --from bach-ioc_search bach_ioc_search
# 或指定版本
uvx --from bach-ioc_search@latest bach_ioc_search方式 2: 直接运行(开发模式)
python server.py方式 3: 安装后作为命令运行
# 安装
pip install bach-ioc_search
# 运行(命令名使用下划线)
bach_ioc_search配置
API 认证
此 API 需要认证。请设置环境变量:
export API_KEY="your_api_key_here"环境变量
变量名 | 说明 | 必需 |
| API 密钥 | 是 |
| 不适用 | 否 |
| 不适用 | 否 |
在 Cursor 中使用
编辑 Cursor MCP 配置文件 ~/.cursor/mcp.json:
{
"mcpServers": {
"bach-ioc_search": {
"command": "uvx",
"args": ["--from", "bach-ioc_search", "bach_ioc_search"],
"env": {
"API_KEY": "your_api_key_here"
}
}
}
}在 Claude Desktop 中使用
编辑 Claude Desktop 配置文件 claude_desktop_config.json:
{
"mcpServers": {
"bach-ioc_search": {
"command": "uvx",
"args": ["--from", "bach-ioc_search", "bach_ioc_search"],
"env": {
"API_KEY": "your_api_key_here"
}
}
}
}可用工具
此服务器提供以下工具:
ip_address_search
Provides comprehensive analysis for a given IP address, including associated ASN, geographic location, network details, WHOIS information, and security vendor evaluations. Summarizes malicious, suspicious, harmless, and undetected classifications, enabling effective threat detection and risk assessment.
端点: GET /rapid/v1/ioc/search/ip
参数:
query(string): Example value: 117.131.215.118
hash_search
Provides detailed threat analysis for a given hash, including analysis date, reputation, categories, security vendor assessments, threat names, and URL details. Detects malware, suspicious activity, and clean results from various security vendors with statistical summaries.
端点: GET /rapid/v1/ioc/search/hash
参数:
query(string): Example value: 0000059fcb7d4275e2019593617f3b9c8aa568792e3eaf035420ed7dbffd44bc
domain_search
Analyzes a given domain to provide insights into DNS records, HTTP certificate details, reputation, security vendor evaluations, and related tags. Includes detailed security classifications and supports identifying malicious or suspicious domains effectively.
端点: GET /rapid/v1/ioc/search/domain
参数:
query(string): Example value: tracking-usopt-cr.com
url_search
Provides in-depth threat analysis for a given URL, including reputation scores, categories, security vendor evaluations, threat names, and metadata. Offers detailed insights into malicious, suspicious, and harmless classifications from various sources, helping to identify potential risks effectively.
端点: GET /rapid/v1/ioc/search/url
参数:
query(string): Example value: http://2.56.56.117/zato/Josho.spc
技术栈
传输协议: stdio
HTTP 客户端: httpx
许可证
MIT License - 详见 LICENSE 文件。
开发
此服务器由 API-to-MCP 工具生成。
版本: 1.0.0
Available Tools
4 toolsdomain_searchC
Analyzes a given domain to provide insights into DNS records, HTTP certificate details, reputation, security vendor evaluations, and related tags. Includes detailed security classifications and supports identifying malicious or suspicious domains effectively.
Inputs: query.
hash_searchB
Provides detailed threat analysis for a given hash, including analysis date, reputation, categories, security vendor assessments, threat names, and URL details. Detects malware, suspicious activity, and clean results from various security vendors with statistical summaries.
Inputs: query.
ip_address_searchA
Provides comprehensive analysis for a given IP address, including associated ASN, geographic location, network details, WHOIS information, and security vendor evaluations. Summarizes malicious, suspicious, harmless, and undetected classifications, enabling effective threat detection and risk assessment.
Inputs: query.
url_searchB
Provides in-depth threat analysis for a given URL, including reputation scores, categories, security vendor evaluations, threat names, and metadata. Offers detailed insights into malicious, suspicious, and harmless classifications from various sources, helping to identify potential risks effectively.
Inputs: query.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
TDQS
Scored across 4 tools
Each tool has a clearly distinct purpose targeting a specific type of indicator: domain, hash, IP address, and URL. The descriptions reinforce this by detailing unique analysis aspects for each, such as DNS records for domains, hash categories for malware, geographic location for IPs, and URL metadata. There is no overlap or ambiguity in their functions.
All tool names follow a consistent pattern of 'noun_search' (domain_search, hash_search, ip_address_search, url_search), using snake_case uniformly. This predictable naming scheme makes it easy for agents to understand and select the appropriate tool based on the indicator type.
With 4 tools, the server is well-scoped for its purpose of IOC (Indicator of Compromise) search, covering the core indicator types: domain, hash, IP address, and URL. Each tool earns its place by providing specialized analysis, and the count is neither too thin nor excessive for the domain.
The tool set offers complete coverage for IOC search, including all major indicator types used in threat intelligence and security analysis. There are no gaps in the surface; agents can analyze domains, hashes, IPs, and URLs effectively, with detailed insights into reputation, security evaluations, and classifications from each tool.
Maintenance
Related MCP Connectors
Reputation for IPs, domains, URLs, hashes, emails, phones; CVEs; injection and email scans
Enrich, search, assess, and manage threat intelligence through 80+ typed MCP tools.
Free no-key IP intelligence: geolocation, VPN detection, DNS, WHOIS, blacklists, breach checks
Live threat intel for agents: incidents, actors, CVEs with KEV/EPSS, ransomware leak-site victims.
Related MCP Servers
- AlicenseAqualityBmaintenanceAggregates real-time threat intelligence from multiple sources including Feodo Tracker, URLhaus, CISA KEV, and ThreatFox, with IP/hash reputation checking via VirusTotal, AbuseIPDB, and Shodan for comprehensive security monitoring.111,062MIT
- AlicenseNot gradedqualityDmaintenanceEnables AI-powered threat intelligence analysis of IPs, domains, URLs, and file hashes across multiple threat intelligence platforms (VirusTotal, AlienVault OTX, AbuseIPDB, IPinfo) with APT attribution and interactive reporting through natural language queries.19 PyPI40Apache 2.0
- AlicenseAqualityCmaintenanceProvides unified access to multiple threat intelligence sources like AlienVault OTX, AbuseIPDB, and GreyNoise for security research and analysis. It enables users to perform simultaneous lookups on IPs, domains, hashes, and URLs across several platforms within a single response.795 npm10MIT
- AlicenseNot gradedqualityDmaintenanceProvides comprehensive IP and domain security intelligence, enabling analysis of IP addresses and domains for threat and reputation information.1MIT