greynoise-mcp-server

Official

by GreyNoise-Intelligence

Overview Schema Source Related Servers Discussions Admin

TypeScript

Remote

Callback IP Lookup

callback-ip-lookup

Read-only

Investigate a callback or C2 IP address to identify attack stage, scanner associations, RIOT status, network context, and downloaded malware files.

Instructions

Look up a single callback/C2 IP: attack stage, scanner associations, RIOT status, geo/network enrichment, and downloaded malware files.

Input Schema

Name	Required	Description	Default
`ip`	Yes	The callback IP address to look up

Output Schema

Name	Required	Description	Default
`ip`	No
`is_riot`	No
`last_seen`	No
`enrichment`	No
`file_count`	No
`first_seen`	No
`is_stage_1`	No
`is_stage_2`	No
`scanner_ips`	No
`active_files`	No
`attack_stage`	No
`scanner_count`	No
`riot_trust_level`	No
`source_workspaces`	No

Schema Changelog

Changes observed during successful MCP inspections.

Changed6 schema fields changedv0.5.5Nov 2, 2026

removedOutput schema / properties / attack_stage / anyOf

Removed value: -[
-  {
-    "type": "number"
-  },
-  {
-    "type": "null"
-  }
-]

addedOutput schema / properties / attack_stage / type
```
Added value: +[
+  "number",
+  "null"
+]
```

removedOutput schema / properties / first_seen / anyOf

Removed value: -[
-  {
-    "type": "string"
-  },
-  {
-    "type": "null"
-  }
-]

addedOutput schema / properties / first_seen / type
```
Added value: +[
+  "string",
+  "null"
+]
```

removedOutput schema / properties / last_seen / anyOf

Removed value: -[
-  {
-    "type": "string"
-  },
-  {
-    "type": "null"
-  }
-]

addedOutput schema / properties / last_seen / type
```
Added value: +[
+  "string",
+  "null"
+]
```

Addedv0.5.4Jul 23, 2026

TDQS

B3.3/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=true, so the safety and external-data profile is covered. The description adds useful context about the enrichment dimensions returned, but does not discuss permissions, rate limits, or data freshness. Given annotation coverage, this is adequate but not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single front-loaded sentence that packs the resource, cardinality, and enrichment dimensions without waste. Every clause contributes useful information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, and annotations cover the safety profile. However, among many similar IP/session enrichment tools, the description does not explain how this one differs from lookup-ip-context or quick-check-ip, leaving a meaningful selection gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the schema already defines the single required 'ip' parameter. The description reinforces that only one IP is handled but adds no format or validation details beyond the schema, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb and resource ('Look up a single callback/C2 IP') and enumerates the enrichment categories returned, so the tool's function is clear. It does not, however, distinguish this from sibling tools like lookup-ip-context or quick-check-ip, which likely have overlapping purposes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit guidance on when to use this tool versus alternatives such as lookup-ip-context, quick-check-ip, multi-ip-check, or callback-overview. The 'single IP' wording implies cardinality but does not state selection criteria or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server