Skip to main content
Glama
abe-source

mcp-abuseipdb

by abe-source
OverviewSchemaRelated ServersScoreDiscussions
TypeScript
Remote

An MCP server that exposes AbuseIPDB threat intelligence as tools — ask Claude (or any MCP client) whether an IP, subnet, or set of reports looks malicious, and get real data back instead of a guess.

Tools

Tool

What it does

check_ip

Check a single IP — abuse confidence score, ISP, country, usage type, report count, optionally the last 10 individual reports

check_block

Check a CIDR network block (up to /16) — network range info plus a per-IP breakdown of any reported addresses inside it

get_reports

Get the individual abuse reports filed against an IP — who reported it, why, and when, paginated

get_blacklist

Get the most-reported IPs overall. Free tier is capped at confidence 100 regardless of what you ask for; paid tiers can widen the range

Related MCP server: FastMCP ThreatIntel

Prerequisites

  • Node.js 18+

  • A free AbuseIPDB API key (free tier: 1,000 checks/day, 5 blacklist calls/day)

Installation

Quick install

The package is published on npm, so these register it in one step — no cloning or building required:

Claude Code:

claude mcp add abuseipdb -e ABUSEIPDB_API_KEY=your-api-key-here -- npx -y mcp-abuseipdb

Codex CLI:

codex mcp add abuseipdb --env ABUSEIPDB_API_KEY=your-api-key-here -- npx -y mcp-abuseipdb

Manual config (any stdio MCP client)

Most clients that support stdio MCP servers (Claude Desktop, Cursor, Windsurf, etc.) use this same config shape — add it to whichever config file your client expects:

{
  "mcpServers": {
    "abuseipdb": {
      "command": "node",
      "args": ["/absolute/path/to/mcp-abuseipdb/dist/index.js"],
      "env": {
        "ABUSEIPDB_API_KEY": "your-api-key-here"
      }
    }
  }
}

Restart your client, then try asking:

"Has 8.8.8.8 been reported for anything?"

"Check my office subnet 203.0.113.0/24 for abuse reports"

"What are the most reported IPs right now?"

How it works

MCP client (Claude, Inspector, ...)
        │  stdio, JSON-RPC
        ▼
  McpServer (src/server.ts)
        │
        ▼
  tools/*.ts     — one file per tool: Zod schema + handler, formats the reply
        │
        ▼
  endpoints/*.ts — one file per AbuseIPDB endpoint: typed request + response
        │
        ▼
  abuseipdbClient.ts — auth header, response envelope, AbuseIPDB error parsing
        │
        ▼
  client.ts      — generic fetch wrapper, timeout, HTTP error handling
        │
        ▼
  AbuseIPDB REST API

Each layer knows nothing about the one above it. client.ts doesn't know AbuseIPDB exists; endpoints/ doesn't know MCP exists. Adding a new tool means one new file in endpoints/, one new file in tools/, one line in tools/index.ts — nothing else changes.

Tool arguments are validated with Zod before any handler runs — a malformed request never reaches the API.

Development

git clone https://github.com/abe-source/mcp-abuseipdb.git
cd mcp-abuseipdb
npm install
npm run build   # compile TypeScript
npm run lint     # check formatting + lint rules
npm run check    # lint + format + fix, in place

Test locally with the MCP Inspector:

npx @modelcontextprotocol/inspector --cli node --env-file=.env dist/index.js --method tools/call --tool-name check_ip --tool-arg ip=8.8.8.8

License

MIT

This server cannot be installed

A
license - permissive license
-
quality - not tested
A
maintenance

How are these scores calculated?

Maintenance

–Maintainers
–Response time
–Release cycle
1Releases (12mo)
Commit activity

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Servers

  • AbuseIPDB MCP Server

    n3r0-b1n4ry
    A
    license
    -
    quality
    C
    maintenance
    Integrates with the AbuseIPDB API to check IP addresses for abuse reports and report abusive IP addresses.
    Last updated
    2
    MIT

  • FastMCP ThreatIntel

    4R9UN
    A
    license
    -
    quality
    C
    maintenance
    Enables AI-powered threat intelligence analysis of IPs, domains, URLs, and file hashes across multiple threat intelligence platforms (VirusTotal, AlienVault OTX, AbuseIPDB, IPinfo) with APT attribution and interactive reporting through natural language queries.
    Last updated
    40
    Apache 2.0

  • MCP AbuseIPDB Server

    alephnan
    A
    license
    A
    quality
    D
    maintenance
    Provides threat intelligence lookups against the AbuseIPDB database, enabling IP reputation checks, CIDR block analysis, and log enrichment. It features intelligent caching and rate limiting to efficiently manage API usage for security analysis and automated workflows.
    Last updated
    5
    MIT

  • mcp-abuseipdb

    nickjlucker
    A
    license
    -
    quality
    D
    maintenance
    Enables AI agents to check IP reputation and abuse reports via AbuseIPDB, including abuse confidence scores, report details, and bulk IP triage.
    Last updated
    27
    1
    MIT

View all related MCP servers

Related MCP Connectors

  • Abuseipdb

    AbuseIPDB MCP — wraps AbuseIPDB v2 API (api.abuseipdb.com/api/v2)

  • Scry

    Free IPv4 lookups against a distributed attacker-observation corpus.

  • Virustotal

    VirusTotal MCP — file / URL / domain / IP reputation (BYO key)

View all MCP Connectors

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/abe-source/mcp-abuseipdb'

If you have feedback or need assistance with the MCP directory API, please join our Discord server