greynoise_ip
Identify if an IP address is internet background noise or a targeted threat using GreyNoise intelligence.
Instructions
Check if an IP is internet background noise or a targeted threat (GreyNoise)
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| ip | Yes | IP address to check |
Implementation Reference
- src/index.ts:619-632 (handler)The handler function for the greynoise_ip tool. It extracts the 'ip' argument, calls the GreyNoise community API endpoint, and returns the JSON result. Works without an API key (keyless community endpoint), but if GREYNOISE_API_KEY is set, it's passed in the request header for higher rate limits.
case "greynoise_ip": { const { ip } = args as { ip: string }; const result = await apiRequest<unknown>( `${config.greynoise.baseUrl}/community/${ip}`, config.greynoise.apiKey ? { headers: { key: config.greynoise.apiKey } } : {} ); return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }], }; } - src/index.ts:229-241 (schema)The tool definition and input schema for greynoise_ip. Defines the tool name, description ('Check if an IP is internet background noise or a targeted threat'), and input schema requiring an 'ip' string parameter.
name: "greynoise_ip", description: "Check if an IP is internet background noise or a targeted threat (GreyNoise)", inputSchema: { type: "object" as const, properties: { ip: { type: "string", description: "IP address to check", }, }, required: ["ip"], }, }); - src/index.ts:227-242 (registration)Registration of the greynoise_ip tool. The tool is conditionally pushed into the TOOLS array only if services.greynoise is enabled (always true, since GreyNoise community endpoint works without auth).
if (services.greynoise) { TOOLS.push({ name: "greynoise_ip", description: "Check if an IP is internet background noise or a targeted threat (GreyNoise)", inputSchema: { type: "object" as const, properties: { ip: { type: "string", description: "IP address to check", }, }, required: ["ip"], }, }); }