threatintel_lookup_ip

Instructions

Implementation Reference

• src/index.ts:112-125 (schema)

  Tool schema/definition for threatintel_lookup_ip: defines the tool name, description ('Look up an IP address across all configured threat intelligence sources...'), and input schema requiring an 'ip' string parameter.

  {
    name: "threatintel_lookup_ip",
    description: "Look up an IP address across all configured threat intelligence sources (OTX, AbuseIPDB, GreyNoise, Feodo Tracker)",
    inputSchema: {
      type: "object" as const,
      properties: {
        ip: {
          type: "string",
          description: "IP address to look up",
        },
      },
      required: ["ip"],
    },
  },

• src/index.ts:408-456 (handler)

  Handler implementation for threatintel_lookup_ip: extracts the 'ip' argument, then queries AbuseIPDB (for reputation), OTX (for IP indicators), and GreyNoise (for classification), collecting results into a single response.

  case "threatintel_lookup_ip": {
    const { ip } = args as { ip: string };
    const results: Record<string, unknown> = { ip };
  
    // AbuseIPDB
    if (services.abuseipdb) {
      try {
        const abuseResult = await apiRequest<{ data: unknown }>(
          `${config.abuseipdb.baseUrl}/check?ipAddress=${encodeURIComponent(ip)}&maxAgeInDays=90`,
          { headers: { Key: config.abuseipdb.apiKey! } }
        );
        results.abuseipdb = abuseResult.data;
      } catch (e) {
        results.abuseipdb = { error: e instanceof Error ? e.message : String(e) };
      }
    }
  
    // OTX
    if (services.otx) {
      try {
        const otxResult = await apiRequest<unknown>(
          `${config.otx.baseUrl}/indicators/IPv4/${ip}/general`,
          { headers: { "X-OTX-API-KEY": config.otx.apiKey! } }
        );
        results.otx = otxResult;
      } catch (e) {
        results.otx = { error: e instanceof Error ? e.message : String(e) };
      }
    }
  
    // GreyNoise
    if (services.greynoise) {
      try {
        const gnResult = await apiRequest<unknown>(
          `${config.greynoise.baseUrl}/community/${ip}`,
          config.greynoise.apiKey
            ? { headers: { key: config.greynoise.apiKey } }
            : {}
        );
        results.greynoise = gnResult;
      } catch (e) {
        results.greynoise = { error: e instanceof Error ? e.message : String(e) };
      }
    }
  
    return {
      content: [{ type: "text", text: JSON.stringify(results, null, 2) }],
    };
  }

• src/index.ts:99-168 (registration)

  Tools registration: the TOOLS array is defined starting at line 99, and threatintel_lookup_ip is included at lines 112-125. This array is returned by the ListToolsRequestSchema handler at line 377-379.

  // Define available tools
  const TOOLS: Tool[] = [
    // Status tool
    {
      name: "threatintel_status",
      description: `Check which threat intelligence sources are configured. Currently available: ${configuredServices.join(", ") || "none (abuse.ch feeds work without auth)"}`,
      inputSchema: {
        type: "object" as const,
        properties: {},
        required: [],
      },
    },
    // Unified lookup
    {
      name: "threatintel_lookup_ip",
      description: "Look up an IP address across all configured threat intelligence sources (OTX, AbuseIPDB, GreyNoise, Feodo Tracker)",
      inputSchema: {
        type: "object" as const,
        properties: {
          ip: {
            type: "string",
            description: "IP address to look up",
          },
        },
        required: ["ip"],
      },
    },
    {
      name: "threatintel_lookup_domain",
      description: "Look up a domain across threat intelligence sources (OTX, URLhaus)",
      inputSchema: {
        type: "object" as const,
        properties: {
          domain: {
            type: "string",
            description: "Domain name to look up",
          },
        },
        required: ["domain"],
      },
    },
    {
      name: "threatintel_lookup_hash",
      description: "Look up a file hash (MD5, SHA1, SHA256) across threat intelligence sources (OTX, MalwareBazaar)",
      inputSchema: {
        type: "object" as const,
        properties: {
          hash: {
            type: "string",
            description: "File hash (MD5, SHA1, or SHA256)",
          },
        },
        required: ["hash"],
      },
    },
    {
      name: "threatintel_lookup_url",
      description: "Look up a URL for malware/phishing indicators (OTX, URLhaus)",
      inputSchema: {
        type: "object" as const,
        properties: {
          url: {
            type: "string",
            description: "URL to check",
          },
        },
        required: ["url"],
      },
    },
  ];

• src/index.ts:77-97 (helper)

  Helper function apiRequest used by the IP lookup handler to make HTTP requests to threat intel APIs with JSON headers and error handling.

  // Helper function for API requests
  async function apiRequest<T>(
    url: string,
    options: RequestInit = {}
  ): Promise<T> {
    const response = await fetch(url, {
      ...options,
      headers: {
        "Content-Type": "application/json",
        "Accept": "application/json",
        ...(options.headers || {}),
      },
    });
  
    if (!response.ok) {
      const text = await response.text();
      throw new Error(`API error ${response.status}: ${text}`);
    }
  
    return response.json() as Promise<T>;
  }