A
licenseA
qualityC
maintenanceMCP server for accessing URLhaus malicious URL database from abuse.ch - provides threat intelligence for cybersecurity research
7
8 npm
6
MIT
Best abuse.ch MCP Servers
Abuse.ch is a research project that tracks and monitors malware, botnets, and other cyber threats. It provides various tools and resources to help security professionals identify and combat online abuse, including databases of malicious URLs, compromised websites, and command-and-control servers.
Why this server?
Provides access to abuse.ch's URLhaus threat intelligence platform, enabling queries for malicious URLs, host/domain information, malware payloads, and malware tags or signatures.
Why this server?
Integrates with abuse.ch services ThreatFox, URLhaus, and MalwareBazaar for threat intelligence lookups on domains, IPs, URLs, and hashes, requiring an abuse.ch Auth-Key.
AlicenseBqualityCmaintenanceEnables AI agents to investigate domains, emails, IPs, hashes, URLs, onion addresses, Bitcoin addresses and CVEs across 68 tools spanning 19 threat-intelligence and dark-web source categories, returning bounded evidence with provenance, coverage and explicit skipped, errored or inconclusive checks. It also ships a local investigation dashboard for running combined lookups, reviewing source readiness and downloading JSON reports.683MITWhy this server?
Integrates AbuseIPDB and URLhaus threat intelligence for IP reputation checks and PCAP-wide threat scanning.
AlicenseBqualityCmaintenanceA professional-grade network analysis MCP server that integrates Wireshark/TShark, Nmap, and threat intelligence to enable packet capture, network scanning, threat detection, and credential extraction through natural language.412MITWhy this server?
Integrates with URLhaus (abuse.ch) to check URLs against active malware distribution lists.
AlicenseAqualityCmaintenanceEnables AI agents to check URL safety before fetching content, using Google Web Risk, URLhaus, PhishTank, and AI analysis to return SAFE/SUSPICIOUS/DANGEROUS verdicts.165 npm1MITWhy this server?
Provides unified access to abuse.ch projects including URLhaus for malware distribution URLs, MalwareBazaar for sample lookups by hash, ThreatFox for IOC sharing, and Feodo Tracker for identifying active botnet C2 infrastructure.
AlicenseAqualityCmaintenanceProvides unified access to multiple threat intelligence sources like AlienVault OTX, AbuseIPDB, and GreyNoise for security research and analysis. It enables users to perform simultaneous lookups on IPs, domains, hashes, and URLs across several platforms within a single response.7128 npm11MITWhy this server?
Provides access to abuse.ch's threat intelligence platforms (ThreatFox, URLhaus, MalwareBazaar) for searching malicious IOCs, URLs, and malware samples.
AlicenseBqualityDmaintenanceUnified dark web and threat intelligence MCP server providing 66 tools across 16 data sources, including breach databases, ransomware tracking, Tor .onion access, blockchain intel, and malware analysis for AI agents.66419 npm3MITWhy this server?
Retrieves Feodo Tracker's public IP blocklist from abuse.ch and converts it into PathLens threat-feed format, with optional validation and periodic refresh support.
Why this server?
Enables AI agents to query abuse.ch services such as ThreatFox for malware IOCs, URLhaus for malicious URLs, and other threat intelligence feeds.
AlicenseAqualityCmaintenanceDark web & threat intelligence for AI agents. HIBP, ThreatFox, ransomware tracking, Tor .onion access, blockchain intel, exploit search, stealer logs, malware analysis — unified into a single MCP server.66419 npm524MITWhy this server?
Integrates with abuse.ch services (URLhaus, ThreatFox, MalwareBazaar) to look up malware samples, search IOCs, retrieve recent submissions, and pivot on hashes, families, tags, and hosts.
FlicenseBqualityBmaintenanceEnables detection engineers to search, build, validate, and correlate detection rules across multiple SIEM formats using MITRE ATT&CK, Atomic Red Team, and threat intelligence.129-