Provides a unified API layer for querying threat intelligence from multiple abuse.ch platforms including MalwareBazaar, URLhaus, and ThreatFox, enabling comprehensive reports on files, URLs, IPs, and domains for cybersecurity analysis.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Abuse.ch Threat Intelligence MCP Server check if 8.8.8.8 is malicious"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
abusech-mcp is an MCP server that fetches threat intelligence from multiple abuse.ch platforms, including MalwareBazaar, URLhaus, and ThreatFox.
Unified VT-like API for querying file, URL, IP, and domain intelligence
Uses Pydantic schemas for robust data validation and serialization
Powered by fastmcp:
Unified API layer: Directly use functions from abusech_intel.py to obtain correlated intelligence from abuse.ch platforms—serving as a unified API layer since the platforms themselves do not provide one
Related MCP server: FastMCP ThreatIntel
Python 3.10+
abuse.ch API key (set as ABUSECH_API_KEY environment variable)
Start the MCP server:
python abusech_mcp.pyget_ip_report(ip: str): Get a comprehensive IP report from URLhaus and ThreatFox
get_domain_report(domain: str): Get a domain report from URLhaus and ThreatFox
get_url_report(url: str): Get a URL report from URLhaus and ThreatFox
get_file_report(hash_value: str): Get a file report (MD5/SHA-1/SHA-256) from MalwareBazaar, URLhaus, and ThreatFox
Set your API key as an environment variable:
export ABUSECH_API_KEY=your_api_key_hereMIT License
This server cannot be deployed
ThreatFox MCP — abuse.ch indicator-of-compromise feed (free, key required)
Submit files and URLs to a malware sandbox, poll scans, fetch reports, hashes and IOCs.
Enrich, search, assess, and manage threat intelligence through 80+ typed MCP tools.
MalwareBazaar MCP — abuse.ch malware sample database (free, key required)
