MCP server for GreyNoise threat intelligence, enabling IP analysis, GNQL queries, tag and vulnerability lookups, and session/pcap retrieval via natural language.
Enables IP address lookups and risk assessments for IPv4/IPv6, providing geolocation, ISP/ASN, and security flags such as VPN, proxy, Tor, datacenter, and mobile with a risk score.
Provides threat intelligence lookups against the AbuseIPDB database, enabling IP reputation checks, CIDR block analysis, and log enrichment. It features intelligent caching and rate limiting to efficiently manage API usage for security analysis and automated workflows.