GreyNoise API용 MCP 서버 — IP 주소가 인터넷 배경 소음인지, 아니면 잠재적 표적 공격인지 확인합니다.
npx mcp-greynoise이것으로 끝입니다. 별도의 설정 없이 하루 10회 조회가 가능합니다(API 키 불필요).
Related MCP server: Yunaq GAC MCP Server
GreyNoise는 인터넷 전체의 스캔 트래픽을 수집하고 분석합니다. 다음을 알려줍니다:
Noise: 이 IP가 인터넷을 대규모로 스캔하고 있나요? (봇넷, 연구자, 크롤러)
RIOT: 이 IP가 알려진 정상 서비스인가요? (Google, Cloudflare, Microsoft 등)
Classification: 악성, 정상 또는 알 수 없음
로그에서 의심스러운 트래픽을 발견했을 때:
GreyNoise 결과 | 해석 |
NOISE + Malicious | 배경 공격 트래픽(스캐너, 봇넷) — 표적이 아닐 가능성이 높음 |
NOISE + Benign | 보안 연구자, 검색 크롤러 — 일반적으로 안전함 |
RIOT | 알려진 정상 서비스(CDN, DNS, 클라우드) — 거의 확실히 정상 |
NOT NOISE | ⚠️ 이 IP는 대규모 스캔을 하지 않음 — 트래픽이 사용자를 표적으로 한 것일 수 있음 |
"NOT NOISE" 사례가 가장 중요한 경우가 많습니다 — 이는 누군가가 특별히 사용자의 시스템에 관심을 갖고 있음을 시사합니다.
check_ip 출력 예시:
IP: 51.91.185.74
Classification: MALICIOUS
Noise: YES - This IP has been observed scanning the internet
RIOT: NO - Not a known benign service IP
Last Seen: 2024-01-15
Details: https://viz.greynoise.io/ip/51.91.185.74
--- Interpretation ---
🚨 This IP is actively scanning the internet and classified as MALICIOUS.
Likely a scanner, botnet, or threat actor.npm install -g mcp-greynoisenpx mcp-greynoisegit clone https://github.com/nickjlucker/mcp-greynoise.git
cd mcp-greynoise
npm install
npm run build
node build/index.jsclaude_desktop_config.json에 추가하세요:
macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json
{
"mcpServers": {
"greynoise": {
"command": "npx",
"args": ["mcp-greynoise"],
"env": {
"GREYNOISE_API_KEY": "your-api-key-here"
}
}
}
}변수 | 필수 여부 | 설명 |
| 아니요 | 더 높은 요청 한도를 위한 API 키(하루 50회 vs 10회) |
무료 API 키는 viz.greynoise.io/signup에서 받을 수 있습니다.
⚠️ API 키를 커밋하지 마세요. 권장 설정은
.env.example을 참조하세요.
check_ip단일 IP 주소를 GreyNoise에 조회합니다.
입력:
ip (string): 조회할 IPv4 주소
check_ips한 번의 호출로 여러 IP 주소를 조회합니다(최대 10개).
입력:
ips (string[]): IPv4 주소 배열
출력 예시:
=== Results ===
8.8.8.8: RIOT (benign service) [Google]
51.91.185.74: NOISE - MALICIOUS
192.168.1.1: NOT NOISE (potentially targeted)
--- Legend ---
RIOT: Known benign service (CDN, DNS, etc.)
NOISE: IP is mass-scanning the internet
NOT NOISE: IP is NOT mass-scanning (traffic may be targeted)greynoise://statusAPI 상태 및 요청 한도 정보를 반환합니다.
등급 | 일일 조회 수 |
비인증 | 10 |
무료 계정 | 50 |
유료 요금제 | 더 높음 |
요청 한도는 API 호출과 GreyNoise Visualizer 간에 공유됩니다.
이 서버는:
GreyNoise API에서 읽기만 수행합니다(스캔 없음, 악용 없음)
현재 요청 외의 데이터를 저장하지 않습니다
사용자의 API 키를 GreyNoise 외의 어디에도 전송하지 않습니다
평판/텔레메트리 보강만 수행합니다
사용자의 API 키는 환경 변수를 통해 전달되며 절대 기록되지 않습니다.
SOC 트라이지: 알림 IP가 배경 소음인지 표적 공격인지 신속하게 판단합니다
침해 대응: 공격자 IP가 대규모 스캐너인지 집중형 위협인지 식별합니다
위협 헌팅: 로그에서 대규모 스캐너가 아닌 IP(잠재적 표적)를 찾아냅니다
로그 분석: 알려진 스캐너를 필터링하여 오탐지를 줄입니다
# Install dependencies
npm install
# Run in development mode
npm run dev
# Build for production
npm run build
# Run built version
npm startMIT
Check if an IP address is internet background noise or potentially targeted activity. GreyNoise tracks IPs that mass-scan the internet. If an IP is 'noise', traffic from it is likely untargeted scanning. If it's NOT noise, traffic may be targeted at you specifically. RIOT dataset contains known-good IPs (CDNs, DNS servers, etc.).
| Name | Required | Description | Default |
|---|---|---|---|
| ip | Yes | IPv4 address to check (e.g., 8.8.8.8) |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description bears the full burden. It explains the two classification outcomes (noise vs. targeted, and RIOT good IPs) but does not specify the actual output format, fields, or error behavior. The conceptual outline is helpful but lacks concrete details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with four sentences, front-loading the core purpose. Every sentence adds value: it defines the action, explains the background, and clarifies interpretation. No redundant or irrelevant content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple lookup tool, the description covers the reasoning behind the classification, but it lacks explicit mention of the return format or fields. The existence of a sibling ('check_ips') suggests batch capability is not clarified, which could confuse an agent. The description is adequate but not fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is one parameter with 100% schema description coverage (example provided). The tool description adds conceptual context about what the IP is checked against, but does not add new constraints or semantic details beyond the schema. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool checks if an IP is internet background noise or potentially targeted activity, using GreyNoise and RIOT datasets. It provides a specific verb and resource. However, it does not explicitly differentiate from the sibling tool 'check_ips', which likely handles multiple IPs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains the context (security analysis, noise vs. targeted) but does not provide explicit guidance on when to use this tool over 'check_ips' or any exclusion criteria. The use case is implied but not directly stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Check multiple IP addresses against GreyNoise in one call. Useful for triaging a list of suspicious IPs from logs or alerts. Rate limits apply (50/day for free tier).
| Name | Required | Description | Default |
|---|---|---|---|
| ips | Yes | Array of IPv4 addresses to check (max 10) |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses rate limits (50/day for free tier) and the batch nature, but does not mention idempotency, error behavior, or whether the tool is read-only. This leaves gaps in the agent's understanding of side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, each earning its place: the first states the action and target, the second provides a use case and a critical constraint (rate limits). No redundancy or excess.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has 1 parameter with full schema coverage, but no output schema. The description does not explain what the tool returns (e.g., risk scores, noise classification), which is essential for an agent to interpret results. It also lacks authentication requirements or explicit differentiation from 'check_ip', leaving the agent slightly under-informed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds no new information about the 'ips' parameter beyond what the schema already provides (array of strings, max 10, min 1). It does not clarify IP format or validation rules.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Check' and the resource 'multiple IP addresses against GreyNoise'. It also distinguishes itself from the sibling tool 'check_ip' by emphasizing batch capability ('in one call'), leaving no ambiguity about its purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context: 'useful for triaging a list of suspicious IPs from logs or alerts.' It also mentions rate limits. While it does not explicitly contrast with 'check_ip' or state when not to use it, the use case is well-defined and implicitly differentiates from a single-IP check.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v0.1.0check_ipcheck_ipsScored across 2 tools
The two tools have clearly distinct purposes: one checks a single IP address, the other checks multiple IPs in bulk. An agent can easily distinguish between them based on the singular/plural naming and the explicit descriptions.
Both tools follow the consistent pattern of 'check_' followed by a noun indicating the input type ('ip' vs 'ips'). The naming is predictable and uses consistent snake_case throughout.
With only two tools, the server feels minimal for its domain. While both tools are necessary and well-scoped, a more comprehensive IP intelligence server would typically benefit from additional tools (e.g., contextual enrichment, history). The count is borderline thin.
The tool set covers the basic use case of checking IPs against GreyNoise data, both individually and in bulk. However, it lacks other common operations like fetching detailed threat context, searching by tags or queries, or retrieving known-good RIOT entries specifically. Notable gaps exist for a more complete threat intelligence surface.
GreyNoise Community MCP — internet scanner classification (free tier with key)
Free no-key IP intelligence: geolocation, VPN detection, DNS, WHOIS, blacklists, breach checks
Resolves IP autonomous system numbers (ASN) and geographic coordinates.
Enrich and search people and companies, resolve identities, and enrich IP addresses.
