mcp-greynoise
mcp-greynoise
用于 GreyNoise API 的 MCP 服务器 — 检查 IP 地址是互联网背景噪音还是潜在的有针对性的攻击。
快速开始
npx mcp-greynoise就这样。开箱即用,每天可查询 10 次(无需 API 密钥)。
Related MCP server: MCP AbuseIPDB Server
什么是 GreyNoise?
GreyNoise 收集并分析互联网范围的扫描流量。它能告诉你:
噪音:这个 IP 是否在大量扫描互联网?(僵尸网络、研究人员、爬虫)
RIOT:这个 IP 是否是已知的良性服务?(Google、Cloudflare、Microsoft 等)
分类:恶意、良性或未知
这对安全的重要性
当你在日志中看到可疑流量时:
GreyNoise 结果 | 解释 |
噪音 + 恶意 | 背景攻击流量(扫描器、僵尸网络)— 很可能不是针对你的 |
噪音 + 良性 | 安全研究人员、搜索引擎爬虫 — 通常安全 |
RIOT | 已知的良好服务(CDN、DNS、云)— 几乎肯定是良性的 |
非噪音 | ⚠️ 这个 IP 不是大量扫描的 — 流量可能是 针对你的 |
“非噪音”的情况通常最重要 — 它表明有人对你的系统特别感兴趣。
演示
check_ip 的输出示例:
IP: 51.91.185.74
Classification: MALICIOUS
Noise: YES - This IP has been observed scanning the internet
RIOT: NO - Not a known benign service IP
Last Seen: 2024-01-15
Details: https://viz.greynoise.io/ip/51.91.185.74
--- Interpretation ---
🚨 This IP is actively scanning the internet and classified as MALICIOUS.
Likely a scanner, botnet, or threat actor.安装
npm(推荐)
npm install -g mcp-greynoisenpx(无需安装)
npx mcp-greynoise从源码安装
git clone https://github.com/nickjlucker/mcp-greynoise.git
cd mcp-greynoise
npm install
npm run build
node build/index.js配置
Claude Desktop
添加到你的 claude_desktop_config.json 文件中:
macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json
{
"mcpServers": {
"greynoise": {
"command": "npx",
"args": ["mcp-greynoise"],
"env": {
"GREYNOISE_API_KEY": "your-api-key-here"
}
}
}
}环境变量
变量 | 必填 | 描述 |
| 否 | 用于更高速率限制的 API 密钥(每天 50 次 vs 10 次) |
在 viz.greynoise.io/signup 获取免费 API 密钥。
⚠️ 切勿提交 API 密钥。 请参阅
.env.example了解推荐设置。
工具
check_ip
检查单个 IP 地址与 GreyNoise 的关系。
输入:
ip(字符串):要检查的 IPv4 地址
check_ips
在一次调用中检查多个 IP 地址(最多 10 个)。
输入:
ips(字符串数组):IPv4 地址数组
输出示例:
=== Results ===
8.8.8.8: RIOT (benign service) [Google]
51.91.185.74: NOISE - MALICIOUS
192.168.1.1: NOT NOISE (potentially targeted)
--- Legend ---
RIOT: Known benign service (CDN, DNS, etc.)
NOISE: IP is mass-scanning the internet
NOT NOISE: IP is NOT mass-scanning (traffic may be targeted)资源
greynoise://status
返回 API 状态和速率限制信息。
速率限制
层级 | 每日查询次数 |
未认证 | 10 |
免费账户 | 50 |
付费计划 | 更高 |
速率限制在 API 调用和 GreyNoise Visualizer 之间共享。
安全
此服务器:
仅从 GreyNoise API 读取数据(无扫描、无漏洞利用)
不存储 当前请求之外的任何数据
不传输 你的 API 密钥到除 GreyNoise 之外的任何地方
仅执行 声誉/遥测富集
你的 API 密钥通过环境变量传递,且永远不会被记录。
用例
SOC 分类:快速判断告警 IP 是背景噪音还是针对性的
事件响应:识别攻击者 IP 是批量扫描器还是针对性的威胁
威胁狩猎:在日志中找到非批量扫描的 IP(可能具有针对性)
日志分析:通过过滤已知扫描器减少误报
开发
# Install dependencies
npm install
# Run in development mode
npm run dev
# Build for production
npm run build
# Run built version
npm start许可证
MIT
链接
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Servers
- Alicense-qualityCmaintenanceIntegrates with the AbuseIPDB API to check IP addresses for abuse reports and report abusive IP addresses.2MIT
- AlicenseAqualityDmaintenanceProvides threat intelligence lookups against the AbuseIPDB database, enabling IP reputation checks, CIDR block analysis, and log enrichment. It features intelligent caching and rate limiting to efficiently manage API usage for security analysis and automated workflows.5MIT
- Alicense-qualityDmaintenanceProvides comprehensive IP and domain security intelligence, enabling analysis of IP addresses and domains for threat and reputation information.MIT
- AlicenseAqualityAmaintenanceMCP server for GreyNoise threat intelligence, enabling IP analysis, GNQL queries, tag and vulnerability lookups, and session/pcap retrieval via natural language.48925MIT
Related MCP Connectors
GreyNoise Community MCP — internet scanner classification (free tier with key)
Free no-key IP intelligence: geolocation, VPN detection, DNS, WHOIS, blacklists, breach checks
Free IPv4 lookups against a distributed attacker-observation corpus.
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/nickjlucker/mcp-greynoise'
If you have feedback or need assistance with the MCP directory API, please join our Discord server