Provides tools for querying the ThreatFox indicator-of-compromise feed from abuse.ch, allowing AI agents to search IOCs by file hash or malware family.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@mcp-threatfox find IOCs for the Cobalt Strike malware family"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
ThreatFox (abuse.ch) MCP — community IOC feed.
Part of Pipeworx — an MCP gateway connecting AI agents to 1684+ live data sources.
search_ioc(indicator, exact_match?)
recent_iocs(days?)
search_hash(hash) — see below, it asks TWO upstream queries
search_malware(malware, limit?)
Related MCP server: Ioc Search MCP Server
ThreatFox stores hashes in two unrelated places and abuse.ch's own
query: "search_hash" only searches one of them:
relation | what it means | upstream query |
| the hash is a malware SAMPLE; rows are the C&C servers it talks to |
|
| the hash is itself published as an indicator ( |
|
Asking only the first made this tool 34-for-34 empty over the 30d to
2026-09-16. It was never a broken endpoint — abuse.ch answers illegl_hash
(their typo) for a malformed hash and no_result for a well-formed one, so our
request was parsed and accepted throughout. It was the wrong question:
da168c3ff95c749beec0a2f29a1e6b82, taken from this pack's own recent_iocs,
returns nothing from search_hash and a full row from search_ioc.
The tool now tries both and returns matched_relation saying which answered
(null when neither did, alongside searched_relations). The second call only
runs when the first found nothing, so a non-empty answer still costs one
request. Do not collapse the two into one unlabelled list: "this file phones
home to that C2" and "this file is itself flagged as a payload" are different
security facts.
Empty is a real answer here. ThreatFox tracks C&C infrastructure, not
samples — most hashes are in neither relation. Measured 2026-09-16: 7 of 40
recent MalwareBazaar sample hashes and 2 of 88 of ThreatFox's own hash IOCs
resolved. For sample metadata use the malwarebazaar pack (same vendor, same
key), which indexes every sample.
Committed examples go stale by design. abuse.ch expires every IOC older
than six months ("IOCs older than 6 months are no longer exposed on the
ThreatFox API and ThreatFox Export"), which is why abuse.ch's OWN documentation
example hash 2151c4b970eff0071948dbbc19066aa4 returns no_result today — it
points at IOC id 4726, from 2021. Re-verify the examples in
workers/gateway/src/tool-examples.json when they age out; never commit a
placeholder like d41d8cd98f00b204e9800998ecf8427e (the MD5 of the empty
string), which is what taught every caller the wrong shape.
Platform key: gateway env PLATFORM_ABUSECH_KEY (shared with malwarebazaar).
BYO: ?_apiKey=<key> after registering at https://auth.abuse.ch.
https://threatfox-api.abuse.ch/api/v1/ — header Auth-Key, POST with JSON body.
Add to your MCP client (Claude Desktop, Cursor, Windsurf, etc.):
{
"mcpServers": {
"threatfox": {
"url": "https://gateway.pipeworx.io/threatfox/mcp"
}
}
}tools/list at https://gateway.pipeworx.io/threatfox/mcp returns the tools in the table
above plus the shared Pipeworx meta-tools — ask_pipeworx,
discover_tools, search_within, remember/recall and the rest of the
gateway-wide set. So the tool count you see is larger than this table: a
single-pack endpoint currently lists roughly 30 shared tools alongside the
pack's own. The connection's initialize response states its exact scope, and
is the authoritative answer for a given day.
This is deliberate, not multiplexing by accident. The meta-tools are what let a
scoped connection answer a question this pack does not cover — via
ask_pipeworx, which routes across the whole catalog — without you adding a
second MCP server. There is currently no way to mount a pack endpoint without
them; if the extra schemas cost you more context than the routing is worth,
connect to the full gateway once rather than to several pack endpoints.
Or connect to the full Pipeworx gateway to get every pack's tools listed directly, instead of just this one's:
{
"mcpServers": {
"pipeworx": {
"url": "https://gateway.pipeworx.io/mcp"
}
}
}Both URLs reach the same gateway and the same 1684+ data sources. The
only difference is which pack's tools are listed directly; ask_pipeworx
reaches all of them from either one.
curl -X POST https://gateway.pipeworx.io/v1/tools/search_ioc \
-H 'Content-Type: application/json' \
-d '{"indicator":"105.72.55.52:8080"}'No account needed for the first calls. Inspect any tool: GET https://gateway.pipeworx.io/v1/tools/search_ioc. Find one: POST https://gateway.pipeworx.io/v1/tools/search_packs with {"query":"..."}.
This package also runs as a local stdio MCP server — no Pipeworx account, no gateway round-trip:
{
"mcpServers": {
"threatfox": {
"command": "npx",
"args": ["-y", "@pipeworx/mcp-threatfox"]
}
}
}Or run it directly to confirm it starts:
npx -y @pipeworx/mcp-threatfoxIt speaks MCP over stdin/stdout and answers initialize/tools/list/tools/call
for only this pack's tools — none of the shared meta-tools the gateway
connection above adds. Same source, same tools, no ask_pipeworx routing.
Instead of calling tools directly, you can ask questions in plain English — this works on the pack endpoint above as well as on the full gateway:
ask_pipeworx({ question: "your question about Threatfox data" })The gateway picks the right tool and fills the arguments automatically.
MIT
This server cannot be deployed
Submit files and URLs to a malware sandbox, poll scans, fetch reports, hashes and IOCs.
VirusTotal MCP — file / URL / domain / IP reputation (BYO key)
Enrich, search, assess, and manage threat intelligence through 80+ typed MCP tools.
