MCP server for GreyNoise API - Check if IPs are internet background noise or targeted attacks
{
"mcpServers": {
"io-github-nickjlucker-greynoise": {
"command": "<see-readme>",
"args": []
}
}
}No install config available. Check the server's README for setup instructions.
Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
MCP server for GreyNoise API - Check if IPs are internet background noise or targeted attacks
Is it safe?
No package registry to scan.
No authentication — any process on your machine can connect.
License not specified.
Is it maintained?
Last commit 41 days ago.
Will it work with my client?
Transport: stdio. Works with Claude Desktop, Cursor, Claude Code, and most MCP clients.
No automated test available for this server. Check the GitHub README for setup instructions.
No known vulnerabilities.
This server is missing a description. Tools and install config are also missing.If you've used it, help the community.
Add informationHave you used this server?
Share your experience — it helps other developers decide.
Sign in to write a review.
Persistent memory using a knowledge graph
Privacy-first. MCP is the protocol for tool access. We're the virtualization layer for context.
Pre-build reality check. Scans GitHub, HN, npm, PyPI, Product Hunt — returns 0-100 signal.
Monitor browser logs directly from Cursor and other MCP compatible IDEs.
MCP Security Weekly
Get CVE alerts and security updates for io.github.nickjlucker/greynoise and similar servers.
Start a conversation
Ask a question, share a tip, or report an issue.
Sign in to join the discussion.
MCP server for the GreyNoise API — check if IP addresses are internet background noise or potentially targeted attacks.
npx mcp-greynoise
That's it. Works out of the box with 10 lookups/day (no API key needed).
GreyNoise collects and analyzes internet-wide scan traffic. It tells you:
When you see suspicious traffic in your logs:
| GreyNoise Result | Interpretation | |------------------|----------------| | NOISE + Malicious | Background attack traffic (scanners, botnets) — likely untargeted | | NOISE + Benign | Security researchers, search crawlers — usually safe | | RIOT | Known good service (CDN, DNS, cloud) — almost certainly benign | | NOT NOISE | ⚠️ This IP is NOT mass-scanning — traffic may be targeted at you |
The "NOT NOISE" case is often the most important — it suggests someone is specifically interested in your systems.
Example output from check_ip:
IP: 51.91.185.74
Classification: MALICIOUS
Noise: YES - This IP has been observed scanning the internet
RIOT: NO - Not a known benign service IP
Last Seen: 2024-01-15
Details: https://viz.greynoise.io/ip/51.91.185.74
--- Interpretation ---
🚨 This IP is actively scanning the internet and classified as MALICIOUS.
Likely a scanner, botnet, or threat actor.
npm install -g mcp-greynoise
npx mcp-greynoise
git clone https://github.com/nickjlucker/mcp-greynoise.git
cd mcp-greynoise
npm install
npm run build
node build/index.js
Add to your claude_desktop_config.json:
macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json
{
"mcpServers": {
"greynoise": {
"command": "npx",
"args": ["mcp-greynoise"],
"env": {
"GREYNOISE_API_KEY": "your-api-key-here"
}
}
}
}
| Variable | Required | Description |
|----------|----------|-------------|
| GREYNOISE_API_KEY | No | API key for higher rate limits (50/day vs 10/day) |
Get a free API key at viz.greynoise.io/signup.
⚠️ Never commit API keys. See
.env.examplefor the recommended setup.
check_ipCheck a single IP address against GreyNoise.
Input:
ip (string): IPv4 address to checkcheck_ipsCheck multiple IP addresses in one call (max 10).
Input:
ips (string[]): Array of IPv4 addressesExample output:
=== Results ===
8.8.8.8: RIOT (benign service) [Google]
51.91.185.74: NOISE - MALICIOUS
192.168.1.1: NOT NOISE (potentially targeted)
--- Legend ---
RIOT: Known benign service (CDN, DNS, etc.)
NOISE: IP is mass-scanning the internet
NOT NOISE: IP is NOT mass-scanning (traffic may be targeted)
greynoise://statusReturns API status and rate limit information.
| Tier | Daily Lookups | |------|---------------| | Unauthenticated | 10 | | Free account | 50 | | Paid plans | Higher |
Rate limits are shared between API calls and the GreyNoise Visualizer.
This server: