{
  "markdown": "# mcp-greynoise\n\n[![npm version](https://img.shields.io/npm/v/mcp-greynoise.svg)](https://www.npmjs.com/package/mcp-greynoise)\n[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)\n\nMCP server for the [GreyNoise](https://greynoise.io) API — check if IP addresses are internet background noise or potentially targeted attacks.\n\n## Quick Start\n\n```bash\nnpx mcp-greynoise\n```\n\nThat's it. Works out of the box with 10 lookups/day (no API key needed).\n\n## What is GreyNoise?\n\nGreyNoise collects and analyzes internet-wide scan traffic. It tells you:\n\n- **Noise**: Is this IP mass-scanning the internet? (botnets, researchers, crawlers)\n- **RIOT**: Is this IP a known benign service? (Google, Cloudflare, Microsoft, etc.)\n- **Classification**: Malicious, benign, or unknown\n\n### Why this matters for security\n\nWhen you see suspicious traffic in your logs:\n\n| GreyNoise Result | Interpretation |\n|------------------|----------------|\n| **NOISE + Malicious** | Background attack traffic (scanners, botnets) — likely untargeted |\n| **NOISE + Benign** | Security researchers, search crawlers — usually safe |\n| **RIOT** | Known good service (CDN, DNS, cloud) — almost certainly benign |\n| **NOT NOISE** | ⚠️ This IP is NOT mass-scanning — traffic may be **targeted at you** |\n\nThe \"NOT NOISE\" case is often the most important — it suggests someone is specifically interested in your systems.\n\n## Demo\n\n<!-- TODO: Add GIF of Claude Desktop calling check_ip -->\n\n**Example output from `check_ip`:**\n\n```\nIP: 51.91.185.74\nClassification: MALICIOUS\nNoise: YES - This IP has been observed scanning the internet\nRIOT: NO - Not a known benign service IP\nLast Seen: 2024-01-15\nDetails: https://viz.greynoise.io/ip/51.91.185.74\n\n--- Interpretation ---\n🚨 This IP is actively scanning the internet and classified as MALICIOUS. \n   Likely a scanner, botnet, or threat actor.\n```\n\n## Installation\n\n### npm (recommended)\n\n```bash\nnpm install -g mcp-greynoise\n```\n\n### npx (no install)\n\n```bash\nnpx mcp-greynoise\n```\n\n### From source\n\n```bash\ngit clone https://github.com/nickjlucker/mcp-greynoise.git\ncd mcp-greynoise\nnpm install\nnpm run build\nnode build/index.js\n```\n\n## Configuration\n\n### Claude Desktop\n\nAdd to your `claude_desktop_config.json`:\n\n**macOS:** `~/Library/Application Support/Claude/claude_desktop_config.json`  \n**Windows:** `%APPDATA%\\Claude\\claude_desktop_config.json`\n\n```json\n{\n  \"mcpServers\": {\n    \"greynoise\": {\n      \"command\": \"npx\",\n      \"args\": [\"mcp-greynoise\"],\n      \"env\": {\n        \"GREYNOISE_API_KEY\": \"your-api-key-here\"\n      }\n    }\n  }\n}\n```\n\n### Environment Variables\n\n| Variable | Required | Description |\n|----------|----------|-------------|\n| `GREYNOISE_API_KEY` | No | API key for higher rate limits (50/day vs 10/day) |\n\nGet a free API key at [viz.greynoise.io/signup](https://viz.greynoise.io/signup).\n\n> ⚠️ **Never commit API keys.** See `.env.example` for the recommended setup.\n\n## Tools\n\n### `check_ip`\n\nCheck a single IP address against GreyNoise.\n\n**Input:**\n- `ip` (string): IPv4 address to check\n\n### `check_ips`\n\nCheck multiple IP addresses in one call (max 10).\n\n**Input:**\n- `ips` (string[]): Array of IPv4 addresses\n\n**Example output:**\n```\n=== Results ===\n8.8.8.8: RIOT (benign service) [Google]\n51.91.185.74: NOISE - MALICIOUS\n192.168.1.1: NOT NOISE (potentially targeted)\n\n--- Legend ---\nRIOT: Known benign service (CDN, DNS, etc.)\nNOISE: IP is mass-scanning the internet\nNOT NOISE: IP is NOT mass-scanning (traffic may be targeted)\n```\n\n## Resources\n\n### `greynoise://status`\n\nReturns API status and rate limit information.\n\n## Rate Limits\n\n| Tier | Daily Lookups |\n|------|---------------|\n| Unauthenticated | 10 |\n| Free account | 50 |\n| Paid plans | Higher |\n\nRate limits are shared between API calls and the [GreyNoise Visualizer](https://viz.greynoise.io).\n\n## Security\n\nThis server:\n- **Only reads** from the GreyNoise API (no scanning, no exploitation)\n- **Does not store** any data beyond the current request\n- **Does not transmit** your API key anywhere except to GreyNoise\n- Performs **reputation/telemetry enrichment only**\n\nYour API key is passed via environment variable and never logged.\n\n## Use Cases\n\n- **SOC Triage**: Quickly determine if alert IPs are background noise or targeted\n- **Incident Response**: Identify if attacker IPs are mass-scanners or focused threats\n- **Threat Hunting**: Find IPs in your logs that aren't mass-scanners (potentially targeted)\n- **Log Analysis**: Reduce false positives by filtering out known scanners\n\n## Development\n\n```bash\n# Install dependencies\nnpm install\n\n# Run in development mode\nnpm run dev\n\n# Build for production\nnpm run build\n\n# Run built version\nnpm start\n```\n\n## License\n\nMIT\n\n## Links\n\n- [GreyNoise](https://greynoise.io)\n- [GreyNoise API Docs](https://docs.greynoise.io)\n- [Model Context Protocol](https://modelcontextprotocol.io)\n- [MCP Registry](https://registry.modelcontextprotocol.io)\n",
  "bytes": 4953,
  "sha": "7467b2da3122e9c75e020b95607bf89a4f375f68482059c4e3144d900842fd0f",
  "repo_slug": "nickjlucker/mcp-greynoise",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_nickjlucker_greynoise_bd2255f3/readme"
}