Skip to main content
Glama

Greynoise

by io.github.pipeworx-io

Ip Context

ip_context
Read-onlyIdempotent

Classify an IPv4 address using the GreyNoise Community dataset (BYO API key). Returns: noise (mass internet scanner?), riot (known-good service like Google/AWS?), classification (malicious|benign|unknown), entity name, last-seen date, and a viz.greynoise.io deep link for SOC triage.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
ipYesIPv4 address

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
ipYesIPv4 address queried
linkYesDeep link to GreyNoise visualization page for this IP
nameYesName or organization associated with the IP
riotYesWhether the IP is a known good service (RIOT)
noiseYesWhether the IP is classified as internet background noise
messageYesAdditional message or explanation
observedYesWhether GreyNoise has observed scanner activity from this IP
last_seenYesISO date when the IP was last observed
classificationYesClassification of the IP activity

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. Changed2 schema fields changed
    • addedInput schema / examples
      Added value: +[
+  {
+    "ip": "8.8.8.8"
+  },
+  {
+    "ip": "192.0.2.1"
+  }
+]
    • changedOutput schema / (root)
      Previous value: -nullNew value: +{
+  "properties": {
+    "classification": {
+      "description": "Classification of the IP activity",
+      "enum": [
+        "malicious",
+        "benign",
+        "unknown"
+      ],
+      "type": "string"
+    },
+    "ip": {
+      "description": "IPv4 address queried",
+      "type": "string"
+    },
+    "last_seen": {
+      "description": "ISO date when the IP was last observed",
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "link": {
+      "description": "Deep link to GreyNoise visualization page for this IP",
+      "type": "string"
+    },
+    "message": {
+      "description": "Additional message or explanation",
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "name": {
+      "description": "Name or organization associated with the IP",
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "noise": {
+      "description": "Whether the IP is classified as internet background noise",
+      "type": "boolean"
+    },
+    "observed": {
+      "description": "Whether GreyNoise has observed scanner activity from this IP",
+      "type": "boolean"
+    },
+    "riot": {
+      "description": "Whether the IP is a known good service (RIOT)",
+      "type": "boolean"
+    }
+  },
+  "required": [
+    "ip",
+    "observed",
+    "noise",
+    "riot",
+    "classification",
+    "name",
+    "last_seen",
+    "link",
+    "message"
+  ],
+  "type": "object"
+}
  2. First observed

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations indicate read-only, open-world, idempotent, non-destructive. The description adds value by specifying the data source (GreyNoise Community), authentication requirement (BYO API key), and return fields including a deep link. No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences: first states action, second lists return fields. Front-loaded and efficient. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple classification tool with an output schema, the description covers the key aspects: input, data source, authentication, and output fields. It is sufficiently complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Only one parameter 'ip' with schema description 'IPv4 address'. Description does not significantly add beyond schema; baseline score is appropriate given 100% schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it classifies an IPv4 address using the GreyNoise Community dataset and lists return fields. It distinguishes from sibling tools which focus on entities, research, or subscriptions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description mentions 'BYO API key' as a prerequisite but does not explicitly state when to use vs. alternatives. However, the purpose is clear enough that an agent would recognize it for IP reputation classification.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Greynoise toolsInspect
Try in Browser
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A3.7/5.0
Disambiguation2/5

ask_pipeworx and ask_pipeworx_beta are explicitly identical right now, creating a true duplicate entry point, and the prediction-market cluster (bet_research, polymarket_arbitrage, polymarket_edges, polymarket_kalshi_spread) all detect mispricings with heavily overlapping descriptions. The detailed docs help, but an agent choosing among these will frequently misselect.

Naming Consistency3/5

The set mixes verb-first names (ask_pipeworx, compare_entities, discover_tools, subscribe) with noun-first names (polymarket_edges, entity_profile, ip_context, recent_changes) and bare verbs (remember, forget) without a unifying convention. Subfamilies are internally consistent (polymarket_*, ask_pipeworx_*, subscribe/unsubscribe), which keeps it readable, but there is no predictable server-wide pattern.

Tool Count2/5

32 tools is well into the too-many band, and several tools duplicate or wrap others: ask_pipeworx_beta is a redundant copy of ask_pipeworx, scan_competitor_ai_presence wraps ai_visibility_check, and bet_research overlaps polymarket_edges/arbitrage. The broad scope justifies a large set, but it would be tighter and clearer around 20-24 tools.

Completeness4/5

For the domain the descriptions actually define (structured-data research, company intelligence, prediction markets, subscriptions, memory), coverage is strong with few dead ends: subscription and memory lifecycles are complete, and research has routing/grounded/deep modes. However, the server is named Greynoise while only ip_context serves that domain, and side tools like generate_llms_txt and scan_dependency sit outside any core workflow.

Resources