How do I use mcp-abuseipdb?

1. Click on "Install Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@mcp-abuseipdb Check IP 8.8.8.8 for abuse reports" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

mcp-abuseipdb

by abe-source

Overview Schema Related Servers Score Discussions

TypeScript

Remote

An MCP server that exposes AbuseIPDB threat intelligence as tools — ask Claude (or any MCP client) whether an IP, subnet, or set of reports looks malicious, and get real data back instead of a guess.

Tools

Tool	What it does
`check_ip`	Check a single IP — abuse confidence score, ISP, country, usage type, report count, optionally the last 10 individual reports
`check_block`	Check a CIDR network block (up to `/16`) — network range info plus a per-IP breakdown of any reported addresses inside it
`get_reports`	Get the individual abuse reports filed against an IP — who reported it, why, and when, paginated
`get_blacklist`	Get the most-reported IPs overall. Free tier is capped at confidence 100 regardless of what you ask for; paid tiers can widen the range

Related MCP server: FastMCP ThreatIntel

Prerequisites

Node.js 18+
A free AbuseIPDB API key (free tier: 1,000 checks/day, 5 blacklist calls/day)

Installation

Quick install

The package is published on npm, so these register it in one step — no cloning or building required:

Claude Code:

claude mcp add abuseipdb -e ABUSEIPDB_API_KEY=your-api-key-here -- npx -y mcp-abuseipdb

Codex CLI:

codex mcp add abuseipdb --env ABUSEIPDB_API_KEY=your-api-key-here -- npx -y mcp-abuseipdb

Manual config (any stdio MCP client)

Most clients that support stdio MCP servers (Claude Desktop, Cursor, Windsurf, etc.) use this same config shape — add it to whichever config file your client expects:

{
  "mcpServers": {
    "abuseipdb": {
      "command": "node",
      "args": ["/absolute/path/to/mcp-abuseipdb/dist/index.js"],
      "env": {
        "ABUSEIPDB_API_KEY": "your-api-key-here"
      }
    }
  }
}

Restart your client, then try asking:

"Has 8.8.8.8 been reported for anything?"
"Check my office subnet 203.0.113.0/24 for abuse reports"
"What are the most reported IPs right now?"

How it works

MCP client (Claude, Inspector, ...)
        │  stdio, JSON-RPC
        ▼
  McpServer (src/server.ts)
        │
        ▼
  tools/*.ts     — one file per tool: Zod schema + handler, formats the reply
        │
        ▼
  endpoints/*.ts — one file per AbuseIPDB endpoint: typed request + response
        │
        ▼
  abuseipdbClient.ts — auth header, response envelope, AbuseIPDB error parsing
        │
        ▼
  client.ts      — generic fetch wrapper, timeout, HTTP error handling
        │
        ▼
  AbuseIPDB REST API

Each layer knows nothing about the one above it. client.ts doesn't know AbuseIPDB exists; endpoints/ doesn't know MCP exists. Adding a new tool means one new file in endpoints/, one new file in tools/, one line in tools/index.ts — nothing else changes.

Tool arguments are validated with Zod before any handler runs — a malformed request never reaches the API.

Development

git clone https://github.com/abe-source/mcp-abuseipdb.git
cd mcp-abuseipdb
npm install
npm run build   # compile TypeScript
npm run lint     # check formatting + lint rules
npm run check    # lint + format + fix, in place

Test locally with the MCP Inspector:

npx @modelcontextprotocol/inspector --cli node --env-file=.env dist/index.js --method tools/call --tool-name check_ip --tool-arg ip=8.8.8.8

License

MIT

Available Tools

4 tools

check_blockA

Check a CIDR network block (e.g. a /24 subnet) for reported IPs — returns network range info plus a per-IP breakdown of any reported addresses within it. Use check_ip instead for a single IP address.

ParametersJSON Schema

Name	Required	Description	Default
`network`	Yes	CIDR network to check, e.g. 192.168.1.0/24. Maximum range is /16 — wider blocks are rejected by the API.
`max_age_in_days`	No	Only include reports from the last N days (default: 30)

TDQS

A4.2/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden of behavioral disclosure. It mentions the return payload (network range info plus per-IP breakdown), implying a read-only operation, but does not explicitly state side effects, rate limits, or error behavior. The term 'check' suggests safety, but more detail would be helpful.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences long and front-loaded with the core purpose. Every sentence adds value: the first defines the action and output, the second provides a cross-reference to a sibling tool. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description gives a sufficient high-level summary of return values, which is important because there is no output schema. It does not cover edge cases like maximum range or error handling, but those are partly addressed in the schema. For a relatively simple check tool, the description is reasonably complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, and both parameters are already well-described in the schema (e.g., network format and max_age_in_days). The tool description adds no additional parameter semantics beyond what the schema provides, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool checks a CIDR network block and returns network range info plus per-IP breakdown of reported addresses. It explicitly differentiates from the sibling check_ip tool by noting to use check_ip for a single IP address, making the purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit usage guidance by stating 'Use check_ip instead for a single IP address,' which clarifies the primary distinction between the two tools. It implies the tool is for checking CIDR blocks, giving clear context for when to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

check_ipB

Check if an IP address has been reported for abusive behavior. Returns abuse confidence score (0-100), ISP, country, usage type, and report count.

ParametersJSON Schema

Name	Required	Description
`ip`	Yes	IPv4 or IPv6 address to check
`verbose`	No	Include the last 10 individual abuse reports (default: false)
`max_age_in_days`	No	Only include reports from the last N days (1-365, default: 90)

TDQS

B3.2/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must fully disclose behavior. It lists return values but does not state that this is a read-only operation, any rate limits, error behavior, or authentication requirements.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the primary purpose, and lists key return fields without unnecessary detail. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only IP check with no output schema, the description adequately explains the purpose and return values. However, it could be more complete by mentioning what happens when the IP is not found or how verbose/max_age affect results, but the schema provides defaults.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all three parameters with types and defaults. The description adds no additional parameter semantics beyond what is already in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb ('Check') and resource ('IP address') and specifies what it returns (abuse confidence score, ISP, country, usage type, report count). However, it does not explicitly differentiate from sibling tools like check_block or get_reports.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides no explicit guidance on when to use this tool vs alternatives. The only implied context is checking an IP for abuse, but there are no exclusions or alternative recommendations, even though similar sibling tools exist.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_blacklistA

Get the most reported IP addresses. Free tier only returns confidence 100 results regardless of confidence_minimum; paid tiers can widen the range.

ParametersJSON Schema

Name	Required	Description	Default
`limit`	No	Number of IPs to return (default: 25, max: 10000)
`confidence_minimum`	No	Minimum abuse confidence score, 0-100 (default: 100). Free tier ignores this and always returns 100 only.

TDQS

A4/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, so the description must disclose behavior. It usefully explains that free tier ignores confidence_minimum and always returns confidence 100 results. However, it omits details on ordering, pagination, or authentication, which are relevant for a read operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two compact sentences, front-loaded with the core purpose and a key caveat. Every word earns its place; no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (two optional params, no output schema), the description covers the main purpose and the critical tier constraint. Minor gaps like return ordering are not significant enough to warrant a lower score.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema descriptions fully cover both parameters, but the description adds critical semantics not in the schema: paid vs. free tier behavior regarding confidence_minimum. This goes beyond the structured parameter docs, enhancing understanding.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Get') and resource ('most reported IP addresses'), clearly distinguishing this from siblings like check_ip and check_block which target individual IPs. The 'blacklist' aspect is implicit but unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description states the tool fetches top reported IPs and highlights a tier-based limitation, but it does not explicitly contrast with alternatives like get_reports or check_ip. Usage context is clear but no direct 'when to use' guidance is given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_reportsA

Get the individual abuse reports filed against an IP address — who reported it, why, and when.

ParametersJSON Schema

Name	Required	Description
`ip`	Yes	IPv4 or IPv6 address to get reports for
`page`	No	Page number for pagination (default: 1)
`per_page`	No	Reports per page (default: 25)
`max_age_in_days`	No	Only include reports from the last N days (1-365, default: 30)

TDQS

A3.7/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full responsibility for disclosing behavior. It indicates a read operation and describes the returned data, but does not mention pagination behavior, default filters, or any rate parameters. This is a moderate level of transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence that front-loads the primary action and resource, and includes a clarifying detail about the report contents. It is appropriately sized with no wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no output schema and no annotations, this description explains the core purpose and return content, but lacks details about response structure, pagination defaults, and how it fits with sibling tools. It is adequate but not fully complete for an agent to invoke it confidently without more context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema descriptions cover all parameters (100% coverage), so the baseline is 3. The description does not add any parameter-specific meaning beyond what the schema already provides, though it does hint at the 'when' aspect via reports being filed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool retrieves individual abuse reports for an IP address, naming the specific content (who, why, when). This distinguishes it from sibling tools like check_ip or get_blacklist, which focus on other aspects.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool is used when abuse reports are needed, but does not explicitly state when to use it over alternatives or mention any exclusions. No explicit comparisons to sibling tools are made, leaving usage guidance only implicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

4 tool updatesv1.0.0Aug 11, 2026
- First observedcheck_block
- First observedcheck_ip
- First observedget_blacklist
- First observedget_reports

Install Server

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

TDQS

A4/5.0

Disambiguation5/5

Each tool targets a distinct abuse-related lookup: single IP, CIDR block, detailed reports, and top offenders. There is no overlap in purpose; even check_ip and get_reports complement rather than duplicate, since one gives a confidence score and the other gives specific incident details.

Naming Consistency5/5

All tool names follow a consistent verb_noun pattern with imperative verbs: get_reports, check_ip, get_blacklist, check_block. The two verbs (get/check) are used predictably based on whether the action retrieves a list or evaluates a specific target.

Tool Count5/5

Four tools is well-scoped for an IP abuse lookup service, covering the core operations an agent would need: single IP check, network block check, report details, and blacklist retrieval. Each tool earns its place without redundancy or bloat.

Completeness5/5

The tool surface fully covers the read-only domain of IP abuse checking. There are no obvious missing operations for the stated purpose; the four tools provide both summary and detailed views across individual IPs and network ranges.

Maintenance

ActivitySlowing

ResponsivenessSyncing

Resources

Need Help?

Related Servers

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Abuseipdb A
io.github.pipeworx-io
AbuseIPDB MCP — wraps AbuseIPDB v2 API (api.abuseipdb.com/api/v2)
Security Networking & Infrastructure
342
HackMyIP — no-key IP intelligence A
io.github.0xvibly
Free no-key IP intelligence: geolocation, VPN detection, DNS, WHOIS, blacklists, breach checks
Networking & Infrastructure Security
151
Scry A
ai.tunnelmind
Free IPv4 lookups against a distributed attacker-observation corpus.
Security Monitoring
122
Have I Been Pwned A
io.github.troyhunt
Breach intelligence API: email search, domain monitoring, passwords and stealer logs.
Security Search Monitoring
172

Related MCP Servers

AbuseIPDB MCP Server
Security
n3r0-b1n4ry
A
license
Not graded
quality
C
maintenance
Integrates with the AbuseIPDB API to check IP addresses for abuse reports and report abusive IP addresses.
Updated 2 months ago (2026-06-26 06:19 UTC)
2
MIT
FastMCP ThreatIntel
Security Search Monitoring
4R9UN
A
license
Not graded
quality
C
maintenance
Enables AI-powered threat intelligence analysis of IPs, domains, URLs, and file hashes across multiple threat intelligence platforms (VirusTotal, AlienVault OTX, AbuseIPDB, IPinfo) with APT attribution and interactive reporting through natural language queries.
Updated a year ago (2025-07-18 09:56 UTC)
40
Apache 2.0
MCP AbuseIPDB Server
Security Search Monitoring
alephnan
A
license
A
quality
D
maintenance
Provides threat intelligence lookups against the AbuseIPDB database, enabling IP reputation checks, CIDR block analysis, and log enrichment. It features intelligent caching and rate limiting to efficiently manage API usage for security analysis and automated workflows.
Updated 5 months ago (2026-04-09 04:29 UTC)
5
MIT
mcp-abuseipdb
Security Monitoring
nickjlucker
A
license
Not graded
quality
D
maintenance
Enables AI agents to check IP reputation and abuse reports via AbuseIPDB, including abuse confidence scores, report details, and bulk IP triage.
Updated 6 months ago (2026-02-28 08:41 UTC)
20
1
MIT

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/abe-source/mcp-abuseipdb'

If you have feedback or need assistance with the MCP directory API, please join our Discord server