# Abuseipdb [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/pipeworx-io/mcp-abuseipdb  
**GitHub Stars:** 0  
**npm Downloads (last month):** 747  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/abuseipdb

## Description
AbuseIPDB MCP — wraps AbuseIPDB v2 API (api.abuseipdb.com/api/v2)

## Tools
Capabilities this server exposes over MCP:

- **check_ip** — Check an IP address against the AbuseIPDB database. Returns abuse confidence score (0-100), ISP, usage type, country, number of reports, and last reported date. Example: check_ip("8.8.8.8").
- **report_ip** — Report an abusive IP address to AbuseIPDB. Requires category IDs (e.g., "18,22" for DDoS + SSH brute force). Returns the updated abuse confidence score.
- **get_blacklist** — Get the AbuseIPDB blacklist of the most-reported IP addresses. Returns IPs with their abuse confidence scores. Useful for building blocklists.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "abuseipdb": {
    "command": "npx",
    "args": ["-y","@pipeworx/mcp-abuseipdb"]
  }
}
```

## Documentation

## What Abuseipdb does

Abuseipdb exposes AbuseIPDB’s community-maintained IP reputation data through the Model Context Protocol. AbuseIPDB assigns each address a confidence score from 0 to 100 using factors such as report volume, report age, and reporter trust. The data can help an agent assess suspicious addresses found in application, firewall, or authentication logs.

The supported workflows include checking an individual IP, retrieving blacklist data with filters such as activity type and reporting period, and submitting evidence about abusive activity. Abuse categories include DDoS attacks, brute force, port scans, web spam, hacking, SSH brute force, and other activities. A score of 75 or higher is described as a conservative automated-blocking threshold, while 25 or higher is more suitable for broad alerting and triage.

## How it works

A hosted MCP connection uses the Pipeworx endpoint at `https://gateway.pipeworx.io/abuseipdb/mcp`. The endpoint lists the AbuseIPDB pack’s tools and also includes shared Pipeworx meta-tools. The `ask_pipeworx` tool can route a natural-language request to an appropriate tool, including tools outside the AbuseIPDB pack.

The full Pipeworx endpoint, `https://gateway.pipeworx.io/mcp`, reaches the same catalog. The pack endpoint and full gateway differ in which tools are listed directly, not in the data sources reachable through gateway routing.

A local npm package, `@pipeworx/mcp-abuseipdb`, provides a stdio bridge that forwards MCP calls to the hosted endpoint. It requires network access and has no offline mode. Direct HTTP inspection is also available through Pipeworx’s tools API.

## Setup and configuration

For Claude Desktop, Cursor, Windsurf, or another MCP client that accepts remote servers, configure the hosted URL as an MCP server. A local setup can run the package with `npx -y @pipeworx/mcp-abuseipdb`.

AbuseIPDB requires an API key obtained from its account API page. Supply that credential to the AbuseIPDB operation as `_apiKey`. The npm bridge can additionally use `PIPEWORX_API_KEY` for a Pipeworx account; without it, the bridge permits up to 50 calls per day, while a free Pipeworx account raises that limit to 200 calls per day. Set `PIPEWORX_META_TOOLS=1` if the local bridge should list the shared gateway tools as well as the pack-specific tools.

## Tools and capabilities

- Check an IP’s reputation, confidence score, recent reports, and abuse categories.
- Retrieve blacklist entries filtered by criteria such as category and reporting window.
- Submit a report describing abusive activity from an IP address.
- Ask the Pipeworx gateway to select and call a relevant tool using plain language.
- Access the gateway through hosted MCP, local stdio, or HTTP tool endpoints.

## Limitations and notes

AbuseIPDB scores are reporter-weighted and should not be treated as direct proof that a particular user is malicious. Shared addresses, carrier-grade NAT, cloud exit points, and Tor nodes can accumulate reports affecting unrelated users. Historical activity also decays in relevance, and legitimate scanners may generate false positives.

The AbuseIPDB free tier is limited to 1,000 requests per day. The npm bridge applies separate Pipeworx usage limits, and all local calls require network access. The integration is independent and unofficial rather than affiliated with or endorsed by AbuseIPDB. It is released under the MIT license.

_Full upstream README: https://allmcps.com/mcp/abuseipdb/readme_