# Greynoise [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/pipeworx-io/mcp-greynoise  
**GitHub Stars:** 0  
**npm Downloads (last month):** 464  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/greynoise-2

## Description
GreyNoise Community MCP — internet scanner classification (free tier with key)

## Tools
Capabilities this server exposes over MCP:

- **ip_context** — Classify an IPv4 address using the GreyNoise Community dataset (BYO API key). Returns: noise (mass internet scanner?), riot (known-good service like Google/AWS?), classification (malicious|benign|unknown), entity name, last-seen date, and a viz.greynoise.io deep link for SOC triage.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "greynoise": {
    "command": "npx",
    "args": ["-y","@pipeworx/mcp-greynoise"],
    "env": {
      "PLATFORM_GREYNOISE_KEY": "",
      "PIPEWORX_API_KEY": "",
      "PIPEWORX_META_TOOLS": "",
      "NODE_USE_ENV_PROXY": ""
    }
  }
}
```

**Requires environment variables:** `PLATFORM_GREYNOISE_KEY`, `PIPEWORX_API_KEY`, `PIPEWORX_META_TOOLS`, `NODE_USE_ENV_PROXY` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What Greynoise does

Greynoise exposes GreyNoise Community IP intelligence to MCP-compatible clients. The primary `ip_context` tool accepts an IP address and returns its noise or RIOT classification, associated name, and last-seen information. This makes the integration suitable for agent workflows that need to assess whether an address is associated with internet scanning activity.

The integration is published as an independent, unofficial connection rather than by GreyNoise. It reaches the GreyNoise Community API through Pipeworx rather than connecting an agent directly to the upstream service.

## How it works

The hosted MCP endpoint is `https://gateway.pipeworx.io/greynoise/mcp`. Add that URL to an MCP client to expose the Greynoise pack. The endpoint also lists shared Pipeworx gateway tools, including tools such as `ask_pipeworx`, `discover_tools`, `search_within`, `remember`, and `recall`. These shared tools are included alongside the pack-specific tool, so the tool list can be larger than the Greynoise capability alone.

A full Pipeworx gateway connection is also available at `https://gateway.pipeworx.io/mcp`. Both endpoints use the same gateway and data sources; the scoped endpoint lists Greynoise tools directly, while the full endpoint lists all packs directly. The `ask_pipeworx` tool can route plain-language questions to an appropriate tool from either connection.

For clients without MCP support, the gateway provides HTTP access. An IP lookup can be sent as a JSON POST to `https://gateway.pipeworx.io/v1/tools/ip_context`.

## Setup and configuration

For a hosted MCP connection, add the following server entry:

```json
{
  "mcpServers": {
    "greynoise": {
      "url": "https://gateway.pipeworx.io/greynoise/mcp"
    }
  }
}
```

The local npm package, `@pipeworx/mcp-greynoise`, runs as a stdio bridge and forwards calls to the same hosted endpoint. Configure it with `npx`:

```json
{
  "mcpServers": {
    "greynoise": {
      "command": "npx",
      "args": ["-y", "@pipeworx/mcp-greynoise"]
    }
  }
}
```

The local bridge requires network access and has no offline mode. Anonymous use is capped at 50 calls per day. A Pipeworx account key raises the limit to 200 calls per day; pass it as `PIPEWORX_API_KEY`. The gateway platform key is configured with `PLATFORM_GREYNOISE_KEY`. A GreyNoise key can instead be supplied through the gateway URL with the `?_apiKey=<key>` parameter after registering at GreyNoise Viz.

## Tools and capabilities

- `ip_context(ip)`: retrieves GreyNoise Community context for an IP address, including noise or RIOT classification, name, and last-seen information.
- `ask_pipeworx`: accepts a plain-language question and lets the gateway select and populate a suitable tool.
- `discover_tools`, `search_within`, `remember`, and `recall`: shared Pipeworx gateway tools available on hosted pack connections.
- HTTP invocation through `/v1/tools/ip_context` for callers that do not use an MCP client.

The local bridge lists the Greynoise pack tools by default. Set `PIPEWORX_META_TOOLS=1` to include the shared gateway tools as well.

## Limitations and notes

Greynoise depends on the Pipeworx gateway and GreyNoise Community API, so local use requires outbound network access. The local bridge does not provide offline operation. Anonymous calls have a daily limit of 50, while a free Pipeworx account increases that allowance to 200 calls per day.

The gateway’s scoped endpoint includes shared meta-tools by design. If those additional tool schemas consume more context than desired, connecting once to the full gateway avoids adding several separate pack endpoints. When using an HTTPS proxy with the local npm bridge, Node’s built-in `fetch` does not read `HTTPS_PROXY` by default; newer Node versions can honor it when `NODE_USE_ENV_PROXY=1` is set.

Greynoise is licensed under MIT.

_Full upstream README: https://allmcps.com/mcp/greynoise-2/readme_