# Pulsedive [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/pipeworx-io/mcp-pulsedive  
**GitHub Stars:** 0  
**npm Downloads (last month):** 518  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/pulsedive

## Description
Pulsedive MCP — threat-intelligence IOC enrichment (pulsedive.com)

## Tools
Capabilities this server exposes over MCP:

- **pulsedive_indicator** — Is this IP/domain/URL/hash malicious — risk score + threats. Looks up an indicator of compromise (IOC) in Pulsedive and returns its risk level, contributing risk factors, associated threats, and intel feeds. Example: pulsedive_indicator({ indicator: "8.8.8.8", _apiKey: "your-key" })
- **pulsedive_explore** — Search Pulsedive threat DB with a query. Uses the Pulsedive Explore query language (boolean field filters) to find indicators matching criteria like type, risk, feed, or threat. Example: pulsedive_explore({ q: "type=domain and risk=high", limit: 20, _apiKey: "your-key" })

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "pulsedive": {
    "command": "npx",
    "args": ["-y","@pipeworx/mcp-pulsedive"]
  }
}
```

## Documentation

## What Pulsedive MCP server does

Pulsedive MCP server exposes Pulsedive threat-intelligence lookups to MCP-compatible clients through Pipeworx. The integration is an independent, unofficial connection and is not affiliated with, endorsed by, or published by Pulsedive.

The server focuses on indicator-of-compromise enrichment. It accepts IP addresses, domains, URLs, and hashes, then returns Pulsedive information such as an indicator's risk level, factors contributing to that assessment, related threats, and intelligence feeds. A separate search function queries the Pulsedive threat database using its Explore query language.

## How it works

The hosted MCP endpoint is `https://gateway.pipeworx.io/pulsedive/mcp`. A client can connect directly to that URL, or use the full Pipeworx gateway at `https://gateway.pipeworx.io/mcp`. The scoped endpoint lists the Pulsedive tools along with shared Pipeworx meta-tools. Those meta-tools can route broader questions across the gateway catalog through `ask_pipeworx`.

A local npm option runs as a stdio bridge. The client starts `@pipeworx/mcp-pulsedive` with `npx`, and the bridge forwards requests to the same hosted endpoint. Both modes require network access; the npm bridge has no offline mode.

## Setup and configuration

For a hosted connection, add the Pulsedive endpoint to an MCP client configuration:

```json
{
  "mcpServers": {
    "pulsedive": {
      "url": "https://gateway.pipeworx.io/pulsedive/mcp"
    }
  }
}
```

The npm configuration uses:

```json
{
  "mcpServers": {
    "pulsedive": {
      "command": "npx",
      "args": ["-y", "@pipeworx/mcp-pulsedive"]
    }
  }
}
```

A key is optional for anonymous use. Anonymous access is limited to 50 calls per day. A free Pipeworx account raises that allowance to 200 calls per day; configure its key as `PIPEWORX_API_KEY`. The key is sent as a Bearer token, and calls are metered and billed in the same way as hosted connections.

Set `PIPEWORX_META_TOOLS=1` if the local bridge should also list shared gateway tools such as `ask_pipeworx`. Without that setting, it lists the Pulsedive pack's tools by default.

## Tools and capabilities

- `pulsedive_indicator` checks an IP, domain, URL, or hash and returns its Pulsedive risk level, contributing risk factors, associated threats, and intelligence feeds.
- `pulsedive_explore` searches the Pulsedive threat database with Explore boolean field filters. Queries can target fields including indicator type, risk, feed, and threat, and the tool accepts a result limit.
- `ask_pipeworx` can be used through the gateway to ask questions in plain language; the gateway selects a tool and fills its arguments.

## Limitations and notes

The dedicated pack endpoint also exposes shared Pipeworx meta-tools, so its complete tool list is larger than the two Pulsedive-specific tools. Its `initialize` response defines the exact scope at connection time. The integration requires network access and a Pulsedive-compatible call path; the HTTP tool API also requires an API key for calls that cannot run anonymously. Behind an HTTPS proxy, Node's built-in `fetch` does not read `HTTPS_PROXY` by default; newer Node releases can honor it when `NODE_USE_ENV_PROXY=1` is set.

_Full upstream README: https://allmcps.com/mcp/pulsedive/readme_