Log inSubmit server
Abuseipdb logo

Abuseipdb

Checks IP reputation, retrieves filtered abuse data, and submits reports through AbuseIPDB’s v2 API over MCP.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Abuseipdb

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "abuseipdb": {
      "command": "npx",
      "args": [
        "-y",
        "@pipeworx/mcp-abuseipdb"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Automated check passed— started and listed 3 tools correctly (4d ago).

Overview

Abuseipdb connects MCP clients to the AbuseIPDB v2 API for IP reputation and threat-intelligence workflows. It supports IP checks, filtered blacklist retrieval, and abuse-report submission, with AbuseIPDB credentials supplied through the `_apiKey` argument. The service is available through a hosted Pipeworx endpoint or an npm stdio bridge, making it suitable for investigating suspicious log addresses, triaging traffic, and building blocklists. AbuseIPDB’s free API tier allows 1,000 requests per day, while the npm bridge has separate anonymous and Pipeworx-account limits.

Use cases

  • Investigate suspicious IPs found in security logs
  • Retrieve recent blacklist entries for DDoS sources
  • Filter reputation results by abuse category
  • Submit evidence about malicious IP activity
  • Triage inbound traffic using reputation scores

Key features

  • IP reputation checks
  • Filtered blacklist retrieval
  • Abuse report submission
  • Abuse category and confidence-score data
  • Hosted MCP and local stdio access
  • Natural-language routing through Pipeworx

Tools3

What Abuseipdb lets your agent do. Expand a tool for its parameters.

Verified live~484 tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 2d ago

Recent health check succeeded.

11/11 checks healthy over the last 61d

What it can do

From the 3 tools this server returned when we ran it; 3 declare their own safety hints.

Handles credentials · 1Makes network requests · 3Read-only tools · 3
Network at startup5 connections
Files written at startupNone
Install scriptsNone
npm provenanceSigned build
Package age130 days
Maintainers1

Observed 2026-11-03 in an isolated sandbox. A description of reach, not a security audit.

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 15d ago via OSV.dev · @pipeworx/mcp-abuseipdb (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

npm downloads747Package downloads in the last 30 days.
Last commit9d agoMost recent push to the default branch.
Availability100%Our rolling endpoint + install checks that succeeded.
Install checkPassedOur sandbox started it and listed its tools.
Tools exposed3Callable tools this server registers over MCP.

How Abuseipdb works

What Abuseipdb does

Abuseipdb exposes AbuseIPDB’s community-maintained IP reputation data through the Model Context Protocol. AbuseIPDB assigns each address a confidence score from 0 to 100 using factors such as report volume, report age, and reporter trust. The data can help an agent assess suspicious addresses found in application, firewall, or authentication logs.

The supported workflows include checking an individual IP, retrieving blacklist data with filters such as activity type and reporting period, and submitting evidence about abusive activity. Abuse categories include DDoS attacks, brute force, port scans, web spam, hacking, SSH brute force, and other activities. A score of 75 or higher is described as a conservative automated-blocking threshold, while 25 or higher is more suitable for broad alerting and triage.

How it works

A hosted MCP connection uses the Pipeworx endpoint at https://gateway.pipeworx.io/abuseipdb/mcp. The endpoint lists the AbuseIPDB pack’s tools and also includes shared Pipeworx meta-tools. The ask_pipeworx tool can route a natural-language request to an appropriate tool, including tools outside the AbuseIPDB pack.

The full Pipeworx endpoint, https://gateway.pipeworx.io/mcp, reaches the same catalog. The pack endpoint and full gateway differ in which tools are listed directly, not in the data sources reachable through gateway routing.

A local npm package, @pipeworx/mcp-abuseipdb, provides a stdio bridge that forwards MCP calls to the hosted endpoint. It requires network access and has no offline mode. Direct HTTP inspection is also available through Pipeworx’s tools API.

Setup and configuration

For Claude Desktop, Cursor, Windsurf, or another MCP client that accepts remote servers, configure the hosted URL as an MCP server. A local setup can run the package with npx -y @pipeworx/mcp-abuseipdb.

AbuseIPDB requires an API key obtained from its account API page. Supply that credential to the AbuseIPDB operation as _apiKey. The npm bridge can additionally use PIPEWORX_API_KEY for a Pipeworx account; without it, the bridge permits up to 50 calls per day, while a free Pipeworx account raises that limit to 200 calls per day. Set PIPEWORX_META_TOOLS=1 if the local bridge should list the shared gateway tools as well as the pack-specific tools.

Tools and capabilities

  • Check an IP’s reputation, confidence score, recent reports, and abuse categories.
  • Retrieve blacklist entries filtered by criteria such as category and reporting window.
  • Submit a report describing abusive activity from an IP address.
  • Ask the Pipeworx gateway to select and call a relevant tool using plain language.
  • Access the gateway through hosted MCP, local stdio, or HTTP tool endpoints.

Limitations and notes

AbuseIPDB scores are reporter-weighted and should not be treated as direct proof that a particular user is malicious. Shared addresses, carrier-grade NAT, cloud exit points, and Tor nodes can accumulate reports affecting unrelated users. Historical activity also decays in relevance, and legitimate scanners may generate false positives.

The AbuseIPDB free tier is limited to 1,000 requests per day. The npm bridge applies separate Pipeworx usage limits, and all local calls require network access. The integration is independent and unofficial rather than affiliated with or endorsed by AbuseIPDB. It is released under the MIT license.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Abuseipdb

Abuseipdb is an MCP server that connects AI agents to the AbuseIPDB v2 API. Its main tools check IP reputation, retrieve filtered blacklist data, and submit abuse reports. It can be used through a hosted Pipeworx MCP endpoint or a local npm stdio bridge, with an AbuseIPDB API key passed as `_apiKey`.

Install it locally by configuring your MCP client to run `npx -y @pipeworx/mcp-abuseipdb`. The package forwards calls to the hosted Pipeworx endpoint and needs network access. Alternatively, configure the remote URL `https://gateway.pipeworx.io/abuseipdb/mcp` directly in an MCP client.

Authenticate AbuseIPDB operations by passing an API key through the `_apiKey` argument. Create the key from the AbuseIPDB account API page. The local npm bridge can separately use `PIPEWORX_API_KEY` for Pipeworx authentication and metering.

Yes, Abuseipdb works with Cursor through the hosted MCP endpoint. Add `https://gateway.pipeworx.io/abuseipdb/mcp` as an MCP server in the client configuration, or run the npm stdio bridge with `npx`.

The AbuseIPDB free tier allows 1,000 requests per day. The local Pipeworx bridge allows up to 50 calls per day without a Pipeworx key and up to 200 calls per day with a free Pipeworx account. These limits are separate.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewAbuseipdb AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/abuseipdb?style=directory)](https://allmcps.com/mcp/abuseipdb)
HTML Embed
<a href="https://allmcps.com/mcp/abuseipdb"><img src="https://allmcps.com/api/badge/abuseipdb?style=directory" alt="Abuseipdb on AllMCPs" /></a>