Feodotracker

What Feodotracker MCP server does

Feodotracker brings the abuse.ch Feodo Tracker IP blocklist into MCP-compatible agent workflows. The underlying data tracks botnet command-and-control infrastructure associated with malware families such as Dridex, Emotet, Qakbot, Heodo, and TrickBot.

Its main use is indicator lookup. An agent can retrieve the current blocklist, narrow results by malware family or status, test whether a specific IP address is listed, inspect entries first observed within a recent time window, or request a broader aggressive list that also includes older and lower-confidence addresses.

The integration is an independent Pipeworx connection to Feodo Tracker and is not presented as an official abuse.ch publication.

How it works

The hosted MCP endpoint is available at https://gateway.pipeworx.io/feodotracker/mcp. A client connects over the endpoint and can invoke the Feodotracker tools directly. The gateway obtains data from https://feodotracker.abuse.ch/downloads/ipblocklist.json and caches it for 15 minutes.

The four domain-specific tools are:

• list(family?, status?) returns the current C&C IP blocklist, with optional family and status filters.
• check_ip(ip) checks whether an address currently appears in the botnet C&C list.
• recent(hours?) returns entries first seen during the specified recent period.
• aggressive() returns the expanded blocklist, including older and lower-confidence indicators.

A scoped endpoint also exposes shared Pipeworx meta-tools. These include routing and discovery functions such as ask_pipeworx, which can select an appropriate tool when a question is phrased in natural language. The full Pipeworx gateway is another connection option and exposes the wider catalog directly.

Setup and configuration

For a hosted MCP connection, add the endpoint to a client such as Claude Desktop, Cursor, or Windsurf:

{
  "mcpServers": {
    "feodotracker": {
      "url": "https://gateway.pipeworx.io/feodotracker/mcp"
    }
  }
}

The npm package, @pipeworx/mcp-feodotracker, provides a local stdio bridge that forwards requests to the same hosted endpoint. Configure a client to launch it with npx -y @pipeworx/mcp-feodotracker. This mode requires network access and has no offline operation.

Anonymous use is capped at 50 calls per day. A free Pipeworx account increases the allowance to 200 calls per day; its key is supplied through PIPEWORX_API_KEY and sent as a Bearer token. Set PIPEWORX_META_TOOLS=1 when the local bridge should also advertise the shared gateway tools.

Without an MCP client, the gateway exposes HTTP tool calls under /v1/tools, including feodotracker_list.

Tools and capabilities

Feodotracker supports current-list retrieval, IP reputation checks, time-based filtering, family and status filtering, and expanded indicator retrieval. The ask_pipeworx route can translate a natural-language question into a tool call and populate its arguments.

The data source is focused on IP-based C&C indicators. Results depend on the upstream Feodo Tracker feed and the gateway's 15-minute cache interval.

Limitations and notes

The integration needs network access in both hosted and npm-bridge modes. The npm bridge is not an offline copy of the blocklist. Anonymous calls have a daily limit, while keyed calls are metered through Pipeworx. Scoped endpoints include shared gateway meta-tools alongside the pack tools, so the advertised tool count can exceed the four Feodotracker-specific functions.