Greynoise

What Greynoise does

Greynoise exposes GreyNoise Community IP intelligence to MCP-compatible clients. The primary ip_context tool accepts an IP address and returns its noise or RIOT classification, associated name, and last-seen information. This makes the integration suitable for agent workflows that need to assess whether an address is associated with internet scanning activity.

The integration is published as an independent, unofficial connection rather than by GreyNoise. It reaches the GreyNoise Community API through Pipeworx rather than connecting an agent directly to the upstream service.

How it works

The hosted MCP endpoint is https://gateway.pipeworx.io/greynoise/mcp. Add that URL to an MCP client to expose the Greynoise pack. The endpoint also lists shared Pipeworx gateway tools, including tools such as ask_pipeworx, discover_tools, search_within, remember, and recall. These shared tools are included alongside the pack-specific tool, so the tool list can be larger than the Greynoise capability alone.

A full Pipeworx gateway connection is also available at https://gateway.pipeworx.io/mcp. Both endpoints use the same gateway and data sources; the scoped endpoint lists Greynoise tools directly, while the full endpoint lists all packs directly. The ask_pipeworx tool can route plain-language questions to an appropriate tool from either connection.

For clients without MCP support, the gateway provides HTTP access. An IP lookup can be sent as a JSON POST to https://gateway.pipeworx.io/v1/tools/ip_context.

Setup and configuration

For a hosted MCP connection, add the following server entry:

{
  "mcpServers": {
    "greynoise": {
      "url": "https://gateway.pipeworx.io/greynoise/mcp"
    }
  }
}

The local npm package, @pipeworx/mcp-greynoise, runs as a stdio bridge and forwards calls to the same hosted endpoint. Configure it with npx:

{
  "mcpServers": {
    "greynoise": {
      "command": "npx",
      "args": ["-y", "@pipeworx/mcp-greynoise"]
    }
  }
}

The local bridge requires network access and has no offline mode. Anonymous use is capped at 50 calls per day. A Pipeworx account key raises the limit to 200 calls per day; pass it as PIPEWORX_API_KEY. The gateway platform key is configured with PLATFORM_GREYNOISE_KEY. A GreyNoise key can instead be supplied through the gateway URL with the ?_apiKey=<key> parameter after registering at GreyNoise Viz.

Tools and capabilities

• ip_context(ip): retrieves GreyNoise Community context for an IP address, including noise or RIOT classification, name, and last-seen information.
• ask_pipeworx: accepts a plain-language question and lets the gateway select and populate a suitable tool.
• discover_tools, search_within, remember, and recall: shared Pipeworx gateway tools available on hosted pack connections.
• HTTP invocation through /v1/tools/ip_context for callers that do not use an MCP client.

The local bridge lists the Greynoise pack tools by default. Set PIPEWORX_META_TOOLS=1 to include the shared gateway tools as well.

Limitations and notes

Greynoise depends on the Pipeworx gateway and GreyNoise Community API, so local use requires outbound network access. The local bridge does not provide offline operation. Anonymous calls have a daily limit of 50, while a free Pipeworx account increases that allowance to 200 calls per day.

The gateway’s scoped endpoint includes shared meta-tools by design. If those additional tool schemas consume more context than desired, connecting once to the full gateway avoids adding several separate pack endpoints. When using an HTTPS proxy with the local npm bridge, Node’s built-in fetch does not read HTTPS_PROXY by default; newer Node versions can honor it when NODE_USE_ENV_PROXY=1 is set.

Greynoise is licensed under MIT.