Greynoise README
The full upstream README, mirrored here for reference. Install config, tool schemas, adoption signals, and an original overview live on the Greynoise listing page.
mcp-greynoise
MCP server for the GreyNoise API — check if IP addresses are internet background noise or potentially targeted attacks.
Quick Start
That's it. Works out of the box with 10 lookups/day (no API key needed).
What is GreyNoise?
GreyNoise collects and analyzes internet-wide scan traffic. It tells you:
- Noise: Is this IP mass-scanning the internet? (botnets, researchers, crawlers)
- RIOT: Is this IP a known benign service? (Google, Cloudflare, Microsoft, etc.)
- Classification: Malicious, benign, or unknown
Why this matters for security
When you see suspicious traffic in your logs:
| GreyNoise Result | Interpretation |
|---|---|
| NOISE + Malicious | Background attack traffic (scanners, botnets) — likely untargeted |
| NOISE + Benign | Security researchers, search crawlers — usually safe |
| RIOT | Known good service (CDN, DNS, cloud) — almost certainly benign |
| NOT NOISE | ⚠️ This IP is NOT mass-scanning — traffic may be targeted at you |
The "NOT NOISE" case is often the most important — it suggests someone is specifically interested in your systems.
Demo
Example output from check_ip:
Installation
npm (recommended)
npx (no install)
From source
Configuration
Claude Desktop
Add to your claude_desktop_config.json:
macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json
Environment Variables
| Variable | Required | Description |
|---|---|---|
GREYNOISE_API_KEY | No | API key for higher rate limits (50/day vs 10/day) |
Get a free API key at viz.greynoise.io/signup.
⚠️ Never commit API keys. See
.env.examplefor the recommended setup.
Tools
check_ip
Check a single IP address against GreyNoise.
Input:
ip(string): IPv4 address to check
check_ips
Check multiple IP addresses in one call (max 10).
Input:
ips(string[]): Array of IPv4 addresses
Example output:
Resources
greynoise://status
Returns API status and rate limit information.
Rate Limits
| Tier | Daily Lookups |
|---|---|
| Unauthenticated | 10 |
| Free account | 50 |
| Paid plans | Higher |
Rate limits are shared between API calls and the GreyNoise Visualizer.
Security
This server:
- Only reads from the GreyNoise API (no scanning, no exploitation)
- Does not store any data beyond the current request
- Does not transmit your API key anywhere except to GreyNoise
- Performs reputation/telemetry enrichment only
Your API key is passed via environment variable and never logged.
Use Cases
- SOC Triage: Quickly determine if alert IPs are background noise or targeted
- Incident Response: Identify if attacker IPs are mass-scanners or focused threats
- Threat Hunting: Find IPs in your logs that aren't mass-scanners (potentially targeted)
- Log Analysis: Reduce false positives by filtering out known scanners
Development
License
MIT