Pulsedive

What Pulsedive MCP server does

Pulsedive MCP server exposes Pulsedive threat-intelligence lookups to MCP-compatible clients through Pipeworx. The integration is an independent, unofficial connection and is not affiliated with, endorsed by, or published by Pulsedive.

The server focuses on indicator-of-compromise enrichment. It accepts IP addresses, domains, URLs, and hashes, then returns Pulsedive information such as an indicator's risk level, factors contributing to that assessment, related threats, and intelligence feeds. A separate search function queries the Pulsedive threat database using its Explore query language.

How it works

The hosted MCP endpoint is https://gateway.pipeworx.io/pulsedive/mcp. A client can connect directly to that URL, or use the full Pipeworx gateway at https://gateway.pipeworx.io/mcp. The scoped endpoint lists the Pulsedive tools along with shared Pipeworx meta-tools. Those meta-tools can route broader questions across the gateway catalog through ask_pipeworx.

A local npm option runs as a stdio bridge. The client starts @pipeworx/mcp-pulsedive with npx, and the bridge forwards requests to the same hosted endpoint. Both modes require network access; the npm bridge has no offline mode.

Setup and configuration

For a hosted connection, add the Pulsedive endpoint to an MCP client configuration:

{
  "mcpServers": {
    "pulsedive": {
      "url": "https://gateway.pipeworx.io/pulsedive/mcp"
    }
  }
}

The npm configuration uses:

{
  "mcpServers": {
    "pulsedive": {
      "command": "npx",
      "args": ["-y", "@pipeworx/mcp-pulsedive"]
    }
  }
}

A key is optional for anonymous use. Anonymous access is limited to 50 calls per day. A free Pipeworx account raises that allowance to 200 calls per day; configure its key as PIPEWORX_API_KEY. The key is sent as a Bearer token, and calls are metered and billed in the same way as hosted connections.

Set PIPEWORX_META_TOOLS=1 if the local bridge should also list shared gateway tools such as ask_pipeworx. Without that setting, it lists the Pulsedive pack's tools by default.

Tools and capabilities

• pulsedive_indicator checks an IP, domain, URL, or hash and returns its Pulsedive risk level, contributing risk factors, associated threats, and intelligence feeds.
• pulsedive_explore searches the Pulsedive threat database with Explore boolean field filters. Queries can target fields including indicator type, risk, feed, and threat, and the tool accepts a result limit.
• ask_pipeworx can be used through the gateway to ask questions in plain language; the gateway selects a tool and fills its arguments.

Limitations and notes

The dedicated pack endpoint also exposes shared Pipeworx meta-tools, so its complete tool list is larger than the two Pulsedive-specific tools. Its initialize response defines the exact scope at connection time. The integration requires network access and a Pulsedive-compatible call path; the HTTP tool API also requires an API key for calls that cannot run anonymously. Behind an HTTPS proxy, Node's built-in fetch does not read HTTPS_PROXY by default; newer Node releases can honor it when NODE_USE_ENV_PROXY=1 is set.