abuseipdb-mcp

An MCP (Model Context Protocol) server that provides threat intelligence lookups against the AbuseIPDB database. This server enables any MCP-capable client to perform IP reputation checks, CIDR block analysis, and access curated blacklists with intelligent caching and rate limiting.

• IP Reputation Checks: Single IP address lookups with detailed abuse data
• CIDR Block Analysis: Check entire network ranges for malicious activity
• Blacklist Access: Retrieve current AbuseIPDB blacklist with configurable confidence levels
• Bulk Operations: Check multiple IP addresses efficiently
• Log Enrichment: Extract and analyze IP addresses from log lines
• Intelligent Caching: SQLite-based caching with TTL to minimize API usage
• Rate Limiting: Built-in quota management for AbuseIPDB API limits
• Security Focused: Input validation, private IP filtering, and secure defaults

• Python 3.11 or higher
• AbuseIPDB API key (get one at abuseipdb.com)

1. Clone the repository:

git clone <repository-url>
cd AbuseIPDB-MCP

1. Install the package:

pip install -e .

1. Set up your environment:

cp .env.example .env
# Edit .env and add your ABUSEIPDB_API_KEY

1. Run the server:

python -m mcp_abuseipdb.server

Add to your MCP client configuration (e.g., mcp.json):

{
  "mcpServers": {
    "mcp-abuseipdb": {
      "command": "python",
      "args": ["scripts/start_mcp_server.py"],
      "cwd": "/path/to/AbuseIPDB-MCP",
      "env": {
        "ABUSEIPDB_API_KEY": "your_api_key_here"
      }
    }
  }
}

{
  "mcpServers": {
    "mcp-abuseipdb": {
      "command": "python",
      "args": ["-m", "mcp_abuseipdb.server"],
      "cwd": "/path/to/A