Greynoise

io.github.nickjluckerPublished by GitHub account nickjluckerv0.1.0Updated Oct 24, 2026

MCP server for GreyNoise API - Check if IPs are internet background noise or targeted attacks

VerifiedSTDIODesktop onlyWeb Search & ScrapingSecurity & Monitoring

Overview

AI-generated overview

A local MCP server that queries the GreyNoise API so an assistant can check whether IP addresses are mass-scanning noise, known benign services, or potentially,

What you can do
Check a single IPv4 address against GreyNoise for noise, RIOT and classification results, with an interpretation of what the result means for security triage. Check up to ten IPv4 addresses in one call and get a combined result list with a legend. Read the GreyNoise API status and rate-limit information as a resource.
When to use it
Useful during SOC triage, incident response, threat hunting or log analysis when you want to know whether suspicious IPs in your logs are background scanners, known benign services, or traffic that may be targeted at you.
Requirements
Runs as a local process via npx or a global npm install, so Node.js is needed. No API key is required for about 10 lookups per day; setting the GREYNOISE_API_KEY environment variable raises the limit to 50 per day on the free tier. Network access to the GreyNoise API is required.
Before you install
The optional GREYNOISE_API_KEY is a secret and should not be committed or logged. Lookups are sent to GreyNoise, and rate limits are shared with the GreyNoise Visualizer. The server is described as read-only and does not store data beyond the current request.

Installation

In SourceWeft

  1. Open Greynoise in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

mcp-greynoise

[npm version] [License: MIT]

MCP server for the GreyNoise API — check if IP addresses are internet background noise or potentially targeted attacks.

Quick Start

bash
npx mcp-greynoise

That's it. Works out of the box with 10 lookups/day (no API key needed).

What is GreyNoise?

GreyNoise collects and analyzes internet-wide scan traffic. It tells you:

  • Noise: Is this IP mass-scanning the internet? (botnets, researchers, crawlers)
  • RIOT: Is this IP a known benign service? (Google, Cloudflare, Microsoft, etc.)
  • Classification: Malicious, benign, or unknown

Why this matters for security

When you see suspicious traffic in your logs:

GreyNoise ResultInterpretation
NOISE + MaliciousBackground attack traffic (scanners, botnets) — likely untargeted
NOISE + BenignSecurity researchers, search crawlers — usually safe
RIOTKnown good service (CDN, DNS, cloud) — almost certainly benign
NOT NOISE⚠️ This IP is NOT mass-scanning — traffic may be targeted at you

The "NOT NOISE" case is often the most important — it suggests someone is specifically interested in your systems.

Demo

Example output from check_ip:

IP: 51.91.185.74Classification: MALICIOUSNoise: YES - This IP has been observed scanning the internetRIOT: NO - Not a known benign service IPLast Seen: 2024-01-15Details: https://viz.greynoise.io/ip/51.91.185.74
--- Interpretation ---🚨 This IP is actively scanning the internet and classified as MALICIOUS.    Likely a scanner, botnet, or threat actor.

Installation

npm (recommended)

bash
npm install -g mcp-greynoise

npx (no install)

bash
npx mcp-greynoise

From source

bash
git clone https://github.com/nickjlucker/mcp-greynoise.gitcd mcp-greynoisenpm installnpm run buildnode build/index.js

Configuration

Claude Desktop

Add to your claude_desktop_config.json:

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json

json
{  "mcpServers": {    "greynoise": {      "command": "npx",      "args": ["mcp-greynoise"],      "env": {        "GREYNOISE_API_KEY": "your-api-key-here"      }    }  }}

Environment Variables

VariableRequiredDescription
GREYNOISE_API_KEYNoAPI key for higher rate limits (50/day vs 10/day)

Get a free API key at viz.greynoise.io/signup.

⚠️ Never commit API keys. See .env.example for the recommended setup.

Tools

check_ip

Check a single IP address against GreyNoise.

Input:

  • ip (string): IPv4 address to check

check_ips

Check multiple IP addresses in one call (max 10).

Input:

  • ips (string[]): Array of IPv4 addresses

Example output:

=== Results ===8.8.8.8: RIOT (benign service) [Google]51.91.185.74: NOISE - MALICIOUS192.168.1.1: NOT NOISE (potentially targeted)
--- Legend ---RIOT: Known benign service (CDN, DNS, etc.)NOISE: IP is mass-scanning the internetNOT NOISE: IP is NOT mass-scanning (traffic may be targeted)

Resources

greynoise://status

Returns API status and rate limit information.

Rate Limits

TierDaily Lookups
Unauthenticated10
Free account50
Paid plansHigher

Rate limits are shared between API calls and the GreyNoise Visualizer.

Security

This server:

  • Only reads from the GreyNoise API (no scanning, no exploitation)
  • Does not store any data beyond the current request
  • Does not transmit your API key anywhere except to GreyNoise
  • Performs reputation/telemetry enrichment only

Your API key is passed via environment variable and never logged.

Use Cases

  • SOC Triage: Quickly determine if alert IPs are background noise or targeted
  • Incident Response: Identify if attacker IPs are mass-scanners or focused threats
  • Threat Hunting: Find IPs in your logs that aren't mass-scanners (potentially targeted)
  • Log Analysis: Reduce false positives by filtering out known scanners

Development

bash
# Install dependenciesnpm install
# Run in development modenpm run dev
# Build for productionnpm run build
# Run built versionnpm start

License

MIT

Links

Source: README.md at commit 6aa46ac

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.0LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts