`ip_context`

Pack: greynoise · Endpoint: https://gateway.pipeworx.io/greynoise/mcp

Classify an IPv4 address using the GreyNoise Community dataset (BYO API key). Returns: noise (mass internet scanner?), riot (known-good service like Google/AWS?), classification (malicious|benign|unknown), entity name, last-seen date, and a viz.greynoise.io deep link for SOC triage.

Parameters

Name	Type	Required	Description
`ip`	string	yes	IPv4 address

Example call

Arguments

{
  "ip": "8.8.8.8"
}

curl

curl -X POST https://gateway.pipeworx.io/greynoise/mcp \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"ip_context","arguments":{"ip":"8.8.8.8"}}}'

TypeScript (@pipeworx/sdk)

import { Pipeworx } from '@pipeworx/sdk';
const pipeworx = new Pipeworx();

const result = await pipeworx.call('ip_context', {
  "ip": "8.8.8.8"
});

More examples

{
  "ip": "192.0.2.1"
}

Response shape

Always returns: ip, observed, noise, riot, classification, name, last_seen, link, message

Field	Type	Description
`ip`	string	IPv4 address queried
`observed`	boolean	Whether GreyNoise has observed scanner activity from this IP
`noise`	boolean	Whether the IP is classified as internet background noise
`riot`	boolean	Whether the IP is a known good service (RIOT)
`classification`	string	Classification of the IP activity
`name`	string \| null	Name or organization associated with the IP
`last_seen`	string \| null	ISO date when the IP was last observed
`link`	string	Deep link to GreyNoise visualization page for this IP
`message`	string \| null	Additional message or explanation

Full JSON Schema

{
  "type": "object",
  "properties": {
    "ip": {
      "type": "string",
      "description": "IPv4 address queried"
    },
    "observed": {
      "type": "boolean",
      "description": "Whether GreyNoise has observed scanner activity from this IP"
    },
    "noise": {
      "type": "boolean",
      "description": "Whether the IP is classified as internet background noise"
    },
    "riot": {
      "type": "boolean",
      "description": "Whether the IP is a known good service (RIOT)"
    },
    "classification": {
      "type": "string",
      "enum": [
        "malicious",
        "benign",
        "unknown"
      ],
      "description": "Classification of the IP activity"
    },
    "name": {
      "type": [
        "string",
        "null"
      ],
      "description": "Name or organization associated with the IP"
    },
    "last_seen": {
      "type": [
        "string",
        "null"
      ],
      "description": "ISO date when the IP was last observed"
    },
    "link": {
      "type": "string",
      "description": "Deep link to GreyNoise visualization page for this IP"
    },
    "message": {
      "type": [
        "string",
        "null"
      ],
      "description": "Additional message or explanation"
    }
  },
  "required": [
    "ip",
    "observed",
    "noise",
    "riot",
    "classification",
    "name",
    "last_seen",
    "link",
    "message"
  ]
}

Connect

Add this to your MCP client config, or use one-click install buttons:

{
  "mcpServers": {
    "greynoise": {
      "url": "https://gateway.pipeworx.io/greynoise/mcp"
    }
  }
}

See Getting Started for client-specific install steps.

ip_context