`search_ioc`

Pack: threatfox · Endpoint: https://gateway.pipeworx.io/threatfox/mcp

Look up a specific indicator of compromise (IP, domain, URL, hash, etc.). Returns matching IOCs with malware family, confidence, threat-type, first/last seen, tags, references.

Parameters

Name	Type	Required	Description
`indicator`	string	yes	IP / domain / URL / hash to look up
`exact_match`	boolean	no	Require exact match (default true)

Example call

Arguments

{
  "indicator": "192.0.2.42"
}

curl

curl -X POST https://gateway.pipeworx.io/threatfox/mcp \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"search_ioc","arguments":{"indicator":"192.0.2.42"}}}'

TypeScript (@pipeworx/sdk)

import { Pipeworx } from '@pipeworx/sdk';
const pipeworx = new Pipeworx();

const result = await pipeworx.call('search_ioc', {
  "indicator": "192.0.2.42"
});

More examples

{
  "indicator": "evil.example.com",
  "exact_match": false
}

Response shape

Always returns: query, status, count, results

Field	Type	Description
`query`	string	The query type sent (search_ioc)
`status`	string \| null	Query status (ok, no_result, or null)
`count`	integer	Number of results returned
`results`	array	Matching IOC records with malware family, confidence, threat-type, dates, tags, references

Full JSON Schema

{
  "type": "object",
  "properties": {
    "query": {
      "type": "string",
      "description": "The query type sent (search_ioc)"
    },
    "status": {
      "type": [
        "string",
        "null"
      ],
      "description": "Query status (ok, no_result, or null)"
    },
    "count": {
      "type": "integer",
      "description": "Number of results returned"
    },
    "results": {
      "type": "array",
      "description": "Matching IOC records with malware family, confidence, threat-type, dates, tags, references",
      "items": {
        "type": "object"
      }
    }
  },
  "required": [
    "query",
    "status",
    "count",
    "results"
  ]
}

Connect

Add this to your MCP client config, or use one-click install buttons:

{
  "mcpServers": {
    "threatfox": {
      "url": "https://gateway.pipeworx.io/threatfox/mcp"
    }
  }
}

See Getting Started for client-specific install steps.

search_ioc