`lookup_host`

Pack: urlhaus · Endpoint: https://gateway.pipeworx.io/urlhaus/mcp

Look up a hostname or IP address in the URLhaus database to find associated malware URLs. Returns all known malicious URLs hosted on that host.

Parameters

Name	Type	Required	Description
`host`	string	yes	Hostname or IP address to look up (e.g. “example.com” or “192.168.1.1”).

Example call

Arguments

{
  "host": "malicious-site.com"
}

curl

curl -X POST https://gateway.pipeworx.io/urlhaus/mcp \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"lookup_host","arguments":{"host":"malicious-site.com"}}}'

TypeScript (@pipeworx/sdk)

import { Pipeworx } from '@pipeworx/sdk';
const pipeworx = new Pipeworx();

const result = await pipeworx.call('lookup_host', {
  "host": "malicious-site.com"
});

More examples

{
  "host": "192.168.1.100"
}

Response shape

Always returns: query_status, urlhaus_reference, blacklists, url_count, urls

Field	Type	Description
`query_status`	string	Status of the query
`urlhaus_reference`	string \| null	Reference URL on URLhaus for this host
`blacklists`	object \| null	Blacklist detection status by various services
`url_count`	number	Number of malware URLs found on this host
`urls`	array	List of malware URLs on this host

Full JSON Schema

{
  "type": "object",
  "properties": {
    "query_status": {
      "type": "string",
      "description": "Status of the query"
    },
    "urlhaus_reference": {
      "type": [
        "string",
        "null"
      ],
      "description": "Reference URL on URLhaus for this host"
    },
    "blacklists": {
      "type": [
        "object",
        "null"
      ],
      "description": "Blacklist detection status by various services"
    },
    "url_count": {
      "type": "number",
      "description": "Number of malware URLs found on this host"
    },
    "urls": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "id": {
            "type": "string",
            "description": "URLhaus ID for this URL"
          },
          "url": {
            "type": "string",
            "description": "The malware URL"
          },
          "url_status": {
            "type": "string",
            "description": "Status of the URL"
          },
          "date_added": {
            "type": "string",
            "description": "Date when URL was added"
          },
          "threat": {
            "type": "string",
            "description": "Threat category"
          },
          "tags": {
            "type": [
              "array",
              "null"
            ],
            "items": {
              "type": "string"
            },
            "description": "Associated tags"
          }
        },
        "required": [
          "id",
          "url",
          "url_status",
          "date_added",
          "threat",
          "tags"
        ]
      },
      "description": "List of malware URLs on this host"
    }
  },
  "required": [
    "query_status",
    "urlhaus_reference",
    "blacklists",
    "url_count",
    "urls"
  ]
}

Connect

Add this to your MCP client config, or use one-click install buttons:

{
  "mcpServers": {
    "urlhaus": {
      "url": "https://gateway.pipeworx.io/urlhaus/mcp"
    }
  }
}

See Getting Started for client-specific install steps.

lookup_host