Simple GreyNoise community API MCP server

README.md

Simple GreyNoise MCP Server

Supports basic queries by IP which all users, community and enterprise, have access to. Easy to extend for enterprise-only APIs.

Configuration

Add this to your claude_desktop_config.json file (editing as needed for paths and your API key):

{
  "mcpServers": {
    "GreyNoise": {
          "command": "/Library/Frameworks/Python.framework/Versions/3.13/bin/uv",
          "args": [
            "--directory",
            "/path/to/greynoise-mcp",
            "run",
            "python",
            "server.py"
          ],
          "env": {
            "GREYNOISE_API_KEY": "YOUR KEY GOES HERE"
          }
        }
   }
 }

greynoise_mcp_server.py

# https://greynoise.readthedocs.io/en/latest/tutorial.html#api-client

import logging
import os
from typing import Any, Dict, List

import aiohttp
from mcp.server.fastmcp import FastMCP

SERVER_NAME = "greynoise-mcp"

mcp = FastMCP(SERVER_NAME)

logging.basicConfig(level=logging.INFO)
logger = logging.getLogger(SERVER_NAME)
BASE_URL = "https://api.greynoise.io/v3/community/"
HEADERS = {"accept": "application/json", "key": os.getenv("GREYNOISE_API_KEY")}

@mcp.tool()
async def search_one_greynoise(ip: str) -> List[Dict[str, Any]]:
    """
    Name: search_one_greynoise
    Description: Check if a given IP addresses are considered internet noise or have been observed scanning or attacking devices across the Internet.
    Parameters:
    ip (required): The IP addresses to get context from
    """
    logger.info(f"Querying GreyNoise events for {ip}")
    async with aiohttp.ClientSession() as session:
        async with session.get(f"{BASE_URL}{ip}", headers=HEADERS) as response:
            data = await response.text()
    return data

def main() -> None:
    logger.info("Starting GreyNoise MCP server")
    mcp.run(transport="stdio")

if __name__ == "__main__":
    main()

requirements.txt

aiohttp==3.11.18
mcp==1.5.0
typing_extensions==4.13.1
typing-inspection==0.4.0