@greynoise/greynoise-mcp-server

Filter GreyNoise tags then aggregate their v3/tags/{id}/activity into a summary (total active IPs by classification, most active tags, per-tag detail). query substring-matches name/description/slug/label; category and intention are exact (case-insensitive) matches. days must be 1, 10, or 30 (default 30).

Search GreyNoise tags (client-side over the cached v3/tags list). query substring-matches name/description/slug/label; category and intention are exact (case-insensitive) matches; cve substring-matches associated CVEs. All params optional; omitting all returns every tag.

Retrieve time-series unique-IP counts and intention activity for a tag (by id/slug) or by CVE, from v3/tags/{id}/activity. Provide exactly one of id_or_slug or cve. days must be 1, 10, or 30 (default 30); granularity is 1h for 1 day, else 24h.

Look up a single callback/C2 IP: attack stage, scanner associations, RIOT status, geo/network enrichment, and downloaded malware files.

Paginated list of callback/C2 IPs filtered by attack stage, first/last seen date ranges, file attributes, and scanner associations. Dates are YYYY-MM-DD.

Export callback/C2 IPs matching the filters as a plain list. Same filters as List Callback IPs. Dates are YYYY-MM-DD.

Aggregate statistics for callback/C2 IPs matching the filters: counts by attack stage, file analysis status, RIOT trust levels, scanner associations, and top threat names. Bounded to a recent window (days: 1-7, default 1) — wider ranges overload the aggregation.

Look up Business Service Intelligence provider matches for a single IPv4 address. Returns providers whose CIDRs contain the IP, in ascending precedence order (lower = higher priority). IPv6 is rejected. Requires a BSI license.

Look up BSI provider matches for up to 1,000 IPv4 addresses. Results preserve request order; any IPv6 address fails the whole request with HTTP 400. Requires a BSI license.

Counts of BSI IPs and CIDRs grouped by trust level. Requires BSI entitlements.

Counts of BSI IPs and CIDRs grouped by company name. Requires BSI entitlements.

Counts of BSI IPs and CIDRs grouped by category. Requires BSI entitlements.

Get the number of unique IPs matching a GNQL query per hour/day over a time range (Recall Stats). Returns aggregated counts of unique IPs per time bucket, useful for trend analysis and understanding how scanning/attack activity changes over time. interval must be 'hour' or 'day'. Time bounds use ISO 8601 format.

List currently trending and anomalous GreyNoise vulnerability tags. Takes no parameters. Makes two calls (sort=trending, sort=anomalies) and returns the combined set with a 'source' field per tag plus a total count.

Get the full record for a single GreyNoise tag, looked up by exact tag id or slug (slug matched case-insensitively) over the cached v3/tags list.

Get a fast, lightweight classification and business-service check for a single IP address.

Export a PCAP file containing packets from multiple GreyNoise sensor sessions matching query criteria. Saves the binary PCAP to a temporary directory and returns the file path. The file can be opened with Wireshark, tshark, or tcpdump. Use Lucene query syntax to filter sessions (e.g., "destination.port:443", "source.ip:1.2.3.4").

Get detailed GreyNoise context for a single IP: classification, tags, Internet Scanner Intelligence (scan/HTTP/TLS/SSH/TCP raw data), Business Service Intelligence, geo, and network metadata.

Check up to 10,000 IP addresses at once. Returns classification, business-service status, and trust level for each, plus a summary breakdown.

Create a dynamic blocklist from a GNQL query. The blocklist auto-populates with IPs matching the query. Requires a plan entitled to blocklists.

List the blocklists in a workspace.

Retrieve a single blocklist's configuration by ID.

Update a blocklist's query, name, IP limit, or enabled state.

Permanently delete a blocklist. This cannot be undone.

Retrieve the current list of IPs in a blocklist.

Get full metadata and connection details for a single GreyNoise sensor session by its ID. Returns source/destination IPs and ports, timestamps, byte/packet counts, classification, and any additional enrichment fields.

Search GreyNoise data using GNQL (GreyNoise Query Language). Returns full IP context results including raw scan data. GNQL is a domain-specific query language that uses Lucene deep under the hood. Facets: - "ip" - The IP address of the scanning device - "classification" - Whether the device has been categorized as unknown, benign, or malicious - "first_seen" / "last_seen" - Date the device was first/most recently observed - "actor" - The benign actor the device has been associated with (Shodan, Censys, etc) - "tags" - Tags assigned to the device over the past 90 days - "cve" - CVEs associated with the device - "vpn" / "vpn_service" / "bot" / "tor" - Boolean/string indicators - "metadata.category" - Network category (business, isp, hosting, education, mobile) - "metadata.source_country" / "metadata.source_country_code" - Source location - "metadata.organization" / "metadata.asn" / "metadata.rdns" - Network info - "raw_data.scan.port" / "raw_data.scan.protocol" - Scan targets - "raw_data.web.paths" / "raw_data.web.useragents" - HTTP activity - "raw_data.ja3.fingerprint" / "raw_data.hassh.fingerprint" - TLS/SSH fingerprints Examples: - "classification:malicious last_seen:1d" - Malicious IPs seen in last day - "tags:Mirai" - Devices tagged as Mirai - "raw_data.scan.port:445 metadata.os:Windows*" - Windows hosts scanning port 445 - "cve:CVE-2021-30461" - Devices associated with a CVE - "source_country:Iran destination_country:Ukraine single_destination:true" - Targeted scanning Results are paginated. Use the scroll parameter to retrieve additional pages.

Download the raw PCAP capture for a single GreyNoise sensor session. Saves the binary PCAP file to a temporary directory and returns the file path. The file can be opened with Wireshark, tshark, or tcpdump.

Search GreyNoise data using GNQL, returning IP metadata without raw scan data. Lighter and faster than gnql-query. Supports the same GNQL query syntax as gnql-query. Use this when you need IP classification, tags, and metadata but not raw scan details (ports, fingerprints, HTTP paths). Results are paginated via the scroll token. Set quick=true to return only IP and classification/trust level. Set format="csv" for spreadsheet-friendly CSV output (columns: ip, classification, actor, organization, source_country, tags, ports, bsi_found, bsi_name, bsi_trust_level); default "json" renders a Markdown summary. structuredContent is always the full JSON regardless of format.

Retrieve hourly GNQL records for a time range. Enables temporal analysis of IP activity matching any GNQL query (Recall). Returns IP records bucketed by hour, useful for investigating when specific IPs were active and what they were doing. Time bounds use ISO 8601 (e.g. 2025-01-15T00:00:00Z). size is results per hourly bucket (default: 25, max: 10000).

Query and filter GreyNoise sensor network sessions over a time range. Returns a paginated list with source/destination IPs and ports, timestamps, byte/packet counts, and classification. Use Lucene query syntax (e.g. destination.port:443).

Discover the queryable session field schema: field identifiers, types, groups, and whether each is sortable. Use these field names when building session queries, counts, connections, timeseries, and unique-value requests.

Aggregate session counts grouped by one or more fields over a time range. Multiple fields produce nested (drill-down) buckets.

Build a connection graph (nodes + links) between a source field and a destination field over a time range. Useful for visualizing communication relationships.

Return session volume over time, optionally grouped by a field. Without a field, returns a single timeseries; with a field, returns per-group timeseries.

Return the distinct values of a single session field over a time range (server produces a CSV). Optionally include per-value counts. Useful for extracting distinct IPs, ports, or other field values matching a query.

Download a single session's data for a given session ID as a PCAP or raw payload (type: pcap | rawSource | rawDestination; default pcap). Saves the binary to a temp file and returns its path. Not available when scope=demo.

Create a scheduled alert that runs a GNQL query and notifies recipients (email/webhook) when it matches. Requires a plan entitled to alerts.

List the alerts configured in a workspace.

Retrieve a single alert's configuration by ID.

Update an alert's query, schedule, recipients, name, or enabled state.

Permanently delete an alert. This cannot be undone.

Enable (resume) a previously disabled alert.

Disable (pause) an alert without deleting it.

Send a test payload to a webhook URL to verify delivery before wiring it to an alert.

Get GreyNoise vulnerability intelligence for one CVE: CVSS/EPSS scores, KEV status, exploitation stats, and observed benign/threat IP activity. cve_id must match 'CVE-YYYY-NNNNN' (e.g. CVE-2023-6549); case-insensitive.

Retrieve the complete list of GreyNoise tags (from v3/tags, cached 1h). Returns JSON with count and each tag's name and slug. Takes no parameters.