`ip_context`

Pack: greynoise · Connect: https://pipeworx.io/mcp (see Connect below for a single-pack URL)

No MCP client? Call it directly: GET https://gateway.pipeworx.io/v1/tools/ip_context for the schema, then POST the same URL with its arguments for the data.

Classify an IPv4 address using the GreyNoise Community dataset (BYO API key). Returns: noise (mass internet scanner?), riot (known-good service like Google/AWS?), classification (malicious|benign|unknown), entity name, last-seen date, and a viz.greynoise.io deep link for SOC triage.

Parameters

Name	Type	Required	Description
`ip`	string	yes	IPv4 address

Example call

Arguments

{
  "ip": "8.8.8.8"
}

curl

curl -X POST https://gateway.pipeworx.io/greynoise/mcp \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"ip_context","arguments":{"ip":"8.8.8.8"}}}'

TypeScript (@pipeworx/sdk)

import { Pipeworx } from '@pipeworx/sdk';
const pipeworx = new Pipeworx();

const result = await pipeworx.call('ip_context', {
  "ip": "8.8.8.8"
});

More examples

{
  "ip": "192.0.2.1"
}

Response shape

Full JSON Schema

{
  "type": "object",
  "oneOf": [
    {
      "type": "object",
      "properties": {
        "ip": {
          "type": "string",
          "description": "IPv4 address queried"
        },
        "observed": {
          "type": "boolean",
          "description": "Whether GreyNoise has observed scanner activity from this IP"
        },
        "noise": {
          "type": "boolean",
          "description": "Whether the IP is classified as internet background noise"
        },
        "riot": {
          "type": "boolean",
          "description": "Whether the IP is a known good service (RIOT)"
        },
        "classification": {
          "type": "string",
          "enum": [
            "malicious",
            "benign",
            "unknown"
          ],
          "description": "Classification of the IP activity"
        },
        "name": {
          "type": [
            "string",
            "null"
          ],
          "description": "Name or organization associated with the IP"
        },
        "last_seen": {
          "type": [
            "string",
            "null"
          ],
          "description": "ISO date when the IP was last observed"
        },
        "link": {
          "type": "string",
          "description": "Deep link to GreyNoise visualization page for this IP"
        },
        "message": {
          "type": [
            "string",
            "null"
          ],
          "description": "Additional message or explanation"
        },
        "found": {
          "type": "boolean",
          "enum": [
            true
          ],
          "description": "Present and true on an answer; a miss is the found:false branch."
        }
      },
      "required": [
        "ip",
        "observed",
        "noise",
        "riot",
        "classification",
        "message"
      ]
    },
    {
      "type": "object",
      "description": "A miss or an unavailable upstream: found:false with a reason and a hint (the shape check-found-false-schemas.mjs expects).",
      "properties": {
        "found": {
          "type": "boolean",
          "enum": [
            false
          ]
        }
      },
      "required": [
        "found"
      ]
    }
  ]
}

Connect

Add this to your MCP client config — every tool in the catalog, including this one — or use one-click install buttons:

{
  "mcpServers": {
    "pipeworx": {
      "url": "https://pipeworx.io/mcp"
    }
  }
}

Connect to just the greynoise pack

{
  "mcpServers": {
    "greynoise": {
      "url": "https://gateway.pipeworx.io/greynoise/mcp"
    }
  }
}

See Getting Started for client-specific install steps.

ip_context