greynoise

This MCP server provides access to GreyNoise Intelligence data through a set of available tools, enabling you to analyze IP context, perform quick checks, run batch analyses, inspect tag metadata and activity, and query vulnerabilities. The server is designed to work with the standard stdio transport (bundled version) by default, and can also operate over HTTP if you install Express in your environment. Key capabilities include IP analysis (lookup-ip-context, quick-check-ip, multi-ip-check, riot-lookup), tag exploration (get-tag-list, get-tag-details, get-tag-activity, search-tags, analyze-tags-activity, get-trending-vulnerabilities), and vulnerability/queries (get-trending-vulnerabilities, gnql-stats, get-cve-details). You can invoke the tools via the MCP client interface, passing the tool name and parameters as described in the usage examples in the README. The server requires a GreyNoise Enterprise API key to access the GreyNoise endpoints.

Prerequisites:

• Node.js and npm installed
• Access to a GreyNoise Enterprise API key
• (Optional) If you plan to use HTTP transport, install Express in your environment

Installation steps:

1. Install dependencies and build the project

git clone <repository-url>
cd greynoise-intelligence-greynoise-mcp-server
npm install
npm run build

2. Run the MCP server (example using NPX configuration shown in the repo):

npx @greynoise/greynoise-mcp-server --help

3. For HTTP transport (requires Express):

npm install express
node @greynoise/greynoise-mcp-server --transport http

4. If you prefer development workflow hampered by bundling, you can build and run from the local bundle:

npm run build
# then run the built server, e.g. node build/index.js

5. Set your API key before use:

export GREYNOISE_API_KEY=your-api-key-here

(Windows equivalents: set GREYNOISE_API_KEY=your-api-key-here or $env:GREYNOISE_API_KEY="your-api-key-here" in PowerShell)

• The GreyNoise Enterprise API key is required for all operations.
• The bundled version supports stdio transport by default; HTTP transport requires Express to be installed.
• For NPX usage, the command is ready-to-run as shown in the README; for local development, point the node command to the built entry file (index.js) in the build directory.
• If you encounter transport or API errors, ensure GREYNOISE_API_KEY is correctly set and that network access to GreyNoise endpoints is permitted.
• The test tooling described in the README allows you to validate individual endpoints without MCP server layer interaction.
• The available tools support both single-IP and multi-IP workflows; refer to the usage examples in the README for parameter shapes.