MCP server

Threatfox

io.github.pipeworx-io/threatfox

Checked 26 Oct 2026, 08:29 UTC · Connected to it and listed its tools

ThreatFox MCP — abuse.ch indicator-of-compromise feed (free, key required)

Website Source

At a glance

Type

MCP server

Publisher

pipeworx.io (verified by the MCP Registry)

Status

Working at last check

Tools

46

Token cost

About 27,059 tokens per request

Sets up in

Claude Code, Claude Desktop, Codex, Gemini CLI, Cursor, VS Code, Antigravity, ChatGPT, OpenAI API, Grok

Last checked

26 Oct 2026, 08:29 UTC

Connect it to your agent

Add to CursorAdd to VS CodeVS Code Insiders

Opens the app, which shows the server and asks you to confirm. For other apps, copy the setup below.

Claude Code

claude mcp add --transport http threatfox https://gateway.pipeworx.io/threatfox/mcp

Claude Desktop

Settings → Connectors → Add custom connector, and paste the URL.

Codex (config.toml)

[mcp_servers.threatfox]
url = "https://gateway.pipeworx.io/threatfox/mcp"

Gemini CLI

{"mcpServers":{"threatfox":{"httpUrl":"https://gateway.pipeworx.io/threatfox/mcp"}}}

Cursor

{"mcpServers":{"threatfox":{"url":"https://gateway.pipeworx.io/threatfox/mcp"}}}

VS Code

{"servers":{"threatfox":{"type":"http","url":"https://gateway.pipeworx.io/threatfox/mcp"}}}

Antigravity

agy mcp add threatfox https://gateway.pipeworx.io/threatfox/mcp

ChatGPT

Settings → Apps & Connectors → Advanced settings: turn on Developer mode, then Create a connector and paste the URL. Which plans can do this varies.

OpenAI API (Responses tools)

{"type":"mcp","server_label":"threatfox","server_url":"https://gateway.pipeworx.io/threatfox/mcp","require_approval":"always"}

Grok (xAI API tools)

{"type":"mcp","server_label":"threatfox","server_url":"https://gateway.pipeworx.io/threatfox/mcp"}

Tools

• recent_iocs ~84 tokens
  IOCs added to ThreatFox in the last N days. Useful for daily threat-intel ingestion.
• search_hash ~400 tokens
  Everything ThreatFox knows about one file hash (md5 / sha1 / sha256), across BOTH relations it stores hashes in — they are different facts and a caller with a hash in hand rarely knows which one they have. (1) sample_to_c2: the hash is a malware SAMPLE, and ThreatFox returns the botnet C&C servers t
• search_ioc ~153 tokens
  Look up a specific indicator of compromise (IP, domain, URL, hash, etc.). Returns matching IOCs with malware family, confidence, threat-type, first/last seen, tags, references.
• search_malware ~119 tokens
  IOCs tagged to a malware family (e.g., "Cobalt Strike", "Emotet", "QakBot").

Browse

• GitHub tools
• GitHub and code hosting
• Databases
• Security scanning

Related MCP servers

• ContrastAPI
  55 tools, 7 Resources, Sigma rules, email SPF/DMARC, MITRE, CVE/KEV, risk_score. No key.
• SiteCheck Web Intel
  129 pay-per-call agent tools: security, threat intelligence, web search and SEO data tools. x402
• NicheDB
  Sources in, feeds out: an open, ever-growing database of real-time public data, enriched.
• Pulsedive
  Pulsedive MCP — threat-intelligence IOC enrichment (pulsedive.com)
• Gapup
  271 agent-payable tools: competitive intel, finance, KYC, compliance, ESG. x402 per-call.
• Website Search
  Improve security writing, score it against rubrics, plan IR, CTI, vuln, and product strategy.
• AgentAegis
  Pay-per-call cybersecurity for AI agents: vuln scans, threat intel, compliance, code security.
• PG1 Sovereign Threat Intelligence
  Preflight for AI agents, signed: one call; wallet, domain, IP abuse, package checks and CVEs.

Badge for your README

[![AptLynx](https://aptlynx.net/badge/io.github.pipeworx-io/threatfox.svg)](https://aptlynx.net/servers/io.github.pipeworx-io/threatfox)

Listing text is written by the maker; AptLynx lists tools and does not vouch for them. Find another tool · Browse by topic · For agents