Pipeworx provides an official MCP server that integrates the ThreatFox abuse.ch IOC feed, allowing agents to search for indicators of compromise including IPs, domains, URLs, and hashes associated with malware families and campaigns.
- Operator: Pipeworx
- Endpoint: https://gateway.pipeworx.io/threatfox/mcp
- Transport: streamable-http
- Sign-in: No sign-in
- Category: AI and machine learning
- Use cases: Search for specific IOCs like IPs or domains; Retrieve recent IOCs from the last N days; Find IOCs associated with a specific file hash; Look up IOCs tagged to a malware family
- Tools: ask_pipeworx, ask_pipeworx_beta, ask_pipeworx_grounded, search_within, deep_research, discover_tools, resolve_entity, compare_entities, subscribe, unsubscribe, list_subscriptions, recent_alerts, entity_profile, recent_changes, validate_claim, company_facts, scan_dependency, bet_research, polymarket_arbitrage, polymarket_edges, polymarket_kalshi_spread, polymarket_fill_risk, polymarket_edge_tracker, kalshi_weather_edge, resolution_audit, resolution_diff, release_calendar_markets, pipeworx_trending, suggest_questions, generate_llms_txt, ai_visibility_check, scan_competitor_ai_presence, pipeworx_feedback, remember, recall, forget, search_ioc, recent_iocs, search_hash, search_malware
- Documentation: https://pipeworx.io/packs/threatfox
- Directory listing: https://koskamo.com/explore/threatfox-mcp
- Also known as: ThreatFox MCP MCP; threatfox-mcp