abusech-mcp 🚦

abusech-mcp is an MCP server that fetches threat intelligence from multiple abuse.ch platforms, including MalwareBazaar, URLhaus, and ThreatFox.

Features

• Unified VT-like API for querying file, URL, IP, and domain intelligence
• Uses Pydantic schemas for robust data validation and serialization
• **Powered by fastmcp:**
• Unified API layer: Directly use functions from `abusech_intel.py` to obtain correlated intelligence from abuse.ch platforms—serving as a unified API layer since the platforms themselves do not provide one

Requirements

• Python 3.10+
• abuse.ch API key (set as `ABUSECH_API_KEY` environment variable)

Usage

Start the MCP server:

python abusech_mcp.py

Available Tools

• `get_ip_report(ip: str)`: Get a comprehensive IP report from URLhaus and ThreatFox
• `get_domain_report(domain: str)`: Get a domain report from URLhaus and ThreatFox
• `get_url_report(url: str)`: Get a URL report from URLhaus and ThreatFox
• `get_file_report(hash_value: str)`: Get a file report (MD5/SHA-1/SHA-256) from MalwareBazaar, URLhaus, and ThreatFox

Configuration

Set your API key as an environment variable:

export ABUSECH_API_KEY=your_api_key_here

License

MIT License