Abusech

Fetches threat intelligence from abuse.ch platforms and exposes a unified API for IP, domain, URL, and file queries.

python

1

GitHub Stars

python

Language

6 months ago

First Indexed

2 months ago

Catalog Refreshed

Documentation & install

Readme and setup notes from the catalogue, plus a client-ready config you can copy for your MCP host.

Installation

Add the following to your MCP client configuration file.

Configuration

View docs

{
  "mcpServers": {
    "lokallost-abusech-mcp": {
      "command": "python",
      "args": [
        "abusech_mcp.py"
      ],
      "env": {
        "ABUSECH_API_KEY": "YOUR_API_KEY"
      }
    }
  }
}

abusech-mcp is an MCP server that unifies threat intelligence from abuse.ch platforms such as MalwareBazaar, URLhaus, and ThreatFox. It exposes a common API to query IPs, domains, URLs, and files, making it easy to integrate abuse.ch data into your security workflows.

How to use

You run the MCP server locally and then connect to it with your MCP client to fetch threat intelligence. Start the server, then use the available functions to obtain comprehensive reports for IPs, domains, URLs, and files.

How to install

Prerequisites: ensure you have Python 3.10 or newer installed on your system.

Install dependencies for the MCP server if a requirements file exists in the project directory. This commonly looks like this:

pip install -r requirements.txt

Set your abuse.ch API key as an environment variable before starting the server.

export ABUSECH_API_KEY=your_api_key_here

Start the MCP server using the Python entry point that runs the MCP script:

python abusech_mcp.py

Configuration and usage notes

The server relies on the ABUSECH_API_KEY environment variable for authenticating with abuse.ch services. Keep this key secure and rotate it if you suspect it has been exposed.

Once running, you can access the unified intelligence by querying the MCP server via your MCP client to obtain reports for IPs, domains, URLs, and files.

Troubleshooting and tips

If the server fails to start, verify that you have Python 3.10+ installed and that ABUSECH_API_KEY is set in the environment before launching the server.

Check for common startup issues such as missing dependencies. If you see import or module errors, ensure you installed the dependencies listed in the project’s requirements and that you are running the command from the correct directory where abusech_mcp.py resides.

Available tools

get_ip_report

Fetches a comprehensive IP report by aggregating data from URLhaus and ThreatFox.

get_domain_report

Fetches a domain report by aggregating data from URLhaus and ThreatFox.

get_url_report

Fetches a URL report by aggregating data from URLhaus and ThreatFox.

get_file_report

Fetches a file report (MD5/SHA-1/SHA-256) by aggregating data from MalwareBazaar, URLhaus, and ThreatFox.