IR Toolshed

an MCP server providing tools for network incident response folks

python

2

GitHub Stars

python

Language

6 months ago

First Indexed

2 months ago

Catalog Refreshed

Documentation & install

Readme and setup notes from the catalogue, plus a client-ready config you can copy for your MCP host.

Installation

Add the following to your MCP client configuration file.

Configuration

View docs

{
  "mcpServers": {
    "rossja-irtoolshed-mcp-server": {
      "command": "uv",
      "args": [
        "run",
        "mcp",
        "dev",
        "src/mcp_server.py"
      ]
    }
  }
}

You run the IR Toolshed MCP Server to provide incident response and network analysis tools that you can access from an MCP client. It offers practical capabilities like ASN lookups, DNS lookups, WHOIS data, and geolocation information to help security investigations and network analyses from a unified MCP interface.

How to use

Connect to the server from your MCP client to start issuing lookups and analyses. You can perform AS Number lookups to map IPs to ownership, resolve DNS records for domains, retrieve WHOIS ownership and registrar details, and obtain geolocation data for IP addresses. Each tool returns structured results you can use directly in your investigations, and you can combine multiple tools to build a fuller picture of a given IP or domain.

How to install

Prerequisites: You need Python and the uv package manager available on your system.

# 1) Clone the project
# (Replace <repository-url> with the actual URL you were provided)
git clone <repository-url>
cd irtoolshed_mcp_server

# 2) Create a virtual environment
uv venv

# 3) Activate the virtual environment
# On Windows:
.venv\Scripts\activate
# On macOS/Linux:
source .venv/bin/activate

# 4) Install the package in development mode
uv pip install -e .

Running the server

Start the MCP server in development mode so you can connect with MCP clients. Use the runtime command shown here to launch the server.

uv run mcp dev src/mcp_server.py

Notes on usage with an MCP client

Once the server is running, you can invoke each tool through your MCP client interface by calling the corresponding tool function with the required input (for example, an IP address for ASN or a domain for DNS/WB). The client will receive structured results that you can interpret or display in your workflow.

Security and maintenance

Operate the server in accordance with applicable laws and organizational policies. Keep dependencies up to date, monitor license terms (for geolocation data), and manage access controls for your MCP client connections.

Available tools

asnlookup

Performs ASN lookups to map an IP address to its AS number and the owning organization.

dnslookup

Queries DNS records for domains and returns records of types such as A, AAAA, MX, NS, and TXT.

whoislookup

Retrieves domain registration details including ownership, registration dates, nameservers, and registrar information.

geolocation

Provides IP geolocation data (country, city, coordinates, network, timezone) using a geolocation database.