Abuse.ch

This MCP server provides threat intelligence analysis by integrating with abuse.ch platforms including MalwareBazaar, URLhaus, and ThreatFox to deliver comprehensive security reports for files, URLs, domains, and IP addresses. Built with Python using FastMCP and aiohttp for async operations, it features structured Pydantic schemas for data validation, concurrent API calls for performance, and automatic response limiting to prevent oversized payloads. The implementation offers four core tools for retrieving detailed threat reports with hash validation, URL formatting, and consolidated intelligence from multiple abuse.ch sources, making it valuable for security analysts, incident responders, and threat hunters who need programmatic access to malware intelligence and IOC enrichment capabilities.