ThreatFox

liveSecurity

abuse.ch IOC feed — IPs, domains, URLs, hashes tied to malware families and campaigns.

4tools
0msauth
free tier50 calls/day

Tools

search_iocrequired: indicator

Look up a specific indicator of compromise (IP, domain, URL, hash, etc.). Returns matching IOCs with malware family, confidence, threat-type, first/last seen, tags, references.

Parameters
NameTypeDescription
indicatorreqstringIP/domain/URL/hash
exact_matchoptbooleanDefault true
▶Try it
recent_iocs

IOCs added to ThreatFox in the last N days. Useful for daily threat-intel ingestion.

Parameters
NameTypeDescription
daysoptnumber1-7
▶Try it
search_hashrequired: hash

Everything ThreatFox knows about one file hash (md5 / sha1 / sha256), across BOTH relations it stores hashes in —

Parameters
NameTypeDescription
hashreqstringmd5/sha1/sha256
▶Try it
search_malwarerequired: malware

IOCs tagged to a malware family (e.g., "Cobalt Strike", "Emotet", "QakBot").

Parameters
NameTypeDescription
malwarereqstringFamily name
limitoptnumberMax records
▶Try it

Test with curl

The gateway speaks JSON-RPC 2.0 over HTTP POST. You can test any pack directly from the terminal.

List available tools
bash
curl -X POST https://gateway.pipeworx.io/threatfox/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
Call a tool
bash
curl -X POST https://gateway.pipeworx.io/threatfox/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"search_ioc","arguments":{"indicator": "example"}}}'

Use with the SDK

Install @pipeworx/sdk to call tools from any TypeScript/Node project.

TypeScript
import { Pipeworx } from '@pipeworx/sdk';
const px = new Pipeworx();
const result = await px.call("search_ioc", {"indicator":"example"});
ask_pipeworx
// Or ask in plain English:
const answer = await px.ask("abuse");