AbuseIPDB MCP integration for AI agents.
Connect AI agents to AbuseIPDB through 4 structured actions, including check block, blacklist, and check ip. Review authentication, inputs, workflows, and sa…
- ACTION CONTRACTS
- 4
- AUTHENTICATION
- API key
- SOURCE STATUS
- Provider-backed
CATALOG SOURCE REVIEWED AUGUST 23, 2026 / ACTION NAMES AND SCHEMAS DERIVED FROM WORKING MACHINES PROVIDER SOURCE
CAPABILITY PROFILE
What the AbuseIPDB integration exposes
The AbuseIPDB Agent App exposes 4 provider-backed actions for security and data work. Its current contract lets an authorized agent inspect a cidr block for reported addresses with abuseipdb, read the structured abuseipdb blacklist feed in json format, and check the abuse reputation of a single ip address with abuseipdb. These operations are called through Working Machines as typed capabilities rather than through browser navigation or copied UI steps.
A connection uses API key. Before execution, the agent can inspect the selected action, its required fields, declared scopes, and expected output contract. Provider credentials remain inside the Working Machines runtime; the calling agent receives the capability and its structured result, not the underlying secret.
For reliable operation, start with the narrowest action that satisfies the task, resolve stable provider identifiers before changing state, and validate the returned object or status after execution. Availability still depends on the connected AbuseIPDB account, granted provider permissions, workspace policy, region, plan, and upstream API behavior.
VERIFIED ACTION SAMPLE
Real AbuseIPDB capabilities.
Showing 4 of 4 actions. Risk labels are conservative signals based on operation names, not substitutes for provider documentation or runtime policy.
check_blockREADInspect a CIDR block for reported addresses with AbuseIPDB.
INPUTS: network / maxAgeInDays
blacklistREVIEWRead the structured AbuseIPDB blacklist feed in JSON format.
INPUTS: limit / ipVersion / confidenceMinimum / onlyCountries / exceptCountries
check_ipREADCheck the abuse reputation of a single IP address with AbuseIPDB.
INPUTS: ipAddress / maxAgeInDays / verbose
get_reportsREADList detailed AbuseIPDB reports for a single IP address.
INPUTS: ipAddress / maxAgeInDays / page / perPage
INPUT CONTRACTS
Know what the action needs before it runs.
check_block
networkREQUIRED- CIDR network to inspect with the AbuseIPDB block endpoint.
maxAgeInDaysOPTIONAL- Look-back window in days for AbuseIPDB report matching.
blacklist
limitOPTIONAL- Maximum number of blacklist entries to return.
ipVersionOPTIONAL- Optional IP version filter for blacklist results.
confidenceMinimumOPTIONAL- Minimum abuse confidence score required for returned entries.
onlyCountriesOPTIONAL- Optional allowlist of countries to include in the blacklist response.
exceptCountriesOPTIONAL- Optional denylist of countries to exclude from the blacklist response.
check_ip
ipAddressREQUIRED- IPv4 or IPv6 address to inspect.
maxAgeInDaysOPTIONAL- Look-back window in days for AbuseIPDB report matching.
verboseOPTIONAL- Whether to include detailed abuse reports in the response.
get_reports
ipAddressREQUIRED- IPv4 or IPv6 address to inspect.
maxAgeInDaysOPTIONAL- Look-back window in days for AbuseIPDB report matching.
pageOPTIONAL- Page number to request from the AbuseIPDB reports endpoint.
perPageOPTIONAL- Number of reports to request per page from AbuseIPDB.
PROVIDER-SPECIFIC WORKFLOWS
Jobs this Agent App can support
Inspect Check Block
Inspect a CIDR block for reported addresses with AbuseIPDB. Use this as a bounded discovery step, retain the returned identifier, and avoid expanding the read beyond the task's stated scope.
check_blockVerify with Check Ip
Check the abuse reputation of a single IP address with AbuseIPDB. Compare the returned provider state with the intended outcome and preserve stable IDs or canonical links in the run record.
check_ipSAFETY BOUNDARY
Operate AbuseIPDB with explicit limits
- Authorize AbuseIPDB with API key and grant only the provider access required by the selected actions.
- The current action names appear read-oriented, but returned AbuseIPDB data may still be sensitive and should be minimized before it enters model context.
- Do not infer permission from catalog visibility. Workspace policy, connection identity, and upstream authorization still govern execution.
- No provider scope string is declared on the sampled actions. Verify the connected account's actual permissions in AbuseIPDB rather than assuming unrestricted access.
- After a call, inspect the structured result and execution record before reporting that the AbuseIPDB task completed successfully.
CONNECTION MODEL
API key
AbuseIPDB API key sent with the Key header. Get it from your account page under API Settings: https://www.abuseipdb.com/api.html.
Working Machines stores provider credentials behind the execution boundary. An agent can use an authorized connection identity, but catalog discovery alone does not reveal OAuth tokens, API keys, or provider secrets.
- READ SIGNALS
- 3
- WRITE SIGNALS
- 0
- HIGH IMPACT
- 0
- REVIEW SIGNALS
- 1
EVIDENCE AND AVAILABILITY
Provider reference
Action names, input fields, authentication types, and counts on this page are generated from the Working Machines provider catalog. Provider behavior, quotas, object semantics, account eligibility, and regional availability remain governed by AbuseIPDB.