Connects Claude to abuse.ch's Feodo Tracker, a live feed of botnet command-and-control IP addresses. You get four tools: list the current blocklist with optional filters for malware family or status, check if a specific IPv4 is flagged, pull entries first seen in the last N hours, or grab the aggressive blocklist that includes older and lower-confidence indicators. Useful when you're triaging suspicious IPs, building security automation, or need real-time botnet intelligence without leaving your MCP workflow. Part of the Pipeworx gateway, so you can query it directly or use ask_pipeworx to retrieve blocklist data in plain English.
Feodo Tracker MCP — botnet C&C IP blocklist from abuse.ch.
Part of Pipeworx — an MCP gateway connecting AI agents to 673+ live data sources.
| Tool | Description |
|---|---|
list | Current C&C blocklist (optional malware-family / status filter). |
check_ip | Check whether a given IPv4 is on the current blocklist. |
recent | Blocklist entries first seen in the last N hours. |
aggressive | Full aggressive blocklist (includes older + lower-confidence IPs). |
Add to your MCP client (Claude Desktop, Cursor, Windsurf, etc.):
{
"mcpServers": {
"feodotracker": {
"url": "https://gateway.pipeworx.io/feodotracker/mcp"
}
}
}
Or connect to the full Pipeworx gateway for access to all 673+ data sources:
{
"mcpServers": {
"pipeworx": {
"url": "https://gateway.pipeworx.io/mcp"
}
}
}
Instead of calling tools directly, you can ask questions in plain English:
ask_pipeworx({ question: "your question about Feodotracker data" })
The gateway picks the right tool and fills the arguments automatically.
MIT