Integration

AbuseIPDB integration

AbuseIPDB is a shared database of IP addresses reported for hacking, spam, brute-force and other abuse. Check an address's abuse confidence score, ISP, country and Tor status, read the reports filed against it, check a whole subnet, download the blacklist of the most reported addresses, file a public abuse report, and delete the reports your own account filed for an address. Reports are public, and their comments and the addresses themselves can be personal data. Left out: the bulk CSV report upload (its file format is documented only on a web form) and the plain-text blacklist. Authentication is an APIv2 key from the account dashboard, sent in the Key header.

Connect AbuseIPDB How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in AbuseIPDB.Built from the 6 AbuseIPDB tools below, on the connection you add once.

What you can do with AbuseIPDB

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Report, 2 operations

list_ip_reportsList ip reportsGETReturns the abuse reports filed against one IPv4 or IPv6 address, page by page, with each reporter's comment and categories. The vendor marks this endpoint as open beta.
report_ipReport ipPOSTFiles a public abuse report against an IP address in AbuseIPDB's shared database, visible to every AbuseIPDB user and counted in the address's score. Returns the address's updated abuse confidence score.

Blacklist, 1 operation

get_blacklistGet blacklistGETReturns AbuseIPDB's list of the most reported addresses, ordered by abuse confidence score then by last report, each with its score and last report time. Up to 10,000 addresses on the free plan.

Check, 1 operation

check_ipCheck ipGETReturns AbuseIPDB's verdict on one IPv4 or IPv6 address, mainly the abuse confidence score (0 to 100), how often and by how many users it was reported, and its country, ISP, usage type and Tor status.

Check block, 1 operation

check_networkCheck networkGETReturns the addresses of a subnet (CIDR notation, IPv4 or IPv6) that were reported, with each one's report count, last report time and abuse confidence score, plus the subnet's range and address space.

Clear address, 1 operation

clear_address_reportsClear address reportsDELETEDeletes every report YOUR account filed against one IP address and returns how many were deleted. Reports by other users are untouched.

Use AbuseIPDB from Claude Code, Cursor or Codex

Connect AbuseIPDB in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its AbuseIPDB operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect AbuseIPDB

Create your workspace
Sign up free. Nothing to install.
Connect AbuseIPDB once
Add your AbuseIPDB connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.