Advertise
MCP.so
Sign In

IR Toolshed MCP Server

@rossja

Repository

Basic information

Category

Other

License

Apache-2.0

Transports

stdio

Author

rossja

About IR Toolshed MCP Server

an MCP server providing tools for network incident response folks

IR Toolshed MCP Server config

Add this server to your MCP-compatible client using the configuration below.

{
  "mcpServers": {
    "irtoolshed-mcp-server": {
      "command": "uv",
      "args": [
        "venv"
      ]
    }
  }
}

IR Toolshed MCP Server tools

Tool list not available yet

This listing does not currently have a tool list to display. This does not mean the server has no tools; check its documentation for supported capabilities.

We auto-extract tools from the README. The maintainer can list them under a ## Tools heading to populate this section.

Overview

What is IR Toolshed MCP Server?

IR Toolshed MCP Server is a comprehensive Model Context Protocol (MCP) server that provides incident response and network analysis tools for security professionals. It enables AI agents like Claude to perform network-related lookups and analyses to assist with security investigations.

How to use IR Toolshed MCP Server?

Clone the repository, create a virtual environment with uv venv, activate it, then install the package with uv pip install -e .. Start the server using uv run mcp dev src/mcp_server.py. For IP geolocation, set the MAXMIND_LICENSE_KEY environment variable or provide it as a parameter when using the tool.

Key features of IR Toolshed MCP Server

  • ASN lookup for IP addresses
  • DNS lookup (A, AAAA, MX, NS, TXT)
  • WHOIS record retrieval for domains
  • IP geolocation via MaxMind GeoLite2
  • Consistent error handling across all tools
  • Detailed documentation as resources for AI agents

Use cases of IR Toolshed MCP Server

  • Investigating suspicious IP addresses during incident response
  • Verifying domain ownership and registration details
  • Enriching threat intelligence with geolocation data
  • Automating DNS and WHOIS lookups in security workflows

Frequently asked questions

1

What is IR Toolshed MCP Server?

It is an MCP server that exposes networking and security tools (ASN, DNS, WHOIS, geolocation) as callable resources for AI agents, designed for security professionals.

2

What are the prerequisites to run it?

Python 3.8 or newer (3.13+ recommended) and the `uv` package manager. The geolocation tool additionally requires a free MaxMind license key.

3

How do I obtain a MaxMind license key?

Visit https://dev.maxmind.com/geoip/geolite2-free-geolocation-data to get a free key. Set it as the `MAXMIND_LICENSE_KEY` environment variable or provide it each time you use the geolocation tool.

4

What happens when a lookup fails?

Each tool returns a structured error response with a status of "error", a detailed error message, and the original query value, enabling graceful handling by AI agents.

5

Does the server require an internet connection?

Yes, ASN, DNS, and WHOIS lookups require network access to external services. The geolocation tool uses a local MaxMind database but still needs an internet connection to download the database initially.

Comments

More Other MCP servers

Hindsight

vectorize-io

Hindsight: Agent Memory That Learns

50.4K

MaxKB

1Panel-dev

🔥 MaxKB is an open-source platform for building enterprise-grade agents. 强大易用的开源企业级智能体平台。

22.0K

Screenpipe

screenpipe

YC (S26) | Open Computer History | Continuously record your company computer work, map your workflows, help you find work worth automating, and power your agents' context

22.0K

Senso MCP for Joomla

sensomedia

Senso MCP turns a Joomla 5 or 6 site into a remote MCP server. It runs inside Joomla itself (no extra server, no Node.js bridge) and is secured with OAuth 2.1 and Joomla's own ACL. The free pack lets an AI assistant crea

EverArt

modelcontextprotocol

Model Context Protocol Servers

88.1K
Advertise