AbuseIPDB MCP integration
Scores an IP or a whole network block before you trust it, reads the complaints behind that score, and files your own reports back.
6actions available
Three actions you can hand over today
Every action runs live through MCP. Nothing to build, nothing to maintain.
Check IP reputation
Lyro checks the abuse reputation of an IP address against AbuseIPDB's database. A security team confirms whether traffic from an address is flagged as malicious before deciding how to respond.
Bulk report
Lyro submits multiple IP abuse reports to AbuseIPDB at once via a CSV upload. A team logs a batch of malicious addresses in one action instead of filing each report separately.
Clear address reports
Lyro removes all abuse reports associated with a specific IP address from AbuseIPDB. A team corrects a mistaken or outdated report without contacting AbuseIPDB support directly.
How businesses use AbuseIPDB + Lyro
Each card is one request a support team gets, and the AbuseIPDB actions Lyro runs to close it.
Check an address before you trust the request
Lyro looks up the abuse confidence score for an IP over a chosen look-back period and reads the individual complaints behind it, including the reported categories, rather than treating the score as a bare number.
Check IP ReputationGet Abuse ReportsJudge a whole network, not one address
Lyro scores every address in a CIDR range for aggregated abuse data on that block, and pulls the most reported addresses in the database to feed a blocklist or firewall rule.
Check BlockRetrieve IP BlacklistContribute back what you have seen
After an abusive session, Lyro submits reports in bulk through a CSV upload and clears the reports your account filed against an address once you have verified you control it.
Bulk ReportClear Address Reports
How it works
Get started in 3 steps
Connect once, then just ask. There is no workflow builder to learn and nothing to maintain — Lyro reads the AbuseIPDB actions it has and picks the ones a request needs.
Connect AbuseIPDB
Authorize the AbuseIPDB account your team already uses — one consent screen, no API keys, no mapping tables. Lyro can only do what you granted that account, and you can disconnect it at any time.
Tell your agent what you need
Describe the job the way you would hand it to a teammate. Lyro maps it to the AbuseIPDB actions that close it and chains as many as the request needs.
Watch it work
The agent runs the actions inside the conversation the customer is already in, so nobody copies data between tabs and your team can take over at any point.
Get started free
AbuseIPDB · Lyro
What can you do in AbuseIPDB without me setting anything up?
These, right away:
- Check an IP address
- Report an IP address
- List recent reports
Great, let's start with the first one.
FAQ
Everything else about AbuseIPDB
Setup, permissions, and the limits of what Lyro can do inside AbuseIPDB.
That is your policy call, not the score's. Check IP Reputation returns a community-sourced abuse confidence score over a look-back window you set, and Get Abuse Reports shows the actual complaints and categories behind it - so the decision can be made on what was reported rather than on the number alone.
Every action available in AbuseIPDB
All 6 actions your agent can call on AbuseIPDB, straight from the live MCP connection.
Retrieve IP blacklist
Retrieves a list of the most reported malicious IP addresses from AbuseIPDB's database.
Bulk report
Submit multiple IP abuse reports to AbuseIPDB in bulk via CSV upload.
Check block
Check the reputation of all IP addresses in a CIDR range.
Check IP reputation
Check the reputation of an IP address.
Clear address reports
Remove all reports associated with a specific IP address.
Get abuse reports
Retrieve abuse reports for a specific IP address from AbuseIPDB.
The tools AbuseIPDB sits next to
Same connection, same setup. Pick the next one your team already uses.
Bitwarden
Looks up members, groups, and their assigned collections, bulk imports or reinvites people, toggles admin rights, and revokes access when someone leaves.
Borneo
Reports scan findings and open issues, clears false positives, keeps the recipient and processing-activity register current, and works breach cases as facts land.
Identitycheck
Reports where an onboarding session has reached, returns captured documents, and maintains verification configurations and webhook endpoints.
Ip2proxy
Checks an IP address against IP2Proxy's proxy, VPN, and TOR detection mid-conversation.
Blazemeter
Starts and stops performance tests, uploads test files, reports run summaries, and schedules the API monitoring that catches regressions.
Convex
Creates projects and deployments, batches query functions to read app data, issues and audits deploy keys, and reports log streams.
Ready to connect AbuseIPDB?
Authorize the account and your agent has all 6 actions from the first conversation.