bulk_report
Bulk Report IPs
Submit multiple IP abuse reports at once by uploading CSV data. Include the required IP, Categories, ReportDate, and Comment columns. Returns the number of successfully saved reports and details about any invalid entries.
Ask your agent in plain language. Each of these maps to a real tool on the server.
bulk_report
Submit multiple IP abuse reports at once by uploading CSV data. Include the required IP, Categories, ReportDate, and Comment columns. Returns the number of successfully saved reports and details about any invalid entries.
get_ip_reports
Retrieve detailed, paginated abuse reports for a specific IP address. Each report includes the reporter's information, abuse categories, comments, and timestamps. Use this for in-depth investigation of abuse activity against a specific IP.
check_subnet
Check an entire subnet (CIDR notation) for IP addresses that have been reported for abuse. Returns network details and a list of reported addresses within the block with their abuse scores. Use this to assess the reputation of a network range.
get_blacklist
Retrieve a structured list of the most reported IP addresses, ordered by abuse confidence score. Can be filtered by minimum confidence score, country, and IP version. Use this to populate firewall blocklists or analyze global threat trends.
check_ip
Look up the abuse reputation of an IP address (IPv4 or IPv6). Returns the abuse confidence score (0–100), geographic and network information, and optionally individual abuse reports in verbose mode. Use this to assess whether an IP address has been involved in malicious activity.
clear_ip_reports
Delete all abuse reports that **your account** has previously submitted for a specific IP address. This does not affect reports submitted by other users. Use this to retract mistaken or outdated reports for an IP address.
report_ip
Submit an abuse report for a malicious IP address. Specify the IP, one or more abuse category IDs, and an optional comment describing the attack. **Abuse category IDs:** - 1: DNS Compromise — 2: DNS Poisoning — 3: Fraud Orders — 4: DDoS Attack - 5: FTP Brute-Force — 6: Ping of Death — 7: Phishing — 8: Fraud VoIP - 9: Open Proxy — 10: Web Spam — 11: Email Spam — 12: Blog Spam - 13: VPN IP — 14: Port Scan — 15: Hacking — 16: SQL Injection - 17: Spoofing — 18: Brute Force — 19: Bad Web Bot — 20: Exploited Host - 21: Web App Attack — 22: SSH — 23: IoT Targeted
export_blacklist
Prepare a downloadable plaintext blacklist with one IP address per line for firewall import. Supports the same confidence, country, and IP version filters as get_blacklist.
Every client uses the same Magic MCP URL, and so does any other MCP client. Add it once and sign in with SSO.
{"mcpServers": {"metorial": {"url": "<your-magic-mcp-url>"}}}
claude mcp add --transport http metorial <your-magic-mcp-url>
codex mcp add metorial --url <your-magic-mcp-url>codex mcp login metorial
One governed layer for every app your agents reach, not a separate connector per tool.
Check IP address reputation and abuse confidence scores. Report malicious IP addresses with categorized abuse types. Retrieve detailed abuse reports for IPs and subnets. Download blacklists of known malicious IPs for firewall import. Bulk-report abusive IPs via CSV upload. Clear your own submitted reports for an IP address.
Common questions about connecting Abuseipdb to AI agents with Metorial.