# AbuseIPDB vs GreyNoise (slim)

> GreyNoise scores 66 (B) to AbuseIPDB's 55.7 (C) for secintel reputation. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/abuseipdb-vs-greynoise.md (~3,950 tokens) · this version ~2,330 tokens · JSON https://www.anchorterminal.com/compare/abuseipdb-vs-greynoise.json · canonical https://www.anchorterminal.com/compare/abuseipdb-vs-greynoise
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-03
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

GreyNoise scores 66 (B) on agent readiness against AbuseIPDB's 55.7 (C), and leads in every scored category. Both do secintel reputation.

- AbuseIPDB: C 55.7, rank #819 of 1349 · https://www.anchorterminal.com/tools/abuseipdb.min.md
- GreyNoise: B 66, rank #350 of 1349 · https://www.anchorterminal.com/tools/greynoise.min.md
- AbuseIPDB, good for An agent that needs a quick reputation verdict on an IP or subnet, or wants to report abuse from its own logs, with a free daily quota large enough for one incident. Also Free to start without a card.
- GreyNoise, good for A triage or investigation agent that needs to know whether an IP is mass-scanning background noise, a known business service or something targeted, with tags and exploited CVEs to explain the verdict. Ahead on Schema & documentation, 83 against 59; Payments & pricing, 35 against 30; Maintenance & community, 75 against 38; Transparency & trust, 76 against 63. Also A hosted endpoint, with nothing to install.

| Category | AbuseIPDB | GreyNoise |
| --- | --- | --- |
| Reliability (16%) | 75 | 78 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 59 | 83 |
| Agent ergonomics (13%) | 74 | 76 |
| Security & auth (14%) | 37 | 40 |
| Payments & pricing (10%) | 30 | 35 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 38 | 75 |
| Transparency & trust (7%) | 63 | 76 |

| Fact (where they differ) | AbuseIPDB | GreyNoise |
| --- | --- | --- |
| Vendor | AbuseIPDB LLC | GreyNoise Intelligence, Inc. |
| Hosted endpoint | no (local only) | `https://api.greynoise.io/v3` |
| Transports | stdio | HTTP, stdio |
| Licence | none | Proprietary service under the GreyNoise End User License Agreement. The MCP server (greynoise-mcp-server) and the Python SDK (pygreynoise) are MIT |
| Tools exposed | 2 | 48 |
| Read-only variant documented | yes | no |
| MCP registry | `io.github.abuseipdb/abuseipdb-mcp` | not listed |
| Last release | 2026-08-02 | 2026-10-09 |
| Terms last updated | no date given | 2025-05-07 |
| Privacy policy last updated | no date given | 2026-09-03 |
| Terms restrict automated access | yes | not found in the text |
| Terms or service can change without notice | yes | not found in the text |
| Arbitration or class-action waiver | yes | not found in the text |
| Popularity | 6 stars | 99 npm/wk |

Why the edge:
- Maintenance & community, GreyNoise +37: AbuseIPDB 38 (Read as a closed service with an official MCP server. The newest dated change to the surface is the MCP server's v0.1.1 on 2 August 2026, 93 days before the check; the API docs and blog carry no later date (10 of 30). One release in the last 90 days, v0.1.1 fell just outside it (0 of 20). Support is a contact form with no guaranteed response on the free plan, there is no public changelog for the API, and the MCP repository shows a pull request merged on 2 August but GitHub's issue pages could not be read (5 of 15). The MCP server sits in the official registry under io.github.abuseipdb (15). The MCP package has CI on Python 3.11 to 3.14 with ruff, pytest and a packaging check, and a locked dependency set (8 of 10). 10 + 0 + 5 + 15 + 8 = 38.); GreyNoise 75 (Read for a closed service with an open-source MCP server and SDK. MCP server v0.5.5 tagged 9 October 2026, 25 days before the check, and product updates on 31 August 2026 (30). In the 90 days to 3 November, dated entries are the Visualizer post of 17 August, the CrowdStrike post of 31 August and the MCP release of 9 October; the Python SDK's last tag is v3.1.0 of 9 July (12 of 20). The MCP repository merged pull request 18 from an outside account on 9 October and has commits from two outside contributors; issues could not be read on github.com; Slack and Discord communities and support@greynoise.io (15 of 25). The official MCP server is not in the official MCP registry, where three third-party servers are; the Python SDK is current (10 of 15). CI runs typecheck, tests, a build, `npm audit` and an MCPB pack, with a live read-only validation against the API, and releases publish from tags with npm provenance; the SDK repository has only a Slack notice workflow (8 of 10). 30 + 12 + 15 + 10 + 8 = 75.)
- Schema & documentation, GreyNoise +24: AbuseIPDB 59 (The surface graded is the REST API v2, with the official MCP server noted. No OpenAPI document was found. The MCP server's two tools carry JSON Schema inputs with range constraints from pydantic Field (8 of 25). llms.txt on abuseipdb.com describes the API, endpoints, categories and reporting rules (10). Each endpoint has a purpose statement and a parameter table, the FAQ explains scoring and decay, and the docs say to act on abuseConfidenceScore rather than isWhitelisted, with little on when not to call (14 of 20). Parameters give defaults and ranges (maxAgeInDays 1 to 365, perPage 1 to 100), usageType has a listed set of values and categories are numbered, but types are not stated and the categories default is ambiguous (10 of 15). Examples in cURL, Python, PHP, C# and VBScript for every endpoint, and errors follow the JSON API shape with 422, 429 and 402 examples (12 of 15). v2 is in the path, there is no API changelog, the blog's last post is from December 2018, and the reports endpoint may change without notice (5 of 15). 8 + 10 + 14 + 10 + 12 + 5 = 59.); GreyNoise 83 (OpenAPI 3.0.0 at api.greynoise.io/v3/openapi.yaml, 65 paths and 70 operations, every one with a description, 32 enums, a `key` header security scheme, and 400, 401, 403, 429 and 500 responses on nearly every operation (25). llms.txt at docs.greynoise.io/llms.txt, and every docs page is served as Markdown with a .md suffix (10). Operation descriptions say what each call returns and when to use `quick`, with little on when not to use a call; the MCP tool descriptions in the source are fuller (14 of 20). Typed path and query parameters with enums and required flags, and bulk bodies typed as `{"ips": [...]}` with a 10,000 limit in prose (12 of 15). The guides carry curl and Python examples and the spec defines error bodies with example messages, but the v3 IP reference page itself has no code sample (11 of 15). Versioned paths and a migration matrix with dated deprecation, end-of-life and decommission for v2, plus dated product-update posts naming new endpoints, but no API changelog as such and an empty roadmap page (11 of 15). 25 + 10 + 14 + 12 + 11 + 11 = 83.)
- Transparency & trust, GreyNoise +13: AbuseIPDB 63 (A closed service with clear terms that name AbuseIPDB LLC and the governing law, and an MIT MCP server (15 of 30). The privacy policy of 15 March 2023 lists providers and says data is kept as long as needed, with no retention periods, no DPA and every provider's GDPR status marked in process (10 of 30). No deprecation policy; the reports endpoint may change without notice and the only migration note is from APIv1 (3 of 20). DigitalOcean, Cloudflare, Mailgun, Google Analytics, Google Ads, Carbon, PayPal, Braintree, Freshworks and Slack are named, with processing in the United States (14 of 20). 15 + 10 + 3 + 14 = 42.); GreyNoise 76 (Closed service under an EULA last modified 7 May 2025 that is clear on scope, with the MCP server and SDK under MIT (15 of 30). Privacy policy of 3 September 2026 with retention periods (threat data indefinitely, backups 14 days, logs about 30 days, account data until deletion is requested), named subprocessors and standard contractual clauses for transfers; no DPA named, and the page as served repeats its sections twice with small differences, such as whether Cloudflare is a subprocessor (20 of 30). The migration matrix dates v2's deprecation (28 July 2025), end of life (1 January 2026) and decommission (30 April 2026) and marks five v3 endpoints deprecated, while the EULA lets GreyNoise discontinue any product at any time with 10 days' notice of EULA changes (15 of 20). Amazon Web Services, Snowflake, Auth0, Stripe, Stigg, Datadog, Webflow, Google, HubSpot and Cloudflare named, with hosting in the United States (15 of 20). 15 + 20 + 15 + 15 = 65.)
- Payments & pricing, GreyNoise +5: AbuseIPDB 30 (No x402, MPP or L402 (0). Plan prices are public, $25 and $99 a month, sold by daily quota rather than per call (10). The Individual plan allows 1,000 checks a day with no card, and paid plans carry a 30-day trial (20). The key comes from the account page after a browser signup, and the terms forbid multiple accounts to raise quota, so no autonomous route (0). 0 + 10 + 20 + 0 = 30.); GreyNoise 35 (No x402, MPP or L402 (0). Standard, Advanced and Elite are contact sales with no figure on the plans page, and no per-lookup price exists (0). A free Community account at 50 searches a week needs a business email and no card is mentioned; `/v3/community/{ip}` answers 10 lookups a day with no account at all (20). An agent can call the community endpoint with no key, but a key and the v3 API need a browser signup and a sales contract (15 of 20). 0 + 0 + 20 + 15 = 35.)