OTInstaller
Sign in

greynoise

v3.1.0Verified publisher

Looks up an IP address in GreyNoise to see whether it is internet background noise or a known benign service

Community-packaged from github.com/GreyNoise-Intelligence/pygreynoise: the registry's community pins the upstream release; the tool is its authors' work. Maintain that project? Claim this package.

Run

Through ot mcp, an agent calls run_tool with this; ot asks you before anything that goes online or touches a target. Set it up: ot mcp install claude (or cursor, vscode, codex, gemini).

{"tool":"osintverse-community/greynoise","target":"1.1.1.1","input_type":"ip"}

Or just say: "Run osintverse-community/greynoise on 1.1.1.1 with OTInstaller." The registry's read-only MCP server at api.otinstaller.com/mcp can find tools without installing anything.

ot run osintverse-community/greynoise ip:1.1.1.1 --format table
ot install osintverse-community/greynoise

Python wheel, run in a read-only container (Docker optional with --native) · network allowed · needs GREYNOISE_API_KEY · up to 5 min. The first ot run installs the tool after asking once. The example value is the registry's own test input, so this command has run. Drop --format table for JSON.

Don't have ot? Install it in one line
curl -fsSL https://get.otinstaller.com/ot | sh
What this script does
  1. Downloads the latest ot release for your machine from GitHub Releases.
  2. Checks its SHA-256 against checksums.txt, and the Ed25519 signature on that file against the key built into the script.
  3. Puts ot in /usr/local/bin or ~/.local/bin. Nothing else is written. Read the script.
irm https://get.otinstaller.com/ot.ps1 | iex
What this script does
  1. Downloads the latest ot release for your machine from GitHub Releases.
  2. Checks its SHA-256 against checksums.txt, and the Ed25519 signature on that file against the key built into the script.
  3. Puts ot in %LOCALAPPDATA%\Programs\ot, and adds it to your PATH. Nothing else is written. Read the script.

Evidence

Security tab →
  • Pinnedwheel sha256:2165b223…947572 from PyPI. ot re-hashes the file after download and refuses a mismatch.
  • Not signedthis release carries no signature the registry could verify. ot warns before installing.
  • Scanned22 Oct 2026: 0 critical, 0 high, 5 medium, 1 low vulnerabilities; 0 embedded secrets, 0 malware heuristics; SBOM with 21 packages.
  • Workssmoke test passed on 22 Oct 2026 (exit 255 in 3.6 s, offline sandbox); the nightly health check has not run yet.
  • Backed upa copy of this wheel is kept by the registry. If PyPI removes it, ot downloads the copy and checks the same hash.
  • Reviewedosintverse-community is a verified publisher: the registry confirmed who runs it, and a person reviewed its first release against the acceptable-use rules.

What you get back

Result envelope →
{
  "envelope": 1,
  "tool": "osintverse-community/greynoise@3.1.0",
  "runtime": "pipx",
  "input": {
    "ip": "1.1.1.1"
  },
  "started_at": "2026-10-21T09:00:00Z",
  "duration_ms": 4100,
  "exit_code": 0,
  "entities": [
    {
      "type": "ip",
      "value": "192.0.2.1"
    },
    {
      "type": "organization",
      "value": "Example Ltd"
    },
    {
      "type": "other",
      "value": "…"
    }
  ],
  "warnings": []
}

Every tool returns this shape, shaped here from what this tool declares it finds. --format table to read it; ot extract and ot auto to continue.

greynoise (community package)

This repository packages github.com/GreyNoise-Intelligence/pygreynoise for the OTInstaller Registry as osintverse-community/greynoise. The tool is the work of its authors, under the MIT license; this repository only holds the manifest and release workflow.

Report problems with the tool upstream, and problems with the packaging here. If you maintain the upstream project and want to publish it yourself, open an issue or run ot claim osintverse-community/greynoise: the package is transferred to you.

It installs the upstream project's own release from PyPI, pinned by version and hash; nothing here is rebuilt.

The wrapper uses the Community API (--offering community), which free GreyNoise accounts can call; Enterprise keys work with it too. Without GREYNOISE_API_KEY the CLI prints how to set it and exits with code 255, which is what the registry's smoke test expects.

ot run osintverse-community/greynoise --ip …

Packaged version: 3.1.0.

What next

greynoise finds ip, organization, other. Tools that take those:

ip → 6 toolsorganization → 1 toolot auto, with a saved result

Other ip address tools

All ip address tools →

Alternatives to greynoise that also take an ip address; ot auto runs every installed one on the same value.

osintverse-community/ipwhois

Looks up who holds an IP address through RDAP: network, ASN, organisation and contacts

Takes ip address → finds organization, other
No key · Docker
Worked todayVerified publisher

osintverse-community/naabu

Lists an IP's open ports passively from Shodan InternetDB, without scanning it

Takes ip address → finds other
No key · Docker
Worked todayVerified publisher

osintverse-community/shodan-host

Shows what Shodan has seen on an IP: open ports, services, banners, vulnerabilities, location

Takes ip address → finds location, organization, other
Key required · Docker
Worked todayVerified publisher

osintverse-community/dnsanity

Checks whether DNS resolvers answer correctly by comparing them with trusted resolvers on a test template

Takes ip address → finds ip
No key · Docker
Not health-checkedVerified publisher

osintverse-community/cut-cdn

Filters out IP addresses that belong to known CDN providers, leaving the ones that point at real origin servers

Takes ip address → finds ip
No key · Docker
Not health-checkedVerified publisher
Esc

Try

↑ ↓ to move↵ to open