KosmoKrator

data

AbuseIPDB Lua API for KosmoKrator Agents

Agent-facing Lua documentation and function reference for the AbuseIPDB KosmoKrator integration.

Lua Namespace

Agents call this integration through app.integrations.abuseipdb.*. Use lua_read_doc("integrations.abuseipdb") inside KosmoKrator to discover the same reference at runtime.

Call Lua from the Headless CLI

Use kosmo integrations:lua when a shell script, CI job, cron job, or another coding CLI should run a deterministic AbuseIPDB workflow without starting an interactive agent session.

Inline Lua call 
kosmo integrations:lua --eval 'dump(app.integrations.abuseipdb.check({}))' --json
Read Lua docs headlessly 
kosmo integrations:lua --eval 'print(docs.read("abuseipdb"))' --json
kosmo integrations:lua --eval 'print(docs.read("abuseipdb.check"))' --json

Workflow file

Put repeatable logic in a Lua file, then execute it with JSON output for the calling process.

workflow.lua 
local abuseipdb = app.integrations.abuseipdb
local result = abuseipdb.check({})

dump(result)
Run the workflow 
kosmo integrations:lua workflow.lua --json
kosmo integrations:lua workflow.lua --force --json
Namespace note. integrations:lua exposes app.integrations.abuseipdb, app.mcp.*, docs.*, json.*, and regex.*. Use app.integrations.abuseipdb.default.* or app.integrations.abuseipdb.work.* when you configured named credential accounts.

MCP-only Lua

If the script only needs configured MCP servers and does not need AbuseIPDB, use the narrower mcp:lua command.

MCP Lua command 
# Use mcp:lua for MCP-only scripts; use integrations:lua for this integration namespace.
kosmo mcp:lua --eval 'dump(mcp.servers())' --json

Agent-Facing Lua Docs

This is the rendered version of the full Lua documentation exposed to agents when they inspect the integration namespace.

AbuseIPDB

Namespace: abuseipdb

Use this integration to query and submit AbuseIPDB API v2 threat-intelligence data: IP reputation checks, report history, blacklist feeds, CIDR block checks, single reports, CSV bulk reports, and clearing reports from the configured account.

Authentication

All AbuseIPDB API v2 endpoints require an API key. The integration sends it in the Key header, as AbuseIPDB recommends.

Tools

  • abuseipdb_check: check one IPv4 or IPv6 address.
  • abuseipdb_reports: list report history for one IP with pagination.
  • abuseipdb_blacklist: retrieve JSON blacklist data or plaintext IPs.
  • abuseipdb_report: submit one abuse report.
  • abuseipdb_check_block: check a CIDR block.
  • abuseipdb_bulk_report: submit CSV report content as a multipart upload.
  • abuseipdb_clear_address: clear this account’s reports for one IP.

Return Notes

JSON endpoints return AbuseIPDB’s documented response shape, usually under data. JSON API error responses are flattened into tool errors using the first errors[].detail value when present.

When abuseipdb_blacklist is called with plaintext = true, the integration returns both data, a parsed list of non-empty IP lines, and body, the raw plaintext response.

Examples

local check = tools.abuseipdb_check({
  ip_address = "198.51.100.10",
  max_age_in_days = 30,
  verbose = true
})

local block = tools.abuseipdb_check_block({
  network = "198.51.100.0/24",
  max_age_in_days = 15
})

local feed = tools.abuseipdb_blacklist({
  confidence_minimum = 90,
  ip_version = 4
})

For write tools, avoid submitting private log data, real customer data, or PII in comments or CSV content.

Raw agent markdown 
# AbuseIPDB

Namespace: `abuseipdb`

Use this integration to query and submit AbuseIPDB API v2 threat-intelligence
data: IP reputation checks, report history, blacklist feeds, CIDR block checks,
single reports, CSV bulk reports, and clearing reports from the configured
account.

## Authentication

All AbuseIPDB API v2 endpoints require an API key. The integration sends it in
the `Key` header, as AbuseIPDB recommends.

## Tools

- `abuseipdb_check`: check one IPv4 or IPv6 address.
- `abuseipdb_reports`: list report history for one IP with pagination.
- `abuseipdb_blacklist`: retrieve JSON blacklist data or plaintext IPs.
- `abuseipdb_report`: submit one abuse report.
- `abuseipdb_check_block`: check a CIDR block.
- `abuseipdb_bulk_report`: submit CSV report content as a multipart upload.
- `abuseipdb_clear_address`: clear this account's reports for one IP.

## Return Notes

JSON endpoints return AbuseIPDB's documented response shape, usually under
`data`. JSON API error responses are flattened into tool errors using the first
`errors[].detail` value when present.

When `abuseipdb_blacklist` is called with `plaintext = true`, the integration
returns both `data`, a parsed list of non-empty IP lines, and `body`, the raw
plaintext response.

## Examples

```lua
local check = tools.abuseipdb_check({
  ip_address = "198.51.100.10",
  max_age_in_days = 30,
  verbose = true
})

local block = tools.abuseipdb_check_block({
  network = "198.51.100.0/24",
  max_age_in_days = 15
})

local feed = tools.abuseipdb_blacklist({
  confidence_minimum = 90,
  ip_version = 4
})
```

For write tools, avoid submitting private log data, real customer data, or PII
in comments or CSV content.
Metadata-derived Lua example 
local result = app.integrations.abuseipdb.check({})
print(result)

Functions

check Read

Check reputation for one IP address.

Lua path
app.integrations.abuseipdb.check
Full name
abuseipdb.abuseipdb_check
ParameterTypeRequiredDescription
No parameters.
reports Read

List reports for one IP address.

Lua path
app.integrations.abuseipdb.reports
Full name
abuseipdb.abuseipdb_reports
ParameterTypeRequiredDescription
No parameters.
blacklist Read

Retrieve the AbuseIPDB blacklist.

Lua path
app.integrations.abuseipdb.blacklist
Full name
abuseipdb.abuseipdb_blacklist
ParameterTypeRequiredDescription
No parameters.
report Write

Submit an abuse report for one IP address.

Lua path
app.integrations.abuseipdb.report
Full name
abuseipdb.abuseipdb_report
ParameterTypeRequiredDescription
No parameters.
check_block Read

Check abuse data for a CIDR block.

Lua path
app.integrations.abuseipdb.check_block
Full name
abuseipdb.abuseipdb_check_block
ParameterTypeRequiredDescription
No parameters.
bulk_report Write

Submit CSV abuse reports in bulk.

Lua path
app.integrations.abuseipdb.bulk_report
Full name
abuseipdb.abuseipdb_bulk_report
ParameterTypeRequiredDescription
No parameters.
clear_address Write

Clear this account reports for one IP address.

Lua path
app.integrations.abuseipdb.clear_address
Full name
abuseipdb.abuseipdb_clear_address
ParameterTypeRequiredDescription
No parameters.