isIPsafe

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

• Connection: Runs in the cloud
• Transport: Streamable HTTP
• Category: Other
• You need to fill in: X-API-Key

Install

Pick the AI app you use, then copy the settings.

You need

• Runs in the cloudNothing to install; it connects over the internet

Which app do you use?

claude mcp add --transport http isipsafe https://isipsafe.com/mcp --header 'X-API-Key: your-value'

{
  "mcpServers": {
    "isipsafe": {
      "url": "https://isipsafe.com/mcp",
      "headers": {
        "X-API-Key": "your-value"
      }
    }
  }
}

{
  "servers": {
    "isipsafe": {
      "type": "http",
      "url": "https://isipsafe.com/mcp",
      "headers": {
        "X-API-Key": "your-value"
      }
    }
  }
}

Your choice stays on this device in a cookie; no account needed.

Values you fill in

• X-API-Key secret HTTP header
  isIPsafe API key. Optional for lookups, needed to report IPs. Get one at https://isipsafe.com/account

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

Tool names and descriptions exactly as the server reported them on Nov 6, 2026. The maker wrote them, not us; we show them as plain text.

• check_ip

  Reputation of one IPv4 or IPv6 address: abuse confidence score (0-100, 75+ is on the blocklist), number of reports and distinct reporters, attack categories, country, network owner (ASN), Tor exit status and a link to its page. Set verbose to include the latest reports with their

• get_reports

  The individual abuse reports filed against one address, newest first, with time, categories, comment (usually log lines) and reporter. Paginated.

• check_network

  Every reported address inside a CIDR block (IPv4 up to /16, IPv6 up to /48), with score, report count and last report time, plus the network's owner. Use it to judge a whole hosting range or subnet.

• report_ip

  File an abuse report against an address that attacked a system you run. Needs an API key. Use category codes from list_categories (e.g. ssh,brute-force) and put the evidence (log lines, never personal data) in the comment. Each reporter can report the same address once per 15 min

• get_blocklist

  The highest-confidence abusive addresses right now, best first, with score, country and categories. Needs an API key and counts as one blocklist download. For a firewall-ready file, point the firewall at the blocklist URL instead (see the integrations).

• list_categories

  All attack categories with their code, numeric ID, group and when to use them. Use the codes with report_ip.

• get_statistics

  What the database sees right now: reports in the last 24 hours, addresses on the blocklist, and over the last 30 days the top attack categories, countries, networks and highest-scoring addresses.

• get_today_news

  Today's threat news from the last 24 hours: the countries the most reported attacks come from, the networks (ASNs) behind them, the attack techniques (categories) reported most, and the top 10 malicious IP addresses reported today, highest score first. Use it for a daily briefing

• analyze_logs

  Find malicious traffic in logs. Pass raw log lines from any source (nginx/Apache/IIS access logs, sshd/auth.log, syslog, firewall such as iptables/UFW/pfSense/ASA, mail servers, Windows events as text, CEF, JSON lines from a SIEM or cloud, CSV); every IPv4/IPv6 address is extract

• get_country_report

  How many addresses in a country were reported in the last 30 days, how many are on the blocklist, the most reported addresses there, and the networks and attack categories behind them.

• get_network_report

  Abuse reported against one autonomous system in the last 30 days: number of reported and blocklisted addresses, the worst addresses, attack categories and countries. Useful to judge a hosting provider or ISP.

• about_isipsafe

  Explains isIPsafe itself. Use it for any question about the product rather than guessing: what it is and who it is for, its mission and aims, how reports and the confidence score work, plans, pricing and limits, how to get started, how to get an address delisted, privacy, and who

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 8, 2026

• ✓ Pass

  Maker matches the repo

  The registry name was verified against the domain isipsafe.com (the registry checks domain ownership)

• … Not checked yet

  Still maintained

  We have not read this repo from GitHub yet

• … Not checked yet

  Has a licence

  We have not read this repo from GitHub yet

• ✓ Pass

  Endpoint responds

  Responded in 507 ms (HTTP 200)

• – Not applicable

  Sign-in with OAuth

  No sign-in needed

• ✓ Pass

  No hidden instructions in tool descriptions

  Read 12 tool descriptions and found no hidden instructions to the AI

Compared with others in Otheri

• More stars than 0% of the other 18374 servers in this category
• Published to the registry more recently than 90% of the other 18374 servers in this category
• Basic checks equal to or better than 100% of the other 18374 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

README from the maker

pip install isipsafe

export ISIPSAFE_API_KEY=sl_your_key_here

from isipsafe import Client

result = client.bulk_report(

ips = client.blocklist(confidence_minimum=90, except_countries=["GB"])

$ isipsafe check 185.220.101.1

if ! isipsafe check "$IP" --fail-if-malicious --threshold 80 > /dev/null; then