原型 · 预览版:收录官方注册中心里的全部服务器,每 30 分钟同步一次。评价和账户功能将在后续阶段推出。
PopNx MCP为使用 AI 的人准备的 MCP 服务器 · 用大白话讲清楚

isIPsafe

作者:isipsafe版本 1.0.1i★ –i在云端运行
注册名称com.isipsafe/isipsafe

安装

概览

作者提供的说明(英文原文)

Check whether an IP address or network is malicious and report abusive IPs to isIPsafe.

PopNx MCP 的三大支柱

这三项永远不会合并成一个分数:意见、测量和人气是不同的东西。

它能帮你做什么

我们还没有为它写通俗的介绍。下面是我们从注册中心读取到的事实。

  • 连接方式: 在云端运行
  • 传输方式: Streamable HTTP
  • 分类: 其他
  • 你需要填写:X-API-Key

安装

选择你使用的 AI 应用,然后复制设置。

安装之前

标为机密的值是你账户的钥匙。千万不要分享给别人,也不要粘贴到聊天里。

你需要

你用的是哪个应用?

在上方选择你的应用。我们会记住它,下次按钮会显示“安装到 …”。

这个地址需要在请求的 header 中放入密钥,而添加连接器的菜单无法设置。请改用 Claude Code、Cursor 或 VS Code。

在终端中运行这条命令

claude mcp add --transport http isipsafe https://isipsafe.com/mcp --header 'X-API-Key: your-value'

运行前请先填写空着的值。

在 Cursor 中打开

或者自己复制设置

粘贴到项目中的 .cursor/mcp.json,或 ~/.cursor/mcp.json

{
  "mcpServers": {
    "isipsafe": {
      "url": "https://isipsafe.com/mcp",
      "headers": {
        "X-API-Key": "your-value"
      }
    }
  }
}

浏览器会先询问是否打开应用,然后应用会显示设置并请你确认。密钥的值会留空,由你自己填写。

在 VS Code 中打开

或者自己复制设置

粘贴到项目中的 .vscode/mcp.json

{
  "servers": {
    "isipsafe": {
      "type": "http",
      "url": "https://isipsafe.com/mcp",
      "headers": {
        "X-API-Key": "your-value"
      }
    }
  }
}

浏览器会先询问是否打开应用,然后应用会显示设置并请你确认。密钥的值会留空,由你自己填写。

这个地址需要在请求的 header 中放入密钥,而添加连接器的菜单无法设置。请改用 Claude Code、Cursor 或 VS Code。

你的选择通过 Cookie 保存在这台设备上,无需账户。

需要你填写的值

  • X-API-Key 机密 HTTP header
    isIPsafe API key. Optional for lookups, needed to report IPs. Get one at https://isipsafe.com/account

这些设置是根据作者在注册中心的条目生成的。如果 README 的写法不同,请以 README 为准。

它能做什么

工具名称和描述与服务器在 2026年11月6日 报告的完全一致。这些内容由作者撰写,不是我们写的;我们以纯文本形式显示。

  • check_ip

    Reputation of one IPv4 or IPv6 address: abuse confidence score (0-100, 75+ is on the blocklist), number of reports and distinct reporters, attack categories, country, network owner (ASN), Tor exit status and a link to its page. Set verbose to include the latest reports with their

  • get_reports

    The individual abuse reports filed against one address, newest first, with time, categories, comment (usually log lines) and reporter. Paginated.

  • check_network

    Every reported address inside a CIDR block (IPv4 up to /16, IPv6 up to /48), with score, report count and last report time, plus the network's owner. Use it to judge a whole hosting range or subnet.

  • report_ip

    File an abuse report against an address that attacked a system you run. Needs an API key. Use category codes from list_categories (e.g. ssh,brute-force) and put the evidence (log lines, never personal data) in the comment. Each reporter can report the same address once per 15 min

  • get_blocklist

    The highest-confidence abusive addresses right now, best first, with score, country and categories. Needs an API key and counts as one blocklist download. For a firewall-ready file, point the firewall at the blocklist URL instead (see the integrations).

  • list_categories

    All attack categories with their code, numeric ID, group and when to use them. Use the codes with report_ip.

  • get_statistics

    What the database sees right now: reports in the last 24 hours, addresses on the blocklist, and over the last 30 days the top attack categories, countries, networks and highest-scoring addresses.

  • get_today_news

    Today's threat news from the last 24 hours: the countries the most reported attacks come from, the networks (ASNs) behind them, the attack techniques (categories) reported most, and the top 10 malicious IP addresses reported today, highest score first. Use it for a daily briefing

  • analyze_logs

    Find malicious traffic in logs. Pass raw log lines from any source (nginx/Apache/IIS access logs, sshd/auth.log, syslog, firewall such as iptables/UFW/pfSense/ASA, mail servers, Windows events as text, CEF, JSON lines from a SIEM or cloud, CSV); every IPv4/IPv6 address is extract

  • get_country_report

    How many addresses in a country were reported in the last 30 days, how many are on the blocklist, the most reported addresses there, and the networks and attack categories behind them.

  • get_network_report

    Abuse reported against one autonomous system in the last 30 days: number of reported and blocklisted addresses, the worst addresses, attack categories and countries. Useful to judge a hosting provider or ISP.

  • about_isipsafe

    Explains isIPsafe itself. Use it for any question about the product rather than guessing: what it is and who it is for, its mission and aims, how reports and the confidence score work, plans, pricing and limits, how to get started, how to get an address delisted, privacy, and who

基础检查i

我们检查的是任何人都能看到的信息;我们没有阅读代码。不适用的检查项不计入总数。 · 检查于 2026年11月8日

  • ✓ 通过

    作者与仓库一致

    注册名称已通过域名 isipsafe.com 验证(注册中心会核实域名所有权)

  • … 尚未检查

    仍在维护

    我们还没有从 GitHub 读取这个仓库

  • … 尚未检查

    有许可证

    我们还没有从 GitHub 读取这个仓库

  • ✓ 通过

    端点有响应

    在 507 毫秒内响应(HTTP 200)

  • – 不适用

    使用 OAuth 登录

    无需登录

  • ✓ 通过

    工具描述中没有隐藏指令

    已读取 12 个工具描述,未发现针对 AI 的隐藏指令

与“其他”中的其他服务器比较i

  • 星标数多于此分类中其他 18386 个服务器的 0%
  • 发布到注册中心的时间比此分类中其他 18386 个服务器的 90% 更新
  • 基础检查结果等于或优于此分类中其他 18386 个服务器的 100%

与注册中心里这个分类中所有活跃的服务器比较。只有当发布者拥有该仓库时,星标数才计入。

常见问题

isIPsafe 安全吗?

它在 3 项适用的基础检查中通过了 3 项。我们没有阅读代码。在添加密钥或令牌之前,请先看看这个服务器要求哪些权限,并使用只具备所需权限的密钥。

它需要哪些密钥或代码?

你需要填写:X-API-Key

它在我的电脑上运行还是在云端?

它在作者的云端运行。通过互联网连接,无需安装,但你发送的内容会经过作者的服务器。

它还在维护吗?

GitHub 仓库最后更新于–,最新版本(1.0.1)于4天前进入注册中心。

哪些应用可以使用它?

支持 MCP 的应用,例如 Claude Desktop、Claude Code、Cursor 和 VS Code。它通过 URL 连接,所以接受远程 MCP 服务器的应用也可以使用,例如开启开发者模式的 ChatGPT。

有什么可以替代它?

同一分类中有:Spec Driven Development, Remote Desktop Commander, Tethered Trust

替代选择

同一分类中其他作者的服务器,按星标数排序。

如何看卡片:★ GitHub 星标i三大支柱:评价 · 检查 · 使用情况i更新 = 最新版本发布到注册中心的时间i

Spec Driven Development

作者:formulahendry

MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.

在你的电脑上运行★ 440MIT14个月前更新
安装

Remote Desktop Commander

作者:desktop-commander

Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.

在云端运行★ 211前天更新
安装

Tethered Trust

作者:tetheredtrust.com

Fit, compatibility and recall checks for AI agents before they buy: verdicts, evidence, receipts.

在云端运行今天更新
安装

作者的 README

打开 README

按原文从作者的仓库复制。PopNx MCP 没有审查或背书其内容。HTML、图片和脚本已被移除。链接会离开本站。

isipsafe

Official Python client and command-line tool for isIPsafe, the free IP reputation and abuse reporting service.

  • Check whether an IP address is malicious before you trust it
  • Report attackers from your logs, one at a time or 10,000 at once
  • Download the blocklist in a firewall-ready format (nftables, ipset, nginx, apache, MikroTik, STIX and more)

No dependencies outside the Python standard library. Python 3.9+.

pip install isipsafe

Get an API key

Lookups work without a key (400 per day per address). Reporting, bulk uploads and the blocklist need a free key from isipsafe.com/login. A key also raises the lookup limit to 10,000 per day.

export ISIPSAFE_API_KEY=sl_your_key_here

The client sends the key in an Authorization header, never in the URL, so it stays out of proxy and server logs.

Python

from isipsafe import Client

client = Client() # reads ISIPSAFE_API_KEY, or pass Client("sl_...")

result = client.check("185.220.101.1") print(result.abuse_confidence_score, result.total_reports, result.categories)

if result.is_malicious(): # score >= 75, has reports, not allowlisted block(result.ip_address)

client.report( "203.0.113.50", ["ssh", "brute-force"], comment="sshd: 212 failed logins in 10 minutes", )

Report many addresses at once
result = client.bulk_report(

[ {"ip": "203.0.113.50", "categories": ["ssh", "brute-force"], "comment": "sshd"}, {"ip": "198.51.100.4", "categories": "port-scan"}, ] ) print(result.saved_reports, result.invalid_reports)

Blocklist
ips = client.blocklist(confidence_minimum=90, except_countries=["GB"])

nft = client.blocklist_raw(format="nftables")

Everything else
MethodWhat it does
check(ip, max_age_in_days=None, verbose=False)Score, report counts, location and network for one address
is_malicious(ip, threshold=75)Shortcut that returns True or False
report(ip, categories, comment=None, timestamp=None)Report an address or CIDR network
bulk_report(rows) / bulk_report_csv(text)Up to 10,000 reports in one request
reports(ip, page=1, per_page=25)Reports filed against an address, newest first
check_block(network)Reported addresses inside a network (up to /16 or /48)
blocklist(...) / blocklist_raw(format=...)The highest-confidence addresses
clear_address(ip)Delete your own reports for an address
categories()All report categories and their slugs
Errors

Every error inherits from isipsafe.IsIPsafeError.

ExceptionWhen
AuthenticationErrorMissing or wrong API key (401)
ValidationErrorInvalid input, or an allowlisted address was reported (422)
RateLimitErrorToo many requests (429); see .retry_after
APIErrorAny other error status; see .status
NetworkErrorThe API could not be reached

Lookups are retried automatically on network errors and 5xx responses. Reporting the same address twice within 15 minutes is not an error: report() returns a result with duplicate=True.

Command line

$ isipsafe check 185.220.101.1

185.220.101.1 not flagged score 56/100 (Medium) reports 24 from 5 reporters categories port-scan, hacking, vuln-scan, web-app-attack, c2 network DE AS60729 Stiftung Erneuerbare Freiheit flags Tor exit details https://isipsafe.com/ip/185.220.101.1

$ isipsafe report 203.0.113.50 -c ssh,brute-force -m "sshd: 212 failed logins" $ isipsafe bulk-report reports.csv $ isipsafe blocklist --format nftables --confidence-minimum 90 -o blocklist.nft $ isipsafe check-block 185.220.101.0/24 $ isipsafe categories

Add --json to check, report, reports, check-block and categories for machine-readable output.

Use --fail-if-malicious in shell scripts. The command exits with status 1 when the address is malicious:

if ! isipsafe check "$IP" --fail-if-malicious --threshold 80 > /dev/null; then

echo "blocking $IP" fi

Exit codes: 0 success, 1 malicious (only with --fail-if-malicious), 2 error.

Categories

Use the slug or the numeric ID. Common ones: ssh, brute-force, port-scan, web-app-attack, sql-injection, vuln-scan, bad-bot, ddos, email-spam, phishing. Run isipsafe categories for the full list, or see isipsafe.com/categories.

Links

Licence

The code in this repository is MIT licensed. Data returned by the isIPsafe API is covered by the isIPsafe EULA.

问 PopNx