isIPsafe

com.isipsafe/isipsafeVersion 1.0.1

Check whether an IP address or network is malicious and report abusive IPs to isIPsafe.

Status

Responds134 msNov 14, 2026, 14:02 UTCAnswered our handshake without sign-in.

Registry data may be out of date

We could not refresh it, so this page shows the last copy.

Last checked: Nov 14, 2026, 14:02 UTC
Latency: 134 ms
Remotes responding: 1 of 1
Sign-in: No sign-in
Hosting: Hosted outside the EU (detected)
Registry data as of: Nov 14, 2026, 21:12 UTC

Data from the official MCP Registry, checked by run.zero. How we check

Connect

Streamable HTTP

https://isipsafe.com/mcpResponds134 msNov 14, 2026, 14:02 UTC

No sign-in

Claude Code

claude mcp add --transport http isipsafe https://isipsafe.com/mcp

Claude Desktop and claude.ai

1
2
3

Settings > Connectors > Add custom connector
Name: isipsafe
Remote MCP server URL: https://isipsafe.com/mcp

Cursor

{
  "mcpServers": {
    "isipsafe": {
      "url": "https://isipsafe.com/mcp"
    }
  }
}

VS Code

code --add-mcp '{"name":"isipsafe","type":"http","url":"https://isipsafe.com/mcp"}'

Built your own server? run.zero hosts MCP servers on European infrastructure.

Host your own MCP server on run.zero

Tools

12 tools

Tools of isIPsafe
	Description		Read-only	Idempotent	Open world
`about_isipsafe`Explains isIPsafe itself. Use it for any question about the product rather than guessing: what it is and who it is for, its mission and aims, how reports and the confidence score work, plans, pricing and limits, how to get started, how to get an address delisted, privacy, and who runs it. Needs no API key and uses no allowance.	Explains isIPsafe itself. Use it for any question about the product rather than guessing: what it is and who it is for, its mission and aims, how reports and the confidence score work, plans, pricing and limits, how to get started, how to get an address delisted, privacy, and who runs it. Needs no API key and uses no allowance.	Not declared	Yes	Not declared	No
`analyze_logs`Find malicious traffic in logs. Pass raw log lines from any source (nginx/Apache/IIS access logs, sshd/auth.log, syslog, firewall such as iptables/UFW/pfSense/ASA, mail servers, Windows events as text, CEF, JSON lines from a SIEM or cloud, CSV); every IPv4/IPv6 address is extracted wherever it appears and each non-blank line is one event. Returns how many events came from malicious (score 75+), suspicious (25-74) and unreported addresses, the top offenders with score and attack categories, the busiest addresses, countries, networks, attack categories, detected log formats, HTTP status classes, failed logins and the time range. Each distinct address looked up counts as one lookup against the daily allowance, busiest first. Per analysis: without a key 256 KB and 100 addresses, free key 2 MB and 1,000, Enterprise 5 MB and 10,000. The log is not stored. Remove secrets (passwords, tokens) before sending.	Find malicious traffic in logs. Pass raw log lines from any source (nginx/Apache/IIS access logs, sshd/auth.log, syslog, firewall such as iptables/UFW/pfSense/ASA, mail servers, Windows events as text, CEF, JSON lines from a SIEM or cloud, CSV); every IPv4/IPv6 address is extracted wherever it appears and each non-blank line is one event. Returns how many events came from malicious (score 75+), suspicious (25-74) and unreported addresses, the top offenders with score and attack categories, the busiest addresses, countries, networks, attack categories, detected log formats, HTTP status classes, failed logins and the time range. Each distinct address looked up counts as one lookup against the daily allowance, busiest first. Per analysis: without a key 256 KB and 100 addresses, free key 2 MB and 1,000, Enterprise 5 MB and 10,000. The log is not stored. Remove secrets (passwords, tokens) before sending.	Not declared	Yes	Not declared	No
`check_ip`Reputation of one IPv4 or IPv6 address: abuse confidence score (0-100, 75+ is on the blocklist), number of reports and distinct reporters, attack categories, country, network owner (ASN), Tor exit status and a link to its page. Set verbose to include the latest reports with their comments.	Reputation of one IPv4 or IPv6 address: abuse confidence score (0-100, 75+ is on the blocklist), number of reports and distinct reporters, attack categories, country, network owner (ASN), Tor exit status and a link to its page. Set verbose to include the latest reports with their comments.	Not declared	Yes	Not declared	No
`check_network`Every reported address inside a CIDR block (IPv4 up to /16, IPv6 up to /48), with score, report count and last report time, plus the network's owner. Use it to judge a whole hosting range or subnet.	Every reported address inside a CIDR block (IPv4 up to /16, IPv6 up to /48), with score, report count and last report time, plus the network's owner. Use it to judge a whole hosting range or subnet.	Not declared	Yes	Not declared	No
`get_blocklist`The highest-confidence abusive addresses right now, best first, with score, country and categories. Needs an API key and counts as one blocklist download. For a firewall-ready file, point the firewall at the blocklist URL instead (see the integrations).	The highest-confidence abusive addresses right now, best first, with score, country and categories. Needs an API key and counts as one blocklist download. For a firewall-ready file, point the firewall at the blocklist URL instead (see the integrations).	Not declared	Yes	Not declared	No
`get_country_report`How many addresses in a country were reported in the last 30 days, how many are on the blocklist, the most reported addresses there, and the networks and attack categories behind them.	How many addresses in a country were reported in the last 30 days, how many are on the blocklist, the most reported addresses there, and the networks and attack categories behind them.	Not declared	Yes	Not declared	No
`get_network_report`Abuse reported against one autonomous system in the last 30 days: number of reported and blocklisted addresses, the worst addresses, attack categories and countries. Useful to judge a hosting provider or ISP.	Abuse reported against one autonomous system in the last 30 days: number of reported and blocklisted addresses, the worst addresses, attack categories and countries. Useful to judge a hosting provider or ISP.	Not declared	Yes	Not declared	No
`get_reports`The individual abuse reports filed against one address, newest first, with time, categories, comment (usually log lines) and reporter. Paginated.	The individual abuse reports filed against one address, newest first, with time, categories, comment (usually log lines) and reporter. Paginated.	Not declared	Yes	Not declared	No
`get_statistics`What the database sees right now: reports in the last 24 hours, addresses on the blocklist, and over the last 30 days the top attack categories, countries, networks and highest-scoring addresses.	What the database sees right now: reports in the last 24 hours, addresses on the blocklist, and over the last 30 days the top attack categories, countries, networks and highest-scoring addresses.	Not declared	Yes	Not declared	No
`get_today_news`Today's threat news from the last 24 hours: the countries the most reported attacks come from, the networks (ASNs) behind them, the attack techniques (categories) reported most, and the top 10 malicious IP addresses reported today, highest score first. Use it for a daily briefing on what is attacking right now.	Today's threat news from the last 24 hours: the countries the most reported attacks come from, the networks (ASNs) behind them, the attack techniques (categories) reported most, and the top 10 malicious IP addresses reported today, highest score first. Use it for a daily briefing on what is attacking right now.	Not declared	Yes	Not declared	No
`list_categories`All attack categories with their code, numeric ID, group and when to use them. Use the codes with report_ip.	All attack categories with their code, numeric ID, group and when to use them. Use the codes with report_ip.	Not declared	Yes	Not declared	No
`report_ip`File an abuse report against an address that attacked a system you run. Needs an API key. Use category codes from list_categories (e.g. ssh,brute-force) and put the evidence (log lines, never personal data) in the comment. Each reporter can report the same address once per 15 minutes. Only report real, observed abuse.	File an abuse report against an address that attacked a system you run. Needs an API key. Use category codes from list_categories (e.g. ssh,brute-force) and put the evidence (log lines, never personal data) in the comment. Each reporter can report the same address once per 15 minutes. Only report real, observed abuse.	No	No	No	Yes

Details

Registry status: Active
Published: Nov 3, 2026
Updated: Nov 3, 2026
Website: https://isipsafe.com/⁠ (opens in a new tab)
Repository: https://github.com/isipsafe/isipsafe-python⁠ (opens in a new tab)
Categories (suggested): Data and analyticsSuggested categories are assigned automatically from the registry text and may be wrong. Verified operators can correct them.
GDPR: Not declared

Are you the operator? Claim this listing