com.isipsafePublished by isipsafe.comOfficial publisherv1.0.1Updated Nov 5, 2026
Check whether an IP address or network is malicious and report abusive IPs to isIPsafe.
isIPsafe's hosted MCP server (isipsafe.com), published by isipsafe.com; optional API key; Streamable HTTP; 12 tools.
No AI overview yet: these facts come from the registry entry and the server itself.
Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.
Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.
Read https://sourceweft.com/mcp/com.isipsafe%2Fisipsafe/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.Add this to your client's mcpServers config.
{
"mcpServers": {
"isipsafe": {
"type": "http",
"url": "https://isipsafe.com/mcp"
}
}
}Official Python client and command-line tool for isIPsafe, the free IP reputation and abuse reporting service.
No dependencies outside the Python standard library. Python 3.9+.
Lookups work without a key (400 per day per address). Reporting, bulk uploads and the blocklist need a free key from isipsafe.com/login. A key also raises the lookup limit to 10,000 per day.
The client sends the key in an Authorization header, never in the URL, so it stays out of proxy and server logs.
Every error inherits from isipsafe.IsIPsafeError.
Lookups are retried automatically on network errors and 5xx responses. Reporting the same address twice within 15 minutes is not an error: report() returns a result with duplicate=True.
Add --json to check, report, reports, check-block and categories for machine-readable output.
Use --fail-if-malicious in shell scripts. The command exits with status 1 when the address is malicious:
Exit codes: 0 success, 1 malicious (only with --fail-if-malicious), 2 error.
Use the slug or the numeric ID. Common ones: ssh, brute-force, port-scan, web-app-attack, sql-injection, vuln-scan, bad-bot, ddos, email-spam, phishing. Run isipsafe categories for the full list, or see isipsafe.com/categories.
The code in this repository is MIT licensed. Data returned by the isIPsafe API is covered by the isIPsafe EULA.
Source: README.md at commit e5992ab
Check an IP address
Reputation of one IPv4 or IPv6 address: abuse confidence score (0-100, 75+ is on the blocklist), number of reports and distinct reporters, attack categories, country, network owner (ASN), Tor exit status and a link to its page. Set verbose to include the latest reports with their comments.
iprequiredverbosemaxAgeInDaysList reports for an IP address
The individual abuse reports filed against one address, newest first, with time, categories, comment (usually log lines) and reporter. Paginated.
iprequiredpageperPagemaxAgeInDaysCheck a network (CIDR)
Every reported address inside a CIDR block (IPv4 up to /16, IPv6 up to /48), with score, report count and last report time, plus the network's owner. Use it to judge a whole hosting range or subnet.
networkrequiredmaxAgeInDaysReport an abusive IP address
File an abuse report against an address that attacked a system you run. Needs an API key. Use category codes from list_categories (e.g. ssh,brute-force) and put the evidence (log lines, never personal data) in the comment. Each reporter can report the same address once per 15 minutes. Only report real, observed abuse.
iprequiredcommenttimestampcategoriesrequiredGet the blocklist
The highest-confidence abusive addresses right now, best first, with score, country and categories. Needs an API key and counts as one blocklist download. For a firewall-ready file, point the firewall at the blocklist URL instead (see the integrations).
limitipVersiononlyCountriesexceptCountriesconfidenceMinimumList report categories
All attack categories with their code, numeric ID, group and when to use them. Use the codes with report_ip.
Takes no parameters.
Current abuse statistics
What the database sees right now: reports in the last 24 hours, addresses on the blocklist, and over the last 30 days the top attack categories, countries, networks and highest-scoring addresses.
Takes no parameters.
Today News
Today's threat news from the last 24 hours: the countries the most reported attacks come from, the networks (ASNs) behind them, the attack techniques (categories) reported most, and the top 10 malicious IP addresses reported today, highest score first. Use it for a daily briefing on what is attacking right now.
Takes no parameters.
Analyze log traffic
Find malicious traffic in logs. Pass raw log lines from any source (nginx/Apache/IIS access logs, sshd/auth.log, syslog, firewall such as iptables/UFW/pfSense/ASA, mail servers, Windows events as text, CEF, JSON lines from a SIEM or cloud, CSV); every IPv4/IPv6 address is extracted wherever it appears and each non-blank line is one event. Returns how many events came from malicious (score 75+), suspicious (25-74) and unreported addresses, the top offenders with score and attack categories, the busiest addresses, countries, networks, attack categories, detected log formats, HTTP status classes, failed logins and the time range. Each distinct address looked up counts as one lookup against the daily allowance, busiest first. Per analysis: without a key 256 KB and 100 addresses, free key 2 MB and 1,000, Enterprise 5 MB and 10,000. The log is not stored. Remove secrets (passwords, tokens) before sending.
logsrequiredAbuse report for a country
How many addresses in a country were reported in the last 30 days, how many are on the blocklist, the most reported addresses there, and the networks and attack categories behind them.
countryrequiredAbuse report for a network (ASN)
Abuse reported against one autonomous system in the last 30 days: number of reported and blocklisted addresses, the worst addresses, attack categories and countries. Useful to judge a hosting provider or ISP.
asnrequiredAbout isIPsafe
Explains isIPsafe itself. Use it for any question about the product rather than guessing: what it is and who it is for, its mission and aims, how reports and the confidence score work, plans, pricing and limits, how to get started, how to get an address delisted, privacy, and who runs it. Needs no API key and uses no allowance.
topic100% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
pip install isipsafeexport ISIPSAFE_API_KEY=sl_your_key_herefrom isipsafe import Client
client = Client() # reads ISIPSAFE_API_KEY, or pass Client("sl_...")
result = client.check("185.220.101.1")print(result.abuse_confidence_score, result.total_reports, result.categories)
if result.is_malicious(): # score >= 75, has reports, not allowlisted block(result.ip_address)
client.report( "203.0.113.50", ["ssh", "brute-force"], comment="sshd: 212 failed logins in 10 minutes",)result = client.bulk_report( [ {"ip": "203.0.113.50", "categories": ["ssh", "brute-force"], "comment": "sshd"}, {"ip": "198.51.100.4", "categories": "port-scan"}, ])print(result.saved_reports, result.invalid_reports)ips = client.blocklist(confidence_minimum=90, except_countries=["GB"])nft = client.blocklist_raw(format="nftables")$ isipsafe check 185.220.101.1185.220.101.1 not flagged score 56/100 (Medium) reports 24 from 5 reporters categories port-scan, hacking, vuln-scan, web-app-attack, c2 network DE AS60729 Stiftung Erneuerbare Freiheit flags Tor exit details https://isipsafe.com/ip/185.220.101.1
$ isipsafe report 203.0.113.50 -c ssh,brute-force -m "sshd: 212 failed logins"$ isipsafe bulk-report reports.csv$ isipsafe blocklist --format nftables --confidence-minimum 90 -o blocklist.nft$ isipsafe check-block 185.220.101.0/24$ isipsafe categoriesif ! isipsafe check "$IP" --fail-if-malicious --threshold 80 > /dev/null; then echo "blocking $IP"fi