FindIP

io.github.findip-netPublished by GitHub account findip-netv0.1.1Updated Oct 24, 2026

IP intelligence lookups and FindIP Shield visitor risk signals for AI assistants.

The publisher's own server: FindIP

VerifiedSTDIODesktop onlyWeb Search & ScrapingSecurity & Monitoring

Overview

AI-generated overview

A local MCP server that gives an AI assistant FindIP IP intelligence lookups and FindIP Shield visitor risk signals.

What you can do
Look up an IP address for country, city, ISP, ASN and risk signals such as VPN, proxy, Tor, hosting, scanner and threat score. Verify a Shield session server-side for risk score, recommendation, challenge status and network rotation. List your Shield sites with today's event and risky-event counts. Review recent high-risk events on a site and get a plain-language explanation of a single event.
When to use it
Useful when you want an assistant to check whether an IP or visitor session looks risky, or to review and explain recent risky traffic on a FindIP Shield site without leaving the chat.
Requirements
Runs locally over stdio with Node.js 18.17 or later, installed via the npm package. Requires a FindIP API key in FINDIP_API_KEY; verify_session also needs a Shield site secret key in FINDIP_SHIELD_SECRET_KEY. Network access to FindIP hosts.
Before you install
Requires two secrets: FINDIP_API_KEY and, for session verification, FINDIP_SHIELD_SECRET_KEY. The server sends IP and session data to FindIP. Risk signals describe the connection, not the person, and a browser can be bypassed, so important allow, challenge or block decisions should be made on your own backend.

Installation

In SourceWeft

  1. Open FindIP in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

FindIP MCP server

Ask your assistant about an IP address or a risky session, and get the answer from FindIP.

@findip/mcp is a Model Context Protocol server for FindIP. It gives Claude, Cursor and other MCP clients IP intelligence and FindIP Shield risk signals. It runs locally over stdio and only reads data.

Tools

ToolWhat it doesKey
lookup_ipCountry, city, ISP and ASN for an IP, plus risk signals: VPN, proxy, Tor, relay, hosting, scanner, malicious listings, threat scoreAPI key
verify_sessionServer-side risk check for a Shield session: score, recommendation, challenge status, IP and network rotationSite secret key
list_shield_sitesYour Shield sites with today's event and risky-event countsAPI key
recent_risky_eventsRecent high-risk events on a site, for example "what risky traffic hit my signup form this week"API key
explain_eventOne event in plain language: where it came from, which signals fired, what was recommendedAPI key

All five tools are read-only. docs/BACKEND.md lists the FindIP endpoint behind each one.

Setup

You need Node.js 18.17 or later and a FindIP API key. Keys are free at findip.net.

Claude Code

bash
claude mcp add findip --env FINDIP_API_KEY=your_api_key -- npx -y @findip/mcp

Claude Desktop

Add this to claude_desktop_config.json (Settings, Developer, Edit Config), then restart Claude Desktop:

json
{  "mcpServers": {    "findip": {      "command": "npx",      "args": ["-y", "@findip/mcp"],      "env": {        "FINDIP_API_KEY": "your_api_key"      }    }  }}

Cursor

Add this to ~/.cursor/mcp.json, or to .cursor/mcp.json in a project:

json
{  "mcpServers": {    "findip": {      "command": "npx",      "args": ["-y", "@findip/mcp"],      "env": {        "FINDIP_API_KEY": "your_api_key"      }    }  }}

Configuration

VariablePurpose
FINDIP_API_KEYYour FindIP API key. Required for lookup_ip, list_shield_sites, recent_risky_events and explain_event.
FINDIP_SHIELD_SECRET_KEYSecret key (sec_...) of one Shield site. Required for verify_session. Find it in the site's settings in the Shield dashboard.
FINDIP_SHIELD_ACCOUNT_APISet to 0 to turn off the three Shield account tools, so the API key is used for IP lookups only. On by default.
FINDIP_TIMEOUT_MSRequest timeout. Default 15000.
FINDIP_API_BASE_URL, FINDIP_SHIELD_BASE_URL, FINDIP_PORTAL_BASE_URLOverride the FindIP hosts, for testing.

The Shield account tools allow 60 requests per account per minute. Repeated requests with a wrong key are blocked for 10 minutes.

Keys are read from the environment only. They are never accepted as tool arguments and never appear in tool output or error messages.

Examples

  • "Look up 203.0.113.9. Is it a VPN or a hosting provider?"
  • "Verify Shield session sess_8f2c and tell me why it was flagged."
  • "What risky traffic hit my signup form this week?"
  • "Explain event 5b1e... on shop.example. Should I worry?"

How to read the results

FindIP reports risk signals. A VPN, a hosting network or a high score tells you about the connection, not about the person behind it. Use the signals to decide who gets a closer look, an extra step or a manual review.

The Shield browser SDK collects signals and can add friction in the page, but a browser can be scripted or bypassed, so it is not a security boundary. Decisions that matter belong on your server: call server verification (the endpoint verify_session uses) from your backend before you allow, challenge or block. A session with risk_status: "unknown" had no IP intelligence; treat it as unknown, not as safe.

Privacy

  • The server talks only to FindIP: api.findip.net, shield.findip.net and www.findip.net.
  • Shield tools never return end-user identity (email, user ID and their hashes). FindIP removes it before the data leaves its servers.
  • Site listings are a short summary: no site keys, no settings.
  • No telemetry, and nothing is written to disk.

Development

bash
npm installnpm run typechecknpm test        # vitest, all HTTP mockednpm run build

License

MIT

Source: README.md at commit 4feccd4

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.1LatestOct 11, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

Other Findip integrations

FindIP

ai.findipOfficial publisher

FindIP is a remote MCP server that lets an assistant search, compare and analyze patents by meaning rather than keywords.

Streamable HTTPWeb executableAuth
Knowledge & MemoryCredential requiredOct 24, 2026