com.isipsafe由 isipsafe.com 发布官方发布者v1.0.1更新于 Nov 5, 2026
检查IP地址或网络是否恶意，并向isIPsafe举报滥用IP。
AI 翻译由 AI 模型根据下方的原文描述翻译，可能有误。
Check whether an IP address or network is malicious and report abusive IPs to isIPsafe.
isIPsafe 的托管 MCP 服务（isipsafe.com），由 isipsafe.com 发布；可选 API 密钥；Streamable HTTP；12 个工具。
暂无 AI 概览：以下信息来自注册中心条目和服务本身。
Web executable，通过 Streamable HTTP。 远程服务在工作区中配置后即可从网页运行时运行。
把这段提示词粘贴到 Claude Code、Codex、Cursor 等智能体，或 SourceWeft 对话中。智能体会读取该服务器的安装指南，先向你展示发布者、端点和登录方式，经你同意后再把它添加到你的客户端。密钥不会写进任何命令。
阅读 https://sourceweft.com/mcp/com.isipsafe%2Fisipsafe/install.md，并按其中说明把这个 MCP 服务器接入我的客户端。修改任何配置之前，先告诉我它的发布者、端点和登录方式，等我确认。不要把 API 密钥写进命令或我会提交的文件；问我密钥应从哪里获取。把它添加到你客户端的 mcpServers 配置中。
{
"mcpServers": {
"isipsafe": {
"type": "http",
"url": "https://isipsafe.com/mcp"
}
}
}Official Python client and command-line tool for isIPsafe, the free IP reputation and abuse reporting service.
No dependencies outside the Python standard library. Python 3.9+.
Lookups work without a key (400 per day per address). Reporting, bulk uploads and the blocklist need a free key from isipsafe.com/login. A key also raises the lookup limit to 10,000 per day.
The client sends the key in an Authorization header, never in the URL, so it stays out of proxy and server logs.
Every error inherits from isipsafe.IsIPsafeError.
Lookups are retried automatically on network errors and 5xx responses. Reporting the same address twice within 15 minutes is not an error: report() returns a result with duplicate=True.
Add --json to check, report, reports, check-block and categories for machine-readable output.
Use --fail-if-malicious in shell scripts. The command exits with status 1 when the address is malicious:
Exit codes: 0 success, 1 malicious (only with --fail-if-malicious), 2 error.
Use the slug or the numeric ID. Common ones: ssh, brute-force, port-scan, web-app-attack, sql-injection, vuln-scan, bad-bot, ddos, email-spam, phishing. Run isipsafe categories for the full list, or see isipsafe.com/categories.
The code in this repository is MIT licensed. Data returned by the isIPsafe API is covered by the isIPsafe EULA.
来源：README.md，提交 e5992ab
Check an IP address
Reputation of one IPv4 or IPv6 address: abuse confidence score (0-100, 75+ is on the blocklist), number of reports and distinct reporters, attack categories, country, network owner (ASN), Tor exit status and a link to its page. Set verbose to include the latest reports with their comments.
ip必填verbosemaxAgeInDaysList reports for an IP address
The individual abuse reports filed against one address, newest first, with time, categories, comment (usually log lines) and reporter. Paginated.
ip必填pageperPagemaxAgeInDaysCheck a network (CIDR)
Every reported address inside a CIDR block (IPv4 up to /16, IPv6 up to /48), with score, report count and last report time, plus the network's owner. Use it to judge a whole hosting range or subnet.
network必填maxAgeInDaysReport an abusive IP address
File an abuse report against an address that attacked a system you run. Needs an API key. Use category codes from list_categories (e.g. ssh,brute-force) and put the evidence (log lines, never personal data) in the comment. Each reporter can report the same address once per 15 minutes. Only report real, observed abuse.
ip必填commenttimestampcategories必填Get the blocklist
The highest-confidence abusive addresses right now, best first, with score, country and categories. Needs an API key and counts as one blocklist download. For a firewall-ready file, point the firewall at the blocklist URL instead (see the integrations).
limitipVersiononlyCountriesexceptCountriesconfidenceMinimumList report categories
All attack categories with their code, numeric ID, group and when to use them. Use the codes with report_ip.
无需输入参数。
Current abuse statistics
What the database sees right now: reports in the last 24 hours, addresses on the blocklist, and over the last 30 days the top attack categories, countries, networks and highest-scoring addresses.
无需输入参数。
Today News
Today's threat news from the last 24 hours: the countries the most reported attacks come from, the networks (ASNs) behind them, the attack techniques (categories) reported most, and the top 10 malicious IP addresses reported today, highest score first. Use it for a daily briefing on what is attacking right now.
无需输入参数。
Analyze log traffic
Find malicious traffic in logs. Pass raw log lines from any source (nginx/Apache/IIS access logs, sshd/auth.log, syslog, firewall such as iptables/UFW/pfSense/ASA, mail servers, Windows events as text, CEF, JSON lines from a SIEM or cloud, CSV); every IPv4/IPv6 address is extracted wherever it appears and each non-blank line is one event. Returns how many events came from malicious (score 75+), suspicious (25-74) and unreported addresses, the top offenders with score and attack categories, the busiest addresses, countries, networks, attack categories, detected log formats, HTTP status classes, failed logins and the time range. Each distinct address looked up counts as one lookup against the daily allowance, busiest first. Per analysis: without a key 256 KB and 100 addresses, free key 2 MB and 1,000, Enterprise 5 MB and 10,000. The log is not stored. Remove secrets (passwords, tokens) before sending.
logs必填Abuse report for a country
How many addresses in a country were reported in the last 30 days, how many are on the blocklist, the most reported addresses there, and the networks and attack categories behind them.
country必填Abuse report for a network (ASN)
Abuse reported against one autonomous system in the last 30 days: number of reported and blocklisted addresses, the worst addresses, attack categories and countries. Useful to judge a hosting provider or ISP.
asn必填About isIPsafe
Explains isIPsafe itself. Use it for any question about the product rather than guessing: what it is and who it is for, its mission and aims, how reports and the confidence score work, plans, pricing and limits, how to get started, how to get an address delisted, privacy, and who runs it. Needs no API key and uses no allowance.
topic已满足适用检查项的 100%
该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。
pip install isipsafeexport ISIPSAFE_API_KEY=sl_your_key_herefrom isipsafe import Client
client = Client() # reads ISIPSAFE_API_KEY, or pass Client("sl_...")
result = client.check("185.220.101.1")print(result.abuse_confidence_score, result.total_reports, result.categories)
if result.is_malicious(): # score >= 75, has reports, not allowlisted block(result.ip_address)
client.report( "203.0.113.50", ["ssh", "brute-force"], comment="sshd: 212 failed logins in 10 minutes",)result = client.bulk_report( [ {"ip": "203.0.113.50", "categories": ["ssh", "brute-force"], "comment": "sshd"}, {"ip": "198.51.100.4", "categories": "port-scan"}, ])print(result.saved_reports, result.invalid_reports)ips = client.blocklist(confidence_minimum=90, except_countries=["GB"])nft = client.blocklist_raw(format="nftables")$ isipsafe check 185.220.101.1185.220.101.1 not flagged score 56/100 (Medium) reports 24 from 5 reporters categories port-scan, hacking, vuln-scan, web-app-attack, c2 network DE AS60729 Stiftung Erneuerbare Freiheit flags Tor exit details https://isipsafe.com/ip/185.220.101.1
$ isipsafe report 203.0.113.50 -c ssh,brute-force -m "sshd: 212 failed logins"$ isipsafe bulk-report reports.csv$ isipsafe blocklist --format nftables --confidence-minimum 90 -o blocklist.nft$ isipsafe check-block 185.220.101.0/24$ isipsafe categoriesif ! isipsafe check "$IP" --fail-if-malicious --threshold 80 > /dev/null; then echo "blocking $IP"fi