whatismynetip

io.github.getlarkwright由 GitHub 账号 getlarkwright 发布v0.1.1更新于 Nov 7, 2026

Subnet math, port and MAC lookups, DNS, DNSBL, TLS cert inspection, public IP. No account.

已验证STDIO仅桌面云端与基础设施开发者工具安全与监控

概览

AI 生成的概览

面向编码代理的本地网络工具箱：子网计算、IP 转换、MAC 厂商查询、端口暴露建议、DNS、DNSBL、TLS 证书与公网 IP 查询。

可以做什么
  • 计算子网，并判断某个地址是否位于指定 CIDR 网段内，支持 IPv4 与 IPv6
  • 在点分、整数、十六进制与二进制之间转换 IPv4，并规范化 IPv6 地址
  • 依据内置 IEEE 表查询 MAC 地址厂商，并查询某端口上运行什么服务以及是否应当对外开放
  • 通过 DNS-over-HTTPS 解析 DNS 记录与反向 DNS，并用常见黑名单检查地址
  • 检查主机实际提供的 TLS 证书，并报告互联网所看到的公网 IP、ASN 与边缘节点位置
适用场景
适合在代理协助处理网络配置、防火墙与暴露面审查、DNS 排障、证书到期检查，或回答某端口是否应对外开放这类问题时使用。
运行要求
以 stdio 方式在本地运行。npx 方式需要 Node.js 18 或更高版本，也可使用 Docker 镜像。无需账号、API 密钥或环境变量。仅 DNS、黑名单、TLS 与公网 IP 工具需要联网，计算与查询类工具可离线使用。
安装前请注意
网络类工具会访问第三方公共服务（Cloudflare 的 DNS-over-HTTPS 与 trace、Google 的 DNS-over-HTTPS、Team Cymru 的 ASN DNS）以及 TLS 检查所指向的主机，因此被查询的主机名与地址会离开本机。TLS 检查会拒绝私有或保留地址。它无法测试端口是否能从 NAT 外部访问。

安装

在 SourceWeft 中

  1. 打开 控制台中的 whatismynetip，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Desktop only，通过 STDIO。 STDIO 服务会启动本地进程，因此需要 SourceWeft 桌面宿主。

其他 MCP 客户端

参照 仓库 中的启动说明。

README

netip-mcp

The whatismynetip.com toolbox as tools your coding agent can call. Subnet math, "what runs on this port and should it be open", MAC vendor lookups, DNS and blocklist checks, the certificate a host actually serves, and the IP the internet sees you as.

Free, MIT, no account, no telemetry. The site's own tools run in your browser; this runs the same logic next to your agent.

Install

Pin the version.

Claude Code

claude mcp add netip -- npx -y github:getlarkwright/netip-mcp#v0.1.1

Claude Desktop, Cursor, or any client with a JSON config

json
{  "mcpServers": {    "netip": {      "command": "npx",      "args": ["-y", "github:getlarkwright/netip-mcp#v0.1.1"]    }  }}

Docker

json
{  "mcpServers": {    "netip": {      "command": "docker",      "args": ["run", "-i", "--rm", "ghcr.io/getlarkwright/netip-mcp:0.1.1"]    }  }}

Node 18 or newer for the npx route. Also in the official MCP registry as io.github.getlarkwright/netip-mcp.

Tools

ToolWhat it answersNetwork
subnet_calcNetwork, mask, wildcard, broadcast, host range and counts for a CIDR — IPv4 and IPv6, /31 and /32 done rightnone
ip_in_subnetIs this address inside that block?none
ip_convertIPv4 as dotted, integer, hex, binary — from any of themnone
ipv6_normalizeExpanded and RFC 5952 compressed forms, and what kind of address it isnone
mac_lookupVendor from the full IEEE registry (~40,000 assignments, bundled), plus the multicast and locally-administered bitsnone
lookup_portWhat runs on a port, and whether to expose it — 100 ports written up by hand, searchable by servicenone
dns_lookupA, AAAA, MX, TXT, NS, CNAME, CAA, SOA, PTR, SRV over DNS-over-HTTPSDoH
reverse_dnsPTR for an IPv4 or IPv6 addressDoH
dnsbl_checkFive common blocklists, honest about the ones that refuse public resolversDoH
tls_inspectThe certificate a host actually serves: expiry, SANs, chain verification, protocol, cipherdirect TLS
my_public_ipThe address the internet sees, edge location, ASN, reverse DNS, datacenter/VPN hintCloudflare trace + Team Cymru DNS

lookup_port

The one I reach for most. The port pages on the site are opinionated — every port carries a verdict:

Port 3389/tcp+udp — RDP (Remote Desktop Protocol)
  Category   remote access  Software   Windows Remote Desktop Services, xrdp, FreeRDP server, Windows Admin Center hosts  Exposure   NEVER — do not expose to the internet
Internet-facing RDP is the most common initial-access route for ransomware crews, whocredential-stuff it around the clock; put it behind WireGuard, Tailscale or an RD Gateway …

Ask by number, or search: lookup_port with query: "redis" finds 6379. detail: true adds the full write-up and FAQ.

What it does not do

  • No account, no signup, no key.
  • No telemetry. Nothing about your usage goes anywhere.
  • Nothing of yours is read from disk. The only file it opens is its own bundled OUI table.
  • The local tools never open a socket. The network tools talk only to public services — Cloudflare and Google's DNS-over-HTTPS resolvers, Cloudflare's trace endpoint, Team Cymru's ASN DNS, and whichever host you point tls_inspect at. tls_inspect refuses anything that resolves to private or reserved space, so it cannot be turned on your own network.
  • "Is my port reachable from outside?" needs a machine outside your NAT to try the connection. That is what whatismynetip.com/port-checker does; a local tool cannot.

The port data and the calculators are the same ones the site uses, so the two stay in step.

Licence

MIT © Larkwright LLC. Written by James Son — network, security, and automation engineer. Corrections and additions to the port write-ups are welcome.

来源：README.md，提交 d422005

工具

0
SourceWeft 尚未在沙箱中启动过该软件包，因此其工具未知。

版本历史

1
  1. v0.1.1最新Nov 7, 2026

评分

已满足适用检查项的 50%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通25 分

    请保持端点能够响应 MCP 握手；SourceWeft 每 30 天探测一次。

  • 已声明认证方式10 分

    请在注册中心条目中声明凭据请求头，或保持端点能够响应探测，以便判定其认证方式。

  • 已列出工具15 分

    请让服务器在无凭据时响应 tools/list，或发布可在沙箱中无凭据启动的软件包。

  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分