com.isipsafe由 isipsafe.com 發布官方發布者v1.0.1更新於 Nov 5, 2026
檢查IP地址或網路是否惡意，並向isIPsafe檢舉濫用IP。
AI 翻譯由 AI 模型根據下方的原文描述翻譯，可能有誤。
Check whether an IP address or network is malicious and report abusive IPs to isIPsafe.
isIPsafe 的託管 MCP 服務（isipsafe.com），由 isipsafe.com 發布；可選 API 金鑰；Streamable HTTP；12 個工具。
暫無 AI 概覽：以下資訊來自註冊中心條目和服務本身。
Web executable，透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。
把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。
閱讀 https://sourceweft.com/mcp/com.isipsafe%2Fisipsafe/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。把它新增到你客戶端的 mcpServers 設定中。
{
"mcpServers": {
"isipsafe": {
"type": "http",
"url": "https://isipsafe.com/mcp"
}
}
}Official Python client and command-line tool for isIPsafe, the free IP reputation and abuse reporting service.
No dependencies outside the Python standard library. Python 3.9+.
Lookups work without a key (400 per day per address). Reporting, bulk uploads and the blocklist need a free key from isipsafe.com/login. A key also raises the lookup limit to 10,000 per day.
The client sends the key in an Authorization header, never in the URL, so it stays out of proxy and server logs.
Every error inherits from isipsafe.IsIPsafeError.
Lookups are retried automatically on network errors and 5xx responses. Reporting the same address twice within 15 minutes is not an error: report() returns a result with duplicate=True.
Add --json to check, report, reports, check-block and categories for machine-readable output.
Use --fail-if-malicious in shell scripts. The command exits with status 1 when the address is malicious:
Exit codes: 0 success, 1 malicious (only with --fail-if-malicious), 2 error.
Use the slug or the numeric ID. Common ones: ssh, brute-force, port-scan, web-app-attack, sql-injection, vuln-scan, bad-bot, ddos, email-spam, phishing. Run isipsafe categories for the full list, or see isipsafe.com/categories.
The code in this repository is MIT licensed. Data returned by the isIPsafe API is covered by the isIPsafe EULA.
來源：README.md，提交 e5992ab
Check an IP address
Reputation of one IPv4 or IPv6 address: abuse confidence score (0-100, 75+ is on the blocklist), number of reports and distinct reporters, attack categories, country, network owner (ASN), Tor exit status and a link to its page. Set verbose to include the latest reports with their comments.
ip必填verbosemaxAgeInDaysList reports for an IP address
The individual abuse reports filed against one address, newest first, with time, categories, comment (usually log lines) and reporter. Paginated.
ip必填pageperPagemaxAgeInDaysCheck a network (CIDR)
Every reported address inside a CIDR block (IPv4 up to /16, IPv6 up to /48), with score, report count and last report time, plus the network's owner. Use it to judge a whole hosting range or subnet.
network必填maxAgeInDaysReport an abusive IP address
File an abuse report against an address that attacked a system you run. Needs an API key. Use category codes from list_categories (e.g. ssh,brute-force) and put the evidence (log lines, never personal data) in the comment. Each reporter can report the same address once per 15 minutes. Only report real, observed abuse.
ip必填commenttimestampcategories必填Get the blocklist
The highest-confidence abusive addresses right now, best first, with score, country and categories. Needs an API key and counts as one blocklist download. For a firewall-ready file, point the firewall at the blocklist URL instead (see the integrations).
limitipVersiononlyCountriesexceptCountriesconfidenceMinimumList report categories
All attack categories with their code, numeric ID, group and when to use them. Use the codes with report_ip.
無需輸入參數。
Current abuse statistics
What the database sees right now: reports in the last 24 hours, addresses on the blocklist, and over the last 30 days the top attack categories, countries, networks and highest-scoring addresses.
無需輸入參數。
Today News
Today's threat news from the last 24 hours: the countries the most reported attacks come from, the networks (ASNs) behind them, the attack techniques (categories) reported most, and the top 10 malicious IP addresses reported today, highest score first. Use it for a daily briefing on what is attacking right now.
無需輸入參數。
Analyze log traffic
Find malicious traffic in logs. Pass raw log lines from any source (nginx/Apache/IIS access logs, sshd/auth.log, syslog, firewall such as iptables/UFW/pfSense/ASA, mail servers, Windows events as text, CEF, JSON lines from a SIEM or cloud, CSV); every IPv4/IPv6 address is extracted wherever it appears and each non-blank line is one event. Returns how many events came from malicious (score 75+), suspicious (25-74) and unreported addresses, the top offenders with score and attack categories, the busiest addresses, countries, networks, attack categories, detected log formats, HTTP status classes, failed logins and the time range. Each distinct address looked up counts as one lookup against the daily allowance, busiest first. Per analysis: without a key 256 KB and 100 addresses, free key 2 MB and 1,000, Enterprise 5 MB and 10,000. The log is not stored. Remove secrets (passwords, tokens) before sending.
logs必填Abuse report for a country
How many addresses in a country were reported in the last 30 days, how many are on the blocklist, the most reported addresses there, and the networks and attack categories behind them.
country必填Abuse report for a network (ASN)
Abuse reported against one autonomous system in the last 30 days: number of reported and blocklisted addresses, the worst addresses, attack categories and countries. Useful to judge a hosting provider or ISP.
asn必填About isIPsafe
Explains isIPsafe itself. Use it for any question about the product rather than guessing: what it is and who it is for, its mission and aims, how reports and the confidence score work, plans, pricing and limits, how to get started, how to get an address delisted, privacy, and who runs it. Needs no API key and uses no allowance.
topic已滿足適用檢查項的 100%
該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。
pip install isipsafeexport ISIPSAFE_API_KEY=sl_your_key_herefrom isipsafe import Client
client = Client() # reads ISIPSAFE_API_KEY, or pass Client("sl_...")
result = client.check("185.220.101.1")print(result.abuse_confidence_score, result.total_reports, result.categories)
if result.is_malicious(): # score >= 75, has reports, not allowlisted block(result.ip_address)
client.report( "203.0.113.50", ["ssh", "brute-force"], comment="sshd: 212 failed logins in 10 minutes",)result = client.bulk_report( [ {"ip": "203.0.113.50", "categories": ["ssh", "brute-force"], "comment": "sshd"}, {"ip": "198.51.100.4", "categories": "port-scan"}, ])print(result.saved_reports, result.invalid_reports)ips = client.blocklist(confidence_minimum=90, except_countries=["GB"])nft = client.blocklist_raw(format="nftables")$ isipsafe check 185.220.101.1185.220.101.1 not flagged score 56/100 (Medium) reports 24 from 5 reporters categories port-scan, hacking, vuln-scan, web-app-attack, c2 network DE AS60729 Stiftung Erneuerbare Freiheit flags Tor exit details https://isipsafe.com/ip/185.220.101.1
$ isipsafe report 203.0.113.50 -c ssh,brute-force -m "sshd: 212 failed logins"$ isipsafe bulk-report reports.csv$ isipsafe blocklist --format nftables --confidence-minimum 90 -o blocklist.nft$ isipsafe check-block 185.220.101.0/24$ isipsafe categoriesif ! isipsafe check "$IP" --fail-if-malicious --threshold 80 > /dev/null; then echo "blocking $IP"fi