Skip to main content
Glama

Netmon (demo)

get_network_entity_info

Read-onlyIdempotent

Retrieves WHOIS, GeoIP and DNS information for a public IP address or hostname. A hostname is resolved to an IP for the GeoIP lookup (resolved_ip, when resolution succeeds); an IP gets a reverse DNS lookup (hostname, when a PTR exists).

whois comes from whois.iana.org and nowhere else. For an address IANA returns the RIR referral record, so its organisation is the regional registry that administers the block (ARIN, RIPE, APNIC, LACNIC, AFRINIC) — NOT the ISP, hosting company or assignee. For a hostname it is the TLD registry, not the domain owner. Never report either as the operator; a refer or whois field only names the RIR's own whois server, which this tool does not query.

geoip is the geolocation provider's response passed through verbatim, so the key set varies with provider tier and with whether the answer came from cache. Treat every field as optional — including isProxy, asn and asnOrganization, which may simply be absent. The whole geoip key is omitted for addresses that are not globally routable and when the lookup is unavailable.

To judge hosting/datacenter versus residential or small-business ISP, reason from the evidence actually returned:

  • The hostname PTR pattern: a provider-branded label under a hosting or cloud domain reads as datacenter, whereas the address itself embedded in the name under a consumer ISP's domain reads as subscriber. A missing PTR is weak evidence in either direction.

  • geoip.isProxy when present: true points to a VPN, proxy or hosting exit.

  • geoip.asnOrganization (and asn) when present: a cloud, colocation or hosting provider points to a datacenter; an access or eyeball ISP points to residential.

Label that classification as a heuristic and name the evidence you used for it. If no PTR came back and no ASN fields are present, say the evidence is insufficient rather than guessing.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
entity_identifierYesThe IP address or hostname to query.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes far beyond the annotations. It discloses that `whois` comes from whois.iana.org only, that GeoIP responses are passed through verbatim with variable keys, that the whole `geoip` key may be omitted for non-routable addresses, and that hostname resolution behavior depends on whether resolution succeeds. It also provides detailed guidance on how to interpret PTR records and ASN fields for classification, and explicitly warns against reporting RIRs as operators. This is exceptional behavioral transparency for a read-only lookup tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but every section earns its place. It is front-loaded with the core purpose, then systematically covers WHOIS source, GeoIP variability, and classification heuristics. The structure uses clear paragraph breaks and bullet-like guidance. It is not concise in the sense of being short, but it is efficiently organized and dense with necessary caveats. The length is justified by the complexity of the tool's output interpretation, though a slightly tighter summary of the classification heuristics could have been considered.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with one parameter, no output schema, and rich behavioral caveats, the description is complete. It covers input semantics, output variability, data sources, interpretation guidance, and failure modes (missing PTR, missing ASN, non-routable addresses). An agent has everything needed to call the tool correctly and interpret the response. The annotations (readOnlyHint, idempotentHint, destructiveHint) already cover the safety profile, so the description's focus on data interpretation is appropriate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has 100% description coverage for the single parameter `entity_identifier`, which is described as 'The IP address or hostname to query.' The description adds meaningful semantics beyond this: it explains that a hostname is resolved to an IP for GeoIP, and an IP gets a reverse DNS lookup. It also clarifies the input must be a public IP or hostname. The only minor gap is that the description doesn't explicitly state the expected format (e.g., IPv4 vs IPv6), but the schema already covers the basic meaning, so the description adds sufficient value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Retrieves WHOIS, GeoIP and DNS information for a public IP address or hostname.' It clearly distinguishes the tool's scope from siblings like search_ip or arp_lookup by naming the three data types and the input type. The annotation title 'Look Up WHOIS, GeoIP and DNS' reinforces the purpose, and the description adds detail about resolution behavior that makes the tool's function unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly explains when to use this tool: for WHOIS, GeoIP, and DNS lookups on public IPs or hostnames. It also provides implicit guidance by contrasting with what the tool does NOT do—it does not query the RIR's whois server, and it does not return ISP/operator information. This helps an agent avoid misusing the tool for operator attribution. The sibling list includes related network tools (search_ip, arp_lookup, traceroute), and the description's clarity about scope effectively routes the agent to this tool for the right use case.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.