Skip to main content
Glama
Sign In
ffraud

ffraud

Official
by FFraud-com
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Hybrid

IP check

ip_check
Read-onlyIdempotent

Check any IPv4 or IPv6 address for a 0–100 fraud score, VPN/proxy/Tor use, network owner, location, abuse history, and subnet risk before trusting signups, checkouts, or API callers.

Instructions

Fraud intelligence for any IPv4 or IPv6 address: a 0-100 fraud score, risk band, and whether it is a VPN, proxy, Tor node, relay, datacenter host or mobile connection. Also returns the owning network (ASN, ISP, organisation), geolocation, reverse DNS, abuse history and how much of its /24 subnet is flagged. Free, no key. Use it before trusting a signup, a checkout or an API caller.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "ips": "<ips>"
    },
    "name": "ip_check"
  }
}

Input Schema

NameRequiredDescriptionDefault
ipsYesIPv4 or IPv6 addresses. One is the common case.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv1.1.1

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, openWorld and non-destructive, so the safety profile is covered. The description adds context the annotations cannot: it is free, needs no API key, and returns abuse history and subnet-level flagging, which shapes how the caller interprets results. It does not discuss rate limits, error behavior for malformed IPs, or latency/async behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the capability and its returns, then closed with a single actionable usage sentence. Dense and information-rich with no filler or repeated phrasing.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter read tool with rich annotations and no output schema, the description carries its weight: it enumerates return fields, states cost and auth model, and gives a usage trigger. The main omission is batch behavior (up to 50 addresses) and error handling, both of which an agent would want before calling with a list.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the single parameter is fully documented in the schema, including the 50-item cap and the note that one IP is the common case. The description adds nothing about the `ips` array — notably it never mentions that batch lookup up to 50 addresses is possible, so it does not compensate for the reader who skims only prose.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Names the resource (IPv4/IPv6 address), the operation (fraud intelligence lookup) and enumerates concrete outputs: 0-100 fraud score, risk band, VPN/proxy/Tor/relay/datacenter/mobile flags, ASN/ISP/org, geolocation, reverse DNS, abuse history and /24 subnet flagging. An agent can distinguish this from domain_check or email_check without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit trigger condition: "Use it before trusting a signup, a checkout or an API caller." That tells the agent when to reach for it. It stops short of naming exclusion conditions or pointing to the sibling tools (domain_check, email_check) for non-IP indicators.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools