Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@mcp-ip2location Where is 8.8.8.8 located?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Give your AI assistant a sense of place.
An MCP (Model Context Protocol) server that lets Claude Desktop, Claude Code, or any MCP-compatible client perform IP geolocation, proxy detection, and domain WHOIS lookups natively — powered by IP2Location.io and IP2WHOIS.
Once connected, you can simply ask your assistant things like:
"Where are these 5 IPs from my nginx log located, and are any of them proxies?" "How old is the domain in this suspicious invoice email?" "Which of these login IPs are outside Malaysia?"
…and it answers with real data instead of guessing.
Tool | What it does |
| Country, region, city, coordinates, timezone, ASN for one IP (plus ISP, usage type, mobile carrier and more on paid plans) |
| Is this IP a known proxy/VPN/anonymizer? |
| Domain age, registrar, expiry, nameservers, registrant |
| Up to 50 IPs in one request — ideal for pasted log excerpts |
| Reverse-IP lookup: list domains hosted on a given IP |
Related MCP server: mcp-ipinfo
git clone https://github.com/eweley95/mcp-ip2location
cd mcp-ip2location
npm install
npm run buildGet a free API key at https://www.ip2location.io (50,000 IP queries + 500 WHOIS queries per month — the same key covers both).
The easiest and most reliable way to find the config file is from inside the
app: open Settings → Developer → Edit Config. This opens the correct
claude_desktop_config.json (creating it if needed), wherever your install
keeps it — you don't have to hunt for the path.
If you'd rather open it manually, the location depends on how Claude Desktop was installed:
macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows (installer / .exe version):
%APPDATA%\Claude\claude_desktop_config.json
(i.e. C:\Users\<you>\AppData\Roaming\Claude\)
Windows (Microsoft Store version): the file lives under the packaged
app data instead, e.g.
C:\Users\<you>\AppData\Local\Packages\Claude_<id>\LocalCache\Roaming\Claude\claude_desktop_config.json
The Claude_<id> folder name varies per machine — using Edit Config
avoids having to find it.
Add the mcpServers block to that file. If the file already has other keys
or other servers, merge this entry in rather than overwriting it:
{
"mcpServers": {
"ip2location": {
"command": "node",
"args": ["C:\\path\\to\\mcp-ip2location\\dist\\index.js"],
"env": { "IP2LOCATION_API_KEY": "YOUR_KEY" }
}
}
}Before saving, replace the two placeholders with your own values:
C:\\path\\to\\mcp-ip2location\\dist\\index.js→ the full absolute path todist\index.jsin the folder where you cloned this project (e.g.C:\\src\\IP2\\mcp-ip2location\\dist\\index.js). Keep the doubled backslashes.
YOUR_KEY→ your real IP2Location.io API key from your account dashboard.The server won't start until both are correct.
Notes for Windows:
Use the full absolute path to dist\index.js and double the
backslashes (\\) — JSON treats a single \ as an escape character.
Run npm install and npm run build first, so dist\index.js actually
exists before you point at it.
A stray comma or missing brace will silently stop all servers from loading, so validate the JSON if the tools don't appear.
Then fully quit Claude Desktop (right-click the system-tray icon → Quit, not just closing the window) and reopen it. The five tools appear automatically. Try it with: "Where is the IP 8.8.8.8 located?"
MCP is an open standard (governed by the Linux Foundation), so this server
isn't tied to Claude — the same dist/index.js works with any MCP-compatible
host. Common ones include Claude Desktop & Claude Code, OpenAI ChatGPT,
Google Gemini, GitHub Copilot / VS Code, Cursor, Windsurf, Zed, and local
runners like Ollama and LM Studio.
The server definition is the same everywhere (command, args, env) — only
where you register it differs per app. A few examples:
Cursor — create .cursor/mcp.json in your project (or the global
~/.cursor/mcp.json):
{
"mcpServers": {
"ip2location": {
"command": "node",
"args": ["C:\\path\\to\\mcp-ip2location\\dist\\index.js"],
"env": { "IP2LOCATION_API_KEY": "YOUR_KEY" }
}
}
}VS Code (Copilot / Agent mode) — add to .vscode/mcp.json:
{
"servers": {
"ip2location": {
"command": "node",
"args": ["C:\\path\\to\\mcp-ip2location\\dist\\index.js"],
"env": { "IP2LOCATION_API_KEY": "YOUR_KEY" }
}
}
}Claude Code (CLI):
claude mcp add ip2location \
--env IP2LOCATION_API_KEY=YOUR_KEY \
-- node /absolute/path/to/mcp-ip2location/dist/index.jsFor other hosts (ChatGPT, Gemini, Ollama, LM Studio, etc.), consult that
app's "MCP servers" or "connectors" settings and supply the same three values.
Remember to replace the path and YOUR_KEY in every case.
Once connected, just ask in plain language — Claude picks the right tool. Here is one example per tool:
ip_geolocation — where is a single IP?
You: Where is the IP 8.8.8.8 located?
Claude: [calls ip_geolocation]
8.8.8.8 is in Mountain View, California, United States (AS15169,
Google LLC). Not flagged as a proxy.proxy_check — can I trust this IP?
You: Is 185.220.101.45 a proxy or VPN?
Claude: [calls proxy_check]
Yes — 185.220.101.45 is flagged as a proxy/VPN/anonymizer. It's in
Germany on AS60729, a range well known for Tor exit nodes.whois_lookup — how old / trustworthy is a domain?
You: How old is the domain example.com?
Claude: [calls whois_lookup]
example.com was first registered on 1995-08-14 (about 30 years ago),
last updated 2024-08-14, and expires 2025-08-13. Registrar: RESERVED
— Internet Assigned Numbers Authority. A long-established domain.bulk_geolocate — analyse a list of IPs at once
You: Where are these from, and any proxies?
185.220.101.45, 8.8.8.8, 175.139.142.25
Claude: [calls bulk_geolocate]
185.220.101.45 — Germany, AS60729 — flagged as proxy (Tor range)
8.8.8.8 — United States, Google LLC — not flagged
175.139.142.25 — Malaysia, TM Net — not flaggedhosted_domains — what else is on this server? (reverse IP)
You: What domains are hosted on the IP 104.26.10.78?
Claude: [calls hosted_domains]
That IP hosts 1,240 domains across 25 pages (it's a shared
Cloudflare address). The first page includes example1.com,
example2.net, ... — want me to pull a specific page?The exact values above are illustrative; live results depend on current data and your plan's detail level.
The server speaks MCP over stdio; no port is opened.
Plan-dependent fields. The free plan returns country, region, city,
coordinates, timezone, ASN and the is_proxy flag. Richer fields (ISP,
domain, usage type, mobile carrier, elevation, detailed proxy typing, etc.)
are returned only on paid IP2Location.io plans — ip_geolocation includes
them automatically when your plan provides them, and omits them otherwise.
bulk_geolocate uses the dedicated bulk endpoint (one request for all IPs)
and falls back to per-IP lookups if that endpoint isn't on your plan.
Errors (invalid IP, quota exceeded) are returned to the assistant as tool errors so it can explain them to you rather than failing silently.
MIT
Geolocate up to 50 IP addresses in a single request and return a compact table. Useful for analyzing a list of IPs from a log file.
| Name | Required | Description | Default |
|---|---|---|---|
| ips | Yes | List of IP addresses (max 50) |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description bears full responsibility for behavioral disclosure. It mentions the batch limit (already in schema) and the compact table return format, but does not disclose error handling, invalid IP behavior, or latency characteristics. The added value is modest.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence plus a usage tip, with zero fluff. It front-loads the core functionality and limit in the first clause.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple tool (one parameter, no output schema, no annotations), the description covers the essential purpose and a typical use case. It lacks detail about the actual table columns or failure modes, but for a batch geolocation tool, it is reasonably complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% (the 'ips' parameter has a description: 'List of IP addresses (max 50)'). The tool description adds only the redundant 'up to 50 IP addresses' detail and does not elaborate on IP format (IPv4/IPv6) or input requirements beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's action ('Geolocate'), the resource ('IP addresses'), the batch scope ('up to 50 in a single request'), and the output format ('compact table'). It also distinguishes itself from single-IP siblings like ip_geolocation through its batch focus.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides a clear use case ('analyzing a list of IPs from a log file') but does not explicitly exclude single-IP usage or mention alternatives (e.g., ip_geolocation). This is clear context without explicit when-not-to-use guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List domain names hosted on a given IP address (reverse-IP lookup). Use this to find other sites sharing the same server, e.g. when investigating a suspicious host or mapping an organisation's footprint.
| Name | Required | Description | Default |
|---|---|---|---|
| ip | Yes | IPv4 or IPv6 address to find hosted domains for | |
| page | No | Page number (results are paginated) |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. 'List' and 'lookup' strongly imply a read-only operation with no destructive side effects, which is transparent enough for this type of tool. It does not disclose every nuance (e.g., rate limits), but the core safety profile is clear.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is exactly two sentences: the first states the purpose, the second provides usage context. Every sentence earns its place, and the most important information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (2 params, no output schema, no annotations), the description covers the essential purpose and usage. It doesn't explain the return format or detailed pagination behavior, but those are inferable and the page parameter is already described in the schema. It is complete enough for an agent to use effectively.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already provides 100% coverage for both parameters ('ip' and 'page') with clear descriptions. The tool description adds no additional parameter-specific meaning beyond reinforcing that the IP is the target. Baseling 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'List domain names hosted on a given IP address (reverse-IP lookup)', which uses a specific verb and resource, immediately distinguishing it from sibling tools like ip_geolocation or whois_lookup.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides explicit usage scenarios ('investigating a suspicious host or mapping an organisation's footprint') and clearly states the tool's use case for finding other sites on the same server. However, it does not explicitly name alternatives or exclusions, so it stops short of a full 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Look up the geographic location of an IPv4 or IPv6 address: country, region, city, coordinates, timezone, ASN and network operator. Use this when the user asks where an IP address is located or who operates it.
| Name | Required | Description | Default |
|---|---|---|---|
| ip | Yes | IPv4 or IPv6 address, e.g. 8.8.8.8 |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It accurately describes the read-only nature of the lookup and the data returned, which is transparent for a simple geolocation tool. However, it does not disclose any potential error behavior, data source limitations, or latency expectations. With no annotations, this is adequate but not rich; it meets the minimum viable level.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences: the first announces the action and expected outputs, the second gives a direct usage trigger. There is no redundant information, and it is front-loaded with the verb and resource. Every sentence earns its place, making it highly concise and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's low complexity (single parameter, no output schema), the description is fairly complete: it lists the returned data categories and states when to use it. It does not explicitly mention error handling or response format, but those are not critical for a straightforward lookup. Minor gaps exist, so it is not a perfect 5.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% for the single parameter 'ip', and its description ('IPv4 or IPv6 address, e.g. 8.8.8.8') is clear. The tool description also mentions IPv4/IPv6, but it does not add new semantic details beyond the schema. Since the schema already documents the parameter well, the description does not need to compensate, so a baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function with a specific verb ('Look up') and resource ('geographic location of an IPv4 or IPv6 address'), and lists the output fields (country, region, city, coordinates, timezone, ASN, network operator). This distinguishes it from sibling tools like bulk_geolocate or whois_lookup by focusing on a single-IP lookup with specific data points.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit when-to-use guidance: 'Use this when the user asks where an IP address is located or who operates it.' It does not explicitly mention when not to use alternatives, but the context is clear enough given the tool's simplicity and sibling set. This is a clear context without explicit exclusions, so it falls short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Check whether an IP address is a known proxy, VPN, or anonymizer exit. Use this to assess whether traffic from an IP can be trusted, e.g. for fraud triage or log investigation.
| Name | Required | Description | Default |
|---|---|---|---|
| ip | Yes | IPv4 or IPv6 address to check |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses the core behavior (checking against known proxy/VPN/anonymizer lists), but does not mention data source, coverage, staleness, rate limits, or return format. Basic behavior is clear; operational limitations are omitted.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the action and then a use case. Every word earns its place; no redundant or vague phrasing.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple single-parameter checker with good schema coverage, the description adequately covers purpose and use case. It does not describe return values, but given the low complexity and lack of an output schema, the description is largely complete for selection and invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already documents the single 'ip' parameter with 100% coverage, so the description adds no new parameter-level detail. The description's context (assessing traffic trust) reinforces the parameter's meaning, but it does not enhance the schema-provided information.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Check whether') and clearly identifies the resource (IP address) and the target condition (known proxy, VPN, or anonymizer exit). It distinguishes from sibling tools like ip_geolocation or whois_lookup by focusing on network anonymity/trust rather than location or registration.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly states when to use the tool: 'Use this to assess whether traffic from an IP can be trusted, e.g. for fraud triage or log investigation.' This gives clear contextual guidance, though it does not explicitly contrast with alternative tools for when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Fetch WHOIS registration data for a domain: creation/expiry dates, registrar, nameservers and registrant. Use this to judge how old or trustworthy a domain is, e.g. when vetting a sender or website.
| Name | Required | Description | Default |
|---|---|---|---|
| domain | Yes | Domain name, e.g. example.com |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses the kind of data returned but does not mention potential limitations such as privacy redaction (e.g., GDPR), rate limits, or behavior for invalid/nonexistent domains. The description is accurate but not rich in behavioral detail.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences: the first explains what the tool does and the data it returns, the second gives a concrete use case. No redundant information or fluff, well front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter lookup with no output schema, the description covers the purpose, the kind of data returned, and a practical use case. Minor gaps such as error handling or data availability caveats are not covered, but the tool's simplicity means this is mostly complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the single 'domain' parameter, which already has a clear description with an example. The tool description adds no additional parameter semantics beyond what the schema provides, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses specific verb 'Fetch' and resource 'WHOIS registration data for a domain', listing expected data fields (creation/expiry dates, registrar, nameservers, registrant). This clearly differentiates the tool from IP-focused siblings like ip_geolocation and proxy_check.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides an explicit use case: 'Use this to judge how old or trustworthy a domain is, e.g. when vetting a sender or website.' However, it does not explicitly mention alternative tools or situations where this tool should not be used.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v1.0.0bulk_geolocatehosted_domainsip_geolocationproxy_checkwhois_lookupScored across 5 tools
Each tool has a clearly distinct purpose: single IP geolocation, bulk geolocation, proxy detection, domain WHOIS, and reverse IP lookup. The overlap between ip_geolocation and bulk_geolocate is resolved by the batch vs. single distinction, so no ambiguity exists.
Tool names follow mixed conventions: 'ip_geolocation' is a noun phrase, 'proxy_check' and 'whois_lookup' are object-verb, 'bulk_geolocate' is modifier-verb, and 'hosted_domains' is a noun phrase. There is no consistent verb_noun or resource_action pattern, making the naming unpredictable.
With 5 tools, the server is well-scoped for an IP intelligence service. Each tool provides a distinct and necessary capability without unnecessary redundancy, and the count is within the ideal 3-15 range.
The tool surface covers the primary IP lookup domain: geolocation, proxy detection, bulk geolocation, WHOIS for domains, and reverse IP. Minor gaps exist, such as no direct domain-to-IP resolution or standalone ASN lookup, but these can be worked around with existing tools.
IP geolocation, ASN and network data, plus VPN, proxy and Tor detection. ASN tools need no key.
WHOIS/RDAP lookup, IP geolocation and Punycode conversion. 1400+ TLDs incl. IDN. No API key.
Unlock the power of IP geolocation with our tool! Whether you're a developer needing location data
IP Geolocation: This API provides fast, reliable, and developer-friendly IP geolocation, ASN.