FindIP
OfficialServer Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| FINDIP_API_KEY | Yes | Your FindIP API key. Required for lookup_ip, list_shield_sites, recent_risky_events and explain_event. | |
| FINDIP_TIMEOUT_MS | No | Request timeout. Default 15000. | 15000 |
| FINDIP_API_BASE_URL | No | Override the FindIP API host, for testing. | |
| FINDIP_PORTAL_BASE_URL | No | Override the FindIP portal host, for testing. | |
| FINDIP_SHIELD_BASE_URL | No | Override the FindIP Shield host, for testing. | |
| FINDIP_SHIELD_SECRET_KEY | No | Secret key (sec_...) of one Shield site. Required for verify_session. Find it in the site's settings in the Shield dashboard. | |
| FINDIP_SHIELD_ACCOUNT_API | No | Set to 0 to turn off the three Shield account tools, so the API key is used for IP lookups only. On by default. | 1 |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| lookup_ipA | IP intelligence for one IPv4 or IPv6 address from FindIP: country, city, ISP and ASN, connection type, and risk signals (VPN, proxy, Tor, relay, hosting, scanner, malicious listings, threat score). Signals describe the network an address belongs to, not the person using it. |
| verify_sessionA | Server-side risk check for one FindIP Shield session: risk score, recommendation (allow, monitor, challenge, block), whether a challenge was passed, and the session picture (IP, ASN and country rotation, network flags, risk reasons). This is the same check a backend runs before acting on a signup, login or checkout. An unknown session returns verified: false; a session without IP intelligence returns risk_status "unknown", which is not the same as safe. Uses the site secret key from FINDIP_SHIELD_SECRET_KEY. |
| list_shield_sitesA | Lists the FindIP Shield sites on your account: ID, name, domain, status, last event time and today's event and risky-event counts. Start here to find the site to ask about. |
| recent_risky_eventsA | Recent events on one Shield site at or above a risk score, newest first: event name, page, IP, country, network, network signals, score, recommendation and reasons. Good for questions like "what risky traffic hit my signup form this week". End-user identity is never returned. |
| explain_eventA | Explains one Shield event in plain language: where it came from, which risk signals fired, the score and recommendation, and what the in-page SDK did. The explanation describes risk signals, not a verdict about the visitor. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 5 tools
Each tool targets a clearly distinct object and action: raw IP intel (lookup_ip), session risk verdict (verify_session), site inventory (list_shield_sites), site-level event listing (recent_risky_events), and single-event narrative (explain_event). The descriptions explicitly disambiguate the look-alike pair (IP-level vs session-level risk) and clarify that 'unknown' is not 'safe'. The two event tools are separated by list-vs-explain, which is easy for an agent to reason about.
Four of five names follow a verb_noun pattern (lookup_ip, verify_session, list_shield_sites, explain_event). The exception is recent_risky_events, a bare noun phrase with no verb, which breaks the otherwise predictable convention. All are snake_case, so the deviation is minor rather than chaotic.
Five tools is a tight, well-scoped set for an IP intelligence plus Shield session/event domain, and each tool has an evident role. It sits at the low end, with no room for filtering or drill-down variants, which is a slight under-provisioning rather than an excess.
Core read workflows are covered (identify a site, list its risky events, explain one event, check a session, look up an IP), but there are notable gaps: no way to list all events for a site regardless of risk, no event-detail fetch separate from the plain-language explanation, and no session listing or site configuration inspection. An agent asking 'what happened on my site today' or 'show me this specific event's raw data' can hit a dead end.