Skip to main content
Glama
robyroro

osint-mcp-server

ASN / BGP lookup

asn_lookup
Read-onlyIdempotent

Identify the network or hosting provider behind an IP and map an organization's address space by retrieving AS holder, announcement status, and announced prefixes via RIPEstat.

Instructions

Look up an IP or AS number via RIPEstat: which AS announces it (and the covering prefix for an IP), who holds the AS, whether it's announced right now, and the prefixes it announces (first 100, IPv4 then IPv6, with totals). Works for every RIR, not only RIPE.

Use to find the hosting / network provider behind an IP or to map an organisation's address space. Use ip_whois for the registration record and abuse contact. Cached for 6h.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
queryYesAn IP address ("1.1.1.1") or an AS number, with or without the AS prefix ("AS13335" or "13335").
include_prefixesNoAlso list the prefixes the AS announces. Set false when you only need the holder.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed2 schema fields changedv0.2.2
    • addedInput schema / properties / include_prefixes / description
      Added value: +"Also list the prefixes the AS announces. Set false when you only need the holder."
    • addedInput schema / properties / query / description
      Added value: +"An IP address (\"1.1.1.1\") or an AS number, with or without the AS prefix (\"AS13335\" or \"13335\")."
  2. First observedv0.2.0

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, openWorld, idempotent, non-destructive, so the safety profile is covered. The description adds meaningful behavioral context beyond that: result caching for 6h and the truncation policy on prefixes (first 100, IPv4 then IPv6, with totals). It stops short of stating rate limits or error behavior, so not a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the return shape, then usage, then the sibling disambiguation, then the caching note. Four dense sentences with no filler, though the parenthetical about prefix ordering is slightly crammed mid-sentence.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema, so the description carries the return-value burden itself and does so by enumerating the returned fields and prefix truncation. Caching and sibling routing are covered. It omits error handling and rate-limit behavior, but for a read-only lookup tool this is close to complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, and both parameters carry descriptive text including accepted query syntax and default values. The description's note about prefixes being limited to the first 100 adds runtime behavior the schema does not, but otherwise the schema does the heavy lifting. Baseline 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (look up) and resource (IP or AS number), enumerates exactly what is returned (announcing AS, covering prefix, holder, announcement status, prefixes), and clarifies it works for every RIR, not just RIPE. An agent can distinguish it from ip_whois and dns_lookup without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit use cases (find hosting/network provider behind an IP, map an organisation's address space) and names the alternative (ip_whois) with the condition that routes to it (registration record and abuse contact). Clear when-to-use and when-to-use-something-else.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.