Skip to main content
Glama
enesjakozh
rossja

IR Toolshed MCP Server

by rossja
OverviewSchemaRelated ServersScoreDiscussions
Python
Remote

IR Toolshed MCP Server

A comprehensive Model Context Protocol (MCP) server providing incident response and network analysis tools for security professionals. This server allows AI agents like Claude to perform various network-related lookups and analyses to assist with security investigations.

Overview

The IR Toolshed MCP Server provides a suite of networking and security tools accessible via the Model Context Protocol. It's designed to be a general-purpose service for network incident responders, enabling them to perform basic lookups using:

  • ASN (Autonomous System Number) lookups

  • DNS lookups and analysis

  • WHOIS record retrieval

  • IP geolocation

  • And more network analysis capabilities to come

Each tool is accompanied by detailed documentation as a resource, making it easy for AI systems to understand how to use the tools and what output to expect.

Related MCP server: Wireshark MCP

Current Tools

ASN Lookup Tool

The ASN lookup tool returns information about an IP address including:

  • The IP address that was queried

  • The AS number associated with the IP address

  • The name of the organization that owns the AS number

DNS Lookup Tool

The DNS lookup tool provides DNS record information for domains:

  • Supports multiple record types (A, AAAA, MX, NS, TXT)

  • Returns formatted DNS records

  • Handles both IPv4 and IPv6 queries

WHOIS Lookup Tool

The WHOIS lookup tool retrieves domain registration information:

  • Domain ownership details

  • Registration dates

  • Nameserver information

  • Registrar details

Geolocation Tool

The IP geolocation tool provides location information using MaxMind's GeoLite2 database:

  • Country and city-level location data

  • Latitude and longitude coordinates

  • Network information

  • Timezone data

Note: The geolocation tool requires a MaxMind license key. You can:

  1. Get a free key from: https://dev.maxmind.com/geoip/geolite2-free-geolocation-data

  2. Either:

    • Set the MAXMIND_LICENSE_KEY environment variable

    • Provide it as a parameter when using the tool

    • Enter it when prompted

More tools will be added in future releases.

Prerequisites

  • Python 3.8 or newer (3.13+ recommended)

  • uv Python package manager

Installation

  1. Clone this repository:

git clone <repository-url>
cd ir-toolshed-mcp-server

  1. Create a virtual environment:

uv venv

  1. Activate the virtual environment:

On Windows:

.venv\Scripts\activate

On macOS/Linux:

source .venv/bin/activate

  1. Install the package in development mode:

uv pip install -e .

Running the Server

Start the MCP server with:

uv run mcp dev src/mcp_server.py

This will launch the server in development mode, making it available to MCP clients like Claude Desktop.

Using the Tools

ASN Lookup Tool

When connected to an MCP client such as Claude Desktop, you can use the ASN lookup tool by providing an IP address:

asnlookup("8.8.8.8")

Example output:

{
    "ip_addr": "8.8.8.8",
    "as_number": "15169",
    "as_name": "GOOGLE - Google LLC"
}

DNS Lookup Tool

When connected to an MCP client such as Claude Desktop, you can use the DNS lookup tool by providing a domain:

dnslookup("example.com")

Example output:

{
    "domain": "example.com",
    "record_type": "A",
    "record_value": "93.184.216.34"
}

WHOIS Lookup Tool

When connected to an MCP client such as Claude Desktop, you can use the WHOIS lookup tool by providing a domain:

whoislookup("example.com")

Example output:

{
    "domain": "example.com",
    "ownership_details": "Google LLC",
    "registration_date": "2004-04-26",
    "nameserver_information": "ns1.google.com",
    "registrar_details": "MarkMonitor Inc."
}

Geolocation Tool

When connected to an MCP client such as Claude Desktop, you can use the geolocation tool by providing an IP address:

geolocation("8.8.8.8")

Example output:

{
    "ip_addr": "8.8.8.8",
    "country": "US",
    "city": "Mountain View",
    "latitude": 37.40599,
    "longitude": -122.078514,
    "network": "AS15169 Google LLC",
    "timezone": "America/Los_Angeles"
}

Error Handling

Each tool follows a consistent error handling pattern:

General error response format:

{
    "status": "error",
    "error": "Detailed error message",
    "query": "Original query value"
}

Tool-specific error examples:

ASN Lookup:

{
    "ip_addr": "<queried-ip>",
    "status": "error",
    "error": "Invalid IP address format"
}

DNS Lookup:

{
    "domain": "<queried-domain>",
    "record_type": "<requested-type>",
    "status": "error",
    "error": "DNS resolution failed"
}

WHOIS Lookup:

{
    "domain": "<queried-domain>",
    "status": "error",
    "error": "WHOIS server not available"
}

Geolocation:

{
    "ip_addr": "<queried-ip>",
    "status": "error",
    "error": "MaxMind database not found or license key invalid"
}

Project Structure

The project follows a standard Python package structure:

irtoolshed_mcp_server/     # Main package directory
├── __init__.py           # Package initialization
├── asnlookup.py         # ASN lookup functionality
├── dnslookup.py         # DNS lookup functionality
├── geolookup.py         # Geolocation functionality
├── mcp_server.py        # Main MCP server implementation
└── whoislookup.py       # WHOIS lookup functionality

tests/                    # Test directory
├── test_asnlookup.py    # ASN lookup tests
├── test_dnslookup.py    # DNS lookup tests
├── test_geolookup.py    # Geolocation tests
└── test_whoislookup.py  # WHOIS lookup tests

Development

Setting Up Development Environment

  1. Clone this repository:

git clone <repository-url>
cd ir-toolshed-mcp-server

  1. Create a virtual environment and install dependencies:

uv venv
source .venv/bin/activate  # On Windows use: .venv\Scripts\activate
uv pip install -e ".[dev]"

Running Tests

To run the test suite:

uv run pytest

This will:

  • Run all tests in the tests/ directory

  • Show test coverage information

  • Display detailed output for any failures

Note: Some tests require additional configuration:

  • Geolocation tests require a MaxMind GeoLite2 database and license key

  • WHOIS tests may fail if the WHOIS service is unavailable

Code Quality

The project uses several tools to maintain code quality:

  • Format code with Black:

uv run black .

  • Sort imports with isort:

uv run isort .

  • Run type checking with mypy:

uv run mypy .

  • Run linting with ruff:

uv run ruff .

Roadmap

Completed: ✓ ASN lookups ✓ DNS record lookups (A, AAAA, MX, etc.) ✓ WHOIS record retrieval ✓ IP geolocation services

Future tools planned for inclusion:

  • Domain reputation scoring

  • SSL certificate analysis

  • Network port scanning

  • Threat intelligence integration

  • Passive DNS history

  • Email security analysis (SPF, DKIM, DMARC)

  • BGP route analysis

  • Network traffic visualization

  • Malware hash lookups

  • URL reputation checking

Contributing

Contributions to add new IR tools or improve existing ones are welcome. Please follow these steps:

  1. Fork the repository

  2. Create a feature branch

  3. Add your tool following the existing pattern in mcp_server.py

  4. Include appropriate documentation as a resource

  5. Submit a pull request with a clear description of your changes

License

Apache 2.0

Security Considerations

This server is intended for legitimate security research and incident response. Users must ensure they comply with all applicable laws and regulations when using these tools.

Available Tools

4 tools
asnlookupD
ParametersJSON Schema
NameRequiredDescriptionDefault
ipaddrYes

TDQS

D1/5.0
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Tool has no description.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness1/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Tool has no description.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Tool has no description.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Tool has no description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose1/5

Does the description clearly state what the tool does and how it differs from similar tools?

Tool has no description.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines1/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Tool has no description.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

dnslookupD
ParametersJSON Schema
NameRequiredDescriptionDefault
domainYes
record_typeNoA

TDQS

D1/5.0
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Tool has no description.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness1/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Tool has no description.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Tool has no description.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Tool has no description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose1/5

Does the description clearly state what the tool does and how it differs from similar tools?

Tool has no description.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines1/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Tool has no description.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

geolookupD
ParametersJSON Schema
NameRequiredDescriptionDefault
ipaddrYes
license_keyNo

TDQS

D1/5.0
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Tool has no description.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness1/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Tool has no description.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Tool has no description.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Tool has no description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose1/5

Does the description clearly state what the tool does and how it differs from similar tools?

Tool has no description.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines1/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Tool has no description.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

whoislookupD
ParametersJSON Schema
NameRequiredDescriptionDefault
domainYes

TDQS

D1/5.0
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Tool has no description.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness1/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Tool has no description.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Tool has no description.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Tool has no description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose1/5

Does the description clearly state what the tool does and how it differs from similar tools?

Tool has no description.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines1/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Tool has no description.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 4 tool updatesv0.1.0
    • First observedasnlookup
    • First observeddnslookup
    • First observedgeolookup
    • First observedwhoislookup
Install Server
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

TDQS

C2.1/5.0
Disambiguation5/5

Each tool has a clearly distinct purpose: asnlookup for Autonomous System Number queries, dnslookup for DNS resolution, geolookup for geographic IP location, and whoislookup for domain registration details. There is no overlap or ambiguity between these tools, making it easy for an agent to select the correct one based on the specific information needed.

Naming Consistency5/5

All tool names follow a consistent pattern of noun+lookup (e.g., asnlookup, dnslookup, geolookup, whoislookup), using lowercase and no separators. This predictable naming scheme enhances readability and makes the tool set easy to navigate without any deviations or mixed conventions.

Tool Count5/5

With 4 tools, this server is well-scoped for its purpose in IR (Incident Response) or network investigation. Each tool earns its place by covering a distinct aspect of network intelligence (ASN, DNS, geolocation, WHOIS), providing a focused and efficient set without being too thin or overloaded.

Completeness4/5

The tool set covers core network investigation functions comprehensively, with no obvious gaps for basic lookups. However, minor gaps might exist for advanced IR workflows, such as IP reputation checks or threat intelligence queries, but agents can likely work around this with the provided tools for most common tasks.

Maintenance

ActivityInactive
ResponsivenessNo issues

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

  • sentrysurface
    io.github.sentrysurface

    Cybersecurity MCP server for URL scanning, threat intelligence, and domain reputation.

    SecurityPenetration Testing
    2
  • Google GKEA
    com.googleapis.container

    The Google GKE MCP server is a managed Model Context Protocol server that provides AI applications with tools to manage Google Kubernetes Engine (GKE) clusters and Kubernetes resources. It exposes a structured, discoverable interface that allows AI agents to interact with GKE and Kubernetes APIs, enabling them to inspect cluster configurations, retrieve Kubernetes resource YAMLs, monitor operations like cluster upgrades, diagnose issues, and optimize costs—all without needing to parse text output or use complex kubectl commands.

    Cloud PlatformsVirtualizationObservability
    232
  • TelnyxA
    com.telnyx.api

    The Telnyx MCP server is an official implementation of the Model Context Protocol that enables AI clients (like Claude Desktop, Cursor, and OpenAI Agents) to interact with Telnyx's telephony, messaging, and AI assistant APIs. It provides comprehensive capabilities including making and managing phone calls, sending SMS/MMS messages, purchasing and configuring phone numbers, creating AI assistants with custom instructions, managing cloud storage buckets, scraping and embedding website content, and handling integration secrets. The server exists as both a local implementation and a remotely hosted version, allowing developers to integrate real-world communication infrastructure directly into AI applications.

    CommunicationCloud PlatformsCloud Storage
    62
  • Remote MCPA
    com.remote-mcp.mcp

    The Remote MCP server acts as a standardized bridge between LLM applications (like Claude, ChatGPT, and Cursor) and external services, enabling AI agents to access external tools and resources. Its primary capability is providing a centralized search tool to discover other MCP servers and their respective tools. Unlike local implementations, it runs remotely with OAuth authentication and permission controls for security.

    Developer ToolsSearchAgent Orchestration
    13

Related MCP Servers

  • ADEO CTI MCP Server

    ADEOSec
    F
    license
    Not graded
    quality
    D
    maintenance
    A Model Context Protocol server that provides access to Shodan and VirusTotal APIs for cybersecurity analysis, enabling analysts to perform network intelligence operations including host lookups, vulnerability analysis, and threat intelligence gathering.
    23
    -

  • Wireshark MCP

    sarthaksiddha
    A
    license
    Not graded
    quality
    D
    maintenance
    A Model Context Protocol server that integrates Wireshark's network analysis capabilities with AI systems like Claude, allowing direct analysis of network packet data without manual copying.
    31
    MIT

  • SharkMCP

    tuliperis
    A
    license
    A
    quality
    D
    maintenance
    A Model Context Protocol server that provides network packet capture and analysis capabilities through Wireshark/tshark integration, enabling AI assistants to perform network security analysis and troubleshooting.
    4
    35
    MIT

  • Domain Tools MCP Server

    deshabhishek007
    A
    license
    Not graded
    quality
    D
    maintenance
    A Model Context Protocol server that provides comprehensive domain analysis capabilities including WHOIS lookups, DNS record queries, and DNS health checking.
    14
    MIT

Appeared in Searches

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/rossja/irtoolshed-mcp-server'

If you have feedback or need assistance with the MCP directory API, please join our Discord server