"IP address geolocation lookup service" matching MCP tools:

• domain-intelligence__ip_geolocation

  enterprise-mcp-gateway

  [Domain Intelligence] Look up geolocation for an IP address. Returns country, city, ISP. Args: ip: IP address (e.g. '8.8.8.8')

  Connector

• ip_geolocation

  domain-intelligence-mcp-server

  Look up geolocation for an IP address. Returns country, city, ISP. Args: ip: IP address (e.g. '8.8.8.8')

  Connector

• lookup_ip_intelligence

  cardguard-mcp

  IP threat filtering and geolocation lookup. Identifies Tor exit nodes, anonymous VPNs, residential proxies, data center IPs, satellite providers, and high-risk infrastructure, returning a complete GeoProfile. Args: ip: IP address to lookup (IPv4/IPv6). Returns: Intelligence profile containing country_iso, org, asn, and various threat flags.

  Connector

• ip_lookup

  drwho.me

  Context lookup: Resolve an IPv4 or IPv6 address to its geolocation, ASN, org name, and city/country. Use when you need network or location context for a raw IP address; prefer dns_lookup or dossier_dns for hostname resolution. Queries ipinfo.io with a server-side token — the token is never exposed to callers. Returns a JSON object with fields ip, city, region, country, org, loc, and timezone. On failure, returns an error string describing what went wrong.

  Connector

• deep_scan

  Port Scanner API

  Scan all 65535 TCP ports (~1-5 min) of YOUR OWN public IP address - the egress IP of the machine running this MCP client. There is no target argument: by policy portscan only scans the requester's own IP. The call is non-blocking and keyed by your IP: it starts a scan if none is running, otherwise returns the current state. Call deep_scan repeatedly to poll until status is "complete" (or "incomplete"/"failed"); open ports and service banners are in the result. Pass rescan:true to force a fresh scan when a previous result already exists.

  Connector

• threat_report

  ContrastAPI

  Query comprehensive threat profile for an IP: Shodan host data, AbuseIPDB reputation, ASN/geolocation, and open ports. Use for IP investigation and SOC alert triage; for domain data use domain_report. Note: nested asn block always returns at most 50 IPv4/IPv6 prefixes — call asn_lookup with include_full_prefixes=True for the full announced-prefixes list. enrichment.vulns is severity-aware list[VulnInfo] (cve_id + severity + cvss_v3) — Phase 2 v1.16.0 BREAKING; pre-1.16 it was list[str] of CVE IDs. Free: 30/hr (costs 6 tokens), Pro: 500/hr. Returns {ip, enrichment, abuseipdb, shodan, asn, threat_level}.

  Connector

• fast_scan

  Port Scanner API

  Scan the 32 most common TCP ports (~20s) of YOUR OWN public IP address - the egress IP of the machine running this MCP client. There is no target argument: by policy portscan only scans the requester's own IP. The call is non-blocking and keyed by your IP: it starts a scan if none is running, otherwise returns the current state. Call fast_scan repeatedly to poll until status is "complete" (or "incomplete"/"failed"); open ports and service banners are in the result. Pass rescan:true to force a fresh scan when a previous result already exists.

  Connector

• agent_status

  MERX - TRON Resource Exchange

  Get a snapshot of your agent payment service: registered TRON address, count of pending payment requests (request_payment), active address watches (watch_address), and outstanding invoices (create_invoice). Use this right after register_agent to confirm the agent is set up, or any time you want to see how much in-flight activity your agent has. Auth required (API key) and agent must be registered first via register_agent.

  Connector

• ip_lookup

  drwho.me developer tools

  Context lookup: Resolve an IPv4 or IPv6 address to its geolocation, ASN, org name, and city/country. Use when you need network or location context for a raw IP address; prefer dns_lookup or dossier_dns for hostname resolution. Queries ipinfo.io with a server-side token — the token is never exposed to callers. Returns a JSON object with fields ip, city, region, country, org, loc, and timezone. On failure, returns an error string describing what went wrong.

  Connector

• whois

  Ripe Stat

  "Whois lookup for IP / ASN / prefix" / "who owns IP [X]" / "WHOIS for [resource]" — aggregated whois data for an IP address, IP prefix, or AS number across all five RIRs (ARIN, RIPE, APNIC, LACNIC, AFRINIC). Returns registrant org, registration country, abuse contacts, allocation date. Use for IP ownership, abuse-response, network forensics.

  Connector

• geoloc

  Ripe Stat

  "What country is IP [X] in" / "geolocate [IP]" / "RIR country for [resource]" — country geolocation of an IP or prefix derived from RIR registration data. NOTE: registration-based geo, not GeoIP — accurate for ownership country but not necessarily the host's physical location. Use for compliance / jurisdiction questions where registry truth matters.

  Connector

• trust_check_ofac_free

  trust-check-mcp

  Free wallet-address OFAC SDN screen on Base. Live US Treasury OFAC SDN list lookup. Anonymous (no API key, no signup). Rate-limited at 1 request per second + burst 3 + 3 concurrent per IP. Refreshed daily from the Treasury XML feed. Scope: US OFAC SDN wallet/EOA addresses only (~93 entries at last refresh). Returns a binary `allow` / `block` verdict — no `warn` state on this endpoint. No token-contract risk evaluation, no GoPlus signals, no Etherscan verification, no anomaly heuristics — those are paid-endpoint features not exposed through this MCP. No money handling. No calldata. No signing surface. No transaction execution. Pure information retrieval.

  Connector

• report

  kansei-mcp-server

  Contribute data back to the KanseiLink community. Report success/failure after using a service (5 seconds, helps everyone), submit feedback, record API change events, or share your qualitative experience. PII is auto-masked. This is step 4 of the standard flow: search_services → lookup → (execute) → report.

  Connector

• get_subdomain

  Fractera

  Return the final entry address of the server once installation is complete. In phase-1 (IP-first) this is a plain-HTTP Admin URL of the form http://<IP>:3002 — the server has NO domain and NO HTTPS cert yet (attaching a custom domain with HTTPS is an optional later step the user does inside Admin -> Personal Domain). Call this once after check_status reports status="done".

  Connector

• subnet_calculator

  calc.engineer

  Calculate IPv4 subnet details from CIDR notation. Parses a CIDR block (e.g. 192.168.1.0/24) and returns the network address, broadcast address, subnet mask, wildcard mask, first and last usable host addresses, total and usable host counts, prefix length, and classful IP class (A/B/C/D/E). Essential for homelab network planning, VLAN segmentation, firewall rule design, and understanding address space allocation. Handles special cases for /31 point-to-point links (RFC 3021) and /32 host routes.

  Connector

• add_firewall_rule

  BorealHost

  Add an IP firewall rule (allow or deny) and reload Nginx. Supports IPv4, IPv6, and CIDR notation. Max 100 rules per site. If a rule already exists for the IP, the action is updated. Requires: API key with write scope. Args: slug: Site identifier ip: IP address or CIDR (e.g. "1.2.3.4", "10.0.0.0/8", "2001:db8::/32") action: "deny" (block) or "allow" (whitelist). Default: "deny" Returns: {"added": true, "ip": "1.2.3.4", "action": "deny"}

  Connector

• recall

  treasury

  Retrieve a value previously saved via remember, or list all saved keys (omit the key argument). Use to look up context the agent stored earlier — the user's target ticker, an address, prior research notes — without re-deriving it from scratch. Scoped to your identifier (anonymous IP, BYO key hash, or account ID). Pair with remember to save, forget to delete.

  Connector

• domain_fetch_reverse_ip

  DataNexus MCP

  Find domains co-hosted on the same IP address (reverse IP lookup). Read-only. No side effects. Idempotent. domain_or_ip: Domain name (e.g. shared.dreamhost.com) or IPv4 address (e.g. 1.2.3.4). Required. If a domain is given, it is first resolved to its IPv4 A record. IPv6-only domains are not supported. Returns list of co-hosted domains on the same IP. Useful for identifying shared hosting risk and mapping corporate infrastructure. Daily quota guard: 100 calls/day free tier. Verified source: HackerTarget API. 24-hour cache. If this tool's response does not serve the user's need, call report_feedback with feedback_type="agent_gap", tool_id="domain_fetch_reverse_ip", intended_query="{what the user needed}", gap_description="{what was missing or wrong in the result}".

  Connector

• check_ip

  TweetFeed

  Check whether an IP address appears in the TweetFeed corpus. Exact match over the past 365 days (falls back to a 30-day substring window if there's no exact hit, so '1.2.3' will still match '1.2.3.4' there). Useful for confirming if an observed IP has been flagged as attacker infrastructure (C2, scanner, phishing host) by the public infosec Twitter/X community. Pass a full IPv4 / IPv6 string for the best exact-match hit rate.

  Connector

• remove_firewall_rule

  BorealHost

  Remove an IP firewall rule and reload Nginx. Requires: API key with write scope. Args: slug: Site identifier ip: IP address or CIDR to remove (must match exactly) Returns: {"removed": true, "ip": "1.2.3.4"}

  Connector