Live reputation, network type & abuse score for any IP or domain — from real DNS lookups, no API key.
ip-doctor is both:
- an MCP server (
npx -y ip-doctor-mcp) you add to Claude, Cursor or any agent, and - a pay-per-call HTTP API gated by x402 (USDC on Base) — no sign-up, no key.
Give it an IP address or a domain and get back a CLEAN / LOW_RISK / ELEVATED / HIGH_RISK verdict with a 0–100 risk score and explained findings.
An LLM can reason about an IP, but it cannot run live DNS, DNSBL or reverse-DNS lookups by itself. ip-doctor does exactly that on demand — the moat is the live network access, not the reasoning.
| Signal | Source (key-less) |
|---|---|
| 🌍 Geolocation (RIR country) + ASN + organisation + BGP prefix | Team Cymru DNS IP-to-ASN |
| 🏷️ Network type — datacenter/hosting, VPN/proxy, Tor exit, mobile/carrier, residential ISP | deduced from ASN org + PTR + Tor list |
| 🔁 Reverse DNS (PTR) | node:dns reverse |
| 🚫 DNS blocklist (DNSBL) membership | DroneBL, blocklist.de, s5h, SORBS, UCEPROTECT, Barracuda, Spamhaus ZEN |
| 🧅 Tor exit node | Tor DNS exit list (dnsel.torproject.org) |
| 📊 0–100 abuse/risk score + verdict | derived from the above |
Honesty: geolocation is the coarse RIR-allocation country, not city-level GeoIP. The network type is a deduction from org/PTR signals, not an authoritative paid label. Blocklist zones that don't answer from a public resolver are reported as inconclusive, never silently "clean".
{
"mcpServers": {
"ip-doctor": { "command": "npx", "args": ["-y", "ip-doctor-mcp"] }
}
}Tools:
check_ip—{ target: "8.8.8.8" | "example.com", deep?: boolean }check_many—{ targets: ["1.1.1.1", "evil.example", ...] }
Or connect over HTTP at POST /mcp (stateless JSON-RPC).
Free tier (rate-limited, 40/h/IP):
GET https://ip-doctor.vercel.app/check?target=8.8.8.8
GET https://ip-doctor.vercel.app/check?target=example.com&deep=true
GET https://ip-doctor.vercel.app/check_many?targets=1.1.1.1,8.8.8.8,9.9.9.9
Pay-per-call (x402, $0.02 USDC on Base, DEEP tier — more blocklists + listing reasons, no rate limit):
GET https://ip-doctor.vercel.app/pro/check?target=<ip|domain>
GET https://ip-doctor.vercel.app/pro/check_many?targets=...
Your agent's x402-aware HTTP client pays automatically on the 402 challenge. The server holds no private key — payTo is a public receiving address only.
- Vet inbound traffic / API callers (datacenter or Tor → step-up auth).
- Validate sign-ups & registrations (block known-abusive or proxy IPs).
- Moderate user-supplied IPs/domains in a pipeline.
- Enrich logs with ASN/org/type/blocklist context.
npm install
npm run build
npm run test:engine # live DNS smoke tests
npm run dev:http # local HTTP server on :8080 (payments OFF by default unless env set)
npm run dev:mcp # stdio MCP server- Read-only. No code is executed; nothing is written. All lookups are DNS/DNSBL/reverse-DNS.
- Private/reserved addresses (RFC1918, loopback, CGNAT, link-local) are detected and skipped — no meaningless public lookups.
- IPv6 is supported for ASN/PTR/geo; most DNSBLs are IPv4-only and are reported as not-applicable for IPv6.
MIT licensed. Source: https://github.com/Baneado98/ip-doctor