HackMyIP MCP

A community-hosted Model Context Protocol server providing free IP intelligence tools for AI agents. It offers capabilities such as IP geolocation, VPN and proxy detection, DNS lookups, WHOIS queries, spam blacklist checks, email breach verification, and security header auditing. The server acts as a stateless wrapper around the HackMyIP public REST API, requiring no authentication or API keys to function.

Endpoint and access

No sign-in to connect and list tools. Individual tools may still need a vendor account, credentials, or permissions; check the documented prerequisites.

Community listingStreamable HTTPNo sign-inEndpoint checked 2026-11-06Published by 0xvibly

MCP endpoint (Streamable HTTP)

https://hackmyip.com/mcp

Vendor documentation

What its tools do

15 tools, grouped by the hints the server advertises. Hints are self-declared, not verified behavior.

Not annotated (15)

server_info
my_ip
ip_lookup
bulk_ip_lookup
vpn_proxy_check
asn_lookup
reverse_dns
dns_lookup
whois_domain
ip_blacklist_check
email_breach_check
email_auth_check
security_headers_check
port_scan
site_status_check

15 of 15 have a description · 0 of 15 declare behavior hints · 13 of 13 with parameters document them all

Checks and signals

Each line is separate evidence, not a trust score.

Passed Endpoint answered the live check · Nov 6, 2026, 11:50 PM UTC
Availability 1 of 1 checks passed in 30 days

What you can do with it

Look up public IP details including geolocation and ISP
Detect if an IP is associated with VPN, proxy, or datacenter traffic
Check if an email address appears in known data breaches
Audit HTTP security headers for a given domain

Source and maintenance

Community listingRegistry 1.0.0

mcp-registry: io.github.0xvibly/hackmyip-mcp@1.0.0 Source repository Project website

Maintenance checked: Nov 6, 2026, 11:15 PM UTC

Protocol and capabilities

Server: hackmyip 1.0.0
MCP protocol negotiated in check: 2025-11-25
Tools: 15 advertised
Resources: Not advertised
Resource templates: Not advertised
Prompts: Not advertised

Server-advertised capabilities

{
  "tools": {
    "listChanged": true
  }
}

Tools

15 advertised

server_info — About this MCP server

Advertised by the server during the last successful anonymous check.

Describe this MCP server: what it wraps, the fact that it is completely free with no API key, no signup and no auth, the fair-use rate limit, the full tool list, and links to hackmyip.com and its API docs. Call this when the user asks what this server can do, whether it costs anything, or where the data comes from.

server_info input schema

{
  "type": "object",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "properties": {}
}

my_ip — My IP address

Advertised by the server during the last successful anonymous check.

Get the public IP address of the machine that opened this MCP connection, enriched with city/country, coordinates, timezone, ISP, ASN and hosting/proxy classification. Use this for 'what is my IP', 'where does the internet think I am', or a quick sanity check that a VPN is actually routing traffic. Note: this reflects the IP the MCP request arrived from, so if the client sits behind a corporate proxy or remote host, it reports that egress IP.

my_ip input schema

{
  "type": "object",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "properties": {}
}

ip_lookup — IP address lookup

Advertised by the server during the last successful anonymous check.

Look up geolocation (city, region, country, lat/lon, timezone, postal code) plus ISP, ASN, organization and AS name for any public IPv4 or IPv6 address. The workhorse tool for 'where is this IP', triaging a log entry, or identifying who owns an address.

ip_lookup input schema

{
  "type": "object",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "required": [
    "ip"
  ],
  "properties": {
    "ip": {
      "type": "string",
      "pattern": "^(?:(?:\\d{1,3}\\.){3}\\d{1,3}|[0-9a-fA-F:]{2,45})$",
      "description": "Public IPv4 or IPv6 address, e.g. 8.8.8.8 or 2001:4860:4860::8888"
    }
  }
}

bulk_ip_lookup — Bulk IP lookup

Advertised by the server during the last successful anonymous check.

Look up country, city, ISP, organization and coordinates for up to 50 IP addresses in a single request. Much faster and far kinder to the rate limit than calling ip_lookup in a loop — always prefer this when you have more than a couple of addresses (e.g. a list from access logs or a firewall export).

bulk_ip_lookup input schema

{
  "type": "object",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "required": [
    "ips"
  ],
  "properties": {
    "ips": {
      "type": "array",
      "items": {
        "type": "string",
        "pattern": "^(?:(?:\\d{1,3}\\.){3}\\d{1,3}|[0-9a-fA-F:]{2,45})$"
      },
      "maxItems": 50,
      "minItems": 1,
      "description": "Array of 1-50 public IPv4/IPv6 addresses"
    }
  }
}

vpn_proxy_check — VPN / proxy / datacenter check

Advertised by the server during the last successful anonymous check.

Classify an IP as hosting/datacenter, open proxy, or mobile-carrier, alongside its geolocation and network owner. Use it to decide whether traffic is likely a VPN, a cloud server or a real residential/mobile user — for fraud triage, abuse review, or checking whether your own VPN is being detected. Omit `ip` to check the connection this MCP request came from.

vpn_proxy_check input schema

{
  "type": "object",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "properties": {
    "ip": {
      "type": "string",
      "pattern": "^(?:(?:\\d{1,3}\\.){3}\\d{1,3}|[0-9a-fA-F:]{2,45})$",
      "description": "IP to classify. Defaults to the IP this MCP request arrived from."
    }
  }
}

asn_lookup — ASN lookup

Advertised by the server during the last successful anonymous check.

Resolve an Autonomous System by IP address, AS number, or organization name. Returns the AS number, network name, holder, description, RIR and whether the AS is currently announced. Use it to answer 'which network is this IP on', 'who is AS15169', or to find the ASNs belonging to a company.

asn_lookup input schema

{
  "type": "object",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "required": [
    "query"
  ],
  "properties": {
    "query": {
      "type": "string",
      "maxLength": 100,
      "minLength": 1,
      "description": "An IP (8.8.8.8), an AS number (AS15169 or 15169), or an org name (google)"
    }
  }
}

reverse_dns — Reverse DNS (PTR) lookup

Advertised by the server during the last successful anonymous check.

Get the PTR hostname for an IPv4 or IPv6 address. Useful for identifying mail servers, confirming that a crawler really belongs to the bot it claims to be, or adding a human-readable name to a raw log IP.

reverse_dns input schema

{
  "type": "object",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "required": [
    "ip"
  ],
  "properties": {
    "ip": {
      "type": "string",
      "pattern": "^(?:(?:\\d{1,3}\\.){3}\\d{1,3}|[0-9a-fA-F:]{2,45})$",
      "description": "IPv4 or IPv6 address to reverse-resolve"
    }
  }
}

dns_lookup — DNS record lookup

Advertised by the server during the last successful anonymous check.

Query live DNS records for a domain over public resolvers. Supports A, AAAA, CNAME, MX, NS, TXT, SOA, SRV, CAA and PTR. Use it to verify a deployment's DNS, inspect MX/SPF/DKIM/DMARC TXT records, check nameserver delegation, or confirm propagation after a change.

dns_lookup input schema

{
  "type": "object",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "required": [
    "domain"
  ],
  "properties": {
    "type": {
      "enum": [
        "A",
        "AAAA",
        "CNAME",
        "MX",
        "NS",
        "TXT",
        "SOA",
        "SRV",
        "CAA",
        "PTR"
      ],
      "type": "string",
      "description": "Record type. Defaults to A."
    },
    "domain": {
      "type": "string",
      "pattern": "^[a-zA-Z0-9._-]+$",
      "maxLength": 253,
      "minLength": 3,
      "description": "Domain name, e.g. github.com"
    }
  }
}

whois_domain — WHOIS / RDAP domain lookup

Advertised by the server during the last successful anonymous check.

Fetch registration data for a domain via RDAP: registrar, creation/expiration/last-updated dates, nameservers and EPP status codes. Use it to check domain age (a common trust signal), see when a domain expires, or find who it is registered through. Note that RDAP is a third-party registry service and can be temporarily unavailable — a failure here is upstream, not a bad query.

whois_domain input schema

{
  "type": "object",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "required": [
    "domain"
  ],
  "properties": {
    "domain": {
      "type": "string",
      "pattern": "^[a-zA-Z0-9._-]+$",
      "maxLength": 253,
      "minLength": 3,
      "description": "Domain name, e.g. github.com"
    }
  }
}

ip_blacklist_check — IP blacklist (DNSBL) check

Advertised by the server during the last successful anonymous check.

Check an IPv4 address against 12 major spam and abuse blacklists (Spamhaus ZEN, Barracuda, SpamCop, UCEPROTECT and others) with a per-list LISTED / CLEAN / unavailable breakdown. Run this before sending bulk email from a new IP, or when mail is being rejected. Lists that refuse public queries are reported as 'unavailable' rather than falsely clean, so read total_checked alongside listed_count.

ip_blacklist_check input schema

{
  "type": "object",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "required": [
    "ip"
  ],
  "properties": {
    "ip": {
      "type": "string",
      "pattern": "^(?:(?:\\d{1,3}\\.){3}\\d{1,3}|[0-9a-fA-F:]{2,45})$",
      "description": "IPv4 address to check (DNSBLs are IPv4-only in practice)"
    }
  }
}

email_breach_check — Email breach check

Advertised by the server during the last successful anonymous check.

Check whether an email address appears in known data breaches, using the XposedOrNot breach database. Returns the number of breaches and the named services involved. Free alternative to paid breach-lookup APIs. The address is partially masked in the response.

email_breach_check input schema

{
  "type": "object",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "required": [
    "email"
  ],
  "properties": {
    "email": {
      "type": "string",
      "format": "email",
      "pattern": "^(?!\\.)(?!.*\\.\\.)([A-Za-z0-9_'+\\-\\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$",
      "description": "Email address to check, e.g. someone@example.com"
    }
  }
}

email_auth_check — Email authentication (MX / SPF / DMARC) check

Advertised by the server during the last successful anonymous check.

Audit a domain's email authentication setup: MX records, SPF record and DMARC policy, with a pass/warn/fail verdict per mechanism and an overall grade. Use it when diagnosing deliverability, hardening a domain against spoofing, or reviewing a vendor's email posture.

email_auth_check input schema

{
  "type": "object",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "required": [
    "domain"
  ],
  "properties": {
    "domain": {
      "type": "string",
      "pattern": "^[a-zA-Z0-9._-]+$",
      "maxLength": 253,
      "minLength": 3,
      "description": "Domain to audit, e.g. github.com"
    }
  }
}

security_headers_check — HTTP security headers audit

Advertised by the server during the last successful anonymous check.

Fetch a site and grade its HTTP security headers (A-F): CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, plus information-leak headers like Server and X-Powered-By. Each check comes back with the actual header value and an explanation. Use it for a quick security review of your own site or a third party's. Rate limited to 20 requests/minute.

security_headers_check input schema

{
  "type": "object",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "required": [
    "url"
  ],
  "properties": {
    "url": {
      "type": "string",
      "maxLength": 2000,
      "minLength": 3,
      "description": "Site to analyze. Scheme optional — https is assumed. e.g. example.com"
    }
  }
}

port_scan — TCP port scan

Advertised by the server during the last successful anonymous check.

Run a real server-side TCP connect scan against a public host. Each port comes back as open (handshake completed), closed (refused/reset), filtered (no response, likely firewalled) or blocked (Cloudflare blocks outbound to that port, e.g. 25/SMTP). With no `ports` argument a curated common-port catalog is scanned. Private, reserved and internal addresses are rejected. Only scan hosts you are authorized to test. Rate limited to 20 requests/minute and can take 20+ seconds.

port_scan input schema

{
  "type": "object",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "required": [
    "host"
  ],
  "properties": {
    "host": {
      "type": "string",
      "maxLength": 253,
      "minLength": 1,
      "description": "Public hostname or IP to scan, e.g. example.com. Required — do not scan third parties without permission."
    },
    "ports": {
      "type": "string",
      "pattern": "^\\d{1,5}(,\\d{1,5})*$",
      "description": "Optional comma-separated port list. Omit to scan the common-port catalog."
    }
  }
}

site_status_check — Is a site up or down

Advertised by the server during the last successful anonymous check.

Check whether a site is reachable from Cloudflare's network. Returns an up/down boolean, HTTP status code, response time in milliseconds, and the server / content-type headers. Use it to confirm an outage is real rather than local, or to verify a deployment is serving.

site_status_check input schema

{
  "type": "object",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "required": [
    "url"
  ],
  "properties": {
    "url": {
      "type": "string",
      "maxLength": 2000,
      "minLength": 3,
      "description": "URL or bare domain to check, e.g. example.com or https://example.com/health"
    }
  }
}

Prompts

Not advertised

No prompt definitions available.

Resources

Not advertised

No resource definitions available.

90-day uptime

A lightweight connection check about every six hours, sampled on hosts with many listings. It shows the server answered, not that its tools work.

Too few checks for a percentage yet (1 of 1 answered).

2026-11-07: 1 of 1 checks answered

30-day availability

Aggregated from read-only remote checks; this is not a tool-execution or security guarantee.

Successful checks: 1 of 1 (100%)
Average latency: 512 ms
95th percentile latency: 512 ms

Maintenance history

Public check and source-refresh events. Editorial and ownership records remain private.

Nov 6, 2026, 11:50 PM UTC · probe · passed · 512 ms · metadata changed · 15 tool(s)

Connect from your client

Each snippet registers the same endpoint; pick the client you use.

This server is operated by the named third party. Listing and endpoint checks are not an endorsement or a security audit. Review the operator's permissions, terms, and data handling before connecting. How listings are checked and corrected.

Claude Code

Run this once in a terminal. It registers the remote server. Use --scope project to write .mcp.json for the repo.

Claude Code configuration

claude mcp add --transport http hackmyip-mcp https://hackmyip.com/mcp

Codex

Run this once. Codex stores MCP servers in ~/.codex/config.toml (or .codex/config.toml in a trusted project).

Codex configuration

codex mcp add hackmyip-mcp --url https://hackmyip.com/mcp

Cursor

Merge this server into .cursor/mcp.json in your project, then enable hackmyip-mcp in your MCP settings.

Cursor configuration

{
  "mcpServers": {
    "hackmyip-mcp": {
      "url": "https://hackmyip.com/mcp"
    }
  }
}

Cline

Merge this into cline_mcp_settings.json (Cline → MCP Servers → Configure).

Cline configuration

{
  "mcpServers": {
    "hackmyip-mcp": {
      "type": "streamableHttp",
      "url": "https://hackmyip.com/mcp",
      "disabled": false
    }
  }
}

VS Code

Merge this server into .vscode/mcp.json. Use MCP: List Servers to start hackmyip-mcp and inspect its tools.

VS Code configuration

{
  "servers": {
    "hackmyip-mcp": {
      "type": "http",
      "url": "https://hackmyip.com/mcp"
    }
  }
}

Gemini CLI

Run this once. It writes .gemini/settings.json in the current project; pass --scope user for ~/.gemini/settings.json.

Gemini CLI configuration

gemini mcp add --transport http hackmyip-mcp https://hackmyip.com/mcp

Claude Desktop

Open Claude Settings > Connectors > Add custom connector, enter this server URL and enable it for the conversation. This is a manual remote-connector handoff, not a desktop JSON configuration.

Claude Desktop configuration

https://hackmyip.com/mcp

Windsurf

Merge this into ~/.codeium/windsurf/mcp_config.json, then refresh MCP in Cascade. Windsurf remote servers use serverUrl, not url.

Windsurf configuration

{
  "mcpServers": {
    "hackmyip-mcp": {
      "serverUrl": "https://hackmyip.com/mcp"
    }
  }
}

Let your agent find its tools

Find servers like HackMyIP MCP from your agent. Add Koskamo once to search the index for endpoints, access requirements, and client setup. Public discovery needs no key.

Connect Koskamo Explore workflows