Koskamo

IPDetective MCP

An MCP server hosted by UsefulAPI that allows AI agents to investigate IP addresses for bot, VPN, proxy, ASN, and country signals. It supports checking account usage limits, looking up individual IPs, and batch processing up to 100 addresses for fraud prevention and operational analysis.

Visit usefulapi

Endpoint and access

No sign-in to connect and list tools. Individual tools may still need a vendor account, credentials, or permissions; check the documented prerequisites.

IPDetective MCP logo, by usefulapiVendor evidenceStreamable HTTPNo sign-inEndpoint checked 2026-11-01Operated by usefulapi
You need:Sign in at ipdetective.io and copy your API key from the dashboardTeam and Enterprise: an Owner adds the connector for the organization first
MCP endpoint (Streamable HTTP)
https://ipdetective.usefulapi.io/mcp
Vendor documentation

What you can do with it

  • Check IPDetective request and lookup allowance
  • Investigate an IP address for bot and proxy signals
  • Review a batch of suspicious IP addresses
  • Report current usage status and plan limits

Source and maintenance

Vendor evidenceRegistry 1.4.0
mcp-registry: io.usefulapi/ipdetective@1.4.0Source repositoryProject website
Maintenance checked

Protocol and capabilities

Server
ipdetective-mcp 1.4.0
MCP protocol
2025-06-18
Tools
3 advertised
Resources
Not advertised
Resource templates
Not advertised
Prompts
4 advertised
Server-advertised capabilities
{
  "tools": {
    "listChanged": true
  },
  "prompts": {
    "listChanged": true
  }
}

Server-provided instructions

Untrusted server output shown for inspection. It is not Koskamo guidance and is excluded from knowledge search.

Tools for IPDetective, hosted by usefulapi.io. If the user is new or asks what this server can do, suggest requests such as: "Check my IPDetective request and lookup allowance."; "Investigate 8.8.8.8 for bot, datacenter and ASN signals."; "Check this list of IP addresses after I confirm the allowance usage.". Read-only tools never change data; ask the user before a tool that creates, changes or deletes IPDetective data. Free plan: 50 tool calls per month. Run ipdetective_usage_status to see the calls used this month. If the user asks for something none of these tools can do, tell the user and, with their OK, run ipdetective_request_feature to record the request. Paid plan: Pro (unlimited tool calls (fair use limit: 10,000 a month), $9/month or $90/year). Pro can be cancelled at any time and then runs to the end of the paid period, so it also suits a one-time job. When the user wants more calls or reaches the limit, run ipdetective_upgrade (plan "monthly" or "yearly"); it returns a payment link for the user to open. ipdetective_cancel_subscription cancels Pro at the end of the paid period.

Tools

3 advertised

ipdetective_account_usage — Check IPDetective allowance
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Read account request and lookup limits and current usage. Does not look up an IP address.

ipdetective_account_usage input schema
{
  "type": "object",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "properties": {}
}
ipdetective_account_usage annotations
{
  "title": "Check IPDetective allowance",
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}
ipdetective_lookup_ip — Investigate an IP address
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Look up a public IPv4 or IPv6 address for IPDetective's bot signal and optional datacenter, VPN/proxy, ASN and country information. Uses your vendor allowance. This is a risk signal, not proof of abuse. No automatic retries.

ipdetective_lookup_ip input schema
{
  "type": "object",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "required": [
    "ip"
  ],
  "properties": {
    "ip": {
      "anyOf": [
        {
          "type": "string",
          "format": "ipv4",
          "pattern": "^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$"
        },
        {
          "type": "string",
          "format": "ipv6",
          "pattern": "^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$"
        }
      ]
    },
    "include_info": {
      "type": "boolean",
      "default": true
    }
  }
}
ipdetective_lookup_ip annotations
{
  "title": "Investigate an IP address",
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": false,
  "destructiveHint": false
}
ipdetective_lookup_batch — Investigate a batch of IP addresses
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Look up 1–100 public IP addresses in one vendor request. Requires confirm:true because it consumes your IPDetective allowance. Duplicates are removed before submission. No automatic retries or background polling; check usage before resubmitting after an error.

ipdetective_lookup_batch input schema
{
  "type": "object",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "required": [
    "ips"
  ],
  "properties": {
    "ips": {
      "type": "array",
      "items": {
        "anyOf": [
          {
            "type": "string",
            "format": "ipv4",
            "pattern": "^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$"
          },
          {
            "type": "string",
            "format": "ipv6",
            "pattern": "^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$"
          }
        ]
      },
      "maxItems": 100,
      "minItems": 1
    },
    "confirm": {
      "type": "boolean",
      "default": false
    },
    "include_info": {
      "type": "boolean",
      "default": true
    }
  }
}
ipdetective_lookup_batch annotations
{
  "title": "Investigate a batch of IP addresses",
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": false,
  "destructiveHint": false
}

Prompts

4 advertised

getting_started — Get started with IPDetective

Advertised by the server during the last successful anonymous check.

What you can do with IPDetective here, with example requests to try.

No arguments advertised.

check_the_remaining_lookup_allowance — Check the remaining lookup allowance

Advertised by the server during the last successful anonymous check.

Read account request and lookup limits alongside current usage before investigating addresses.

No arguments advertised.

investigate_an_unfamiliar_ip_address — Investigate an unfamiliar IP address

Advertised by the server during the last successful anonymous check.

Look up a public IP for bot, VPN, proxy, ASN and country signals where available. Use the results as investigation context rather than proof of abuse.

No arguments advertised.

review_a_batch_of_suspicious_addresses — Review a batch of suspicious addresses

Advertised by the server during the last successful anonymous check.

Confirm allowance usage to investigate up to 100 public IP addresses in one request. Review the returned signals and check usage before repeating an uncertain request.

No arguments advertised.

Resources

Not advertised

No resource definitions available.

30-day availability

Aggregated from read-only remote checks; this is not a tool-execution or security guarantee.

Successful checks
1 of 1 (100%)
Average latency
571 ms
95th percentile latency
571 ms

Maintenance history

Public check and source-refresh events. Editorial and ownership records remain private.

  • · probe · passed · 571 ms · metadata changed · 3 tool(s), 4 prompt(s)

Connect from your client

Each snippet registers the same endpoint; pick the client you use.

This server is operated by the named third party. Listing and endpoint checks are not an endorsement or a security audit. Review the operator's permissions, terms, and data handling before connecting. How listings are checked and corrected.

Claude Code

Run this once in a terminal. It registers the remote server. Use --scope project to write .mcp.json for the repo.
Claude Code configuration
claude mcp add --transport http ipdetective-mcp https://ipdetective.usefulapi.io/mcp

Codex

Run this once. Codex stores MCP servers in ~/.codex/config.toml (or .codex/config.toml in a trusted project).
Codex configuration
codex mcp add ipdetective-mcp --url https://ipdetective.usefulapi.io/mcp

Cursor

Merge this server into .cursor/mcp.json in your project, then enable ipdetective-mcp in your MCP settings.
Cursor configuration
{
  "mcpServers": {
    "ipdetective-mcp": {
      "url": "https://ipdetective.usefulapi.io/mcp"
    }
  }
}

Cline

Merge this into cline_mcp_settings.json (Cline → MCP Servers → Configure).
Cline configuration
{
  "mcpServers": {
    "ipdetective-mcp": {
      "type": "streamableHttp",
      "url": "https://ipdetective.usefulapi.io/mcp",
      "disabled": false
    }
  }
}

VS Code

Merge this server into .vscode/mcp.json. Use MCP: List Servers to start ipdetective-mcp and inspect its tools.
VS Code configuration
{
  "servers": {
    "ipdetective-mcp": {
      "type": "http",
      "url": "https://ipdetective.usefulapi.io/mcp"
    }
  }
}

Gemini CLI

Run this once. It writes .gemini/settings.json in the current project; pass --scope user for ~/.gemini/settings.json.
Gemini CLI configuration
gemini mcp add --transport http ipdetective-mcp https://ipdetective.usefulapi.io/mcp

Claude Desktop

Merge this into claude_desktop_config.json (macOS: ~/Library/Application Support/Claude/, Windows: %APPDATA%\Claude\), then restart Claude Desktop.
Claude Desktop configuration
{
  "mcpServers": {
    "ipdetective-mcp": {
      "url": "https://ipdetective.usefulapi.io/mcp"
    }
  }
}

Windsurf

Merge this into ~/.codeium/windsurf/mcp_config.json, then refresh MCP in Cascade. Windsurf remote servers use serverUrl, not url.
Windsurf configuration
{
  "mcpServers": {
    "ipdetective-mcp": {
      "serverUrl": "https://ipdetective.usefulapi.io/mcp"
    }
  }
}

Let your agent find its tools

Find servers like IPDetective MCP from your agent. Add Koskamo once to search the index for endpoints, access requirements, and client setup. Public discovery needs no key.

Connect Koskamo Explore workflows
See all 3,920

Do you run IPDetective MCP?

Prove ownership with a DNS record, a well-known file, or your Official MCP Registry entry, and your edits publish immediately. Proofs are re-checked weekly; admins can still hide or remove a listing.

Claim this listing