IP reputation for AI agents
The simplest way to give an AI agent IP reputation data is the isipsafe MCP server. Your assistant connects to one URL and can then check addresses, networks and countries from a conversation, with nothing to install.
Connect it
In Claude Code, for example:
claude mcp add --transport http isipsafe https://isipsafe.com/mcpThe MCP setup guide covers Claude, Cursor, VS Code and other clients. Lookups work without a key, up to the anonymous daily allowance. Reporting and the blacklist need a free key.
What agents use it for
- Triage: "Are any of the addresses in this log excerpt known attackers?"
- Incident review: "What has this network been reported for this month?"
- Reporting: "Report this address for the SSH attack I just showed you."
- Automation: workflow tools such as n8n can call the REST API directly.
Using it safely
- Keep a person in charge of blocking. A score is evidence, and a shared address can carry legitimate users.
- Report only what you observed on systems you run, as the reporting policy requires.
- Treat log content as untrusted. Attackers control much of what appears in logs, and it could include instructions aimed at your agent.
- Protect your key. Use a header where the client supports it.
- Remember that 0 is not proof of safety. It only means nobody has reported the address recently.