{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_ejh68pyv2ys4","handle":"isipsafe","url":"https://wellknown.network/agents/isipsafe","links":{"self":"https://wellknown.network/agents/isipsafe/record.json","html":"https://wellknown.network/agents/isipsafe","markdown":"https://wellknown.network/agents/isipsafe/record.md","api":"https://wellknown.network/api/v1/agents/isipsafe","status":"https://wellknown.network/api/v1/agents/isipsafe/status","claim":"https://wellknown.network/agents/isipsafe/claim","claimApi":"https://wellknown.network/api/v1/claims","claimDescriptor":"https://wellknown.network/agents/isipsafe/claim.json","badge":"https://wellknown.network/agents/isipsafe/badge.svg","openapi":"https://wellknown.network/openapi.json","history":"https://wellknown.network/api/v1/agents/isipsafe/history","tools":"https://wellknown.network/api/v1/agents/isipsafe/tools"},"ard":{"identifier":"urn:air:isipsafe.com:server:isipsafe","type":"application/mcp-server-card+json"},"kind":"mcp_server","declared":{"name":"isIPsafe","summary":"Check whether an IP address or network is malicious and report abusive IPs to isIPsafe.","description":"Check whether an IP address or network is malicious and report abusive IPs to isIPsafe.","publisher":{"name":"com.isipsafe","url":null},"homepage":"https://isipsafe.com","repository":"https://github.com/isipsafe/isipsafe-python","version":"1.0.1","license":null,"protocols":["mcp"],"tags":[],"pricing":null,"endpoints":[{"url":"https://isipsafe.com/mcp","type":"mcp_streamable_http","auth":null,"probeable":true}],"skills":null,"tools":null,"extra":{"updatedAt":"2026-11-03T17:12:44.975343Z","publishedAt":"2026-11-03T17:12:44.975343Z","registryName":"com.isipsafe/isipsafe"},"attribution":{"kind":"mcp_registry","name":"mcp_registry","repoUrl":"mcp_registry","summary":"mcp_registry","version":"mcp_registry","description":"mcp_registry","homepageUrl":"mcp_registry","publisherName":"mcp_registry"}},"derived":{"capabilities":[{"slug":"analytics.reporting","name":"Reporting & Dashboards","confidence":0.885,"provenance":"derived"},{"slug":"data.database","name":"Databases","confidence":0.525,"provenance":"derived"}],"categories":["analytics","data"],"language":"en"},"observed":{"status":"live","statusReason":"Responded 7h ago.","lastOkAt":"2026-11-07T05:29:18.363Z","lastProbedAt":"2026-11-07T05:29:18.363Z","statusComputedAt":"2026-11-07T05:33:07.698Z","reliability30d":{"probes":7,"successRate":1,"p50Ms":81,"basis":"service","measures":{"availability":"availability","latency":"response time","tools":"tool surface observed","summary":"Checks reached the service itself."},"checks":{"total":7,"ok":7,"authBoundaryOk":0,"serviceOk":7,"note":"Counted from the observation rows for the window, checks of the server only (HTTP, A2A card, MCP initialize). ok = authBoundaryOk + serviceOk. `probes` is the sum of daily rollups and includes registry checks, so it can differ from `total`."}},"latestObservations":[{"at":"2026-11-07T05:29:18.363Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":65,"error":null,"detail":{"tools":[{"name":"check_ip","description":"Reputation of one IPv4 or IPv6 address: abuse confidence score (0-100, 75+ is on the blocklist), number of reports and distinct reporters, attack categories, co"},{"name":"get_reports","description":"The individual abuse reports filed against one address, newest first, with time, categories, comment (usually log lines) and reporter. Paginated."},{"name":"check_network","description":"Every reported address inside a CIDR block (IPv4 up to /16, IPv6 up to /48), with score, report count and last report time, plus the network's owner. Use it to "},{"name":"report_ip","description":"File an abuse report against an address that attacked a system you run. Needs an API key. Use category codes from list_categories (e.g. ssh,brute-force) and put"},{"name":"get_blocklist","description":"The highest-confidence abusive addresses right now, best first, with score, country and categories. Needs an API key and counts as one blocklist download. For a"},{"name":"list_categories","description":"All attack categories with their code, numeric ID, group and when to use them. Use the codes with report_ip."},{"name":"get_statistics","description":"What the database sees right now: reports in the last 24 hours, addresses on the blocklist, and over the last 30 days the top attack categories, countries, netw"},{"name":"get_today_news","description":"Today's threat news from the last 24 hours: the countries the most reported attacks come from, the networks (ASNs) behind them, the attack techniques (categorie"},{"name":"analyze_logs","description":"Find malicious traffic in logs. Pass raw log lines from any source (nginx/Apache/IIS access logs, sshd/auth.log, syslog, firewall such as iptables/UFW/pfSense/A"},{"name":"get_country_report","description":"How many addresses in a country were reported in the last 30 days, how many are on the blocklist, the most reported addresses there, and the networks and attack"},{"name":"get_network_report","description":"Abuse reported against one autonomous system in the last 30 days: number of reported and blocklisted addresses, the worst addresses, attack categories and count"},{"name":"about_isipsafe","description":"Explains isIPsafe itself. Use it for any question about the product rather than guessing: what it is and who it is for, its mission and aims, how reports and th"}],"toolCount":12,"toolsHash":"7957063662ea2891158442781f6b8c367405fa4e09d0de545d9e1ad8a4e01d28","serverName":"isipsafe","capabilities":["resources","tools"],"serverVersion":"1.0","protocolVersion":"2025-06-18"}},{"at":"2026-11-06T20:26:01.656Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":130,"error":null,"detail":{"tools":[{"name":"check_ip","description":"Reputation of one IPv4 or IPv6 address: abuse confidence score (0-100, 75+ is on the blocklist), number of reports and distinct reporters, attack categories, co"},{"name":"get_reports","description":"The individual abuse reports filed against one address, newest first, with time, categories, comment (usually log lines) and reporter. Paginated."},{"name":"check_network","description":"Every reported address inside a CIDR block (IPv4 up to /16, IPv6 up to /48), with score, report count and last report time, plus the network's owner. Use it to "},{"name":"report_ip","description":"File an abuse report against an address that attacked a system you run. Needs an API key. Use category codes from list_categories (e.g. ssh,brute-force) and put"},{"name":"get_blocklist","description":"The highest-confidence abusive addresses right now, best first, with score, country and categories. Needs an API key and counts as one blocklist download. For a"},{"name":"list_categories","description":"All attack categories with their code, numeric ID, group and when to use them. Use the codes with report_ip."},{"name":"get_statistics","description":"What the database sees right now: reports in the last 24 hours, addresses on the blocklist, and over the last 30 days the top attack categories, countries, netw"},{"name":"get_today_news","description":"Today's threat news from the last 24 hours: the countries the most reported attacks come from, the networks (ASNs) behind them, the attack techniques (categorie"},{"name":"analyze_logs","description":"Find malicious traffic in logs. Pass raw log lines from any source (nginx/Apache/IIS access logs, sshd/auth.log, syslog, firewall such as iptables/UFW/pfSense/A"},{"name":"get_country_report","description":"How many addresses in a country were reported in the last 30 days, how many are on the blocklist, the most reported addresses there, and the networks and attack"},{"name":"get_network_report","description":"Abuse reported against one autonomous system in the last 30 days: number of reported and blocklisted addresses, the worst addresses, attack categories and count"},{"name":"about_isipsafe","description":"Explains isIPsafe itself. Use it for any question about the product rather than guessing: what it is and who it is for, its mission and aims, how reports and th"}],"toolCount":12,"toolsHash":"7957063662ea2891158442781f6b8c367405fa4e09d0de545d9e1ad8a4e01d28","serverName":"isipsafe","capabilities":["resources","tools"],"serverVersion":"1.0","protocolVersion":"2025-06-18"}},{"at":"2026-11-06T11:29:19.143Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":117,"error":null,"detail":{"tools":[{"name":"check_ip","description":"Reputation of one IPv4 or IPv6 address: abuse confidence score (0-100, 75+ is on the blocklist), number of reports and distinct reporters, attack categories, co"},{"name":"get_reports","description":"The individual abuse reports filed against one address, newest first, with time, categories, comment (usually log lines) and reporter. Paginated."},{"name":"check_network","description":"Every reported address inside a CIDR block (IPv4 up to /16, IPv6 up to /48), with score, report count and last report time, plus the network's owner. Use it to "},{"name":"report_ip","description":"File an abuse report against an address that attacked a system you run. Needs an API key. Use category codes from list_categories (e.g. ssh,brute-force) and put"},{"name":"get_blocklist","description":"The highest-confidence abusive addresses right now, best first, with score, country and categories. Needs an API key and counts as one blocklist download. For a"},{"name":"list_categories","description":"All attack categories with their code, numeric ID, group and when to use them. Use the codes with report_ip."},{"name":"get_statistics","description":"What the database sees right now: reports in the last 24 hours, addresses on the blocklist, and over the last 30 days the top attack categories, countries, netw"},{"name":"get_today_news","description":"Today's threat news from the last 24 hours: the countries the most reported attacks come from, the networks (ASNs) behind them, the attack techniques (categorie"},{"name":"analyze_logs","description":"Find malicious traffic in logs. Pass raw log lines from any source (nginx/Apache/IIS access logs, sshd/auth.log, syslog, firewall such as iptables/UFW/pfSense/A"},{"name":"get_country_report","description":"How many addresses in a country were reported in the last 30 days, how many are on the blocklist, the most reported addresses there, and the networks and attack"},{"name":"get_network_report","description":"Abuse reported against one autonomous system in the last 30 days: number of reported and blocklisted addresses, the worst addresses, attack categories and count"},{"name":"about_isipsafe","description":"Explains isIPsafe itself. Use it for any question about the product rather than guessing: what it is and who it is for, its mission and aims, how reports and th"}],"toolCount":12,"toolsHash":"7957063662ea2891158442781f6b8c367405fa4e09d0de545d9e1ad8a4e01d28","serverName":"isipsafe","capabilities":["resources","tools"],"serverVersion":"1.0","protocolVersion":"2025-06-18"}},{"at":"2026-11-06T03:26:19.605Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":68,"error":null,"detail":{"tools":[{"name":"check_ip","description":"Reputation of one IPv4 or IPv6 address: abuse confidence score (0-100, 75+ is on the blocklist), number of reports and distinct reporters, attack categories, co"},{"name":"get_reports","description":"The individual abuse reports filed against one address, newest first, with time, categories, comment (usually log lines) and reporter. Paginated."},{"name":"check_network","description":"Every reported address inside a CIDR block (IPv4 up to /16, IPv6 up to /48), with score, report count and last report time, plus the network's owner. Use it to "},{"name":"report_ip","description":"File an abuse report against an address that attacked a system you run. Needs an API key. Use category codes from list_categories (e.g. ssh,brute-force) and put"},{"name":"get_blocklist","description":"The highest-confidence abusive addresses right now, best first, with score, country and categories. Needs an API key and counts as one blocklist download. For a"},{"name":"list_categories","description":"All attack categories with their code, numeric ID, group and when to use them. Use the codes with report_ip."},{"name":"get_statistics","description":"What the database sees right now: reports in the last 24 hours, addresses on the blocklist, and over the last 30 days the top attack categories, countries, netw"},{"name":"get_today_news","description":"Today's threat news from the last 24 hours: the countries the most reported attacks come from, the networks (ASNs) behind them, the attack techniques (categorie"},{"name":"analyze_logs","description":"Find malicious traffic in logs. Pass raw log lines from any source (nginx/Apache/IIS access logs, sshd/auth.log, syslog, firewall such as iptables/UFW/pfSense/A"},{"name":"get_country_report","description":"How many addresses in a country were reported in the last 30 days, how many are on the blocklist, the most reported addresses there, and the networks and attack"},{"name":"get_network_report","description":"Abuse reported against one autonomous system in the last 30 days: number of reported and blocklisted addresses, the worst addresses, attack categories and count"},{"name":"about_isipsafe","description":"Explains isIPsafe itself. Use it for any question about the product rather than guessing: what it is and who it is for, its mission and aims, how reports and th"}],"toolCount":12,"toolsHash":"7957063662ea2891158442781f6b8c367405fa4e09d0de545d9e1ad8a4e01d28","serverName":"isipsafe","capabilities":["resources","tools"],"serverVersion":"1.0","protocolVersion":"2025-06-18"}},{"at":"2026-11-05T18:25:31.449Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":81,"error":null,"detail":{"tools":[{"name":"check_ip","description":"Reputation of one IPv4 or IPv6 address: abuse confidence score (0-100, 75+ is on the blocklist), number of reports and distinct reporters, attack categories, co"},{"name":"get_reports","description":"The individual abuse reports filed against one address, newest first, with time, categories, comment (usually log lines) and reporter. Paginated."},{"name":"check_network","description":"Every reported address inside a CIDR block (IPv4 up to /16, IPv6 up to /48), with score, report count and last report time, plus the network's owner. Use it to "},{"name":"report_ip","description":"File an abuse report against an address that attacked a system you run. Needs an API key. Use category codes from list_categories (e.g. ssh,brute-force) and put"},{"name":"get_blocklist","description":"The highest-confidence abusive addresses right now, best first, with score, country and categories. Needs an API key and counts as one blocklist download. For a"},{"name":"list_categories","description":"All attack categories with their code, numeric ID, group and when to use them. Use the codes with report_ip."},{"name":"get_statistics","description":"What the database sees right now: reports in the last 24 hours, addresses on the blocklist, and over the last 30 days the top attack categories, countries, netw"},{"name":"get_today_news","description":"Today's threat news from the last 24 hours: the countries the most reported attacks come from, the networks (ASNs) behind them, the attack techniques (categorie"},{"name":"analyze_logs","description":"Find malicious traffic in logs. Pass raw log lines from any source (nginx/Apache/IIS access logs, sshd/auth.log, syslog, firewall such as iptables/UFW/pfSense/A"},{"name":"get_country_report","description":"How many addresses in a country were reported in the last 30 days, how many are on the blocklist, the most reported addresses there, and the networks and attack"},{"name":"get_network_report","description":"Abuse reported against one autonomous system in the last 30 days: number of reported and blocklisted addresses, the worst addresses, attack categories and count"},{"name":"about_isipsafe","description":"Explains isIPsafe itself. Use it for any question about the product rather than guessing: what it is and who it is for, its mission and aims, how reports and th"}],"toolCount":12,"toolsHash":"7957063662ea2891158442781f6b8c367405fa4e09d0de545d9e1ad8a4e01d28","serverName":"isipsafe","capabilities":["resources","tools"],"serverVersion":"1.0","protocolVersion":"2025-06-18"}},{"at":"2026-11-05T09:26:52.590Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":182,"error":null,"detail":{"tools":[{"name":"check_ip","description":"Reputation of one IPv4 or IPv6 address: abuse confidence score (0-100, 75+ is on the blocklist), number of reports and distinct reporters, attack categories, co"},{"name":"get_reports","description":"The individual abuse reports filed against one address, newest first, with time, categories, comment (usually log lines) and reporter. Paginated."},{"name":"check_network","description":"Every reported address inside a CIDR block (IPv4 up to /16, IPv6 up to /48), with score, report count and last report time, plus the network's owner. Use it to "},{"name":"report_ip","description":"File an abuse report against an address that attacked a system you run. Needs an API key. Use category codes from list_categories (e.g. ssh,brute-force) and put"},{"name":"get_blocklist","description":"The highest-confidence abusive addresses right now, best first, with score, country and categories. Needs an API key and counts as one blocklist download. For a"},{"name":"list_categories","description":"All attack categories with their code, numeric ID, group and when to use them. Use the codes with report_ip."},{"name":"get_statistics","description":"What the database sees right now: reports in the last 24 hours, addresses on the blocklist, and over the last 30 days the top attack categories, countries, netw"},{"name":"get_today_news","description":"Today's threat news from the last 24 hours: the countries the most reported attacks come from, the networks (ASNs) behind them, the attack techniques (categorie"},{"name":"analyze_logs","description":"Find malicious traffic in logs. Pass raw log lines from any source (nginx/Apache/IIS access logs, sshd/auth.log, syslog, firewall such as iptables/UFW/pfSense/A"},{"name":"get_country_report","description":"How many addresses in a country were reported in the last 30 days, how many are on the blocklist, the most reported addresses there, and the networks and attack"},{"name":"get_network_report","description":"Abuse reported against one autonomous system in the last 30 days: number of reported and blocklisted addresses, the worst addresses, attack categories and count"},{"name":"about_isipsafe","description":"Explains isIPsafe itself. Use it for any question about the product rather than guessing: what it is and who it is for, its mission and aims, how reports and th"}],"toolCount":12,"toolsHash":"7957063662ea2891158442781f6b8c367405fa4e09d0de545d9e1ad8a4e01d28","serverName":"isipsafe","capabilities":["resources","tools"],"serverVersion":"1.0","protocolVersion":"2025-06-18"}},{"at":"2026-11-05T01:28:32.458Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":70,"error":null,"detail":{"tools":[{"name":"check_ip","description":"Reputation of one IPv4 or IPv6 address: abuse confidence score (0-100, 75+ is on the blocklist), number of reports and distinct reporters, attack categories, co"},{"name":"get_reports","description":"The individual abuse reports filed against one address, newest first, with time, categories, comment (usually log lines) and reporter. Paginated."},{"name":"check_network","description":"Every reported address inside a CIDR block (IPv4 up to /16, IPv6 up to /48), with score, report count and last report time, plus the network's owner. Use it to "},{"name":"report_ip","description":"File an abuse report against an address that attacked a system you run. Needs an API key. Use category codes from list_categories (e.g. ssh,brute-force) and put"},{"name":"get_blocklist","description":"The highest-confidence abusive addresses right now, best first, with score, country and categories. Needs an API key and counts as one blocklist download. For a"},{"name":"list_categories","description":"All attack categories with their code, numeric ID, group and when to use them. Use the codes with report_ip."},{"name":"get_statistics","description":"What the database sees right now: reports in the last 24 hours, addresses on the blocklist, and over the last 30 days the top attack categories, countries, netw"},{"name":"get_today_news","description":"Today's threat news from the last 24 hours: the countries the most reported attacks come from, the networks (ASNs) behind them, the attack techniques (categorie"},{"name":"analyze_logs","description":"Find malicious traffic in logs. Pass raw log lines from any source (nginx/Apache/IIS access logs, sshd/auth.log, syslog, firewall such as iptables/UFW/pfSense/A"},{"name":"get_country_report","description":"How many addresses in a country were reported in the last 30 days, how many are on the blocklist, the most reported addresses there, and the networks and attack"},{"name":"get_network_report","description":"Abuse reported against one autonomous system in the last 30 days: number of reported and blocklisted addresses, the worst addresses, attack categories and count"},{"name":"about_isipsafe","description":"Explains isIPsafe itself. Use it for any question about the product rather than guessing: what it is and who it is for, its mission and aims, how reports and th"}],"toolCount":12,"toolsHash":"7957063662ea2891158442781f6b8c367405fa4e09d0de545d9e1ad8a4e01d28","serverName":"isipsafe","capabilities":["resources","tools"],"serverVersion":"1.0","protocolVersion":"2025-06-18"}}],"tools":[{"name":"check_ip","description":"Reputation of one IPv4 or IPv6 address: abuse confidence score (0-100, 75+ is on the blocklist), number of reports and distinct reporters, attack categories, co"},{"name":"get_reports","description":"The individual abuse reports filed against one address, newest first, with time, categories, comment (usually log lines) and reporter. Paginated."},{"name":"check_network","description":"Every reported address inside a CIDR block (IPv4 up to /16, IPv6 up to /48), with score, report count and last report time, plus the network's owner. Use it to "},{"name":"report_ip","description":"File an abuse report against an address that attacked a system you run. Needs an API key. Use category codes from list_categories (e.g. ssh,brute-force) and put"},{"name":"get_blocklist","description":"The highest-confidence abusive addresses right now, best first, with score, country and categories. Needs an API key and counts as one blocklist download. For a"},{"name":"list_categories","description":"All attack categories with their code, numeric ID, group and when to use them. Use the codes with report_ip."},{"name":"get_statistics","description":"What the database sees right now: reports in the last 24 hours, addresses on the blocklist, and over the last 30 days the top attack categories, countries, netw"},{"name":"get_today_news","description":"Today's threat news from the last 24 hours: the countries the most reported attacks come from, the networks (ASNs) behind them, the attack techniques (categorie"},{"name":"analyze_logs","description":"Find malicious traffic in logs. Pass raw log lines from any source (nginx/Apache/IIS access logs, sshd/auth.log, syslog, firewall such as iptables/UFW/pfSense/A"},{"name":"get_country_report","description":"How many addresses in a country were reported in the last 30 days, how many are on the blocklist, the most reported addresses there, and the networks and attack"},{"name":"get_network_report","description":"Abuse reported against one autonomous system in the last 30 days: number of reported and blocklisted addresses, the worst addresses, attack categories and count"},{"name":"about_isipsafe","description":"Explains isIPsafe itself. Use it for any question about the product rather than guessing: what it is and who it is for, its mission and aims, how reports and th"}],"package":null,"toolSurface":{"id":"ts_wu625zan6edb","endpointId":"ep_86av2sm9g7yn","hash":"7957063662ea2891158442781f6b8c367405fa4e09d0de545d9e1ad8a4e01d28","toolCount":12,"serverName":"isipsafe","serverVersion":"1.0","protocolVersion":"2025-06-18","firstSeenAt":"2026-11-05T01:28:32.479Z","lastSeenAt":"2026-11-07T05:29:18.372Z","observations":7,"hiddenText":{"level":"none","total":0,"tools":0,"kinds":[],"findings":[]},"toolNames":["check_ip","get_reports","check_network","report_ip","get_blocklist","list_categories","get_statistics","get_today_news","analyze_logs","get_country_report","get_network_report","about_isipsafe"],"distinctSurfaces":1,"surfacesWithHiddenText":0},"endpointFacts":[{"id":"ep_86av2sm9g7yn","url":"https://isipsafe.com/mcp","type":"mcp_streamable_http","factsCheckedAt":"2026-11-06T03:26:19.613Z","auth":{"observedAt":"2026-11-06T03:26:19.639Z","authRequired":false,"scheme":null,"resourceMetadata":null,"authorizationServer":null,"conformance":{"dpop":false,"rfc8414":false,"rfc9728":false,"pkceS256":false,"clientIdMetadataDocument":false,"dynamicClientRegistration":false}},"tls":{"observedAt":"2026-11-06T03:26:19.674Z","protocol":"TLSv1.3","chainValid":true,"chainError":null,"hostMatches":true,"subject":"isipsafe.com","issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validFrom":"2026-10-29T07:44:00.000Z","validTo":"2027-01-27T07:43:59.000Z","daysToExpiry":80,"sanCount":2,"fingerprint256":"B5:FE:CC:5C:97:64:DE:75:23:9C:60:54:4C:AD:53:E6:64:B0:06:54:43:ED:68:83:31:F1:E4:68:FA:CB:6B:A6"}}]},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"mcp_registry","key":"com.isipsafe/isipsafe","url":"https://registry.modelcontextprotocol.io/v0/servers/com.isipsafe%2Fisipsafe","firstSeenAt":"2026-11-04T23:18:00.281Z","fetchedAt":"2026-11-04T23:18:00.281Z","normalizedAt":"2026-11-04T23:18:00.281Z"}]},"firstSeenAt":"2026-11-04T23:18:00.281Z","updatedAt":"2026-11-07T05:34:40.352Z"}