Overview

The IPLocate MCP Server exposes IPLocate.io IP intelligence through the Model Context Protocol (MCP). It runs as a local MCP server process and lets LLMs or developer tools call structured “tools” to retrieve rich IP information — geolocation, ASN and network details, privacy signals (VPN/proxy/Tor), organization data, and abuse contacts — without embedding API logic into your prompts.

This is useful for security analysts, incident responders, fraud prevention, support teams, and any application that needs reliable, queryable IP context while interacting with a model. The server proxies requests to IPLocate.io using your API key and returns structured JSON responses that are easy to inspect and reason about in downstream prompts or automation. Source and configuration examples are available on GitHub: https://github.com/iplocate/mcp-server-iplocate

Features

Geolocation: country, region, city, latitude/longitude, timezone, postal code
Network / ASN data: ASN number, ASN name, network range, ISP, regional registry
Privacy & security signals: VPN/proxy detection, Tor exit node status, hosting provider flags, blocklist indicators
Company & organization data: organization name, domain, business type
Abuse contacts: emails, phone numbers, physical address and abuse reporting endpoints for a network
Pre-configured prompts and tools optimized for common IP analysis workflows
Works with MCP-compatible clients (Cursor, Claude Desktop, VS Code MCP preview)

Installation / Configuration

Requirements:

Node.js 18+
npm
IPLocate API key (sign up at https://iplocate.io/signup)

Run via npx (quickest):

# start the MCP server locally (requires IPLOCATE_API_KEY env)
IPLOCATE_API_KEY="your_api_key_here" npx -y @iplocate/mcp-server

Cursor MCP client (project-level config)

Create .cursor/mcp.json:

mkdir -p .cursor
cat > .cursor/mcp.json <<'JSON'
{
  "mcpServers": {
    "iplocate": {
      "command": "npx",
      "args": ["-y", "@iplocate/mcp-server"],
      "env": {
        "IPLOCATE_API_KEY": "your_api_key_here"
      }
    }
  }
}
JSON

Claude Desktop (Developer → Edit Config)

{
  "mcpServers": {
    "iplocate": {
      "command": "npx",
      "args": ["-y", "@iplocate/mcp-server"],
      "env": { "IPLOCATE_API_KEY": "your_api_key_here" }
    }
  }
}

VS Code MCP preview (.vscode/mcp.json)

mkdir -p .vscode
cat > .vscode/mcp.json <<'JSON'
{
  "servers": {
    "iplocate": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "@iplocate/mcp-server"],
      "env": { "IPLOCATE_API_KEY": "your_api_key_here" }
    }
  }
}
JSON

Notes:

Replace “your_api_key_here” with your IPLocate API key.
The server uses standard input/output for MCP communication and runs the same process used by many MCP clients.

Available Tools

The server exposes several callable tools. Each accepts an optional ip parameter (IPv4 or IPv6). If omitted, the server returns info about the caller IP.

Tool name	Purpose
lookup_ip_address_details	Full, all-in-one IP profile
lookup_ip_address_location	Geolocation-only (country, city, coords, timezone)
lookup_ip_address_privacy	VPN/proxy/Tor/hosting detection and blocklist flags
lookup_ip_address_network	ASN, network range, ISP, regional registry
lookup_ip_address_company	Organization/company metadata for the IP
lookup_ip_address_abuse_contacts	Abuse reporting contacts for the network

Example call payload:

{
  "ip": "8.8.8.8"
}

Example successful return (abbreviated):

{
  "ip": "8.8.8.8",
  "location": { "country": "US", "city": "Mountain View", "latitude": 37.386, "longitude": -122.0838, "timezone": "America/Los_Angeles" },
  "network": { "asn": 15169, "asn_name": "GOOGLE", "network": "8.8.8.0/24", "isp": "Google LLC" },
  "privacy": { "vpn": false, "proxy": false, "tor": false, "hosting": true },
  "company": { "name": "Google LLC", "domain": "google.com" },
  "abuse_contacts": [{ "email": "[email protected]", "phone": "+1-650-253-0000" }]
}

Use Cases

Threat analysis: Run lookup_ip_address_privacy to quickly flag VPNs, proxies, or Tor usage during incident triage. Example: “Analyze 203.0.113.5 for VPN/proxy indicators and any recent abuse flags.”
Incident response / takedown: Use lookup_ip_address_abuse_contacts to populate a takedown report with the correct abuse email and phone, plus CIDR range for escalation.
Fraud prevention / account security: Compare a login IP with a claimed user location. Use lookup_ip_address_location to validate that an IP’s country/timezone aligns with the user profile.
Enrichment for logs and alerts: Pipe lookup_ip_address_network and lookup_ip_address_company results into SIEM or alerting rules to show ASN, ISP, and organization context inline with alerts.
Automated model workflows: Embed tool calls in prompts for an LLM to fetch structured IP facts (e.g., “Fetch geolocation and abuse contacts for 1.2.3.4 and summarize action items”).

Best Practices & Notes

Respect IPLocate API rate limits and your plan quotas — avoid excessive automated polling.
Treat IP intelligence as one signal: combine with logs, device fingerprinting, and behavioral data for robust decisions.
The server requires a valid IPLOCATE_API_KEY environment variable; keep keys secret and rotate per your security policies.
For detailed API limits and field definitions, consult the IPLocate.io documentation and the project repository on GitHub: https://github.com/iplocate/mcp-server-iplocate

IPLocate MCP Server — Geolocation, Network, Abuse Contacts