{ "data": { "a": { "slug": "abuseipdb", "name": "AbuseIPDB", "vendor": "AbuseIPDB LLC", "vendorUrl": "https://www.abuseipdb.com", "kind": "http-api", "category": "security-intelligence", "summary": "AbuseIPDB is a crowdsourced database of IP addresses reported for abuse, run by AbuseIPDB LLC under Marathon Studios. Its API v2 returns an abuse confidence score and report history for an address, a subnet or a blacklist, and takes reports.", "url": "https://www.anchorterminal.com/tools/abuseipdb", "markdownUrl": "https://www.anchorterminal.com/tools/abuseipdb.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/abuseipdb.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/abuseipdb.json", "dns": "abuseipdb.grade.anchorterminal.com", "repo": "https://github.com/AbuseIPDB/abuseipdb-mcp", "transports": [ "stdio" ], "packages": [ { "registry": "pypi", "name": "mcp-server-abuseipdb" } ], "auth": "api-key", "authNotes": "API key from the account page after a browser signup, sent in a `Key` header. The docs also accept the key as a lowercase `key` query or form parameter. No scopes were found. The official MCP server reads the key from `ABUSEIPDB_API_KEY` and is read-only.", "pricing": "freemium", "pricingNotes": "Free Individual plan with 1,000 checks and 1,000 reports a day, 100 block checks, a 10,000-address blacklist and no card. Basic $25 a month (10,000 checks a day) and Premium $99 a month (50,000 a day), each with a 30-day trial. Enterprise by contact. Free plans are for evaluation, contributing reports or non-commercial personal projects under the terms.", "priceSummary": "$25 / mo", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the API docs, the pricing page or the MCP server repository (checked 2026-11-03). Plan limits exceeded on check-block return 402 Payment Required with a plain error, not payment requirements.", "endpoints": [] }, "toolCount": 2, "popularity": { "githubStars": 6, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-03" }, "docsUrl": "https://docs.abuseipdb.com/", "llmsTxt": "https://www.abuseipdb.com/llms.txt", "registryName": "io.github.abuseipdb/abuseipdb-mcp", "capabilities": [ "secintel.reputation", "secintel.indicators", "secintel.ip-enrichment" ], "tags": [ "hosted", "freemium", "no-card", "free-tier", "api-key", "mcp", "official", "mcp-registry", "stdio", "read-only-mode", "llms-txt", "sla", "status-page", "python", "closed-source" ], "lastRelease": "2026-08-02", "graded": true, "anchor": { "graded": true, "score": 55.7, "grade": "C", "agentReady": false, "rank": 764, "ranked": true, "rankOf": 1349, "categoryRank": 6, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 74, "maintenance": 38, "payments": 30, "reliability": 75, "schema": 59, "security": 37, "transparency": 63 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-03" }, "negative": 0, "verdict": "A free key allows 1,000 IP checks a day with published per-endpoint limits, rate-limit headers and a 99 per cent SLA in the terms, and the official MCP server is read-only. One key covers reads, reports and deletes, the key may travel in a query string, there is no OpenAPI document, and the terms bar redistribution of results.", "bestFor": "An agent that needs a quick reputation verdict on an IP or subnet, or wants to report abuse from its own logs, with a free daily quota large enough for one incident.", "strengths": [ "1,000 checks and 1,000 reports a day on a free key with no card, and daily limits published for every endpoint and plan", "429 responses carry Retry-After and X-RateLimit headers, and errors follow the JSON API shape with a status and detail", "The terms include a service level agreement with a 99 per cent monthly availability target", "The first-party MCP server has two read-only tools annotated readOnlyHint and idempotentHint, with per-item errors in bulk checks", "llms.txt on abuseipdb.com describes the API, categories and reporting rules for agents" ], "weaknesses": [ "No OpenAPI document, no API changelog (the blog's last post is from December 2018) and the reports endpoint is marked open beta and may change without notice", "One key per account reaches reads, reports, bulk reports and clear-address deletes, and the docs accept it as a query parameter", "No security.txt, disclosure policy or certification found, and the status page's incident history could not be read", "The terms bar reproducing, copying or reselling any portion of the service and its data, and free plans exclude commercial use", "The privacy policy of 15 March 2023 gives no retention periods and marks every provider's GDPR status as in process" ], "agentNotes": [ "Send `Accept: application/json` and the key in the `Key` header; without the Accept header the API answers with an HTML page", "Act on `abuseConfidenceScore` rather than `isWhitelisted`, and pass `maxAgeInDays` to bound how old the reports can be (default 30, maximum 365)", "Watch `X-RateLimit-Remaining` per endpoint and on a 429 wait for `Retry-After`, which can be most of a day since limits reset at 00:00 UTC", "Use `check-block` for a subnet (up to /24 on the free plan) and `blacklist` with `confidenceMinimum` only on a paid plan; over-limit `limit` values are truncated silently", "Strip personal data from report comments, which are public, and prefer the read-only MCP server when the task never reports" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 55.7 } ], "editorialScores": { "ergonomics": 74, "maintenance": 38, "payments": 30, "reliability": 75, "schema": 59, "security": 37, "transparency": 42 }, "provenanceScore": 84, "checked": { "categories": { "ergonomics": "2026-11-03", "maintenance": "2026-11-03", "payments": "2026-11-03", "reliability": "2026-11-03", "schema": "2026-11-03", "security": "2026-11-03", "transparency": "2026-11-03" }, "last": "2026-11-03", "oldest": "2026-11-03", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "uvx mcp-server-abuseipdb", "http": "curl -G https://api.abuseipdb.com/api/v2/check --data-urlencode \"ipAddress=118.25.6.39\" -d maxAgeInDays=90 -H \"Key: $ABUSEIPDB_API_KEY\" -H \"Accept: application/json\"", "claudeCode": "claude mcp add abuseipdb -e ABUSEIPDB_API_KEY=YOUR_KEY -- uvx mcp-server-abuseipdb", "config": { "mcpServers": { "abuseipdb": { "args": [ "mcp-server-abuseipdb" ], "command": "uvx", "env": { "ABUSEIPDB_API_KEY": "${ABUSEIPDB_API_KEY}" } } } } }, "letme": { "capability": "https://letme.dev/secintel.reputation", "tool": "https://letme.dev/abuseipdb" }, "area": "developer", "unitPrices": [ { "item": "Basic, 10,000 checks a day", "unit": "month", "usd": 25, "note": "$228 a year" }, { "item": "Premium, 50,000 checks a day", "unit": "month", "usd": 99, "note": "$1,068 a year" } ], "provenance": { "legalEntity": "AbuseIPDB LLC", "domain": "abuseipdb.com", "domainRegistered": "2010-04-06", "endpointOnVendorDomain": true, "terms": "https://www.abuseipdb.com/legal", "privacy": "https://www.abuseipdb.com/privacy", "statusPage": "https://status.abuseipdb.com/", "changelog": "https://github.com/AbuseIPDB/abuseipdb-mcp/blob/main/CHANGELOG.md", "securityTxt": "none", "checked": "2026-11-03", "notes": [ "The terms of use and privacy policy, both last updated 15 March 2023, name AbuseIPDB LLC, a Pennsylvania limited liability company, under Pennsylvania law with arbitration in Philadelphia. The about page says the project is managed by Marathon Studios Inc.", "Section 3 of the terms forbids accessing the website by automated means other than search engines that follow robots.txt and authorised API use. Public pages were read for this listing and the clause is recorded as a fact.", "www.abuseipdb.com/robots.txt disallows /account and /enterprise/ for all crawlers with a crawl delay of 2; neither path was fetched. docs.abuseipdb.com has no robots.txt.", "The changelog link is the MCP server's. No changelog for the REST API was found; the blog's newest post is dated 13 December 2018.", "status.abuseipdb.com is an UptimeRobot page linked from the footer. Its monitors and history load by script and answered with an error when read on 3 November 2026.", "www.abuseipdb.com/.well-known/security.txt returns 404. RDAP at Verisign gives a registration date of 6 April 2010." ], "score": 84 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/abuseipdb.json", "live": { "slug": "abuseipdb", "vendorStatus": { "page": "https://status.abuseipdb.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-04T15:31:19.057306817Z" }, "versions": [ { "registry": "pypi", "name": "mcp-server-abuseipdb", "version": "0.1.1", "released": "2026-08-03", "seenAt": "2026-11-04T19:54:02.081091414Z" } ], "githubStars": 6, "pypiWeekly": 38, "securityTxt": { "url": "https://abuseipdb.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-04T15:53:21.604779568Z" }, "updatedAt": "2026-11-04T19:54:02.294565318Z" } }, "answer": "Censys scores 64.1 (B) on agent readiness against AbuseIPDB's 55.7 (C), and leads in 6 of 7 scored categories. AbuseIPDB leads on reliability.", "b": { "slug": "censys", "name": "Censys", "vendor": "Censys, Inc.", "vendorUrl": "https://censys.com", "kind": "http-api", "category": "security-intelligence", "summary": "Censys is an internet scanning and intelligence service. Its Platform API returns what an IP address, web property or certificate exposes, with DNS resolution, host history, enrichment and reputation data, through REST, a hosted MCP server, SDKs and a CLI.", "url": "https://www.anchorterminal.com/tools/censys", "markdownUrl": "https://www.anchorterminal.com/tools/censys.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/censys.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/censys.json", "dns": "censys.grade.anchorterminal.com", "repo": "https://github.com/censys/censys-sdk-python", "license": "Proprietary service under Censys's Terms of Service. The Platform SDKs are MIT and the cencli command line tool is Apache-2.0", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://api.platform.censys.io/v3/", "packages": [ { "registry": "pypi", "name": "censys-platform" }, { "registry": "npm", "name": "@censys/platform-sdk" } ], "auth": "mixed", "authNotes": "Personal access token as `Authorization: Bearer`, created in the web console under API Access after a browser signup, several per user, named, shown once and deletable, no scopes or expiry stated. Starter, Search and Core users also need the API Access role from an organisation admin; Free users don't. The organisation goes in `X-Organization-ID` or `?organization_id=`. Service accounts (Search and Core plans) use OAuth 2 client credentials with module roles and a rotatable secret. The hosted MCP server takes OAuth with a consent page or the same token in a header.", "pricing": "freemium", "pricingNotes": "Free accounts get 100 credits a month and five free Platform actions a day, with host, web property and certificate lookups only. Censys Starter is $79 a month for 500 credits and Starter Pro $599 for 4,000, bought in the web console, unlocking search, aggregate and collections endpoints (https://docs.censys.com/docs/platform-starter-subscriptions). Since 2 November 2026 every action costs one credit and each further page of 100 results one more. Core, Adversary Investigation and Security Operations plans are priced by sales, with enrichment at 20,000 calls a day on Core (checked 2026-11-03).", "priceSummary": "$79 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the API reference, the credits pages, the pricing page or the SDK repositories (checked 2026-11-03). Starter subscriptions are bought in the web console and enterprise plans through sales.", "endpoints": [] }, "toolCount": 12, "popularity": { "githubStars": 11, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-03" }, "docsUrl": "https://docs.censys.com/reference/get-started", "llmsTxt": "https://docs.censys.com/llms.txt", "openapi": "https://docs.censys.com/reference/v3-globaldata-search-query", "capabilities": [ "secintel.exposure", "secintel.dns", "secintel.ip-enrichment", "secintel.reputation", "secintel.indicators" ], "tags": [ "hosted", "freemium", "api-key", "oauth", "mcp", "remote-mcp", "official", "openapi", "llms-txt", "credits", "free-tier", "sales-led", "python", "go", "typescript", "cli", "non-commercial" ], "lastRelease": "2026-11-02", "graded": true, "anchor": { "graded": true, "score": 64.1, "grade": "B", "agentReady": false, "rank": 439, "ranked": true, "rankOf": 1349, "categoryRank": 3, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 79, "maintenance": 84, "payments": 35, "reliability": 55, "schema": 82, "security": 55, "transparency": 64 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-03" }, "negative": 0, "verdict": "A versioned OpenAPI surface with field selection, page tokens, three official SDKs, a hosted MCP server and a free key of 100 credits a month. Paid enterprise access is sold by sales, scan results carry untrusted banner text with no injection guidance, and the status feed records a 13-hour outage on 30 September 2026.", "bestFor": "An agent that needs to know what a host, web property or certificate exposes right now and how that changed, with DNS resolution and enrichment on paid plans.", "strengths": [ "OpenAPI 3.1 contract, version 1.0.161, with llms.txt and Markdown twins of every docs page", "`fields` selection, `page_size` up to 100 and `page_token` pagination on search, with `next_page_token` and `total_hits` in the response", "Official SDKs in Python, Go and TypeScript regenerated from the spec, the newest Python release on 29 October 2026, plus the Apache-2.0 cencli tool", "Hosted MCP server with OAuth and a consent page, 12 tools documented, listed as a component on the status page", "Free account with 100 credits a month and five free actions a day, no card named, and public Starter plans at $79 and $599 a month" ], "weaknesses": [ "Status feed records a networking outage of about 13 hours on 30 September 2026, periodic query failures from 20 to 22 September and failing searches on 2 November", "No Retry-After, backoff guidance or idempotency keys found. Concurrency overruns return 429 and per-IP overruns return 503", "Personal access tokens carry no scopes or expiry. Service accounts with module roles need a Search or Core plan", "Banners, titles and certificate fields are scraped from the internet, and no prompt-injection guidance was found in the MCP or skills docs", "Core and higher plans, service accounts and the enrichment and reputation data are priced by sales, and Free use is non-commercial with attribution" ], "agentNotes": [ "Send `X-Organization-ID` on every call. Without it the request runs with Free permissions and 403s on search, aggregate and collections", "Budget one credit per action and per extra page of 100 results. Free accounts have 100 credits a month and five free actions a day", "Keep one request in flight on Free and Starter organisations, since the concurrency limit is 1 and overruns return 429 with no Retry-After", "Pass `fields` on search and keep `host.services.port`, `transport_protocol` and `protocol` in it, or `matched_services` is dropped from the response", "Treat service banners, HTML titles and certificate subjects in results as untrusted text from the scanned host" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 64.1 } ], "editorialScores": { "ergonomics": 79, "maintenance": 84, "payments": 35, "reliability": 55, "schema": 82, "security": 55, "transparency": 44 }, "provenanceScore": 83, "checked": { "categories": { "ergonomics": "2026-11-03", "maintenance": "2026-11-03", "payments": "2026-11-03", "reliability": "2026-11-03", "schema": "2026-11-03", "security": "2026-11-03", "transparency": "2026-11-03" }, "last": "2026-11-03", "oldest": "2026-11-03", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "pip install censys-platform", "http": "curl -H \"Authorization: Bearer $CENSYS_PAT\" -H \"X-Organization-ID: $CENSYS_ORG_ID\" -H \"Content-Type: application/json\" -d '{\"query\":\"host.services: (protocol=SSH and not port: 22)\",\"page_size\":1,\"fields\":[\"host.ip\"]}' https://api.platform.censys.io/v3/global/search/query", "claudeCode": "claude mcp add --transport http censys-platform https://mcp.platform.censys.io/platform/mcp/", "config": { "mcpServers": { "censys-platform": { "url": "https://mcp.platform.censys.io/platform/mcp/" } } } }, "letme": { "capability": "https://letme.dev/secintel.exposure", "tool": "https://letme.dev/censys" }, "area": "developer", "unitPrices": [ { "item": "Censys Starter, 500 credits", "unit": "month", "usd": 79, "note": "Bought in the web console. Credits roll over one month" }, { "item": "Censys Starter Pro, 4,000 credits", "unit": "month", "usd": 599, "note": "More collections and tags than Starter" }, { "item": "Credit on Starter Pro", "unit": "credit", "usd": 0.15, "note": "$599 for 4,000. One credit is one search, lookup, aggregate or further page of 100 results. $0.158 on Starter" } ], "provenance": { "legalEntity": "Censys, Inc.", "domain": "censys.com", "domainRegistered": "1998-10-28", "domainNote": "censys.com was registered on 28 October 1998 per Verisign RDAP, long before the company was founded in 2017. The API and MCP hosts are on censys.io, which redirects to censys.com.", "endpointOnVendorDomain": true, "terms": "https://censys.com/terms-of-service/", "privacy": "https://censys.com/privacy-policy/", "statusPage": "https://status.censys.com", "changelog": "https://docs.censys.com/changelog", "securityTxt": "none", "checked": "2026-11-03", "notes": [ "Censys, Inc. is named in the terms (Michigan law, arbitration in Ann Arbor) and in the privacy policy with its Ann Arbor address. The about page's timeline says Censys Inc. was founded in 2017 from the ZMap research project of 2013.", "Terms effective 1 October 2018. Section 4.1(x) forbids crawling or scraping the site other than through an authorised API, recorded as a fact. censys.com/robots.txt allows all crawlers with a crawl delay of 10 seconds, and docs.censys.com/robots.txt allows all but edit, login and api-next paths.", "Privacy policy effective 1 April 2025. The data retention policy was revised on 11 July 2023 and still names Censys Search.", "/.well-known/security.txt returns 404 on censys.com, and censys.io redirects there. The contact page names security@censys.com.", "status.censys.com/robots.txt disallows /api/ and /embed/, so the history was read from /history.atom." ], "score": 83 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/censys.json", "live": { "slug": "censys", "probe": { "target": "https://api.platform.censys.io/v3/", "method": "get", "lastAt": "2026-11-04T20:46:38.058222901Z", "lastOk": true, "lastStatus": 401, "lastMs": 310, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 343, "p95ms24h": 681, "samples24h": 55, "samples30d": 55, "days": [ { "date": "2026-11-04", "probes": 55, "ok": 55 } ] }, "vendorStatus": { "page": "https://status.censys.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-04T20:38:44.69823671Z" }, "versions": [ { "registry": "github", "name": "censys/censys-sdk-python", "version": "v0.16.7", "released": "2026-10-29", "seenAt": "2026-11-04T20:05:11.170293831Z" }, { "registry": "npm", "name": "@censys/platform-sdk", "version": "0.12.12", "seenAt": "2026-11-04T20:05:10.175171129Z" }, { "registry": "pypi", "name": "censys-platform", "version": "0.16.7", "released": "2026-10-29", "seenAt": "2026-11-04T20:05:09.981920608Z" } ], "githubStars": 11, "npmWeekly": 259, "pypiWeekly": 3974, "securityTxt": { "url": "https://censys.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-04T15:53:02.043068357Z" }, "updatedAt": "2026-11-04T20:46:38.058222901Z" } }, "edges": [ { "by": 46, "category": "maintenance", "leads": "censys", "name": "Maintenance \u0026 community", "reasons": { "a": "Read as a closed service with an official MCP server. The newest dated change to the surface is the MCP server's v0.1.1 on 2 August 2026, 93 days before the check; the API docs and blog carry no later date (10 of 30). One release in the last 90 days, v0.1.1 fell just outside it (0 of 20). Support is a contact form with no guaranteed response on the free plan, there is no public changelog for the API, and the MCP repository shows a pull request merged on 2 August but GitHub's issue pages could not be read (5 of 15). The MCP server sits in the official registry under io.github.abuseipdb (15). The MCP package has CI on Python 3.11 to 3.14 with ruff, pytest and a packaging check, and a locked dependency set (8 of 10). 10 + 0 + 5 + 15 + 8 = 38.", "b": "Newest changelog entry 2 November 2026 and censys-platform 0.16.7 on 29 October (30). Ten dated changelog entries between 8 September and 2 November and eight PyPI releases since 4 August (20). A closed service with a weekly changelog, a Gainsight community forum with Platform Q and A sections, an in-app feedback portal and support@censys.com. GitHub issue replies weren't read (12 of 15). Official SDKs in three languages regenerated from the spec, the Go and TypeScript repositories pushed on 3 November and PyPI on 29 October (15). The SDKs are 0.x and generated, with a stated grace period for dropping Python versions. CI wasn't read (7 of 10). 30 + 20 + 12 + 15 + 7 = 84." }, "scores": { "a": 38, "b": 84 } }, { "by": 23, "category": "schema", "leads": "censys", "name": "Schema \u0026 documentation", "reasons": { "a": "The surface graded is the REST API v2, with the official MCP server noted. No OpenAPI document was found. The MCP server's two tools carry JSON Schema inputs with range constraints from pydantic Field (8 of 25). llms.txt on abuseipdb.com describes the API, endpoints, categories and reporting rules (10). Each endpoint has a purpose statement and a parameter table, the FAQ explains scoring and decay, and the docs say to act on abuseConfidenceScore rather than isWhitelisted, with little on when not to call (14 of 20). Parameters give defaults and ranges (maxAgeInDays 1 to 365, perPage 1 to 100), usageType has a listed set of values and categories are numbered, but types are not stated and the categories default is ambiguous (10 of 15). Examples in cURL, Python, PHP, C# and VBScript for every endpoint, and errors follow the JSON API shape with 422, 429 and 402 examples (12 of 15). v2 is in the path, there is no API changelog, the blog's last post is from December 2018, and the reports endpoint may change without notice (5 of 15). 8 + 10 + 14 + 10 + 12 + 5 = 59.", "b": "OpenAPI 3.1.0, titled Censys Platform API, version 1.0.161, served inside each reference page and the source of the three Speakeasy SDKs. No standalone download was found, and the censys-sdk-openapi repository holds only a README (22 of 25). llms.txt at docs.censys.com with a Markdown twin of every page (10). Endpoint descriptions state purpose and a use case ('Run a search query across Censys data', a SOC hunting for a C2 banner, JARM or favicon hash), MCP tools say what each does, with little on when not to use a call (14 of 20). Typed path, query and body fields, `page_size` default and maximum 100, required `query`, an Accept header for schema versions. The query itself is a CenQL string with its own language docs (11 of 15). Code samples in shell, Python, Go, JavaScript and Java, a status code table and problem+json ErrorModel bodies, but the search operation's usage example block is empty and 429 isn't among its responses (10 of 15). Versioned paths and Accept header, a dated changelog every week from 8 September to 2 November 2026 (15). 22 + 10 + 14 + 11 + 10 + 15 = 82." }, "scores": { "a": 59, "b": 82 } }, { "by": 20, "category": "reliability", "leads": "abuseipdb", "name": "Reliability", "reasons": { "a": "Read with the hosted lines. A status page on UptimeRobot is linked from every page's footer (20). Its monitors and 90-day history load by script and answered with an error on 3 November 2026, so no incident record could be read (5). Daily limits are published per endpoint and per plan, 1,000 checks a day on the free plan up to 50,000 on Premium (15). A 429 carries Retry-After, X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, and a repeated report of the same address with the same comment within 24 hours updates the earlier report instead of adding one (15). The terms carry a service level agreement with a 99 per cent monthly availability target and a refund as the sole remedy (10). API v2 is generally available, with only the reports endpoint in open beta (10). 20 + 5 + 15 + 15 + 10 + 10 = 75.", "b": "Graded as a hosted service on the Platform API. Atlassian Statuspage at status.censys.com with Platform API, Authentication, Credit Management and three MCP server components (20). Its feed lists 12 entries from 24 August to 2 November 2026. Two were maintenance on ASM. The rest include intermittent 500s on the Platform from 13:52 on 24 August to 09:52 the next day, periodic query failures from 20 to 22 September, historical data calls timing out for about an hour on 18 September, an internal networking outage of the Platform and ASM from 00:35 to 13:46 EDT on 30 September, and failing searches from 14:26 EST on 2 November still in monitoring at 19:08. One full outage of about 13 hours and two multi-hour periods of failing core queries, read as more than one major (5). Limits are published with numbers, concurrency 1 or 25 per organisation and 25 requests a second per IP with a burst of 125 (15). Overruns return 429 or 503, but no Retry-After, backoff guidance or idempotency keys were found, and the SDKs say only that they follow the API's default retry strategy (5 of 15). No SLA found. The terms disclaim any warranty that the service will meet requirements, and the pricing page names none (0). The v3 API is generally available (10). 20 + 5 + 15 + 5 + 0 + 10 = 55." }, "scores": { "a": 75, "b": 55 } }, { "by": 18, "category": "security", "leads": "censys", "name": "Security \u0026 auth", "reasons": { "a": "One API key per account with no scopes found, recommended in a Key header but also accepted as a query or form parameter per the docs (20 less 10 for the query string, so 10). The same key submits reports, bulk reports and clear-address deletes, with no read-only key; the official MCP server is read-only and its write-tool switch is inert (10 of 20). check and reports return reporter comments, which are public user-submitted text, and no guidance on treating them as untrusted was found (4 of 15). Paid plans include API log downloads for the last 24 to 120 hours and the pricing page lists the window per plan (10 of 15). security.txt returns 404, no disclosure policy, bug bounty or certification was found, and the MCP repository's SECURITY.md points to the vendor's support channels (3 of 20). 10 + 10 + 4 + 10 + 3 = 37.", "b": "Personal access tokens as a Bearer header, several per user, named, shown once and deletable, with no scopes or expiry stated. Service accounts on Search and Core plans use OAuth 2 client credentials with module roles and a rotatable secret, and the MCP server takes OAuth with a consent page. Only the organisation id, not a secret, may travel in the query string (26 of 30). Module roles (Analyst, Manager), an API Access role and the advice to grant service accounts only the roles they need, but no read-only token and no confirmation step for deleting a collection (12 of 20). Results carry banners, HTML titles and certificate subjects from scanned hosts, and no guidance on treating them as untrusted was found in the API, MCP or skills docs (3 of 15). A platform audit log for admins that records service account activity, credit usage per member through the API and `X-Request-ID` on every response, with no documented per-call log for token holders (10 of 15). security@censys.com on the contact page. security.txt 404, no bug bounty, and the compliance page says Censys helps customers with SOC 2, ISO 27001 and FedRAMP without claiming any for itself (4 of 20). 26 + 12 + 3 + 10 + 4 = 55." }, "scores": { "a": 37, "b": 55 } }, { "by": 5, "category": "ergonomics", "leads": "censys", "name": "Agent ergonomics", "reasons": { "a": "check returns a compact record unless verbose is set, which adds the reports array, maxAgeInDays bounds the window, and blacklist takes a limit and a plaintext form (18 of 25). reports is paginated with page and perPage up to 100 and next and previous links, and blacklist filters by confidence, country and IP version, though check has no field selection (16 of 20). Errors carry a status and a detail an agent can act on, 429 names the daily limit and the headers say when it resets, and a 402 marks a plan limit on check-block (16 of 20). Every lookup is a GET, duplicate reports within 24 hours collapse, and both MCP tools are annotated readOnlyHint and idempotentHint (16 of 20). One required parameter per endpoint with sensible defaults. No official SDK beyond a Laravel package in the vendor's GitHub organisation and the Python MCP server (8 of 15). 18 + 16 + 16 + 16 + 8 = 74.", "b": "`fields` limits a search response to named fields and `page_size` caps it at 100, with raw and full variants of lookups chosen by endpoint (22 of 25). `page_token` with `next_page_token` and `previous_page_token`, `total_hits`, aggregate endpoints and a bulk lookup (20). A status code table that separates 401, 403, 422, 429 and 503, problem+json bodies and `X-Request-ID` on responses, but no catalogue of error codes beyond status (14 of 20). Lookups and search are safe to retry, but collections, tags, comments and member endpoints write with no idempotency key, and no tool annotations are documented for the MCP server (8 of 20). One required field on search, SDKs in Python, Go and TypeScript, a CLI and Claude Code skills, though every paid-tier call also needs the organisation id (15). 22 + 20 + 14 + 8 + 15 = 79." }, "scores": { "a": 74, "b": 79 } }, { "by": 5, "category": "payments", "leads": "censys", "name": "Payments \u0026 pricing", "reasons": { "a": "No x402, MPP or L402 (0). Plan prices are public, $25 and $99 a month, sold by daily quota rather than per call (10). The Individual plan allows 1,000 checks a day with no card, and paid plans carry a 30-day trial (20). The key comes from the account page after a browser signup, and the terms forbid multiple accounts to raise quota, so no autonomous route (0). 0 + 10 + 20 + 0 = 30.", "b": "No x402, MPP or L402 (0). Starter at $79 a month for 500 credits and Starter Pro at $599 for 4,000 are public in the docs with one credit an action, which gives a per-call price, while Core and higher plans and credit top-ups are priced by sales (15 of 20). A free account gets 100 credits a month and five free actions a day with no card named (20). Signup, token creation and Starter purchase all happen in a browser, and no key API was found (0). 0 + 15 + 20 + 0 = 35." }, "scores": { "a": 30, "b": 35 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "AbuseIPDB LLC", "b": "Censys, Inc.", "name": "Vendor" }, { "a": "no (local only)", "b": "https://api.platform.censys.io/v3/", "name": "Hosted endpoint" }, { "a": "stdio", "b": "HTTP, Streamable HTTP", "name": "Transports" }, { "a": "API key", "b": "OAuth or key", "name": "Auth" }, { "a": "Freemium", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "none", "b": "Proprietary service under Censys's Terms of Service. The Platform SDKs are MIT and the cencli command line tool is Apache-2.0", "name": "Licence" }, { "a": "2", "b": "12", "name": "Tools exposed" }, { "a": "yes", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "io.github.abuseipdb/abuseipdb-mcp", "b": "not listed", "name": "MCP registry" }, { "a": "2026-08-02", "b": "2026-11-02", "name": "Last release" }, { "a": "no date given", "b": "no date given", "name": "Terms last updated" }, { "a": "no date given", "b": "no date given", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "yes", "b": "yes", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "yes", "name": "Terms restrict benchmarking" }, { "a": "yes", "b": "yes", "name": "Terms or service can change without notice" }, { "a": "yes", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "6 stars", "b": "11 stars", "name": "Popularity" } ], "faq": [ { "answer": "Censys scores 64.1 (B) on agent readiness against AbuseIPDB's 55.7 (C), and leads in 6 of 7 scored categories. AbuseIPDB leads on reliability.", "question": "Which is better for AI agents, AbuseIPDB or Censys?" }, { "answer": "AbuseIPDB needs an API key. Censys takes an API key or an OAuth sign-in.", "question": "Do AbuseIPDB and Censys need an API key?" }, { "answer": "AbuseIPDB runs on your own machine, with no hosted endpoint listed. Censys has a hosted endpoint at https://api.platform.censys.io/v3/.", "question": "Can an agent call AbuseIPDB and Censys without installing anything?" } ], "goodFor": [ { "aheadOn": [ "Reliability, 75 against 55" ], "also": [ "Runs on your own machine", "Free to start without a card" ], "goodFor": "An agent that needs a quick reputation verdict on an IP or subnet, or wants to report abuse from its own logs, with a free daily quota large enough for one incident.", "slug": "abuseipdb", "watchFor": "No OpenAPI document, no API changelog (the blog's last post is from December 2018) and the reports endpoint is marked open beta and may change without notice" }, { "aheadOn": [ "Schema \u0026 documentation, 82 against 59", "Agent ergonomics, 79 against 74", "Security \u0026 auth, 55 against 37", "Payments \u0026 pricing, 35 against 30", "Maintenance \u0026 community, 84 against 38" ], "also": [ "A hosted endpoint, with nothing to install" ], "goodFor": "An agent that needs to know what a host, web property or certificate exposes right now and how that changed, with DNS resolution and enrichment on paid plans.", "slug": "censys", "watchFor": "Status feed records a networking outage of about 13 hours on 30 September 2026, periodic query failures from 20 to 22 September and failing searches on 2 November" } ], "history": null, "job": { "capability": "secintel.reputation", "name": "Secintel reputation" }, "others": [ { "json": "https://www.anchorterminal.com/compare/abuseipdb-vs-greynoise.json", "title": "AbuseIPDB vs GreyNoise", "url": "https://www.anchorterminal.com/compare/abuseipdb-vs-greynoise" }, { "json": "https://www.anchorterminal.com/compare/abuseipdb-vs-ipinfo.json", "title": "AbuseIPDB vs IPinfo", "url": "https://www.anchorterminal.com/compare/abuseipdb-vs-ipinfo" }, { "json": "https://www.anchorterminal.com/compare/abuseipdb-vs-pulsedive.json", "title": "AbuseIPDB vs Pulsedive", "url": "https://www.anchorterminal.com/compare/abuseipdb-vs-pulsedive" }, { "json": "https://www.anchorterminal.com/compare/abuseipdb-vs-virustotal.json", "title": "AbuseIPDB vs VirusTotal", "url": "https://www.anchorterminal.com/compare/abuseipdb-vs-virustotal" }, { "json": "https://www.anchorterminal.com/compare/abuseipdb-vs-whoisxml-api.json", "title": "AbuseIPDB vs WhoisXML API", "url": "https://www.anchorterminal.com/compare/abuseipdb-vs-whoisxml-api" }, { "json": "https://www.anchorterminal.com/compare/censys-vs-greynoise.json", "title": "Censys vs GreyNoise", "url": "https://www.anchorterminal.com/compare/censys-vs-greynoise" }, { "json": "https://www.anchorterminal.com/compare/censys-vs-virustotal.json", "title": "Censys vs VirusTotal", "url": "https://www.anchorterminal.com/compare/censys-vs-virustotal" }, { "json": "https://www.anchorterminal.com/compare/censys-vs-ipinfo.json", "title": "Censys vs IPinfo", "url": "https://www.anchorterminal.com/compare/censys-vs-ipinfo" }, { "json": "https://www.anchorterminal.com/compare/censys-vs-whoisxml-api.json", "title": "Censys vs WhoisXML API", "url": "https://www.anchorterminal.com/compare/censys-vs-whoisxml-api" }, { "json": "https://www.anchorterminal.com/compare/abuseipdb-vs-shodan.json", "title": "AbuseIPDB vs Shodan", "url": "https://www.anchorterminal.com/compare/abuseipdb-vs-shodan" }, { "json": "https://www.anchorterminal.com/compare/censys-vs-pulsedive.json", "title": "Censys vs Pulsedive", "url": "https://www.anchorterminal.com/compare/censys-vs-pulsedive" }, { "json": "https://www.anchorterminal.com/compare/censys-vs-securitytrails.json", "title": "Censys vs SecurityTrails", "url": "https://www.anchorterminal.com/compare/censys-vs-securitytrails" }, { "json": "https://www.anchorterminal.com/compare/censys-vs-shodan.json", "title": "Censys vs Shodan", "url": "https://www.anchorterminal.com/compare/censys-vs-shodan" } ], "panel": null, "scores": [ { "abuseipdb": 75, "by": 20, "censys": 55, "edge": "abuseipdb", "key": "reliability", "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "abuseipdb": 59, "by": 23, "censys": 82, "edge": "censys", "key": "schema", "name": "Schema \u0026 documentation", "weight": 13 }, { "abuseipdb": 74, "by": 5, "censys": 79, "edge": "censys", "key": "ergonomics", "name": "Agent ergonomics", "weight": 13 }, { "abuseipdb": 37, "by": 18, "censys": 55, "edge": "censys", "key": "security", "name": "Security \u0026 auth", "weight": 14 }, { "abuseipdb": 30, "by": 5, "censys": 35, "edge": "censys", "key": "payments", "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "abuseipdb": 38, "by": 46, "censys": 84, "edge": "censys", "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7 }, { "abuseipdb": 63, "by": 1, "censys": 64, "edge": "censys", "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "Censys scores 64.1 (B) on agent readiness against AbuseIPDB's 55.7 (C), and leads in 6 of 7 scored categories. AbuseIPDB leads on reliability. Both do secintel reputation.", "tasks": null, "tutorials": [], "verdicts": { "abuseipdb": "A free key allows 1,000 IP checks a day with published per-endpoint limits, rate-limit headers and a 99 per cent SLA in the terms, and the official MCP server is read-only. One key covers reads, reports and deletes, the key may travel in a query string, there is no OpenAPI document, and the terms bar redistribution of results.", "censys": "A versioned OpenAPI surface with field selection, page tokens, three official SDKs, a hosted MCP server and a free key of 100 credits a month. Paid enterprise access is sold by sales, scan results carry untrusted banner text with no injection guidance, and the status feed records a 13-hour outage on 30 September 2026." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/abuseipdb-vs-censys", "json": "https://www.anchorterminal.com/compare/abuseipdb-vs-censys.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/abuseipdb-vs-censys.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/abuseipdb-vs-censys.min.md" }, "markdown": "Censys scores 64.1 (B) on agent readiness against AbuseIPDB's 55.7 (C), and leads in 6 of 7 scored categories. AbuseIPDB leads on reliability. Both do secintel reputation.\n\n- AbuseIPDB: grade C, 55.7/100, rank #764 of 1349. Markdown https://www.anchorterminal.com/tools/abuseipdb.md · JSON https://www.anchorterminal.com/api/v1/tools/abuseipdb.json\n- Censys: grade B, 64.1/100, rank #439 of 1349. Markdown https://www.anchorterminal.com/tools/censys.md · JSON https://www.anchorterminal.com/api/v1/tools/censys.json\n- Best threat and security intelligence APIs for AI agents: https://www.anchorterminal.com/best/security-intelligence/index.md\n- All 33 security intel comparisons: https://www.anchorterminal.com/compare/security-intelligence/index.md\n\n## Which one, for what\n\n### AbuseIPDB (C)\n\nGood for: An agent that needs a quick reputation verdict on an IP or subnet, or wants to report abuse from its own logs, with a free daily quota large enough for one incident.\n\nAhead on:\n- Reliability, 75 against 55\n\nAlso in its favour:\n- Runs on your own machine\n- Free to start without a card\n\nWatch for: No OpenAPI document, no API changelog (the blog's last post is from December 2018) and the reports endpoint is marked open beta and may change without notice\n\n### Censys (B)\n\nGood for: An agent that needs to know what a host, web property or certificate exposes right now and how that changed, with DNS resolution and enrichment on paid plans.\n\nAhead on:\n- Schema \u0026 documentation, 82 against 59\n- Agent ergonomics, 79 against 74\n- Security \u0026 auth, 55 against 37\n- Payments \u0026 pricing, 35 against 30\n- Maintenance \u0026 community, 84 against 38\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n\nWatch for: Status feed records a networking outage of about 13 hours on 30 September 2026, periodic query failures from 20 to 22 September and failing searches on 2 November\n\n\n## Why the edge\n\n### Maintenance \u0026 community: Censys +46\n\n- AbuseIPDB (38): Read as a closed service with an official MCP server. The newest dated change to the surface is the MCP server's v0.1.1 on 2 August 2026, 93 days before the check; the API docs and blog carry no later date (10 of 30). One release in the last 90 days, v0.1.1 fell just outside it (0 of 20). Support is a contact form with no guaranteed response on the free plan, there is no public changelog for the API, and the MCP repository shows a pull request merged on 2 August but GitHub's issue pages could not be read (5 of 15). The MCP server sits in the official registry under io.github.abuseipdb (15). The MCP package has CI on Python 3.11 to 3.14 with ruff, pytest and a packaging check, and a locked dependency set (8 of 10). 10 + 0 + 5 + 15 + 8 = 38.\n- Censys (84): Newest changelog entry 2 November 2026 and censys-platform 0.16.7 on 29 October (30). Ten dated changelog entries between 8 September and 2 November and eight PyPI releases since 4 August (20). A closed service with a weekly changelog, a Gainsight community forum with Platform Q and A sections, an in-app feedback portal and support@censys.com. GitHub issue replies weren't read (12 of 15). Official SDKs in three languages regenerated from the spec, the Go and TypeScript repositories pushed on 3 November and PyPI on 29 October (15). The SDKs are 0.x and generated, with a stated grace period for dropping Python versions. CI wasn't read (7 of 10). 30 + 20 + 12 + 15 + 7 = 84.\n\n### Schema \u0026 documentation: Censys +23\n\n- AbuseIPDB (59): The surface graded is the REST API v2, with the official MCP server noted. No OpenAPI document was found. The MCP server's two tools carry JSON Schema inputs with range constraints from pydantic Field (8 of 25). llms.txt on abuseipdb.com describes the API, endpoints, categories and reporting rules (10). Each endpoint has a purpose statement and a parameter table, the FAQ explains scoring and decay, and the docs say to act on abuseConfidenceScore rather than isWhitelisted, with little on when not to call (14 of 20). Parameters give defaults and ranges (maxAgeInDays 1 to 365, perPage 1 to 100), usageType has a listed set of values and categories are numbered, but types are not stated and the categories default is ambiguous (10 of 15). Examples in cURL, Python, PHP, C# and VBScript for every endpoint, and errors follow the JSON API shape with 422, 429 and 402 examples (12 of 15). v2 is in the path, there is no API changelog, the blog's last post is from December 2018, and the reports endpoint may change without notice (5 of 15). 8 + 10 + 14 + 10 + 12 + 5 = 59.\n- Censys (82): OpenAPI 3.1.0, titled Censys Platform API, version 1.0.161, served inside each reference page and the source of the three Speakeasy SDKs. No standalone download was found, and the censys-sdk-openapi repository holds only a README (22 of 25). llms.txt at docs.censys.com with a Markdown twin of every page (10). Endpoint descriptions state purpose and a use case ('Run a search query across Censys data', a SOC hunting for a C2 banner, JARM or favicon hash), MCP tools say what each does, with little on when not to use a call (14 of 20). Typed path, query and body fields, `page_size` default and maximum 100, required `query`, an Accept header for schema versions. The query itself is a CenQL string with its own language docs (11 of 15). Code samples in shell, Python, Go, JavaScript and Java, a status code table and problem+json ErrorModel bodies, but the search operation's usage example block is empty and 429 isn't among its responses (10 of 15). Versioned paths and Accept header, a dated changelog every week from 8 September to 2 November 2026 (15). 22 + 10 + 14 + 11 + 10 + 15 = 82.\n\n### Reliability: AbuseIPDB +20\n\n- AbuseIPDB (75): Read with the hosted lines. A status page on UptimeRobot is linked from every page's footer (20). Its monitors and 90-day history load by script and answered with an error on 3 November 2026, so no incident record could be read (5). Daily limits are published per endpoint and per plan, 1,000 checks a day on the free plan up to 50,000 on Premium (15). A 429 carries Retry-After, X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, and a repeated report of the same address with the same comment within 24 hours updates the earlier report instead of adding one (15). The terms carry a service level agreement with a 99 per cent monthly availability target and a refund as the sole remedy (10). API v2 is generally available, with only the reports endpoint in open beta (10). 20 + 5 + 15 + 15 + 10 + 10 = 75.\n- Censys (55): Graded as a hosted service on the Platform API. Atlassian Statuspage at status.censys.com with Platform API, Authentication, Credit Management and three MCP server components (20). Its feed lists 12 entries from 24 August to 2 November 2026. Two were maintenance on ASM. The rest include intermittent 500s on the Platform from 13:52 on 24 August to 09:52 the next day, periodic query failures from 20 to 22 September, historical data calls timing out for about an hour on 18 September, an internal networking outage of the Platform and ASM from 00:35 to 13:46 EDT on 30 September, and failing searches from 14:26 EST on 2 November still in monitoring at 19:08. One full outage of about 13 hours and two multi-hour periods of failing core queries, read as more than one major (5). Limits are published with numbers, concurrency 1 or 25 per organisation and 25 requests a second per IP with a burst of 125 (15). Overruns return 429 or 503, but no Retry-After, backoff guidance or idempotency keys were found, and the SDKs say only that they follow the API's default retry strategy (5 of 15). No SLA found. The terms disclaim any warranty that the service will meet requirements, and the pricing page names none (0). The v3 API is generally available (10). 20 + 5 + 15 + 5 + 0 + 10 = 55.\n\n### Security \u0026 auth: Censys +18\n\n- AbuseIPDB (37): One API key per account with no scopes found, recommended in a Key header but also accepted as a query or form parameter per the docs (20 less 10 for the query string, so 10). The same key submits reports, bulk reports and clear-address deletes, with no read-only key; the official MCP server is read-only and its write-tool switch is inert (10 of 20). check and reports return reporter comments, which are public user-submitted text, and no guidance on treating them as untrusted was found (4 of 15). Paid plans include API log downloads for the last 24 to 120 hours and the pricing page lists the window per plan (10 of 15). security.txt returns 404, no disclosure policy, bug bounty or certification was found, and the MCP repository's SECURITY.md points to the vendor's support channels (3 of 20). 10 + 10 + 4 + 10 + 3 = 37.\n- Censys (55): Personal access tokens as a Bearer header, several per user, named, shown once and deletable, with no scopes or expiry stated. Service accounts on Search and Core plans use OAuth 2 client credentials with module roles and a rotatable secret, and the MCP server takes OAuth with a consent page. Only the organisation id, not a secret, may travel in the query string (26 of 30). Module roles (Analyst, Manager), an API Access role and the advice to grant service accounts only the roles they need, but no read-only token and no confirmation step for deleting a collection (12 of 20). Results carry banners, HTML titles and certificate subjects from scanned hosts, and no guidance on treating them as untrusted was found in the API, MCP or skills docs (3 of 15). A platform audit log for admins that records service account activity, credit usage per member through the API and `X-Request-ID` on every response, with no documented per-call log for token holders (10 of 15). security@censys.com on the contact page. security.txt 404, no bug bounty, and the compliance page says Censys helps customers with SOC 2, ISO 27001 and FedRAMP without claiming any for itself (4 of 20). 26 + 12 + 3 + 10 + 4 = 55.\n\n### Agent ergonomics: Censys +5\n\n- AbuseIPDB (74): check returns a compact record unless verbose is set, which adds the reports array, maxAgeInDays bounds the window, and blacklist takes a limit and a plaintext form (18 of 25). reports is paginated with page and perPage up to 100 and next and previous links, and blacklist filters by confidence, country and IP version, though check has no field selection (16 of 20). Errors carry a status and a detail an agent can act on, 429 names the daily limit and the headers say when it resets, and a 402 marks a plan limit on check-block (16 of 20). Every lookup is a GET, duplicate reports within 24 hours collapse, and both MCP tools are annotated readOnlyHint and idempotentHint (16 of 20). One required parameter per endpoint with sensible defaults. No official SDK beyond a Laravel package in the vendor's GitHub organisation and the Python MCP server (8 of 15). 18 + 16 + 16 + 16 + 8 = 74.\n- Censys (79): `fields` limits a search response to named fields and `page_size` caps it at 100, with raw and full variants of lookups chosen by endpoint (22 of 25). `page_token` with `next_page_token` and `previous_page_token`, `total_hits`, aggregate endpoints and a bulk lookup (20). A status code table that separates 401, 403, 422, 429 and 503, problem+json bodies and `X-Request-ID` on responses, but no catalogue of error codes beyond status (14 of 20). Lookups and search are safe to retry, but collections, tags, comments and member endpoints write with no idempotency key, and no tool annotations are documented for the MCP server (8 of 20). One required field on search, SDKs in Python, Go and TypeScript, a CLI and Claude Code skills, though every paid-tier call also needs the organisation id (15). 22 + 20 + 14 + 8 + 15 = 79.\n\n### Payments \u0026 pricing: Censys +5\n\n- AbuseIPDB (30): No x402, MPP or L402 (0). Plan prices are public, $25 and $99 a month, sold by daily quota rather than per call (10). The Individual plan allows 1,000 checks a day with no card, and paid plans carry a 30-day trial (20). The key comes from the account page after a browser signup, and the terms forbid multiple accounts to raise quota, so no autonomous route (0). 0 + 10 + 20 + 0 = 30.\n- Censys (35): No x402, MPP or L402 (0). Starter at $79 a month for 500 credits and Starter Pro at $599 for 4,000 are public in the docs with one credit an action, which gives a per-call price, while Core and higher plans and credit top-ups are priced by sales (15 of 20). A free account gets 100 credits a month and five free actions a day with no card named (20). Signup, token creation and Starter purchase all happen in a browser, and no key API was found (0). 0 + 15 + 20 + 0 = 35.\n\n## Score by category\n\n| Category | Weight | AbuseIPDB | Censys | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 75 | 55 | AbuseIPDB +20 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 59 | 82 | Censys +23 |\n| Agent ergonomics | 13% (16.2 this run) | 74 | 79 | Censys +5 |\n| Security \u0026 auth | 14% (17.5 this run) | 37 | 55 | Censys +18 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 30 | 35 | Censys +5 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 38 | 84 | Censys +46 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 63 | 64 | Censys +1 |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **55.7 · C** | **64.1 · B** | |\n\n## Facts side by side\n\n| Fact | AbuseIPDB | Censys |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | AbuseIPDB LLC | Censys, Inc. |\n| Hosted endpoint | no (local only) | `https://api.platform.censys.io/v3/` |\n| Transports | stdio | HTTP, Streamable HTTP |\n| Auth | API key | OAuth or key |\n| Pricing | Freemium | Freemium |\n| x402 | no | no |\n| Licence | none | Proprietary service under Censys's Terms of Service. The Platform SDKs are MIT and the cencli command line tool is Apache-2.0 |\n| Tools exposed | 2 | 12 |\n| Read-only variant documented | yes | no |\n| llms.txt | yes | yes |\n| MCP registry | `io.github.abuseipdb/abuseipdb-mcp` | not listed |\n| Last release | 2026-08-02 | 2026-11-02 |\n| Terms last updated | no date given | no date given |\n| Privacy policy last updated | no date given | no date given |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | yes | yes |\n| Terms restrict benchmarking | not found in the text | yes |\n| Terms or service can change without notice | yes | yes |\n| Arbitration or class-action waiver | yes | yes |\n| Popularity | 6 stars | 11 stars |\n\n## Verdicts\n\n**AbuseIPDB.** A free key allows 1,000 IP checks a day with published per-endpoint limits, rate-limit headers and a 99 per cent SLA in the terms, and the official MCP server is read-only. One key covers reads, reports and deletes, the key may travel in a query string, there is no OpenAPI document, and the terms bar redistribution of results.\n\n**Censys.** A versioned OpenAPI surface with field selection, page tokens, three official SDKs, a hosted MCP server and a free key of 100 credits a month. Paid enterprise access is sold by sales, scan results carry untrusted banner text with no injection guidance, and the status feed records a 13-hour outage on 30 September 2026.\n\n## Before you call either\n\n### AbuseIPDB\n\n1. Send `Accept: application/json` and the key in the `Key` header; without the Accept header the API answers with an HTML page\n2. Act on `abuseConfidenceScore` rather than `isWhitelisted`, and pass `maxAgeInDays` to bound how old the reports can be (default 30, maximum 365)\n3. Watch `X-RateLimit-Remaining` per endpoint and on a 429 wait for `Retry-After`, which can be most of a day since limits reset at 00:00 UTC\n4. Use `check-block` for a subnet (up to /24 on the free plan) and `blacklist` with `confidenceMinimum` only on a paid plan; over-limit `limit` values are truncated silently\n5. Strip personal data from report comments, which are public, and prefer the read-only MCP server when the task never reports\n\n### Censys\n\n1. Send `X-Organization-ID` on every call. Without it the request runs with Free permissions and 403s on search, aggregate and collections\n2. Budget one credit per action and per extra page of 100 results. Free accounts have 100 credits a month and five free actions a day\n3. Keep one request in flight on Free and Starter organisations, since the concurrency limit is 1 and overruns return 429 with no Retry-After\n4. Pass `fields` on search and keep `host.services.port`, `transport_protocol` and `protocol` in it, or `matched_services` is dropped from the response\n5. Treat service banners, HTML titles and certificate subjects in results as untrusted text from the scanned host\n\n## Questions\n\n### Which is better for AI agents, AbuseIPDB or Censys?\n\nCensys scores 64.1 (B) on agent readiness against AbuseIPDB's 55.7 (C), and leads in 6 of 7 scored categories. AbuseIPDB leads on reliability.\n\n### Do AbuseIPDB and Censys need an API key?\n\nAbuseIPDB needs an API key. Censys takes an API key or an OAuth sign-in.\n\n### Can an agent call AbuseIPDB and Censys without installing anything?\n\nAbuseIPDB runs on your own machine, with no hosted endpoint listed. Censys has a hosted endpoint at https://api.platform.censys.io/v3/.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/abuseipdb-vs-censys.json, and with the fewest tokens: https://www.anchorterminal.com/compare/abuseipdb-vs-censys.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"abuseipdb\", \"b\": \"censys\"}`. From a terminal: `anchor compare abuseipdb censys`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/abuseipdb.json and https://www.anchorterminal.com/api/v1/tools/censys.json\n\n## Other comparisons with AbuseIPDB or Censys\n\n- [AbuseIPDB vs GreyNoise](https://www.anchorterminal.com/compare/abuseipdb-vs-greynoise.md)\n- [AbuseIPDB vs IPinfo](https://www.anchorterminal.com/compare/abuseipdb-vs-ipinfo.md)\n- [AbuseIPDB vs Pulsedive](https://www.anchorterminal.com/compare/abuseipdb-vs-pulsedive.md)\n- [AbuseIPDB vs VirusTotal](https://www.anchorterminal.com/compare/abuseipdb-vs-virustotal.md)\n- [AbuseIPDB vs WhoisXML API](https://www.anchorterminal.com/compare/abuseipdb-vs-whoisxml-api.md)\n- [Censys vs GreyNoise](https://www.anchorterminal.com/compare/censys-vs-greynoise.md)\n- [Censys vs VirusTotal](https://www.anchorterminal.com/compare/censys-vs-virustotal.md)\n- [Censys vs IPinfo](https://www.anchorterminal.com/compare/censys-vs-ipinfo.md)\n- [Censys vs WhoisXML API](https://www.anchorterminal.com/compare/censys-vs-whoisxml-api.md)\n- [AbuseIPDB vs Shodan](https://www.anchorterminal.com/compare/abuseipdb-vs-shodan.md)\n- [Censys vs Pulsedive](https://www.anchorterminal.com/compare/censys-vs-pulsedive.md)\n- [Censys vs SecurityTrails](https://www.anchorterminal.com/compare/censys-vs-securitytrails.md)\n- [Censys vs Shodan](https://www.anchorterminal.com/compare/censys-vs-shodan.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-04", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "AbuseIPDB vs Censys", "url": "" } ], "description": "Censys scores 64.1 (B) to AbuseIPDB's 55.7 (C) for secintel reputation. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "AbuseIPDB C 55.7", "Censys B 64.1", "scores" ], "h1": "AbuseIPDB vs Censys", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/abuseipdb-vs-censys", "published": "2026-10-01", "section": "tools", "title": "AbuseIPDB vs Censys for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-04", "url": "https://www.anchorterminal.com/compare/abuseipdb-vs-censys" }, "tokens": { "markdown": 4950, "slim": 3330 }, "version": 1 }