{ "data": { "a": { "slug": "abuseipdb", "name": "AbuseIPDB", "vendor": "AbuseIPDB LLC", "vendorUrl": "https://www.abuseipdb.com", "kind": "http-api", "category": "security-intelligence", "summary": "AbuseIPDB is a crowdsourced database of IP addresses reported for abuse, run by AbuseIPDB LLC under Marathon Studios. Its API v2 returns an abuse confidence score and report history for an address, a subnet or a blacklist, and takes reports.", "url": "https://www.anchorterminal.com/tools/abuseipdb", "markdownUrl": "https://www.anchorterminal.com/tools/abuseipdb.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/abuseipdb.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/abuseipdb.json", "dns": "abuseipdb.grade.anchorterminal.com", "repo": "https://github.com/AbuseIPDB/abuseipdb-mcp", "transports": [ "stdio" ], "packages": [ { "registry": "pypi", "name": "mcp-server-abuseipdb" } ], "auth": "api-key", "authNotes": "API key from the account page after a browser signup, sent in a `Key` header. The docs also accept the key as a lowercase `key` query or form parameter. No scopes were found. The official MCP server reads the key from `ABUSEIPDB_API_KEY` and is read-only.", "pricing": "freemium", "pricingNotes": "Free Individual plan with 1,000 checks and 1,000 reports a day, 100 block checks, a 10,000-address blacklist and no card. Basic $25 a month (10,000 checks a day) and Premium $99 a month (50,000 a day), each with a 30-day trial. Enterprise by contact. Free plans are for evaluation, contributing reports or non-commercial personal projects under the terms.", "priceSummary": "$25 / mo", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the API docs, the pricing page or the MCP server repository (checked 2026-11-03). Plan limits exceeded on check-block return 402 Payment Required with a plain error, not payment requirements.", "endpoints": [] }, "toolCount": 2, "popularity": { "githubStars": 6, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-03" }, "docsUrl": "https://docs.abuseipdb.com/", "llmsTxt": "https://www.abuseipdb.com/llms.txt", "registryName": "io.github.abuseipdb/abuseipdb-mcp", "capabilities": [ "secintel.reputation", "secintel.indicators", "secintel.ip-enrichment" ], "tags": [ "hosted", "freemium", "no-card", "free-tier", "api-key", "mcp", "official", "mcp-registry", "stdio", "read-only-mode", "llms-txt", "sla", "status-page", "python", "closed-source" ], "lastRelease": "2026-08-02", "graded": true, "anchor": { "graded": true, "score": 55.7, "grade": "C", "agentReady": false, "rank": 819, "ranked": true, "rankOf": 1349, "categoryRank": 6, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 74, "maintenance": 38, "payments": 30, "reliability": 75, "schema": 59, "security": 37, "transparency": 63 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-03" }, "negative": 0, "verdict": "A free key allows 1,000 IP checks a day with published per-endpoint limits, rate-limit headers and a 99 per cent SLA in the terms, and the official MCP server is read-only. One key covers reads, reports and deletes, the key may travel in a query string, there is no OpenAPI document, and the terms bar redistribution of results.", "bestFor": "An agent that needs a quick reputation verdict on an IP or subnet, or wants to report abuse from its own logs, with a free daily quota large enough for one incident.", "strengths": [ "1,000 checks and 1,000 reports a day on a free key with no card, and daily limits published for every endpoint and plan", "429 responses carry Retry-After and X-RateLimit headers, and errors follow the JSON API shape with a status and detail", "The terms include a service level agreement with a 99 per cent monthly availability target", "The first-party MCP server has two read-only tools annotated readOnlyHint and idempotentHint, with per-item errors in bulk checks", "llms.txt on abuseipdb.com describes the API, categories and reporting rules for agents" ], "weaknesses": [ "No OpenAPI document, no API changelog (the blog's last post is from December 2018) and the reports endpoint is marked open beta and may change without notice", "One key per account reaches reads, reports, bulk reports and clear-address deletes, and the docs accept it as a query parameter", "No security.txt, disclosure policy or certification found, and the status page's incident history could not be read", "The terms bar reproducing, copying or reselling any portion of the service and its data, and free plans exclude commercial use", "The privacy policy of 15 March 2023 gives no retention periods and marks every provider's GDPR status as in process" ], "agentNotes": [ "Send `Accept: application/json` and the key in the `Key` header; without the Accept header the API answers with an HTML page", "Act on `abuseConfidenceScore` rather than `isWhitelisted`, and pass `maxAgeInDays` to bound how old the reports can be (default 30, maximum 365)", "Watch `X-RateLimit-Remaining` per endpoint and on a 429 wait for `Retry-After`, which can be most of a day since limits reset at 00:00 UTC", "Use `check-block` for a subnet (up to /24 on the free plan) and `blacklist` with `confidenceMinimum` only on a paid plan; over-limit `limit` values are truncated silently", "Strip personal data from report comments, which are public, and prefer the read-only MCP server when the task never reports" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 55.7 } ], "editorialScores": { "ergonomics": 74, "maintenance": 38, "payments": 30, "reliability": 75, "schema": 59, "security": 37, "transparency": 42 }, "provenanceScore": 84, "checked": { "categories": { "ergonomics": "2026-11-03", "maintenance": "2026-11-03", "payments": "2026-11-03", "reliability": "2026-11-03", "schema": "2026-11-03", "security": "2026-11-03", "transparency": "2026-11-03" }, "last": "2026-11-03", "oldest": "2026-11-03", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "uvx mcp-server-abuseipdb", "http": "curl -G https://api.abuseipdb.com/api/v2/check --data-urlencode \"ipAddress=118.25.6.39\" -d maxAgeInDays=90 -H \"Key: $ABUSEIPDB_API_KEY\" -H \"Accept: application/json\"", "claudeCode": "claude mcp add abuseipdb -e ABUSEIPDB_API_KEY=YOUR_KEY -- uvx mcp-server-abuseipdb", "config": { "mcpServers": { "abuseipdb": { "args": [ "mcp-server-abuseipdb" ], "command": "uvx", "env": { "ABUSEIPDB_API_KEY": "${ABUSEIPDB_API_KEY}" } } } } }, "letme": { "capability": "https://letme.dev/secintel.reputation", "tool": "https://letme.dev/abuseipdb" }, "area": "developer", "unitPrices": [ { "item": "Basic, 10,000 checks a day", "unit": "month", "usd": 25, "note": "$228 a year" }, { "item": "Premium, 50,000 checks a day", "unit": "month", "usd": 99, "note": "$1,068 a year" } ], "provenance": { "legalEntity": "AbuseIPDB LLC", "domain": "abuseipdb.com", "domainRegistered": "2010-04-06", "endpointOnVendorDomain": true, "terms": "https://www.abuseipdb.com/legal", "privacy": "https://www.abuseipdb.com/privacy", "statusPage": "https://status.abuseipdb.com/", "changelog": "https://github.com/AbuseIPDB/abuseipdb-mcp/blob/main/CHANGELOG.md", "securityTxt": "none", "checked": "2026-11-03", "notes": [ "The terms of use and privacy policy, both last updated 15 March 2023, name AbuseIPDB LLC, a Pennsylvania limited liability company, under Pennsylvania law with arbitration in Philadelphia. The about page says the project is managed by Marathon Studios Inc.", "Section 3 of the terms forbids accessing the website by automated means other than search engines that follow robots.txt and authorised API use. Public pages were read for this listing and the clause is recorded as a fact.", "www.abuseipdb.com/robots.txt disallows /account and /enterprise/ for all crawlers with a crawl delay of 2; neither path was fetched. docs.abuseipdb.com has no robots.txt.", "The changelog link is the MCP server's. No changelog for the REST API was found; the blog's newest post is dated 13 December 2018.", "status.abuseipdb.com is an UptimeRobot page linked from the footer. Its monitors and history load by script and answered with an error when read on 3 November 2026.", "www.abuseipdb.com/.well-known/security.txt returns 404. RDAP at Verisign gives a registration date of 6 April 2010." ], "score": 84 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/abuseipdb.json", "live": { "slug": "abuseipdb", "vendorStatus": { "page": "https://status.abuseipdb.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-04T15:31:19.057306817Z" }, "versions": [ { "registry": "pypi", "name": "mcp-server-abuseipdb", "version": "0.1.1", "released": "2026-08-03", "seenAt": "2026-11-04T19:54:02.081091414Z" } ], "githubStars": 6, "pypiWeekly": 38, "securityTxt": { "url": "https://abuseipdb.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-04T15:53:21.604779568Z" }, "updatedAt": "2026-11-04T19:54:02.294565318Z" } }, "answer": "IPinfo scores 62.7 (B) on agent readiness against AbuseIPDB's 55.7 (C), and leads in 6 of 7 scored categories. AbuseIPDB leads on reliability.", "b": { "slug": "ipinfo", "name": "IPinfo", "vendor": "IPinfo Inc.", "vendorUrl": "https://ipinfo.io", "kind": "http-api", "category": "security-intelligence", "summary": "IPinfo is an IP address data service from IPinfo Inc. in Seattle. Its API returns geolocation, ASN, privacy and residential proxy signals for an address, with a free Lite tier, paid tiers, a batch endpoint and a hosted MCP server.", "url": "https://www.anchorterminal.com/tools/ipinfo", "markdownUrl": "https://www.anchorterminal.com/tools/ipinfo.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/ipinfo.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/ipinfo.json", "dns": "ipinfo.grade.anchorterminal.com", "repo": "https://github.com/ipinfo/mcp", "transports": [ "streamable-http", "stdio" ], "remoteUrl": "https://mcp.ipinfo.io/", "packages": [ { "registry": "pypi", "name": "ipinfo-mcp-server" } ], "auth": "mixed", "authNotes": "Access token from the dashboard after a browser signup, sent as a Bearer header, as HTTP Basic (token as username) or as a `token` query parameter. The hosted MCP server at mcp.ipinfo.io uses OAuth with a browser login and short-lived tokens it renews itself, or a Bearer token. No scopes were found; tier access follows the plan.", "pricing": "freemium", "pricingNotes": "Lite is free with unlimited requests and no card, country and ASN only. Core $26 a month for 150,000 requests (city geolocation, privacy flags), Max $163 a month for 250,000 (residential proxy, carrier, accuracy radius), both 17 per cent less yearly. Overage $0.34 and $1.30 per 1,000 requests. Enterprise from 1 million requests a month by sales; database downloads from $1,000 a month by sales.", "priceSummary": "$26 / mo", "where": "both", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the developer docs, the OpenAPI document, the pricing page or the MCP server repository (checked 2026-11-03). Overage is billed monthly by card.", "endpoints": [] }, "toolCount": 6, "popularity": { "githubStars": 2, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-03" }, "docsUrl": "https://ipinfo.io/developers", "llmsTxt": "https://ipinfo.io/developers/llms.txt", "openapi": "https://ipinfo.io/developers/openapi.yaml", "registryName": "io.github.ipinfo/mcp", "capabilities": [ "secintel.ip-enrichment", "secintel.reputation" ], "tags": [ "hosted", "freemium", "no-card", "free-tier", "api-key", "oauth", "mcp", "remote-mcp", "official", "mcp-registry", "openapi", "llms-txt", "security-txt", "batch", "read-only-mode", "python", "typescript", "go", "java", "php", "ruby", "closed-source", "no-status-page" ], "lastRelease": "2026-10-29", "graded": true, "anchor": { "graded": true, "score": 62.7, "grade": "B", "agentReady": false, "rank": 464, "ranked": true, "rankOf": 1349, "categoryRank": 4, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 84, "maintenance": 85, "payments": 40, "reliability": 38, "schema": 76, "security": 60, "transparency": 70 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-03" }, "negative": 0, "verdict": "A free Lite tier with no request cap, a public OpenAPI document, llms.txt, a batch endpoint of 1,000 lookups and a six-tool hosted MCP server with OAuth. No status page or SLA was found, the only documented error is 429, the token may travel in a query string, and city-level and privacy data need a paid plan.", "bestFor": "An agent that needs to enrich an IP with location, network and anonymiser flags at volume, free for country and ASN, paid for city and privacy signals.", "strengths": [ "Lite tier is free with no daily or monthly limit and no card, and Core overage is priced per 1,000 requests on the public pricing page", "Public OpenAPI 3.0 document with 48 operations, plus llms.txt and llms-full.txt and Markdown twins of every docs page", "Hosted MCP server with OAuth and six read-only tools, in the official MCP registry, with per-session caching and structured error codes", "Batch endpoint takes up to 1,000 lookups per request, and field paths such as /country return one value", "Valid security.txt with a PGP key, a security policy with response times, and official SDKs in eleven languages" ], "weaknesses": [ "No status page, incident history or SLA was found; the terms supply the service as is", "Only 429 is documented as an error response, and no Retry-After or backoff guidance was found", "The token is accepted as a query parameter, and no scoped or read-only tokens were found", "No public changelog or deprecation policy; the legacy API is maintained with no end date", "City geolocation, privacy flags and residential proxy signals need Core or Max, and company, WHOIS and abuse contact data are enterprise only" ], "agentNotes": [ "Call `https://api.ipinfo.io/lite/{ip}` with `Authorization: Bearer` on a free token; `/lookup/{ip}` and `detailed=true` in the MCP tools return ACCESS_DENIED without a paid plan", "Batch up to 1,000 addresses in one POST to `/batch/lite` or `/batch` with `filter=1`; each address counts as one request against the monthly quota", "Append a field path such as `/country` or `/asn` to get a single plain-text value instead of the full object", "On a 429 the monthly plan quota is spent; there is no Retry-After, so stop and report rather than retry", "Treat the data as licensed for internal use; selling or reselling it needs IPinfo's written consent under the terms" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 62.7 } ], "editorialScores": { "ergonomics": 84, "maintenance": 85, "payments": 40, "reliability": 38, "schema": 76, "security": 60, "transparency": 55 }, "provenanceScore": 85, "checked": { "categories": { "ergonomics": "2026-11-03", "maintenance": "2026-11-03", "payments": "2026-11-03", "reliability": "2026-11-03", "schema": "2026-11-03", "security": "2026-11-03", "transparency": "2026-11-03" }, "last": "2026-11-03", "oldest": "2026-11-03", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "uvx ipinfo-mcp-server", "http": "curl -H \"Authorization: Bearer $IPINFO_TOKEN\" https://api.ipinfo.io/lite/8.8.8.8", "claudeCode": "claude mcp add --transport http ipinfo https://mcp.ipinfo.io/", "config": { "mcpServers": { "ipinfo": { "url": "https://mcp.ipinfo.io/" } } } }, "letme": { "capability": "https://letme.dev/secintel.ip-enrichment", "tool": "https://letme.dev/ipinfo" }, "area": "developer", "unitPrices": [ { "item": "Core, 150,000 requests a month", "unit": "month", "usd": 26, "note": "$310 a year" }, { "item": "Max, 250,000 requests a month", "unit": "month", "usd": 163, "note": "$1,960 a year" }, { "item": "Core overage", "unit": "1k-requests", "usd": 0.34, "note": "$0.000342 a request, billed monthly" }, { "item": "Max overage", "unit": "1k-requests", "usd": 1.3, "note": "$0.001297 a request, billed monthly" } ], "provenance": { "legalEntity": "IPinfo Inc.", "domain": "ipinfo.io", "domainRegistered": "2013-04-23", "endpointOnVendorDomain": true, "terms": "https://ipinfo.io/terms-of-service", "privacy": "https://ipinfo.io/privacy-policy", "statusPage": "", "changelog": "https://github.com/ipinfo/mcp/releases", "securityTxt": "valid", "checked": "2026-11-03", "notes": [ "The terms, last updated 3 June 2024, name IPinfo Inc. under Washington law with JAMS arbitration in King County. The privacy policy, effective 29 October 2026, gives a Seattle business address and names the processors.", "The terms forbid robots, spiders or any automated program to retrieve, index, scrape or data-mine the site. Public pages were read for this listing and the clause is recorded as a fact.", "ipinfo.io/robots.txt disallows the data endpoints (paths ending in json, ip, hostname, city and the other field names), URLs with a colon, token and callback parameters, /case-studies/ and /probenet/live/. None was fetched; the docs and OpenAPI document were read instead.", "No status page was found. status.ipinfo.io does not resolve and the site links none.", "The changelog link is the MCP server's GitHub releases. No changelog for the REST API was found.", "security.txt at /.well-known/security.txt is valid until 21 August 2027 with a PGP key. RDAP at Identity Digital gives a registration date of 23 April 2013." ], "score": 85 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/ipinfo.json", "live": { "slug": "ipinfo", "probe": { "target": "https://mcp.ipinfo.io/", "method": "get", "lastAt": "2026-11-04T20:05:07.209782043Z", "lastOk": true, "lastStatus": 200, "lastMs": 166, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 152, "p95ms24h": 236, "samples24h": 48, "samples30d": 48, "days": [ { "date": "2026-11-04", "probes": 48, "ok": 48 } ] }, "versions": [ { "registry": "mcp-registry", "name": "io.github.ipinfo/mcp", "version": "0.2.3", "seenAt": "2026-11-04T17:11:44.552009456Z" } ], "securityTxt": { "url": "https://ipinfo.io/.well-known/security.txt", "state": "valid", "expires": "2027-08-21T00:00:00.000Z", "checkedAt": "2026-11-04T15:53:37.079212393Z" }, "updatedAt": "2026-11-04T20:05:07.209782043Z" } }, "edges": [ { "by": 47, "category": "maintenance", "leads": "ipinfo", "name": "Maintenance \u0026 community", "reasons": { "a": "Read as a closed service with an official MCP server. The newest dated change to the surface is the MCP server's v0.1.1 on 2 August 2026, 93 days before the check; the API docs and blog carry no later date (10 of 30). One release in the last 90 days, v0.1.1 fell just outside it (0 of 20). Support is a contact form with no guaranteed response on the free plan, there is no public changelog for the API, and the MCP repository shows a pull request merged on 2 August but GitHub's issue pages could not be read (5 of 15). The MCP server sits in the official registry under io.github.abuseipdb (15). The MCP package has CI on Python 3.11 to 3.14 with ruff, pytest and a packaging check, and a locked dependency set (8 of 10). 10 + 0 + 5 + 15 + 8 = 38.", "b": "Read as a closed service with an official MCP server and SDKs. MCP server v0.2.3 on 29 October 2026, a commit on 3 November, and SDK repositories pushed in October and November (30). Eight MCP releases since 8 September 2026, v0.1.12 to v0.2.3 (20). GitHub releases for the MCP server, a community forum, a help centre and a support form, but no changelog for the API and GitHub issue pages could not be read (10 of 15). The MCP server is in the official registry as io.github.ipinfo/mcp and the SDKs are official (15). The MCP package has tests, CI with pinned actions, CodeQL and Scorecard workflows and a lock file (10). 30 + 20 + 10 + 15 + 10 = 85." }, "scores": { "a": 38, "b": 85 } }, { "by": 37, "category": "reliability", "leads": "abuseipdb", "name": "Reliability", "reasons": { "a": "Read with the hosted lines. A status page on UptimeRobot is linked from every page's footer (20). Its monitors and 90-day history load by script and answered with an error on 3 November 2026, so no incident record could be read (5). Daily limits are published per endpoint and per plan, 1,000 checks a day on the free plan up to 50,000 on Premium (15). A 429 carries Retry-After, X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, and a repeated report of the same address with the same comment within 24 hours updates the earlier report instead of adding one (15). The terms carry a service level agreement with a 99 per cent monthly availability target and a refund as the sole remedy (10). API v2 is generally available, with only the reports endpoint in open beta (10). 20 + 5 + 15 + 15 + 10 + 10 = 75.", "b": "Read with the hosted lines. No status page was found; status.ipinfo.io does not resolve and the site, docs and llms.txt link none (0). No readable history (5). Limits are published with numbers, Lite unlimited, Core 150,000 and Max 250,000 requests a month, with no per-second cap (15). A 429 is documented in the OpenAPI document and the developer page for the monthly quota, and the MCP server maps it to RATE_LIMITED, but no Retry-After or backoff guidance was found; every call is a read (8 of 15). No SLA; the terms supply the service as is and as available (0). The API and the MCP server are generally available (10). 0 + 5 + 15 + 8 + 0 + 10 = 38." }, "scores": { "a": 75, "b": 38 } }, { "by": 23, "category": "security", "leads": "ipinfo", "name": "Security \u0026 auth", "reasons": { "a": "One API key per account with no scopes found, recommended in a Key header but also accepted as a query or form parameter per the docs (20 less 10 for the query string, so 10). The same key submits reports, bulk reports and clear-address deletes, with no read-only key; the official MCP server is read-only and its write-tool switch is inert (10 of 20). check and reports return reporter comments, which are public user-submitted text, and no guidance on treating them as untrusted was found (4 of 15). Paid plans include API log downloads for the last 24 to 120 hours and the pricing page lists the window per plan (10 of 15). security.txt returns 404, no disclosure policy, bug bounty or certification was found, and the MCP repository's SECURITY.md points to the vendor's support channels (3 of 20). 10 + 10 + 4 + 10 + 3 = 37.", "b": "One access token per account, accepted as a Bearer header, HTTP Basic or a token query parameter, with no scopes found; the hosted MCP server adds OAuth with short-lived tokens (20 less 10 for the query string, plus 4 for OAuth on the MCP server, so 14). Every endpoint is a read and tools return ACCESS_DENIED outside the plan, but there is no read-only or restricted token (16 of 20). Responses are structured network data rather than third-party free text (10 of 15). The dashboard shows request graphs and lookup history per the pricing page, with no per-call log documented (8 of 15). security.txt valid until 21 August 2027 with a PGP key, a SECURITY.md with 2-day acknowledgement and a 90-day disclosure window, no bug bounty or certification found beyond a bank-grade claim (12 of 20). 14 + 16 + 10 + 8 + 12 = 60." }, "scores": { "a": 37, "b": 60 } }, { "by": 17, "category": "schema", "leads": "ipinfo", "name": "Schema \u0026 documentation", "reasons": { "a": "The surface graded is the REST API v2, with the official MCP server noted. No OpenAPI document was found. The MCP server's two tools carry JSON Schema inputs with range constraints from pydantic Field (8 of 25). llms.txt on abuseipdb.com describes the API, endpoints, categories and reporting rules (10). Each endpoint has a purpose statement and a parameter table, the FAQ explains scoring and decay, and the docs say to act on abuseConfidenceScore rather than isWhitelisted, with little on when not to call (14 of 20). Parameters give defaults and ranges (maxAgeInDays 1 to 365, perPage 1 to 100), usageType has a listed set of values and categories are numbered, but types are not stated and the categories default is ambiguous (10 of 15). Examples in cURL, Python, PHP, C# and VBScript for every endpoint, and errors follow the JSON API shape with 422, 429 and 402 examples (12 of 15). v2 is in the path, there is no API changelog, the blog's last post is from December 2018, and the reports endpoint may change without notice (5 of 15). 8 + 10 + 14 + 10 + 12 + 5 = 59.", "b": "The surface graded is the REST API, with the hosted MCP server noted. A public OpenAPI 3.0 document with 48 operations, and the MCP tools carry JSON Schema inputs (25). llms.txt and llms-full.txt, and every developer page is served as Markdown (10). Each tier page says what it returns and which plan unlocks it, and the MCP tool descriptions say which tiers each option needs, with little on when not to call (14 of 20). Schemas and examples on most responses, path parameters typed, but 401 is undocumented and some operations lack the 429 response (11 of 15). Examples in several languages on every page; only 429 is documented as an error, with no error body shape (9 of 15). A new API system since 2025 with the legacy one kept, but no public changelog, no version in the path and the OpenAPI document at 1.0.0 (7 of 15). 25 + 10 + 14 + 11 + 9 + 7 = 76." }, "scores": { "a": 59, "b": 76 } }, { "by": 10, "category": "ergonomics", "leads": "ipinfo", "name": "Agent ergonomics", "reasons": { "a": "check returns a compact record unless verbose is set, which adds the reports array, maxAgeInDays bounds the window, and blacklist takes a limit and a plaintext form (18 of 25). reports is paginated with page and perPage up to 100 and next and previous links, and blacklist filters by confidence, country and IP version, though check has no field selection (16 of 20). Errors carry a status and a detail an agent can act on, 429 names the daily limit and the headers say when it resets, and a 402 marks a plan limit on check-block (16 of 20). Every lookup is a GET, duplicate reports within 24 hours collapse, and both MCP tools are annotated readOnlyHint and idempotentHint (16 of 20). One required parameter per endpoint with sensible defaults. No official SDK beyond a Laravel package in the vendor's GitHub organisation and the Python MCP server (8 of 15). 18 + 16 + 16 + 16 + 8 = 74.", "b": "Field paths such as /country return one value, the Lite and lookup objects are small, and the MCP server has six compact tools with a per-session cache (23 of 25). Batch takes up to 1,000 lookups with filter=1 to drop empty results; no pagination is needed on single lookups, and ASN and range responses have no size control (16 of 20). The only documented error is 429; the MCP server returns coded errors with a message and a suggestion (12 of 20). Every call is a read, batch is a read over POST, and the MCP tools carry tool annotations (18 of 20). One parameter per call, sensible defaults and official SDKs in eleven languages (15). 23 + 16 + 12 + 18 + 15 = 84." }, "scores": { "a": 74, "b": 84 } }, { "by": 10, "category": "payments", "leads": "ipinfo", "name": "Payments \u0026 pricing", "reasons": { "a": "No x402, MPP or L402 (0). Plan prices are public, $25 and $99 a month, sold by daily quota rather than per call (10). The Individual plan allows 1,000 checks a day with no card, and paid plans carry a 30-day trial (20). The key comes from the account page after a browser signup, and the terms forbid multiple accounts to raise quota, so no autonomous route (0). 0 + 10 + 20 + 0 = 30.", "b": "No x402, MPP or L402 (0). Plan prices and per-1,000 overage rates are public on the pricing page (20). Lite is free with no card and no request cap (20). The token comes from the dashboard after a browser signup, and no key API was found (0). 0 + 20 + 20 + 0 = 40." }, "scores": { "a": 30, "b": 40 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "AbuseIPDB LLC", "b": "IPinfo Inc.", "name": "Vendor" }, { "a": "no (local only)", "b": "https://mcp.ipinfo.io/", "name": "Hosted endpoint" }, { "a": "stdio", "b": "Streamable HTTP, stdio", "name": "Transports" }, { "a": "API key", "b": "OAuth or key", "name": "Auth" }, { "a": "Freemium", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "2", "b": "6", "name": "Tools exposed" }, { "a": "yes", "b": "yes", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "io.github.abuseipdb/abuseipdb-mcp", "b": "io.github.ipinfo/mcp", "name": "MCP registry" }, { "a": "2026-08-02", "b": "2026-10-29", "name": "Last release" }, { "a": "no date given", "b": "2024-06-03", "name": "Terms last updated" }, { "a": "no date given", "b": "2026-10-29", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "yes", "b": "yes", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "yes", "b": "yes", "name": "Terms or service can change without notice" }, { "a": "yes", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "6 stars", "b": "2 stars", "name": "Popularity" } ], "faq": [ { "answer": "IPinfo scores 62.7 (B) on agent readiness against AbuseIPDB's 55.7 (C), and leads in 6 of 7 scored categories. AbuseIPDB leads on reliability.", "question": "Which is better for AI agents, AbuseIPDB or IPinfo?" }, { "answer": "AbuseIPDB needs an API key. IPinfo takes an API key or an OAuth sign-in.", "question": "Do AbuseIPDB and IPinfo need an API key?" }, { "answer": "AbuseIPDB runs on your own machine, with no hosted endpoint listed. IPinfo has a hosted endpoint at https://mcp.ipinfo.io/.", "question": "Can an agent call AbuseIPDB and IPinfo without installing anything?" } ], "goodFor": [ { "aheadOn": [ "Reliability, 75 against 38" ], "also": null, "goodFor": "An agent that needs a quick reputation verdict on an IP or subnet, or wants to report abuse from its own logs, with a free daily quota large enough for one incident.", "slug": "abuseipdb", "watchFor": "No OpenAPI document, no API changelog (the blog's last post is from December 2018) and the reports endpoint is marked open beta and may change without notice" }, { "aheadOn": [ "Schema \u0026 documentation, 76 against 59", "Agent ergonomics, 84 against 74", "Security \u0026 auth, 60 against 37", "Payments \u0026 pricing, 40 against 30", "Maintenance \u0026 community, 85 against 38", "Transparency \u0026 trust, 70 against 63" ], "also": [ "A hosted endpoint, with nothing to install" ], "goodFor": "An agent that needs to enrich an IP with location, network and anonymiser flags at volume, free for country and ASN, paid for city and privacy signals.", "slug": "ipinfo", "watchFor": "No status page, incident history or SLA was found; the terms supply the service as is" } ], "history": null, "job": { "capability": "secintel.reputation", "name": "Secintel reputation" }, "others": [ { "json": "https://www.anchorterminal.com/compare/abuseipdb-vs-censys.json", "title": "AbuseIPDB vs Censys", "url": "https://www.anchorterminal.com/compare/abuseipdb-vs-censys" }, { "json": "https://www.anchorterminal.com/compare/abuseipdb-vs-greynoise.json", "title": "AbuseIPDB vs GreyNoise", "url": "https://www.anchorterminal.com/compare/abuseipdb-vs-greynoise" }, { "json": "https://www.anchorterminal.com/compare/abuseipdb-vs-pulsedive.json", "title": "AbuseIPDB vs Pulsedive", "url": "https://www.anchorterminal.com/compare/abuseipdb-vs-pulsedive" }, { "json": "https://www.anchorterminal.com/compare/abuseipdb-vs-virustotal.json", "title": "AbuseIPDB vs VirusTotal", "url": "https://www.anchorterminal.com/compare/abuseipdb-vs-virustotal" }, { "json": "https://www.anchorterminal.com/compare/abuseipdb-vs-whoisxml-api.json", "title": "AbuseIPDB vs WhoisXML API", "url": "https://www.anchorterminal.com/compare/abuseipdb-vs-whoisxml-api" }, { "json": "https://www.anchorterminal.com/compare/greynoise-vs-ipinfo.json", "title": "GreyNoise vs IPinfo", "url": "https://www.anchorterminal.com/compare/greynoise-vs-ipinfo" }, { "json": "https://www.anchorterminal.com/compare/ipinfo-vs-virustotal.json", "title": "IPinfo vs VirusTotal", "url": "https://www.anchorterminal.com/compare/ipinfo-vs-virustotal" }, { "json": "https://www.anchorterminal.com/compare/censys-vs-ipinfo.json", "title": "Censys vs IPinfo", "url": "https://www.anchorterminal.com/compare/censys-vs-ipinfo" }, { "json": "https://www.anchorterminal.com/compare/ipinfo-vs-pulsedive.json", "title": "IPinfo vs Pulsedive", "url": "https://www.anchorterminal.com/compare/ipinfo-vs-pulsedive" }, { "json": "https://www.anchorterminal.com/compare/ipinfo-vs-securitytrails.json", "title": "IPinfo vs SecurityTrails", "url": "https://www.anchorterminal.com/compare/ipinfo-vs-securitytrails" }, { "json": "https://www.anchorterminal.com/compare/ipinfo-vs-shodan.json", "title": "IPinfo vs Shodan", "url": "https://www.anchorterminal.com/compare/ipinfo-vs-shodan" }, { "json": "https://www.anchorterminal.com/compare/ipinfo-vs-whoisxml-api.json", "title": "IPinfo vs WhoisXML API", "url": "https://www.anchorterminal.com/compare/ipinfo-vs-whoisxml-api" }, { "json": "https://www.anchorterminal.com/compare/abuseipdb-vs-shodan.json", "title": "AbuseIPDB vs Shodan", "url": "https://www.anchorterminal.com/compare/abuseipdb-vs-shodan" } ], "panel": null, "scores": [ { "abuseipdb": 75, "by": 37, "edge": "abuseipdb", "ipinfo": 38, "key": "reliability", "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "abuseipdb": 59, "by": 17, "edge": "ipinfo", "ipinfo": 76, "key": "schema", "name": "Schema \u0026 documentation", "weight": 13 }, { "abuseipdb": 74, "by": 10, "edge": "ipinfo", "ipinfo": 84, "key": "ergonomics", "name": "Agent ergonomics", "weight": 13 }, { "abuseipdb": 37, "by": 23, "edge": "ipinfo", "ipinfo": 60, "key": "security", "name": "Security \u0026 auth", "weight": 14 }, { "abuseipdb": 30, "by": 10, "edge": "ipinfo", "ipinfo": 40, "key": "payments", "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "abuseipdb": 38, "by": 47, "edge": "ipinfo", "ipinfo": 85, "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7 }, { "abuseipdb": 63, "by": 7, "edge": "ipinfo", "ipinfo": 70, "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "IPinfo scores 62.7 (B) on agent readiness against AbuseIPDB's 55.7 (C), and leads in 6 of 7 scored categories. AbuseIPDB leads on reliability. Both do secintel reputation.", "tasks": null, "tutorials": [], "verdicts": { "abuseipdb": "A free key allows 1,000 IP checks a day with published per-endpoint limits, rate-limit headers and a 99 per cent SLA in the terms, and the official MCP server is read-only. One key covers reads, reports and deletes, the key may travel in a query string, there is no OpenAPI document, and the terms bar redistribution of results.", "ipinfo": "A free Lite tier with no request cap, a public OpenAPI document, llms.txt, a batch endpoint of 1,000 lookups and a six-tool hosted MCP server with OAuth. No status page or SLA was found, the only documented error is 429, the token may travel in a query string, and city-level and privacy data need a paid plan." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/abuseipdb-vs-ipinfo", "json": "https://www.anchorterminal.com/compare/abuseipdb-vs-ipinfo.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/abuseipdb-vs-ipinfo.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/abuseipdb-vs-ipinfo.min.md" }, "markdown": "IPinfo scores 62.7 (B) on agent readiness against AbuseIPDB's 55.7 (C), and leads in 6 of 7 scored categories. AbuseIPDB leads on reliability. Both do secintel reputation.\n\n- AbuseIPDB: grade C, 55.7/100, rank #819 of 1349. Markdown https://www.anchorterminal.com/tools/abuseipdb.md · JSON https://www.anchorterminal.com/api/v1/tools/abuseipdb.json\n- IPinfo: grade B, 62.7/100, rank #464 of 1349. Markdown https://www.anchorterminal.com/tools/ipinfo.md · JSON https://www.anchorterminal.com/api/v1/tools/ipinfo.json\n- Best threat and security intelligence APIs for AI agents: https://www.anchorterminal.com/best/security-intelligence/index.md\n- All 33 security intel comparisons: https://www.anchorterminal.com/compare/security-intelligence/index.md\n\n## Which one, for what\n\n### AbuseIPDB (C)\n\nGood for: An agent that needs a quick reputation verdict on an IP or subnet, or wants to report abuse from its own logs, with a free daily quota large enough for one incident.\n\nAhead on:\n- Reliability, 75 against 38\n\nWatch for: No OpenAPI document, no API changelog (the blog's last post is from December 2018) and the reports endpoint is marked open beta and may change without notice\n\n### IPinfo (B)\n\nGood for: An agent that needs to enrich an IP with location, network and anonymiser flags at volume, free for country and ASN, paid for city and privacy signals.\n\nAhead on:\n- Schema \u0026 documentation, 76 against 59\n- Agent ergonomics, 84 against 74\n- Security \u0026 auth, 60 against 37\n- Payments \u0026 pricing, 40 against 30\n- Maintenance \u0026 community, 85 against 38\n- Transparency \u0026 trust, 70 against 63\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n\nWatch for: No status page, incident history or SLA was found; the terms supply the service as is\n\n\n## Why the edge\n\n### Maintenance \u0026 community: IPinfo +47\n\n- AbuseIPDB (38): Read as a closed service with an official MCP server. The newest dated change to the surface is the MCP server's v0.1.1 on 2 August 2026, 93 days before the check; the API docs and blog carry no later date (10 of 30). One release in the last 90 days, v0.1.1 fell just outside it (0 of 20). Support is a contact form with no guaranteed response on the free plan, there is no public changelog for the API, and the MCP repository shows a pull request merged on 2 August but GitHub's issue pages could not be read (5 of 15). The MCP server sits in the official registry under io.github.abuseipdb (15). The MCP package has CI on Python 3.11 to 3.14 with ruff, pytest and a packaging check, and a locked dependency set (8 of 10). 10 + 0 + 5 + 15 + 8 = 38.\n- IPinfo (85): Read as a closed service with an official MCP server and SDKs. MCP server v0.2.3 on 29 October 2026, a commit on 3 November, and SDK repositories pushed in October and November (30). Eight MCP releases since 8 September 2026, v0.1.12 to v0.2.3 (20). GitHub releases for the MCP server, a community forum, a help centre and a support form, but no changelog for the API and GitHub issue pages could not be read (10 of 15). The MCP server is in the official registry as io.github.ipinfo/mcp and the SDKs are official (15). The MCP package has tests, CI with pinned actions, CodeQL and Scorecard workflows and a lock file (10). 30 + 20 + 10 + 15 + 10 = 85.\n\n### Reliability: AbuseIPDB +37\n\n- AbuseIPDB (75): Read with the hosted lines. A status page on UptimeRobot is linked from every page's footer (20). Its monitors and 90-day history load by script and answered with an error on 3 November 2026, so no incident record could be read (5). Daily limits are published per endpoint and per plan, 1,000 checks a day on the free plan up to 50,000 on Premium (15). A 429 carries Retry-After, X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, and a repeated report of the same address with the same comment within 24 hours updates the earlier report instead of adding one (15). The terms carry a service level agreement with a 99 per cent monthly availability target and a refund as the sole remedy (10). API v2 is generally available, with only the reports endpoint in open beta (10). 20 + 5 + 15 + 15 + 10 + 10 = 75.\n- IPinfo (38): Read with the hosted lines. No status page was found; status.ipinfo.io does not resolve and the site, docs and llms.txt link none (0). No readable history (5). Limits are published with numbers, Lite unlimited, Core 150,000 and Max 250,000 requests a month, with no per-second cap (15). A 429 is documented in the OpenAPI document and the developer page for the monthly quota, and the MCP server maps it to RATE_LIMITED, but no Retry-After or backoff guidance was found; every call is a read (8 of 15). No SLA; the terms supply the service as is and as available (0). The API and the MCP server are generally available (10). 0 + 5 + 15 + 8 + 0 + 10 = 38.\n\n### Security \u0026 auth: IPinfo +23\n\n- AbuseIPDB (37): One API key per account with no scopes found, recommended in a Key header but also accepted as a query or form parameter per the docs (20 less 10 for the query string, so 10). The same key submits reports, bulk reports and clear-address deletes, with no read-only key; the official MCP server is read-only and its write-tool switch is inert (10 of 20). check and reports return reporter comments, which are public user-submitted text, and no guidance on treating them as untrusted was found (4 of 15). Paid plans include API log downloads for the last 24 to 120 hours and the pricing page lists the window per plan (10 of 15). security.txt returns 404, no disclosure policy, bug bounty or certification was found, and the MCP repository's SECURITY.md points to the vendor's support channels (3 of 20). 10 + 10 + 4 + 10 + 3 = 37.\n- IPinfo (60): One access token per account, accepted as a Bearer header, HTTP Basic or a token query parameter, with no scopes found; the hosted MCP server adds OAuth with short-lived tokens (20 less 10 for the query string, plus 4 for OAuth on the MCP server, so 14). Every endpoint is a read and tools return ACCESS_DENIED outside the plan, but there is no read-only or restricted token (16 of 20). Responses are structured network data rather than third-party free text (10 of 15). The dashboard shows request graphs and lookup history per the pricing page, with no per-call log documented (8 of 15). security.txt valid until 21 August 2027 with a PGP key, a SECURITY.md with 2-day acknowledgement and a 90-day disclosure window, no bug bounty or certification found beyond a bank-grade claim (12 of 20). 14 + 16 + 10 + 8 + 12 = 60.\n\n### Schema \u0026 documentation: IPinfo +17\n\n- AbuseIPDB (59): The surface graded is the REST API v2, with the official MCP server noted. No OpenAPI document was found. The MCP server's two tools carry JSON Schema inputs with range constraints from pydantic Field (8 of 25). llms.txt on abuseipdb.com describes the API, endpoints, categories and reporting rules (10). Each endpoint has a purpose statement and a parameter table, the FAQ explains scoring and decay, and the docs say to act on abuseConfidenceScore rather than isWhitelisted, with little on when not to call (14 of 20). Parameters give defaults and ranges (maxAgeInDays 1 to 365, perPage 1 to 100), usageType has a listed set of values and categories are numbered, but types are not stated and the categories default is ambiguous (10 of 15). Examples in cURL, Python, PHP, C# and VBScript for every endpoint, and errors follow the JSON API shape with 422, 429 and 402 examples (12 of 15). v2 is in the path, there is no API changelog, the blog's last post is from December 2018, and the reports endpoint may change without notice (5 of 15). 8 + 10 + 14 + 10 + 12 + 5 = 59.\n- IPinfo (76): The surface graded is the REST API, with the hosted MCP server noted. A public OpenAPI 3.0 document with 48 operations, and the MCP tools carry JSON Schema inputs (25). llms.txt and llms-full.txt, and every developer page is served as Markdown (10). Each tier page says what it returns and which plan unlocks it, and the MCP tool descriptions say which tiers each option needs, with little on when not to call (14 of 20). Schemas and examples on most responses, path parameters typed, but 401 is undocumented and some operations lack the 429 response (11 of 15). Examples in several languages on every page; only 429 is documented as an error, with no error body shape (9 of 15). A new API system since 2025 with the legacy one kept, but no public changelog, no version in the path and the OpenAPI document at 1.0.0 (7 of 15). 25 + 10 + 14 + 11 + 9 + 7 = 76.\n\n### Agent ergonomics: IPinfo +10\n\n- AbuseIPDB (74): check returns a compact record unless verbose is set, which adds the reports array, maxAgeInDays bounds the window, and blacklist takes a limit and a plaintext form (18 of 25). reports is paginated with page and perPage up to 100 and next and previous links, and blacklist filters by confidence, country and IP version, though check has no field selection (16 of 20). Errors carry a status and a detail an agent can act on, 429 names the daily limit and the headers say when it resets, and a 402 marks a plan limit on check-block (16 of 20). Every lookup is a GET, duplicate reports within 24 hours collapse, and both MCP tools are annotated readOnlyHint and idempotentHint (16 of 20). One required parameter per endpoint with sensible defaults. No official SDK beyond a Laravel package in the vendor's GitHub organisation and the Python MCP server (8 of 15). 18 + 16 + 16 + 16 + 8 = 74.\n- IPinfo (84): Field paths such as /country return one value, the Lite and lookup objects are small, and the MCP server has six compact tools with a per-session cache (23 of 25). Batch takes up to 1,000 lookups with filter=1 to drop empty results; no pagination is needed on single lookups, and ASN and range responses have no size control (16 of 20). The only documented error is 429; the MCP server returns coded errors with a message and a suggestion (12 of 20). Every call is a read, batch is a read over POST, and the MCP tools carry tool annotations (18 of 20). One parameter per call, sensible defaults and official SDKs in eleven languages (15). 23 + 16 + 12 + 18 + 15 = 84.\n\n### Payments \u0026 pricing: IPinfo +10\n\n- AbuseIPDB (30): No x402, MPP or L402 (0). Plan prices are public, $25 and $99 a month, sold by daily quota rather than per call (10). The Individual plan allows 1,000 checks a day with no card, and paid plans carry a 30-day trial (20). The key comes from the account page after a browser signup, and the terms forbid multiple accounts to raise quota, so no autonomous route (0). 0 + 10 + 20 + 0 = 30.\n- IPinfo (40): No x402, MPP or L402 (0). Plan prices and per-1,000 overage rates are public on the pricing page (20). Lite is free with no card and no request cap (20). The token comes from the dashboard after a browser signup, and no key API was found (0). 0 + 20 + 20 + 0 = 40.\n\n## Score by category\n\n| Category | Weight | AbuseIPDB | IPinfo | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 75 | 38 | AbuseIPDB +37 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 59 | 76 | IPinfo +17 |\n| Agent ergonomics | 13% (16.2 this run) | 74 | 84 | IPinfo +10 |\n| Security \u0026 auth | 14% (17.5 this run) | 37 | 60 | IPinfo +23 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 30 | 40 | IPinfo +10 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 38 | 85 | IPinfo +47 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 63 | 70 | IPinfo +7 |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **55.7 · C** | **62.7 · B** | |\n\n## Facts side by side\n\n| Fact | AbuseIPDB | IPinfo |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | AbuseIPDB LLC | IPinfo Inc. |\n| Hosted endpoint | no (local only) | `https://mcp.ipinfo.io/` |\n| Transports | stdio | Streamable HTTP, stdio |\n| Auth | API key | OAuth or key |\n| Pricing | Freemium | Freemium |\n| x402 | no | no |\n| Tools exposed | 2 | 6 |\n| Read-only variant documented | yes | yes |\n| llms.txt | yes | yes |\n| MCP registry | `io.github.abuseipdb/abuseipdb-mcp` | `io.github.ipinfo/mcp` |\n| Last release | 2026-08-02 | 2026-10-29 |\n| Terms last updated | no date given | 2024-06-03 |\n| Privacy policy last updated | no date given | 2026-10-29 |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | yes | yes |\n| Terms restrict benchmarking | not found in the text | not found in the text |\n| Terms or service can change without notice | yes | yes |\n| Arbitration or class-action waiver | yes | yes |\n| Popularity | 6 stars | 2 stars |\n\n## Verdicts\n\n**AbuseIPDB.** A free key allows 1,000 IP checks a day with published per-endpoint limits, rate-limit headers and a 99 per cent SLA in the terms, and the official MCP server is read-only. One key covers reads, reports and deletes, the key may travel in a query string, there is no OpenAPI document, and the terms bar redistribution of results.\n\n**IPinfo.** A free Lite tier with no request cap, a public OpenAPI document, llms.txt, a batch endpoint of 1,000 lookups and a six-tool hosted MCP server with OAuth. No status page or SLA was found, the only documented error is 429, the token may travel in a query string, and city-level and privacy data need a paid plan.\n\n## Before you call either\n\n### AbuseIPDB\n\n1. Send `Accept: application/json` and the key in the `Key` header; without the Accept header the API answers with an HTML page\n2. Act on `abuseConfidenceScore` rather than `isWhitelisted`, and pass `maxAgeInDays` to bound how old the reports can be (default 30, maximum 365)\n3. Watch `X-RateLimit-Remaining` per endpoint and on a 429 wait for `Retry-After`, which can be most of a day since limits reset at 00:00 UTC\n4. Use `check-block` for a subnet (up to /24 on the free plan) and `blacklist` with `confidenceMinimum` only on a paid plan; over-limit `limit` values are truncated silently\n5. Strip personal data from report comments, which are public, and prefer the read-only MCP server when the task never reports\n\n### IPinfo\n\n1. Call `https://api.ipinfo.io/lite/{ip}` with `Authorization: Bearer` on a free token; `/lookup/{ip}` and `detailed=true` in the MCP tools return ACCESS_DENIED without a paid plan\n2. Batch up to 1,000 addresses in one POST to `/batch/lite` or `/batch` with `filter=1`; each address counts as one request against the monthly quota\n3. Append a field path such as `/country` or `/asn` to get a single plain-text value instead of the full object\n4. On a 429 the monthly plan quota is spent; there is no Retry-After, so stop and report rather than retry\n5. Treat the data as licensed for internal use; selling or reselling it needs IPinfo's written consent under the terms\n\n## Questions\n\n### Which is better for AI agents, AbuseIPDB or IPinfo?\n\nIPinfo scores 62.7 (B) on agent readiness against AbuseIPDB's 55.7 (C), and leads in 6 of 7 scored categories. AbuseIPDB leads on reliability.\n\n### Do AbuseIPDB and IPinfo need an API key?\n\nAbuseIPDB needs an API key. IPinfo takes an API key or an OAuth sign-in.\n\n### Can an agent call AbuseIPDB and IPinfo without installing anything?\n\nAbuseIPDB runs on your own machine, with no hosted endpoint listed. IPinfo has a hosted endpoint at https://mcp.ipinfo.io/.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/abuseipdb-vs-ipinfo.json, and with the fewest tokens: https://www.anchorterminal.com/compare/abuseipdb-vs-ipinfo.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"abuseipdb\", \"b\": \"ipinfo\"}`. From a terminal: `anchor compare abuseipdb ipinfo`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/abuseipdb.json and https://www.anchorterminal.com/api/v1/tools/ipinfo.json\n\n## Other comparisons with AbuseIPDB or IPinfo\n\n- [AbuseIPDB vs Censys](https://www.anchorterminal.com/compare/abuseipdb-vs-censys.md)\n- [AbuseIPDB vs GreyNoise](https://www.anchorterminal.com/compare/abuseipdb-vs-greynoise.md)\n- [AbuseIPDB vs Pulsedive](https://www.anchorterminal.com/compare/abuseipdb-vs-pulsedive.md)\n- [AbuseIPDB vs VirusTotal](https://www.anchorterminal.com/compare/abuseipdb-vs-virustotal.md)\n- [AbuseIPDB vs WhoisXML API](https://www.anchorterminal.com/compare/abuseipdb-vs-whoisxml-api.md)\n- [GreyNoise vs IPinfo](https://www.anchorterminal.com/compare/greynoise-vs-ipinfo.md)\n- [IPinfo vs VirusTotal](https://www.anchorterminal.com/compare/ipinfo-vs-virustotal.md)\n- [Censys vs IPinfo](https://www.anchorterminal.com/compare/censys-vs-ipinfo.md)\n- [IPinfo vs Pulsedive](https://www.anchorterminal.com/compare/ipinfo-vs-pulsedive.md)\n- [IPinfo vs SecurityTrails](https://www.anchorterminal.com/compare/ipinfo-vs-securitytrails.md)\n- [IPinfo vs Shodan](https://www.anchorterminal.com/compare/ipinfo-vs-shodan.md)\n- [IPinfo vs WhoisXML API](https://www.anchorterminal.com/compare/ipinfo-vs-whoisxml-api.md)\n- [AbuseIPDB vs Shodan](https://www.anchorterminal.com/compare/abuseipdb-vs-shodan.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-04", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "AbuseIPDB vs IPinfo", "url": "" } ], "description": "IPinfo scores 62.7 (B) to AbuseIPDB's 55.7 (C) for secintel reputation. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "AbuseIPDB C 55.7", "IPinfo B 62.7", "scores" ], "h1": "AbuseIPDB vs IPinfo", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/abuseipdb-vs-ipinfo", "published": "2026-10-01", "section": "tools", "title": "AbuseIPDB vs IPinfo for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-03", "url": "https://www.anchorterminal.com/compare/abuseipdb-vs-ipinfo" }, "tokens": { "markdown": 4450, "slim": 2880 }, "version": 1 }