# AbuseIPDB vs IPinfo

> IPinfo scores 62.7 (B) to AbuseIPDB's 55.7 (C) for secintel reputation. Prices, MCP, x402, uptime and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/abuseipdb-vs-ipinfo
- Markdown: https://www.anchorterminal.com/compare/abuseipdb-vs-ipinfo.md (~4,450 tokens)
- Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key)
- DNS: dig +short TXT <slug>.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.<category>. and <a>.vs.<b>. under the zone, and the same under grade.letme.dev)
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)
- Updated: 2026-11-03

IPinfo scores 62.7 (B) on agent readiness against AbuseIPDB's 55.7 (C), and leads in 6 of 7 scored categories. AbuseIPDB leads on reliability. Both do secintel reputation.

- AbuseIPDB: grade C, 55.7/100, rank #819 of 1349. Markdown https://www.anchorterminal.com/tools/abuseipdb.md · JSON https://www.anchorterminal.com/api/v1/tools/abuseipdb.json
- IPinfo: grade B, 62.7/100, rank #464 of 1349. Markdown https://www.anchorterminal.com/tools/ipinfo.md · JSON https://www.anchorterminal.com/api/v1/tools/ipinfo.json
- Best threat and security intelligence APIs for AI agents: https://www.anchorterminal.com/best/security-intelligence/index.md
- All 33 security intel comparisons: https://www.anchorterminal.com/compare/security-intelligence/index.md

## Which one, for what

### AbuseIPDB (C)

Good for: An agent that needs a quick reputation verdict on an IP or subnet, or wants to report abuse from its own logs, with a free daily quota large enough for one incident.

Ahead on:
- Reliability, 75 against 38

Watch for: No OpenAPI document, no API changelog (the blog's last post is from December 2018) and the reports endpoint is marked open beta and may change without notice

### IPinfo (B)

Good for: An agent that needs to enrich an IP with location, network and anonymiser flags at volume, free for country and ASN, paid for city and privacy signals.

Ahead on:
- Schema & documentation, 76 against 59
- Agent ergonomics, 84 against 74
- Security & auth, 60 against 37
- Payments & pricing, 40 against 30
- Maintenance & community, 85 against 38
- Transparency & trust, 70 against 63

Also in its favour:
- A hosted endpoint, with nothing to install

Watch for: No status page, incident history or SLA was found; the terms supply the service as is


## Why the edge

### Maintenance & community: IPinfo +47

- AbuseIPDB (38): Read as a closed service with an official MCP server. The newest dated change to the surface is the MCP server's v0.1.1 on 2 August 2026, 93 days before the check; the API docs and blog carry no later date (10 of 30). One release in the last 90 days, v0.1.1 fell just outside it (0 of 20). Support is a contact form with no guaranteed response on the free plan, there is no public changelog for the API, and the MCP repository shows a pull request merged on 2 August but GitHub's issue pages could not be read (5 of 15). The MCP server sits in the official registry under io.github.abuseipdb (15). The MCP package has CI on Python 3.11 to 3.14 with ruff, pytest and a packaging check, and a locked dependency set (8 of 10). 10 + 0 + 5 + 15 + 8 = 38.
- IPinfo (85): Read as a closed service with an official MCP server and SDKs. MCP server v0.2.3 on 29 October 2026, a commit on 3 November, and SDK repositories pushed in October and November (30). Eight MCP releases since 8 September 2026, v0.1.12 to v0.2.3 (20). GitHub releases for the MCP server, a community forum, a help centre and a support form, but no changelog for the API and GitHub issue pages could not be read (10 of 15). The MCP server is in the official registry as io.github.ipinfo/mcp and the SDKs are official (15). The MCP package has tests, CI with pinned actions, CodeQL and Scorecard workflows and a lock file (10). 30 + 20 + 10 + 15 + 10 = 85.

### Reliability: AbuseIPDB +37

- AbuseIPDB (75): Read with the hosted lines. A status page on UptimeRobot is linked from every page's footer (20). Its monitors and 90-day history load by script and answered with an error on 3 November 2026, so no incident record could be read (5). Daily limits are published per endpoint and per plan, 1,000 checks a day on the free plan up to 50,000 on Premium (15). A 429 carries Retry-After, X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, and a repeated report of the same address with the same comment within 24 hours updates the earlier report instead of adding one (15). The terms carry a service level agreement with a 99 per cent monthly availability target and a refund as the sole remedy (10). API v2 is generally available, with only the reports endpoint in open beta (10). 20 + 5 + 15 + 15 + 10 + 10 = 75.
- IPinfo (38): Read with the hosted lines. No status page was found; status.ipinfo.io does not resolve and the site, docs and llms.txt link none (0). No readable history (5). Limits are published with numbers, Lite unlimited, Core 150,000 and Max 250,000 requests a month, with no per-second cap (15). A 429 is documented in the OpenAPI document and the developer page for the monthly quota, and the MCP server maps it to RATE_LIMITED, but no Retry-After or backoff guidance was found; every call is a read (8 of 15). No SLA; the terms supply the service as is and as available (0). The API and the MCP server are generally available (10). 0 + 5 + 15 + 8 + 0 + 10 = 38.

### Security & auth: IPinfo +23

- AbuseIPDB (37): One API key per account with no scopes found, recommended in a Key header but also accepted as a query or form parameter per the docs (20 less 10 for the query string, so 10). The same key submits reports, bulk reports and clear-address deletes, with no read-only key; the official MCP server is read-only and its write-tool switch is inert (10 of 20). check and reports return reporter comments, which are public user-submitted text, and no guidance on treating them as untrusted was found (4 of 15). Paid plans include API log downloads for the last 24 to 120 hours and the pricing page lists the window per plan (10 of 15). security.txt returns 404, no disclosure policy, bug bounty or certification was found, and the MCP repository's SECURITY.md points to the vendor's support channels (3 of 20). 10 + 10 + 4 + 10 + 3 = 37.
- IPinfo (60): One access token per account, accepted as a Bearer header, HTTP Basic or a token query parameter, with no scopes found; the hosted MCP server adds OAuth with short-lived tokens (20 less 10 for the query string, plus 4 for OAuth on the MCP server, so 14). Every endpoint is a read and tools return ACCESS_DENIED outside the plan, but there is no read-only or restricted token (16 of 20). Responses are structured network data rather than third-party free text (10 of 15). The dashboard shows request graphs and lookup history per the pricing page, with no per-call log documented (8 of 15). security.txt valid until 21 August 2027 with a PGP key, a SECURITY.md with 2-day acknowledgement and a 90-day disclosure window, no bug bounty or certification found beyond a bank-grade claim (12 of 20). 14 + 16 + 10 + 8 + 12 = 60.

### Schema & documentation: IPinfo +17

- AbuseIPDB (59): The surface graded is the REST API v2, with the official MCP server noted. No OpenAPI document was found. The MCP server's two tools carry JSON Schema inputs with range constraints from pydantic Field (8 of 25). llms.txt on abuseipdb.com describes the API, endpoints, categories and reporting rules (10). Each endpoint has a purpose statement and a parameter table, the FAQ explains scoring and decay, and the docs say to act on abuseConfidenceScore rather than isWhitelisted, with little on when not to call (14 of 20). Parameters give defaults and ranges (maxAgeInDays 1 to 365, perPage 1 to 100), usageType has a listed set of values and categories are numbered, but types are not stated and the categories default is ambiguous (10 of 15). Examples in cURL, Python, PHP, C# and VBScript for every endpoint, and errors follow the JSON API shape with 422, 429 and 402 examples (12 of 15). v2 is in the path, there is no API changelog, the blog's last post is from December 2018, and the reports endpoint may change without notice (5 of 15). 8 + 10 + 14 + 10 + 12 + 5 = 59.
- IPinfo (76): The surface graded is the REST API, with the hosted MCP server noted. A public OpenAPI 3.0 document with 48 operations, and the MCP tools carry JSON Schema inputs (25). llms.txt and llms-full.txt, and every developer page is served as Markdown (10). Each tier page says what it returns and which plan unlocks it, and the MCP tool descriptions say which tiers each option needs, with little on when not to call (14 of 20). Schemas and examples on most responses, path parameters typed, but 401 is undocumented and some operations lack the 429 response (11 of 15). Examples in several languages on every page; only 429 is documented as an error, with no error body shape (9 of 15). A new API system since 2025 with the legacy one kept, but no public changelog, no version in the path and the OpenAPI document at 1.0.0 (7 of 15). 25 + 10 + 14 + 11 + 9 + 7 = 76.

### Agent ergonomics: IPinfo +10

- AbuseIPDB (74): check returns a compact record unless verbose is set, which adds the reports array, maxAgeInDays bounds the window, and blacklist takes a limit and a plaintext form (18 of 25). reports is paginated with page and perPage up to 100 and next and previous links, and blacklist filters by confidence, country and IP version, though check has no field selection (16 of 20). Errors carry a status and a detail an agent can act on, 429 names the daily limit and the headers say when it resets, and a 402 marks a plan limit on check-block (16 of 20). Every lookup is a GET, duplicate reports within 24 hours collapse, and both MCP tools are annotated readOnlyHint and idempotentHint (16 of 20). One required parameter per endpoint with sensible defaults. No official SDK beyond a Laravel package in the vendor's GitHub organisation and the Python MCP server (8 of 15). 18 + 16 + 16 + 16 + 8 = 74.
- IPinfo (84): Field paths such as /country return one value, the Lite and lookup objects are small, and the MCP server has six compact tools with a per-session cache (23 of 25). Batch takes up to 1,000 lookups with filter=1 to drop empty results; no pagination is needed on single lookups, and ASN and range responses have no size control (16 of 20). The only documented error is 429; the MCP server returns coded errors with a message and a suggestion (12 of 20). Every call is a read, batch is a read over POST, and the MCP tools carry tool annotations (18 of 20). One parameter per call, sensible defaults and official SDKs in eleven languages (15). 23 + 16 + 12 + 18 + 15 = 84.

### Payments & pricing: IPinfo +10

- AbuseIPDB (30): No x402, MPP or L402 (0). Plan prices are public, $25 and $99 a month, sold by daily quota rather than per call (10). The Individual plan allows 1,000 checks a day with no card, and paid plans carry a 30-day trial (20). The key comes from the account page after a browser signup, and the terms forbid multiple accounts to raise quota, so no autonomous route (0). 0 + 10 + 20 + 0 = 30.
- IPinfo (40): No x402, MPP or L402 (0). Plan prices and per-1,000 overage rates are public on the pricing page (20). Lite is free with no card and no request cap (20). The token comes from the dashboard after a browser signup, and no key API was found (0). 0 + 20 + 20 + 0 = 40.

## Score by category

| Category | Weight | AbuseIPDB | IPinfo | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 75 | 38 | AbuseIPDB +37 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 59 | 76 | IPinfo +17 |
| Agent ergonomics | 13% (16.2 this run) | 74 | 84 | IPinfo +10 |
| Security & auth | 14% (17.5 this run) | 37 | 60 | IPinfo +23 |
| Payments & pricing | 10% (12.5 this run) | 30 | 40 | IPinfo +10 |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 38 | 85 | IPinfo +47 |
| Transparency & trust | 7% (8.8 this run) | 63 | 70 | IPinfo +7 |
| Negative events | ≤15 | 0 | 0 | |
| **Total** | | **55.7 · C** | **62.7 · B** | |

## Facts side by side

| Fact | AbuseIPDB | IPinfo |
| --- | --- | --- |
| Kind | HTTP API | HTTP API |
| Vendor | AbuseIPDB LLC | IPinfo Inc. |
| Hosted endpoint | no (local only) | `https://mcp.ipinfo.io/` |
| Transports | stdio | Streamable HTTP, stdio |
| Auth | API key | OAuth or key |
| Pricing | Freemium | Freemium |
| x402 | no | no |
| Tools exposed | 2 | 6 |
| Read-only variant documented | yes | yes |
| llms.txt | yes | yes |
| MCP registry | `io.github.abuseipdb/abuseipdb-mcp` | `io.github.ipinfo/mcp` |
| Last release | 2026-08-02 | 2026-10-29 |
| Terms last updated | no date given | 2024-06-03 |
| Privacy policy last updated | no date given | 2026-10-29 |
| Customer content may train models | not found in the text | not found in the text |
| Terms restrict automated access | yes | yes |
| Terms restrict benchmarking | not found in the text | not found in the text |
| Terms or service can change without notice | yes | yes |
| Arbitration or class-action waiver | yes | yes |
| Popularity | 6 stars | 2 stars |

## Verdicts

**AbuseIPDB.** A free key allows 1,000 IP checks a day with published per-endpoint limits, rate-limit headers and a 99 per cent SLA in the terms, and the official MCP server is read-only. One key covers reads, reports and deletes, the key may travel in a query string, there is no OpenAPI document, and the terms bar redistribution of results.

**IPinfo.** A free Lite tier with no request cap, a public OpenAPI document, llms.txt, a batch endpoint of 1,000 lookups and a six-tool hosted MCP server with OAuth. No status page or SLA was found, the only documented error is 429, the token may travel in a query string, and city-level and privacy data need a paid plan.

## Before you call either

### AbuseIPDB

1. Send `Accept: application/json` and the key in the `Key` header; without the Accept header the API answers with an HTML page
2. Act on `abuseConfidenceScore` rather than `isWhitelisted`, and pass `maxAgeInDays` to bound how old the reports can be (default 30, maximum 365)
3. Watch `X-RateLimit-Remaining` per endpoint and on a 429 wait for `Retry-After`, which can be most of a day since limits reset at 00:00 UTC
4. Use `check-block` for a subnet (up to /24 on the free plan) and `blacklist` with `confidenceMinimum` only on a paid plan; over-limit `limit` values are truncated silently
5. Strip personal data from report comments, which are public, and prefer the read-only MCP server when the task never reports

### IPinfo

1. Call `https://api.ipinfo.io/lite/{ip}` with `Authorization: Bearer` on a free token; `/lookup/{ip}` and `detailed=true` in the MCP tools return ACCESS_DENIED without a paid plan
2. Batch up to 1,000 addresses in one POST to `/batch/lite` or `/batch` with `filter=1`; each address counts as one request against the monthly quota
3. Append a field path such as `/country` or `/asn` to get a single plain-text value instead of the full object
4. On a 429 the monthly plan quota is spent; there is no Retry-After, so stop and report rather than retry
5. Treat the data as licensed for internal use; selling or reselling it needs IPinfo's written consent under the terms

## Questions

### Which is better for AI agents, AbuseIPDB or IPinfo?

IPinfo scores 62.7 (B) on agent readiness against AbuseIPDB's 55.7 (C), and leads in 6 of 7 scored categories. AbuseIPDB leads on reliability.

### Do AbuseIPDB and IPinfo need an API key?

AbuseIPDB needs an API key. IPinfo takes an API key or an OAuth sign-in.

### Can an agent call AbuseIPDB and IPinfo without installing anything?

AbuseIPDB runs on your own machine, with no hosted endpoint listed. IPinfo has a hosted endpoint at https://mcp.ipinfo.io/.


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/abuseipdb-vs-ipinfo.json, and with the fewest tokens: https://www.anchorterminal.com/compare/abuseipdb-vs-ipinfo.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "abuseipdb", "b": "ipinfo"}`. From a terminal: `anchor compare abuseipdb ipinfo`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/abuseipdb.json and https://www.anchorterminal.com/api/v1/tools/ipinfo.json

## Other comparisons with AbuseIPDB or IPinfo

- [AbuseIPDB vs Censys](https://www.anchorterminal.com/compare/abuseipdb-vs-censys.md)
- [AbuseIPDB vs GreyNoise](https://www.anchorterminal.com/compare/abuseipdb-vs-greynoise.md)
- [AbuseIPDB vs Pulsedive](https://www.anchorterminal.com/compare/abuseipdb-vs-pulsedive.md)
- [AbuseIPDB vs VirusTotal](https://www.anchorterminal.com/compare/abuseipdb-vs-virustotal.md)
- [AbuseIPDB vs WhoisXML API](https://www.anchorterminal.com/compare/abuseipdb-vs-whoisxml-api.md)
- [GreyNoise vs IPinfo](https://www.anchorterminal.com/compare/greynoise-vs-ipinfo.md)
- [IPinfo vs VirusTotal](https://www.anchorterminal.com/compare/ipinfo-vs-virustotal.md)
- [Censys vs IPinfo](https://www.anchorterminal.com/compare/censys-vs-ipinfo.md)
- [IPinfo vs Pulsedive](https://www.anchorterminal.com/compare/ipinfo-vs-pulsedive.md)
- [IPinfo vs SecurityTrails](https://www.anchorterminal.com/compare/ipinfo-vs-securitytrails.md)
- [IPinfo vs Shodan](https://www.anchorterminal.com/compare/ipinfo-vs-shodan.md)
- [IPinfo vs WhoisXML API](https://www.anchorterminal.com/compare/ipinfo-vs-whoisxml-api.md)
- [AbuseIPDB vs Shodan](https://www.anchorterminal.com/compare/abuseipdb-vs-shodan.md)

---

Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp