{ "data": { "a": { "slug": "abuseipdb", "name": "AbuseIPDB", "vendor": "AbuseIPDB LLC", "vendorUrl": "https://www.abuseipdb.com", "kind": "http-api", "category": "security-intelligence", "summary": "AbuseIPDB is a crowdsourced database of IP addresses reported for abuse, run by AbuseIPDB LLC under Marathon Studios. Its API v2 returns an abuse confidence score and report history for an address, a subnet or a blacklist, and takes reports.", "url": "https://www.anchorterminal.com/tools/abuseipdb", "markdownUrl": "https://www.anchorterminal.com/tools/abuseipdb.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/abuseipdb.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/abuseipdb.json", "dns": "abuseipdb.grade.anchorterminal.com", "repo": "https://github.com/AbuseIPDB/abuseipdb-mcp", "transports": [ "stdio" ], "packages": [ { "registry": "pypi", "name": "mcp-server-abuseipdb" } ], "auth": "api-key", "authNotes": "API key from the account page after a browser signup, sent in a `Key` header. The docs also accept the key as a lowercase `key` query or form parameter. No scopes were found. The official MCP server reads the key from `ABUSEIPDB_API_KEY` and is read-only.", "pricing": "freemium", "pricingNotes": "Free Individual plan with 1,000 checks and 1,000 reports a day, 100 block checks, a 10,000-address blacklist and no card. Basic $25 a month (10,000 checks a day) and Premium $99 a month (50,000 a day), each with a 30-day trial. Enterprise by contact. Free plans are for evaluation, contributing reports or non-commercial personal projects under the terms.", "priceSummary": "$25 / mo", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the API docs, the pricing page or the MCP server repository (checked 2026-11-03). Plan limits exceeded on check-block return 402 Payment Required with a plain error, not payment requirements.", "endpoints": [] }, "toolCount": 2, "popularity": { "githubStars": 6, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-03" }, "docsUrl": "https://docs.abuseipdb.com/", "llmsTxt": "https://www.abuseipdb.com/llms.txt", "registryName": "io.github.abuseipdb/abuseipdb-mcp", "capabilities": [ "secintel.reputation", "secintel.indicators", "secintel.ip-enrichment" ], "tags": [ "hosted", "freemium", "no-card", "free-tier", "api-key", "mcp", "official", "mcp-registry", "stdio", "read-only-mode", "llms-txt", "sla", "status-page", "python", "closed-source" ], "lastRelease": "2026-08-02", "graded": true, "anchor": { "graded": true, "score": 55.7, "grade": "C", "agentReady": false, "rank": 819, "ranked": true, "rankOf": 1349, "categoryRank": 6, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 74, "maintenance": 38, "payments": 30, "reliability": 75, "schema": 59, "security": 37, "transparency": 63 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-03" }, "negative": 0, "verdict": "A free key allows 1,000 IP checks a day with published per-endpoint limits, rate-limit headers and a 99 per cent SLA in the terms, and the official MCP server is read-only. One key covers reads, reports and deletes, the key may travel in a query string, there is no OpenAPI document, and the terms bar redistribution of results.", "bestFor": "An agent that needs a quick reputation verdict on an IP or subnet, or wants to report abuse from its own logs, with a free daily quota large enough for one incident.", "strengths": [ "1,000 checks and 1,000 reports a day on a free key with no card, and daily limits published for every endpoint and plan", "429 responses carry Retry-After and X-RateLimit headers, and errors follow the JSON API shape with a status and detail", "The terms include a service level agreement with a 99 per cent monthly availability target", "The first-party MCP server has two read-only tools annotated readOnlyHint and idempotentHint, with per-item errors in bulk checks", "llms.txt on abuseipdb.com describes the API, categories and reporting rules for agents" ], "weaknesses": [ "No OpenAPI document, no API changelog (the blog's last post is from December 2018) and the reports endpoint is marked open beta and may change without notice", "One key per account reaches reads, reports, bulk reports and clear-address deletes, and the docs accept it as a query parameter", "No security.txt, disclosure policy or certification found, and the status page's incident history could not be read", "The terms bar reproducing, copying or reselling any portion of the service and its data, and free plans exclude commercial use", "The privacy policy of 15 March 2023 gives no retention periods and marks every provider's GDPR status as in process" ], "agentNotes": [ "Send `Accept: application/json` and the key in the `Key` header; without the Accept header the API answers with an HTML page", "Act on `abuseConfidenceScore` rather than `isWhitelisted`, and pass `maxAgeInDays` to bound how old the reports can be (default 30, maximum 365)", "Watch `X-RateLimit-Remaining` per endpoint and on a 429 wait for `Retry-After`, which can be most of a day since limits reset at 00:00 UTC", "Use `check-block` for a subnet (up to /24 on the free plan) and `blacklist` with `confidenceMinimum` only on a paid plan; over-limit `limit` values are truncated silently", "Strip personal data from report comments, which are public, and prefer the read-only MCP server when the task never reports" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 55.7 } ], "editorialScores": { "ergonomics": 74, "maintenance": 38, "payments": 30, "reliability": 75, "schema": 59, "security": 37, "transparency": 42 }, "provenanceScore": 84, "checked": { "categories": { "ergonomics": "2026-11-03", "maintenance": "2026-11-03", "payments": "2026-11-03", "reliability": "2026-11-03", "schema": "2026-11-03", "security": "2026-11-03", "transparency": "2026-11-03" }, "last": "2026-11-03", "oldest": "2026-11-03", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "uvx mcp-server-abuseipdb", "http": "curl -G https://api.abuseipdb.com/api/v2/check --data-urlencode \"ipAddress=118.25.6.39\" -d maxAgeInDays=90 -H \"Key: $ABUSEIPDB_API_KEY\" -H \"Accept: application/json\"", "claudeCode": "claude mcp add abuseipdb -e ABUSEIPDB_API_KEY=YOUR_KEY -- uvx mcp-server-abuseipdb", "config": { "mcpServers": { "abuseipdb": { "args": [ "mcp-server-abuseipdb" ], "command": "uvx", "env": { "ABUSEIPDB_API_KEY": "${ABUSEIPDB_API_KEY}" } } } } }, "letme": { "capability": "https://letme.dev/secintel.reputation", "tool": "https://letme.dev/abuseipdb" }, "area": "developer", "unitPrices": [ { "item": "Basic, 10,000 checks a day", "unit": "month", "usd": 25, "note": "$228 a year" }, { "item": "Premium, 50,000 checks a day", "unit": "month", "usd": 99, "note": "$1,068 a year" } ], "provenance": { "legalEntity": "AbuseIPDB LLC", "domain": "abuseipdb.com", "domainRegistered": "2010-04-06", "endpointOnVendorDomain": true, "terms": "https://www.abuseipdb.com/legal", "privacy": "https://www.abuseipdb.com/privacy", "statusPage": "https://status.abuseipdb.com/", "changelog": "https://github.com/AbuseIPDB/abuseipdb-mcp/blob/main/CHANGELOG.md", "securityTxt": "none", "checked": "2026-11-03", "notes": [ "The terms of use and privacy policy, both last updated 15 March 2023, name AbuseIPDB LLC, a Pennsylvania limited liability company, under Pennsylvania law with arbitration in Philadelphia. The about page says the project is managed by Marathon Studios Inc.", "Section 3 of the terms forbids accessing the website by automated means other than search engines that follow robots.txt and authorised API use. Public pages were read for this listing and the clause is recorded as a fact.", "www.abuseipdb.com/robots.txt disallows /account and /enterprise/ for all crawlers with a crawl delay of 2; neither path was fetched. docs.abuseipdb.com has no robots.txt.", "The changelog link is the MCP server's. No changelog for the REST API was found; the blog's newest post is dated 13 December 2018.", "status.abuseipdb.com is an UptimeRobot page linked from the footer. Its monitors and history load by script and answered with an error when read on 3 November 2026.", "www.abuseipdb.com/.well-known/security.txt returns 404. RDAP at Verisign gives a registration date of 6 April 2010." ], "score": 84 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/abuseipdb.json", "live": { "slug": "abuseipdb", "vendorStatus": { "page": "https://status.abuseipdb.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-04T15:31:19.057306817Z" }, "versions": [ { "registry": "pypi", "name": "mcp-server-abuseipdb", "version": "0.1.1", "released": "2026-08-03", "seenAt": "2026-11-04T19:54:02.081091414Z" } ], "githubStars": 6, "pypiWeekly": 38, "securityTxt": { "url": "https://abuseipdb.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-04T15:53:21.604779568Z" }, "updatedAt": "2026-11-04T19:54:02.294565318Z" } }, "answer": "AbuseIPDB scores 55.7 (C) on agent readiness against Pulsedive's 47.9 (D), and leads in 4 of 7 scored categories. Pulsedive leads on schema \u0026 documentation and payments \u0026 pricing.", "b": { "slug": "pulsedive", "name": "Pulsedive", "vendor": "Pulsedive LLC", "vendorUrl": "https://pulsedive.com", "kind": "http-api", "category": "security-intelligence", "summary": "Pulsedive is a threat intelligence platform from Pulsedive LLC in New Jersey. Its API looks up domains, IP addresses and URLs for risk scores, linked threats and feeds, scans new indicators on demand and exports STIX over TAXII 2.1.", "url": "https://www.anchorterminal.com/tools/pulsedive", "markdownUrl": "https://www.anchorterminal.com/tools/pulsedive.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/pulsedive.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/pulsedive.json", "dns": "pulsedive.grade.anchorterminal.com", "transports": [], "packages": [], "auth": "api-key", "authNotes": "API key from the account page after a free browser signup, sent only as a `key` query parameter. Requests without a key are accepted at a much lower limit (10 a day and 100 a month per the March 2024 plan post). No scopes, rotation or header option was found. The TAXII server takes the key by HTTP Basic or query parameter.", "pricing": "freemium", "pricingNotes": "Free registered account, no card, 50 API requests a day and 500 a month per the March 2024 plan post. Pro $29 a month (250 a day, 2,500 a month) per the site menu and that post, which also gave Team API $300 a month for 25,000 requests and Business API $900 a month for 100,000 with soft limits, Custom by contact, and feed subscriptions from $1,500 to $3,000 a month. The current pricing pages render by script, so the 2024 figures for Team and Business are the latest read.", "priceSummary": "$29 / mo", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs, the OpenAPI files, the terms or the plan posts (checked 2026-11-03). A spent quota answers 429 with an error string that points to the plan page.", "endpoints": [] }, "toolCount": 0, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-03" }, "docsUrl": "https://docs.pulsedive.com/", "llmsTxt": "https://docs.pulsedive.com/llms.txt", "openapi": "https://docs.pulsedive.com/api/indicator/indicator-by-value.yaml", "capabilities": [ "secintel.indicators", "secintel.reputation", "secintel.dns", "secintel.ip-enrichment" ], "tags": [ "hosted", "freemium", "no-card", "free-tier", "no-auth", "api-key", "llms-txt", "openapi", "async-jobs", "closed-source", "no-status-page" ], "lastRelease": "2026-10-27", "graded": true, "anchor": { "graded": true, "score": 47.9, "grade": "D", "agentReady": false, "rank": 1079, "ranked": true, "rankOf": 1349, "categoryRank": 7, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 64, "maintenance": 40, "payments": 50, "reliability": 31, "schema": 77, "security": 23, "transparency": 57 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-03" }, "negative": 0, "verdict": "Lookups work with no key at all, a free account allows 50 requests a day, and the docs ship llms.txt, per-endpoint OpenAPI files and timestamps for every scan. The key travels only in the query string, numeric limits live in a 2024 blog post rather than the docs, and there is no status page, SLA, security.txt or official SDK.", "bestFor": "An agent that needs a quick risk verdict and linked threats for a domain, IP or URL with no signup, or a passive scan of a new indicator.", "strengths": [ "Keyless lookups and a free account with no card (50 requests a day, 500 a month per the March 2024 plan post)", "llms.txt, Markdown docs, eleven OpenAPI 3.0.3 files and a docs MCP server, all published in March 2026", "Every indicator carries stamp_seen, stamp_probed and stamp_updated, and scans can run passively or actively without storing the result", "Three X-Requests-Remaining headers on every response and a documented error table for 400, 401, 404, 429 and 500", "Explore returns JSON, CSV or STIX 2.1, and feeds and threats page through linked indicators" ], "weaknesses": [ "The key is sent only as a query parameter, with no header option, scopes or rotation documented", "No status page, SLA, security.txt, disclosure policy or certification was found", "The docs give no numeric rate limits and no Retry-After; the numbers come from the vendor's plan post of 11 March 2024", "No official SDK (community Python, Go, Ruby and PowerShell clients), no API version and no changelog", "The terms bar copying, selling, licensing or distributing content from the service and any automated process against it" ], "agentNotes": [ "Call `indicator.php?indicator=\u003cvalue\u003e\u0026pretty=1\u0026key=...`; without a key the limit is about 10 requests a day, so register for 50", "Read `risk`, `risk_recommended` and `stamp_probed` together; an old `stamp_probed` means the scan data may be stale, so queue a scan with `analyze.php` (`probe=0` passive, `submit=0` to avoid storing)", "Poll `analyze.php?qid=` no more than every 500 ms; polling does not count against the quota, but each page of linked indicators does", "Treat a 429 as the day's or month's quota spent and stop; there is no Retry-After, and explore searches above the plan's row limit also return 429", "Expect user comments, banners and DOM snippets in indicator properties, which are third-party content" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 47.9 } ], "editorialScores": { "ergonomics": 64, "maintenance": 40, "payments": 50, "reliability": 31, "schema": 77, "security": 23, "transparency": 50 }, "provenanceScore": 64, "checked": { "categories": { "ergonomics": "2026-11-03", "maintenance": "2026-11-03", "payments": "2026-11-03", "reliability": "2026-11-03", "schema": "2026-11-03", "security": "2026-11-03", "transparency": "2026-11-03" }, "last": "2026-11-03", "oldest": "2026-11-03", "stale": false, "staleAfterDays": 90 } }, "connect": { "http": "curl \"https://pulsedive.com/api/indicator.php?indicator=example.com\u0026pretty=1\u0026key=$PULSEDIVE_API_KEY\"", "claudeCode": "claude mcp add --transport http pulsedive-docs https://docs.pulsedive.com/mcp" }, "letme": { "capability": "https://letme.dev/secintel.indicators", "tool": "https://letme.dev/pulsedive" }, "area": "developer", "unitPrices": [ { "item": "Pro, 250 requests a day", "unit": "month", "usd": 29, "note": "$348 a year; limits per the plan post of 11 March 2024" }, { "item": "Team API, 25,000 requests a month", "unit": "month", "usd": 300, "note": "$3,000 a year, per the plan post of 11 March 2024" }, { "item": "Business API, 100,000 requests a month", "unit": "month", "usd": 900, "note": "$9,000 a year, soft limit, per the plan post of 11 March 2024" } ], "provenance": { "legalEntity": "Pulsedive LLC", "domain": "pulsedive.com", "domainRegistered": "2016-11-11", "endpointOnVendorDomain": true, "terms": "https://pulsedive.com/terms", "privacy": "https://pulsedive.com/privacy", "statusPage": "", "changelog": "", "securityTxt": "none", "checked": "2026-11-03", "notes": [ "The terms, last updated 2 May 2022, name Pulsedive LLC under New Jersey law. The privacy policy, last updated 28 August 2024, gives no postal address. The site footer reads Pulsedive LLC.", "The terms forbid any robot, spider or other automatic process to access the services. Public pages and the docs were read for this listing and the clause is recorded as a fact.", "pulsedive.com/robots.txt allows all. docs.pulsedive.com/robots.txt allows all but /cdn-cgi/ and /_next/ and carries Content-Signal ai-train=yes, search=yes, ai-input=yes.", "No status page was found on the site, the docs, the support page or in search. No changelog was found; the blog carries product posts and the footer a version number.", "pulsedive.com/.well-known/security.txt returns 404. RDAP at Verisign gives a registration date of 11 November 2016." ], "score": 64 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/pulsedive.json", "live": { "slug": "pulsedive", "securityTxt": { "url": "https://pulsedive.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-04T15:54:46.13864767Z" }, "updatedAt": "2026-11-04T15:54:46.13864767Z" } }, "edges": [ { "by": 44, "category": "reliability", "leads": "abuseipdb", "name": "Reliability", "reasons": { "a": "Read with the hosted lines. A status page on UptimeRobot is linked from every page's footer (20). Its monitors and 90-day history load by script and answered with an error on 3 November 2026, so no incident record could be read (5). Daily limits are published per endpoint and per plan, 1,000 checks a day on the free plan up to 50,000 on Premium (15). A 429 carries Retry-After, X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, and a repeated report of the same address with the same comment within 24 hours updates the earlier report instead of adding one (15). The terms carry a service level agreement with a 99 per cent monthly availability target and a refund as the sole remedy (10). API v2 is generally available, with only the reports endpoint in open beta (10). 20 + 5 + 15 + 15 + 10 + 10 = 75.", "b": "Read with the hosted lines. No status page was found on the site, the docs, the support page or in search (0). No readable history (5). The limits page names Free, Pro, Commercial and Enterprise tiers and three remaining-request headers but gives no numbers, pointing to the account page; the vendor's plan post of 11 March 2024 gives 50 a day on Free and 250 on Pro (8 of 15). A 429 returns a JSON error naming the limit and the headers show what remains, with no Retry-After or backoff guidance; scans are safe to repeat and polling is free (8 of 15). No SLA; the terms supply the services as is and as available (0). The API is generally available (10). 0 + 5 + 8 + 8 + 0 + 10 = 31." }, "scores": { "a": 75, "b": 31 } }, { "by": 20, "category": "payments", "leads": "pulsedive", "name": "Payments \u0026 pricing", "reasons": { "a": "No x402, MPP or L402 (0). Plan prices are public, $25 and $99 a month, sold by daily quota rather than per call (10). The Individual plan allows 1,000 checks a day with no card, and paid plans carry a 30-day trial (20). The key comes from the account page after a browser signup, and the terms forbid multiple accounts to raise quota, so no autonomous route (0). 0 + 10 + 20 + 0 = 30.", "b": "No x402, MPP or L402 (0). Pro $29 a month is on the site menu and the Team and Business API prices are in the vendor's plan post of 11 March 2024, sold as monthly quotas rather than per call (10). A free account needs no card (20). Requests without a key are accepted, so an agent can look up an indicator with no signup at about 10 a day (20). 0 + 10 + 20 + 20 = 50." }, "scores": { "a": 30, "b": 50 } }, { "by": 18, "category": "schema", "leads": "pulsedive", "name": "Schema \u0026 documentation", "reasons": { "a": "The surface graded is the REST API v2, with the official MCP server noted. No OpenAPI document was found. The MCP server's two tools carry JSON Schema inputs with range constraints from pydantic Field (8 of 25). llms.txt on abuseipdb.com describes the API, endpoints, categories and reporting rules (10). Each endpoint has a purpose statement and a parameter table, the FAQ explains scoring and decay, and the docs say to act on abuseConfidenceScore rather than isWhitelisted, with little on when not to call (14 of 20). Parameters give defaults and ranges (maxAgeInDays 1 to 365, perPage 1 to 100), usageType has a listed set of values and categories are numbered, but types are not stated and the categories default is ambiguous (10 of 15). Examples in cURL, Python, PHP, C# and VBScript for every endpoint, and errors follow the JSON API shape with 422, 429 and 402 examples (12 of 15). v2 is in the path, there is no API changelog, the blog's last post is from December 2018, and the reports endpoint may change without notice (5 of 15). 8 + 10 + 14 + 10 + 12 + 5 = 59.", "b": "OpenAPI 3.0.3 documents for every endpoint, eleven YAML files under Apache 2.0, with typed parameters and response schemas, though split per endpoint and without a securitySchemes block in the scan and explore file (22 of 25). llms.txt and a Markdown twin of every page, plus a docs MCP server (10). Each endpoint states its purpose, probe and submit are explained with their side effects, and the collection page says what each timestamp means, with little on when not to call (15 of 20). Enumerated 0 or 1 flags, required parameters marked, risk and type enums, but key is optional while 401 describes it missing, and explore summaries allow types the indicator schema does not (11 of 15). curl examples on every page and an error table for 400, 401, 404, 429 and 500 with an example body (12 of 15). No API version or changelog; the docs launch post of 30 March 2026 and a footer version number are the only dated changes, and the spec marks the recent field deprecated with no date (7 of 15). 22 + 10 + 15 + 11 + 12 + 7 = 77." }, "scores": { "a": 59, "b": 77 } }, { "by": 14, "category": "security", "leads": "abuseipdb", "name": "Security \u0026 auth", "reasons": { "a": "One API key per account with no scopes found, recommended in a Key header but also accepted as a query or form parameter per the docs (20 less 10 for the query string, so 10). The same key submits reports, bulk reports and clear-address deletes, with no read-only key; the official MCP server is read-only and its write-tool switch is inert (10 of 20). check and reports return reporter comments, which are public user-submitted text, and no guidance on treating them as untrusted was found (4 of 15). Paid plans include API log downloads for the last 24 to 120 hours and the pricing page lists the window per plan (10 of 15). security.txt returns 404, no disclosure policy, bug bounty or certification was found, and the MCP repository's SECURITY.md points to the vendor's support channels (3 of 20). 10 + 10 + 4 + 10 + 3 = 37.", "b": "One key per account sent only as a query parameter, with no scopes, header option or rotation documented (10 for one all-powerful key less 10 for the query string, so 0). Lookups read, submit=1 writes to the public dataset and keyless use is read-only in practice, but there is no read-only key (10 of 20). Responses include community comments, banners and DOM snippets from scans with no guidance on treating them as untrusted (3 of 15). The privacy policy says web and API logs are available from the account page (10 of 15). security.txt returns 404 and no disclosure policy, bug bounty or certification was found (0 of 20). 0 + 10 + 3 + 10 + 0 = 23." }, "scores": { "a": 37, "b": 23 } }, { "by": 10, "category": "ergonomics", "leads": "abuseipdb", "name": "Agent ergonomics", "reasons": { "a": "check returns a compact record unless verbose is set, which adds the reports array, maxAgeInDays bounds the window, and blacklist takes a limit and a plaintext form (18 of 25). reports is paginated with page and perPage up to 100 and next and previous links, and blacklist filters by confidence, country and IP version, though check has no field selection (16 of 20). Errors carry a status and a detail an agent can act on, 429 names the daily limit and the headers say when it resets, and a 402 marks a plan limit on check-block (16 of 20). Every lookup is a GET, duplicate reports within 24 hours collapse, and both MCP tools are annotated readOnlyHint and idempotentHint (16 of 20). One required parameter per endpoint with sensible defaults. No official SDK beyond a Laravel package in the vendor's GitHub organisation and the Python MCP server (8 of 15). 18 + 16 + 16 + 16 + 8 = 74.", "b": "limit on explore, pretty, get=links or properties, historical and schema flags, and submit=0 keeps a scan out of the dataset, but an indicator record carries every property group with no field selection (16 of 25). Linked indicators page with page_current and page_next, 1 to 10 pages per request by plan, explore rows capped by tier, and CSV or STIX output (14 of 20). Errors are a single string with a status code; the 429 body names the limit (12 of 20). Every lookup is a GET, scanning an existing indicator updates it, and polling by qid is free (14 of 20). One required parameter per call and keyless defaults, but no official SDK (8 of 15). 16 + 14 + 12 + 14 + 8 = 64." }, "scores": { "a": 74, "b": 64 } }, { "by": 6, "category": "transparency", "leads": "abuseipdb", "name": "Transparency \u0026 trust", "reasons": { "a": "A closed service with clear terms that name AbuseIPDB LLC and the governing law, and an MIT MCP server (15 of 30). The privacy policy of 15 March 2023 lists providers and says data is kept as long as needed, with no retention periods, no DPA and every provider's GDPR status marked in process (10 of 30). No deprecation policy; the reports endpoint may change without notice and the only migration note is from APIv1 (3 of 20). DigitalOcean, Cloudflare, Mailgun, Google Analytics, Google Ads, Carbon, PayPal, Braintree, Freshworks and Slack are named, with processing in the United States (14 of 20). 15 + 10 + 3 + 14 = 42.", "b": "A closed service with terms naming Pulsedive LLC and New Jersey law, with the OpenAPI files under Apache 2.0 (15 of 30). The privacy policy of 28 August 2024 lists processors and what is logged, keeps deleted-account data for compliance with no periods, and names no DPA; an enterprise privacy page exists and was not read (14 of 30). The recent field is marked deprecated in the spec with no date and there is no policy (5 of 20). DigitalOcean, Plausible, Stripe, SendGrid, Google Workspace, Monday, QuickBooks and Typeform named, storage in the United States (16 of 20). 15 + 14 + 5 + 16 = 50." }, "scores": { "a": 63, "b": 57 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "AbuseIPDB LLC", "b": "Pulsedive LLC", "name": "Vendor" }, { "a": "no (local only)", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "stdio", "b": "", "name": "Transports" }, { "a": "API key", "b": "API key", "name": "Auth" }, { "a": "Freemium", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "2", "b": "0", "name": "Tools exposed" }, { "a": "yes", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "io.github.abuseipdb/abuseipdb-mcp", "b": "not listed", "name": "MCP registry" }, { "a": "2026-08-02", "b": "2026-10-27", "name": "Last release" }, { "a": "no date given", "b": "2022-05-02", "name": "Terms last updated" }, { "a": "no date given", "b": "2024-08-28", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "yes", "b": "yes", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "yes", "b": "yes", "name": "Terms or service can change without notice" }, { "a": "yes", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "6 stars", "b": "none", "name": "Popularity" } ], "faq": [ { "answer": "AbuseIPDB scores 55.7 (C) on agent readiness against Pulsedive's 47.9 (D), and leads in 4 of 7 scored categories. Pulsedive leads on schema \u0026 documentation and payments \u0026 pricing.", "question": "Which is better for AI agents, AbuseIPDB or Pulsedive?" }, { "answer": "Both need an API key.", "question": "Do AbuseIPDB and Pulsedive need an API key?" }, { "answer": "AbuseIPDB runs on your own machine, with no hosted endpoint listed. No hosted endpoint is listed for Pulsedive.", "question": "Can an agent call AbuseIPDB and Pulsedive without installing anything?" } ], "goodFor": [ { "aheadOn": [ "Reliability, 75 against 31", "Agent ergonomics, 74 against 64", "Security \u0026 auth, 37 against 23", "Transparency \u0026 trust, 63 against 57" ], "also": [ "Runs on your own machine" ], "goodFor": "An agent that needs a quick reputation verdict on an IP or subnet, or wants to report abuse from its own logs, with a free daily quota large enough for one incident.", "slug": "abuseipdb", "watchFor": "No OpenAPI document, no API changelog (the blog's last post is from December 2018) and the reports endpoint is marked open beta and may change without notice" }, { "aheadOn": [ "Schema \u0026 documentation, 77 against 59", "Payments \u0026 pricing, 50 against 30" ], "also": null, "goodFor": "An agent that needs a quick risk verdict and linked threats for a domain, IP or URL with no signup, or a passive scan of a new indicator.", "slug": "pulsedive", "watchFor": "The key is sent only as a query parameter, with no header option, scopes or rotation documented" } ], "history": null, "job": { "capability": "secintel.reputation", "name": "Secintel reputation" }, "others": [ { "json": "https://www.anchorterminal.com/compare/abuseipdb-vs-censys.json", "title": "AbuseIPDB vs Censys", "url": "https://www.anchorterminal.com/compare/abuseipdb-vs-censys" }, { "json": "https://www.anchorterminal.com/compare/abuseipdb-vs-greynoise.json", "title": "AbuseIPDB vs GreyNoise", "url": "https://www.anchorterminal.com/compare/abuseipdb-vs-greynoise" }, { "json": "https://www.anchorterminal.com/compare/abuseipdb-vs-ipinfo.json", "title": "AbuseIPDB vs IPinfo", "url": "https://www.anchorterminal.com/compare/abuseipdb-vs-ipinfo" }, { "json": "https://www.anchorterminal.com/compare/abuseipdb-vs-virustotal.json", "title": "AbuseIPDB vs VirusTotal", "url": "https://www.anchorterminal.com/compare/abuseipdb-vs-virustotal" }, { "json": "https://www.anchorterminal.com/compare/abuseipdb-vs-whoisxml-api.json", "title": "AbuseIPDB vs WhoisXML API", "url": "https://www.anchorterminal.com/compare/abuseipdb-vs-whoisxml-api" }, { "json": "https://www.anchorterminal.com/compare/greynoise-vs-pulsedive.json", "title": "GreyNoise vs Pulsedive", "url": "https://www.anchorterminal.com/compare/greynoise-vs-pulsedive" }, { "json": "https://www.anchorterminal.com/compare/ipinfo-vs-pulsedive.json", "title": "IPinfo vs Pulsedive", "url": "https://www.anchorterminal.com/compare/ipinfo-vs-pulsedive" }, { "json": "https://www.anchorterminal.com/compare/pulsedive-vs-securitytrails.json", "title": "Pulsedive vs SecurityTrails", "url": "https://www.anchorterminal.com/compare/pulsedive-vs-securitytrails" }, { "json": "https://www.anchorterminal.com/compare/abuseipdb-vs-shodan.json", "title": "AbuseIPDB vs Shodan", "url": "https://www.anchorterminal.com/compare/abuseipdb-vs-shodan" }, { "json": "https://www.anchorterminal.com/compare/censys-vs-pulsedive.json", "title": "Censys vs Pulsedive", "url": "https://www.anchorterminal.com/compare/censys-vs-pulsedive" }, { "json": "https://www.anchorterminal.com/compare/pulsedive-vs-shodan.json", "title": "Pulsedive vs Shodan", "url": "https://www.anchorterminal.com/compare/pulsedive-vs-shodan" }, { "json": "https://www.anchorterminal.com/compare/pulsedive-vs-virustotal.json", "title": "Pulsedive vs VirusTotal", "url": "https://www.anchorterminal.com/compare/pulsedive-vs-virustotal" }, { "json": "https://www.anchorterminal.com/compare/pulsedive-vs-whoisxml-api.json", "title": "Pulsedive vs WhoisXML API", "url": "https://www.anchorterminal.com/compare/pulsedive-vs-whoisxml-api" } ], "panel": null, "scores": [ { "abuseipdb": 75, "by": 44, "edge": "abuseipdb", "key": "reliability", "name": "Reliability", "pulsedive": 31, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "abuseipdb": 59, "by": 18, "edge": "pulsedive", "key": "schema", "name": "Schema \u0026 documentation", "pulsedive": 77, "weight": 13 }, { "abuseipdb": 74, "by": 10, "edge": "abuseipdb", "key": "ergonomics", "name": "Agent ergonomics", "pulsedive": 64, "weight": 13 }, { "abuseipdb": 37, "by": 14, "edge": "abuseipdb", "key": "security", "name": "Security \u0026 auth", "pulsedive": 23, "weight": 14 }, { "abuseipdb": 30, "by": 20, "edge": "pulsedive", "key": "payments", "name": "Payments \u0026 pricing", "pulsedive": 50, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "abuseipdb": 38, "by": 2, "edge": "pulsedive", "key": "maintenance", "name": "Maintenance \u0026 community", "pulsedive": 40, "weight": 7 }, { "abuseipdb": 63, "by": 6, "edge": "abuseipdb", "key": "transparency", "name": "Transparency \u0026 trust", "pulsedive": 57, "weight": 7 } ], "summary": "AbuseIPDB scores 55.7 (C) on agent readiness against Pulsedive's 47.9 (D), and leads in 4 of 7 scored categories. Pulsedive leads on schema \u0026 documentation and payments \u0026 pricing. Both do secintel reputation.", "tasks": null, "tutorials": [], "verdicts": { "abuseipdb": "A free key allows 1,000 IP checks a day with published per-endpoint limits, rate-limit headers and a 99 per cent SLA in the terms, and the official MCP server is read-only. One key covers reads, reports and deletes, the key may travel in a query string, there is no OpenAPI document, and the terms bar redistribution of results.", "pulsedive": "Lookups work with no key at all, a free account allows 50 requests a day, and the docs ship llms.txt, per-endpoint OpenAPI files and timestamps for every scan. The key travels only in the query string, numeric limits live in a 2024 blog post rather than the docs, and there is no status page, SLA, security.txt or official SDK." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/abuseipdb-vs-pulsedive", "json": "https://www.anchorterminal.com/compare/abuseipdb-vs-pulsedive.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/abuseipdb-vs-pulsedive.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/abuseipdb-vs-pulsedive.min.md" }, "markdown": "AbuseIPDB scores 55.7 (C) on agent readiness against Pulsedive's 47.9 (D), and leads in 4 of 7 scored categories. Pulsedive leads on schema \u0026 documentation and payments \u0026 pricing. Both do secintel reputation.\n\n- AbuseIPDB: grade C, 55.7/100, rank #819 of 1349. Markdown https://www.anchorterminal.com/tools/abuseipdb.md · JSON https://www.anchorterminal.com/api/v1/tools/abuseipdb.json\n- Pulsedive: grade D, 47.9/100, rank #1079 of 1349. Markdown https://www.anchorterminal.com/tools/pulsedive.md · JSON https://www.anchorterminal.com/api/v1/tools/pulsedive.json\n- Best threat and security intelligence APIs for AI agents: https://www.anchorterminal.com/best/security-intelligence/index.md\n- All 33 security intel comparisons: https://www.anchorterminal.com/compare/security-intelligence/index.md\n\n## Which one, for what\n\n### AbuseIPDB (C)\n\nGood for: An agent that needs a quick reputation verdict on an IP or subnet, or wants to report abuse from its own logs, with a free daily quota large enough for one incident.\n\nAhead on:\n- Reliability, 75 against 31\n- Agent ergonomics, 74 against 64\n- Security \u0026 auth, 37 against 23\n- Transparency \u0026 trust, 63 against 57\n\nAlso in its favour:\n- Runs on your own machine\n\nWatch for: No OpenAPI document, no API changelog (the blog's last post is from December 2018) and the reports endpoint is marked open beta and may change without notice\n\n### Pulsedive (D)\n\nGood for: An agent that needs a quick risk verdict and linked threats for a domain, IP or URL with no signup, or a passive scan of a new indicator.\n\nAhead on:\n- Schema \u0026 documentation, 77 against 59\n- Payments \u0026 pricing, 50 against 30\n\nWatch for: The key is sent only as a query parameter, with no header option, scopes or rotation documented\n\n\n## Why the edge\n\n### Reliability: AbuseIPDB +44\n\n- AbuseIPDB (75): Read with the hosted lines. A status page on UptimeRobot is linked from every page's footer (20). Its monitors and 90-day history load by script and answered with an error on 3 November 2026, so no incident record could be read (5). Daily limits are published per endpoint and per plan, 1,000 checks a day on the free plan up to 50,000 on Premium (15). A 429 carries Retry-After, X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, and a repeated report of the same address with the same comment within 24 hours updates the earlier report instead of adding one (15). The terms carry a service level agreement with a 99 per cent monthly availability target and a refund as the sole remedy (10). API v2 is generally available, with only the reports endpoint in open beta (10). 20 + 5 + 15 + 15 + 10 + 10 = 75.\n- Pulsedive (31): Read with the hosted lines. No status page was found on the site, the docs, the support page or in search (0). No readable history (5). The limits page names Free, Pro, Commercial and Enterprise tiers and three remaining-request headers but gives no numbers, pointing to the account page; the vendor's plan post of 11 March 2024 gives 50 a day on Free and 250 on Pro (8 of 15). A 429 returns a JSON error naming the limit and the headers show what remains, with no Retry-After or backoff guidance; scans are safe to repeat and polling is free (8 of 15). No SLA; the terms supply the services as is and as available (0). The API is generally available (10). 0 + 5 + 8 + 8 + 0 + 10 = 31.\n\n### Payments \u0026 pricing: Pulsedive +20\n\n- AbuseIPDB (30): No x402, MPP or L402 (0). Plan prices are public, $25 and $99 a month, sold by daily quota rather than per call (10). The Individual plan allows 1,000 checks a day with no card, and paid plans carry a 30-day trial (20). The key comes from the account page after a browser signup, and the terms forbid multiple accounts to raise quota, so no autonomous route (0). 0 + 10 + 20 + 0 = 30.\n- Pulsedive (50): No x402, MPP or L402 (0). Pro $29 a month is on the site menu and the Team and Business API prices are in the vendor's plan post of 11 March 2024, sold as monthly quotas rather than per call (10). A free account needs no card (20). Requests without a key are accepted, so an agent can look up an indicator with no signup at about 10 a day (20). 0 + 10 + 20 + 20 = 50.\n\n### Schema \u0026 documentation: Pulsedive +18\n\n- AbuseIPDB (59): The surface graded is the REST API v2, with the official MCP server noted. No OpenAPI document was found. The MCP server's two tools carry JSON Schema inputs with range constraints from pydantic Field (8 of 25). llms.txt on abuseipdb.com describes the API, endpoints, categories and reporting rules (10). Each endpoint has a purpose statement and a parameter table, the FAQ explains scoring and decay, and the docs say to act on abuseConfidenceScore rather than isWhitelisted, with little on when not to call (14 of 20). Parameters give defaults and ranges (maxAgeInDays 1 to 365, perPage 1 to 100), usageType has a listed set of values and categories are numbered, but types are not stated and the categories default is ambiguous (10 of 15). Examples in cURL, Python, PHP, C# and VBScript for every endpoint, and errors follow the JSON API shape with 422, 429 and 402 examples (12 of 15). v2 is in the path, there is no API changelog, the blog's last post is from December 2018, and the reports endpoint may change without notice (5 of 15). 8 + 10 + 14 + 10 + 12 + 5 = 59.\n- Pulsedive (77): OpenAPI 3.0.3 documents for every endpoint, eleven YAML files under Apache 2.0, with typed parameters and response schemas, though split per endpoint and without a securitySchemes block in the scan and explore file (22 of 25). llms.txt and a Markdown twin of every page, plus a docs MCP server (10). Each endpoint states its purpose, probe and submit are explained with their side effects, and the collection page says what each timestamp means, with little on when not to call (15 of 20). Enumerated 0 or 1 flags, required parameters marked, risk and type enums, but key is optional while 401 describes it missing, and explore summaries allow types the indicator schema does not (11 of 15). curl examples on every page and an error table for 400, 401, 404, 429 and 500 with an example body (12 of 15). No API version or changelog; the docs launch post of 30 March 2026 and a footer version number are the only dated changes, and the spec marks the recent field deprecated with no date (7 of 15). 22 + 10 + 15 + 11 + 12 + 7 = 77.\n\n### Security \u0026 auth: AbuseIPDB +14\n\n- AbuseIPDB (37): One API key per account with no scopes found, recommended in a Key header but also accepted as a query or form parameter per the docs (20 less 10 for the query string, so 10). The same key submits reports, bulk reports and clear-address deletes, with no read-only key; the official MCP server is read-only and its write-tool switch is inert (10 of 20). check and reports return reporter comments, which are public user-submitted text, and no guidance on treating them as untrusted was found (4 of 15). Paid plans include API log downloads for the last 24 to 120 hours and the pricing page lists the window per plan (10 of 15). security.txt returns 404, no disclosure policy, bug bounty or certification was found, and the MCP repository's SECURITY.md points to the vendor's support channels (3 of 20). 10 + 10 + 4 + 10 + 3 = 37.\n- Pulsedive (23): One key per account sent only as a query parameter, with no scopes, header option or rotation documented (10 for one all-powerful key less 10 for the query string, so 0). Lookups read, submit=1 writes to the public dataset and keyless use is read-only in practice, but there is no read-only key (10 of 20). Responses include community comments, banners and DOM snippets from scans with no guidance on treating them as untrusted (3 of 15). The privacy policy says web and API logs are available from the account page (10 of 15). security.txt returns 404 and no disclosure policy, bug bounty or certification was found (0 of 20). 0 + 10 + 3 + 10 + 0 = 23.\n\n### Agent ergonomics: AbuseIPDB +10\n\n- AbuseIPDB (74): check returns a compact record unless verbose is set, which adds the reports array, maxAgeInDays bounds the window, and blacklist takes a limit and a plaintext form (18 of 25). reports is paginated with page and perPage up to 100 and next and previous links, and blacklist filters by confidence, country and IP version, though check has no field selection (16 of 20). Errors carry a status and a detail an agent can act on, 429 names the daily limit and the headers say when it resets, and a 402 marks a plan limit on check-block (16 of 20). Every lookup is a GET, duplicate reports within 24 hours collapse, and both MCP tools are annotated readOnlyHint and idempotentHint (16 of 20). One required parameter per endpoint with sensible defaults. No official SDK beyond a Laravel package in the vendor's GitHub organisation and the Python MCP server (8 of 15). 18 + 16 + 16 + 16 + 8 = 74.\n- Pulsedive (64): limit on explore, pretty, get=links or properties, historical and schema flags, and submit=0 keeps a scan out of the dataset, but an indicator record carries every property group with no field selection (16 of 25). Linked indicators page with page_current and page_next, 1 to 10 pages per request by plan, explore rows capped by tier, and CSV or STIX output (14 of 20). Errors are a single string with a status code; the 429 body names the limit (12 of 20). Every lookup is a GET, scanning an existing indicator updates it, and polling by qid is free (14 of 20). One required parameter per call and keyless defaults, but no official SDK (8 of 15). 16 + 14 + 12 + 14 + 8 = 64.\n\n### Transparency \u0026 trust: AbuseIPDB +6\n\n- AbuseIPDB (63): A closed service with clear terms that name AbuseIPDB LLC and the governing law, and an MIT MCP server (15 of 30). The privacy policy of 15 March 2023 lists providers and says data is kept as long as needed, with no retention periods, no DPA and every provider's GDPR status marked in process (10 of 30). No deprecation policy; the reports endpoint may change without notice and the only migration note is from APIv1 (3 of 20). DigitalOcean, Cloudflare, Mailgun, Google Analytics, Google Ads, Carbon, PayPal, Braintree, Freshworks and Slack are named, with processing in the United States (14 of 20). 15 + 10 + 3 + 14 = 42.\n- Pulsedive (57): A closed service with terms naming Pulsedive LLC and New Jersey law, with the OpenAPI files under Apache 2.0 (15 of 30). The privacy policy of 28 August 2024 lists processors and what is logged, keeps deleted-account data for compliance with no periods, and names no DPA; an enterprise privacy page exists and was not read (14 of 30). The recent field is marked deprecated in the spec with no date and there is no policy (5 of 20). DigitalOcean, Plausible, Stripe, SendGrid, Google Workspace, Monday, QuickBooks and Typeform named, storage in the United States (16 of 20). 15 + 14 + 5 + 16 = 50.\n\n## Score by category\n\n| Category | Weight | AbuseIPDB | Pulsedive | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 75 | 31 | AbuseIPDB +44 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 59 | 77 | Pulsedive +18 |\n| Agent ergonomics | 13% (16.2 this run) | 74 | 64 | AbuseIPDB +10 |\n| Security \u0026 auth | 14% (17.5 this run) | 37 | 23 | AbuseIPDB +14 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 30 | 50 | Pulsedive +20 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 38 | 40 | Pulsedive +2 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 63 | 57 | AbuseIPDB +6 |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **55.7 · C** | **47.9 · D** | |\n\n## Facts side by side\n\n| Fact | AbuseIPDB | Pulsedive |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | AbuseIPDB LLC | Pulsedive LLC |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | stdio | |\n| Auth | API key | API key |\n| Pricing | Freemium | Freemium |\n| x402 | no | no |\n| Tools exposed | 2 | 0 |\n| Read-only variant documented | yes | no |\n| llms.txt | yes | yes |\n| MCP registry | `io.github.abuseipdb/abuseipdb-mcp` | not listed |\n| Last release | 2026-08-02 | 2026-10-27 |\n| Terms last updated | no date given | 2022-05-02 |\n| Privacy policy last updated | no date given | 2024-08-28 |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | yes | yes |\n| Terms restrict benchmarking | not found in the text | not found in the text |\n| Terms or service can change without notice | yes | yes |\n| Arbitration or class-action waiver | yes | not found in the text |\n| Popularity | 6 stars | none |\n\n## Verdicts\n\n**AbuseIPDB.** A free key allows 1,000 IP checks a day with published per-endpoint limits, rate-limit headers and a 99 per cent SLA in the terms, and the official MCP server is read-only. One key covers reads, reports and deletes, the key may travel in a query string, there is no OpenAPI document, and the terms bar redistribution of results.\n\n**Pulsedive.** Lookups work with no key at all, a free account allows 50 requests a day, and the docs ship llms.txt, per-endpoint OpenAPI files and timestamps for every scan. The key travels only in the query string, numeric limits live in a 2024 blog post rather than the docs, and there is no status page, SLA, security.txt or official SDK.\n\n## Before you call either\n\n### AbuseIPDB\n\n1. Send `Accept: application/json` and the key in the `Key` header; without the Accept header the API answers with an HTML page\n2. Act on `abuseConfidenceScore` rather than `isWhitelisted`, and pass `maxAgeInDays` to bound how old the reports can be (default 30, maximum 365)\n3. Watch `X-RateLimit-Remaining` per endpoint and on a 429 wait for `Retry-After`, which can be most of a day since limits reset at 00:00 UTC\n4. Use `check-block` for a subnet (up to /24 on the free plan) and `blacklist` with `confidenceMinimum` only on a paid plan; over-limit `limit` values are truncated silently\n5. Strip personal data from report comments, which are public, and prefer the read-only MCP server when the task never reports\n\n### Pulsedive\n\n1. Call `indicator.php?indicator=\u003cvalue\u003e\u0026pretty=1\u0026key=...`; without a key the limit is about 10 requests a day, so register for 50\n2. Read `risk`, `risk_recommended` and `stamp_probed` together; an old `stamp_probed` means the scan data may be stale, so queue a scan with `analyze.php` (`probe=0` passive, `submit=0` to avoid storing)\n3. Poll `analyze.php?qid=` no more than every 500 ms; polling does not count against the quota, but each page of linked indicators does\n4. Treat a 429 as the day's or month's quota spent and stop; there is no Retry-After, and explore searches above the plan's row limit also return 429\n5. Expect user comments, banners and DOM snippets in indicator properties, which are third-party content\n\n## Questions\n\n### Which is better for AI agents, AbuseIPDB or Pulsedive?\n\nAbuseIPDB scores 55.7 (C) on agent readiness against Pulsedive's 47.9 (D), and leads in 4 of 7 scored categories. Pulsedive leads on schema \u0026 documentation and payments \u0026 pricing.\n\n### Do AbuseIPDB and Pulsedive need an API key?\n\nBoth need an API key.\n\n### Can an agent call AbuseIPDB and Pulsedive without installing anything?\n\nAbuseIPDB runs on your own machine, with no hosted endpoint listed. No hosted endpoint is listed for Pulsedive.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/abuseipdb-vs-pulsedive.json, and with the fewest tokens: https://www.anchorterminal.com/compare/abuseipdb-vs-pulsedive.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"abuseipdb\", \"b\": \"pulsedive\"}`. From a terminal: `anchor compare abuseipdb pulsedive`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/abuseipdb.json and https://www.anchorterminal.com/api/v1/tools/pulsedive.json\n\n## Other comparisons with AbuseIPDB or Pulsedive\n\n- [AbuseIPDB vs Censys](https://www.anchorterminal.com/compare/abuseipdb-vs-censys.md)\n- [AbuseIPDB vs GreyNoise](https://www.anchorterminal.com/compare/abuseipdb-vs-greynoise.md)\n- [AbuseIPDB vs IPinfo](https://www.anchorterminal.com/compare/abuseipdb-vs-ipinfo.md)\n- [AbuseIPDB vs VirusTotal](https://www.anchorterminal.com/compare/abuseipdb-vs-virustotal.md)\n- [AbuseIPDB vs WhoisXML API](https://www.anchorterminal.com/compare/abuseipdb-vs-whoisxml-api.md)\n- [GreyNoise vs Pulsedive](https://www.anchorterminal.com/compare/greynoise-vs-pulsedive.md)\n- [IPinfo vs Pulsedive](https://www.anchorterminal.com/compare/ipinfo-vs-pulsedive.md)\n- [Pulsedive vs SecurityTrails](https://www.anchorterminal.com/compare/pulsedive-vs-securitytrails.md)\n- [AbuseIPDB vs Shodan](https://www.anchorterminal.com/compare/abuseipdb-vs-shodan.md)\n- [Censys vs Pulsedive](https://www.anchorterminal.com/compare/censys-vs-pulsedive.md)\n- [Pulsedive vs Shodan](https://www.anchorterminal.com/compare/pulsedive-vs-shodan.md)\n- [Pulsedive vs VirusTotal](https://www.anchorterminal.com/compare/pulsedive-vs-virustotal.md)\n- [Pulsedive vs WhoisXML API](https://www.anchorterminal.com/compare/pulsedive-vs-whoisxml-api.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-04", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "AbuseIPDB vs Pulsedive", "url": "" } ], "description": "AbuseIPDB scores 55.7 (C) to Pulsedive's 47.9 (D) for secintel reputation. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "AbuseIPDB C 55.7", "Pulsedive D 47.9", "scores" ], "h1": "AbuseIPDB vs Pulsedive", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/abuseipdb-vs-pulsedive", "published": "2026-10-01", "section": "tools", "title": "AbuseIPDB vs Pulsedive for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-03", "url": "https://www.anchorterminal.com/compare/abuseipdb-vs-pulsedive" }, "tokens": { "markdown": 4450, "slim": 2880 }, "version": 1 }