# IPinfo vs SecurityTrails (slim)

> IPinfo scores 62.7 (B) to SecurityTrails's 30.7 (F) for secintel ip enrichment. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/ipinfo-vs-securitytrails.md (~4,200 tokens) · this version ~2,780 tokens · JSON https://www.anchorterminal.com/compare/ipinfo-vs-securitytrails.json · canonical https://www.anchorterminal.com/compare/ipinfo-vs-securitytrails
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-03
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

IPinfo scores 62.7 (B) on agent readiness against SecurityTrails's 30.7 (F), and leads in every scored category. Both do secintel ip enrichment.

- IPinfo: B 62.7, rank #464 of 1349 · https://www.anchorterminal.com/tools/ipinfo.min.md
- SecurityTrails: F 30.7, rank #1270 of 1349 · https://www.anchorterminal.com/tools/securitytrails.min.md
- IPinfo, good for An agent that needs to enrich an IP with location, network and anonymiser flags at volume, free for country and ASN, paid for city and privacy signals. Ahead on Reliability, 38 against 20; Schema & documentation, 76 against 54; Agent ergonomics, 84 against 56; Security & auth, 60 against 32; Payments & pricing, 40 against 0; Maintenance & community, 85 against 5; Transparency & trust, 70 against 32. Also Runs on your own machine; Free to start without a card.
- SecurityTrails, good for An agent investigating a domain's DNS and WHOIS history, subdomains and associated infrastructure, where the operator already holds a commercial key.

| Category | IPinfo | SecurityTrails |
| --- | --- | --- |
| Reliability (16%) | 38 | 20 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 76 | 54 |
| Agent ergonomics (13%) | 84 | 56 |
| Security & auth (14%) | 60 | 32 |
| Payments & pricing (10%) | 40 | 0 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 85 | 5 |
| Transparency & trust (7%) | 70 | 32 |

| Fact (where they differ) | IPinfo | SecurityTrails |
| --- | --- | --- |
| Vendor | IPinfo Inc. | SecurityTrails (Recorded Future) |
| Hosted endpoint | `https://mcp.ipinfo.io/` | `https://api.securitytrails.com/v1/` |
| Transports | Streamable HTTP, stdio | HTTP |
| Auth | OAuth or key | API key |
| Pricing | Freemium | Paid |
| Tools exposed | 6 | none |
| MCP registry | `io.github.ipinfo/mcp` | not listed |
| Last release | 2026-10-29 | 2020-05-28 |
| Terms last updated | 2024-06-03 | no document linked |
| Privacy policy last updated | 2026-10-29 | no document linked |
| Customer content may train models | not found in the text | not read yet |
| Terms restrict automated access | yes | not read yet |
| Terms restrict benchmarking | not found in the text | not read yet |
| Terms or service can change without notice | yes | not read yet |
| Arbitration or class-action waiver | yes | not read yet |
| Popularity | 2 stars | none |

Why the edge:
- Maintenance & community, IPinfo +80: IPinfo 85 (Read as a closed service with an official MCP server and SDKs. MCP server v0.2.3 on 29 October 2026, a commit on 3 November, and SDK repositories pushed in October and November (30). Eight MCP releases since 8 September 2026, v0.1.12 to v0.2.3 (20). GitHub releases for the MCP server, a community forum, a help centre and a support form, but no changelog for the API and GitHub issue pages could not be read (10 of 15). The MCP server is in the official registry as io.github.ipinfo/mcp and the SDKs are official (15). The MCP package has tests, CI with pinned actions, CodeQL and Scorecard workflows and a lock file (10). 30 + 20 + 10 + 15 + 10 = 85.); SecurityTrails 5 (The newest dated changelog entry is 28 May 2020, the Project API 1.7.0 entry is undated and the SurfaceBrowser changelog ends on 26 February 2019, so no change within 180 days was found (0 of 30). No entries in the last 90 days (0). A public changelog exists but is five years stale, and the support page is disallowed by robots.txt (3 of 25). No official SDK; the npm package of October 2021 names the vendor as author with no repository (0 of 15). The docs site serves llms.txt and Markdown twins, which shows the documentation platform is current (2 of 10). 0 + 0 + 3 + 0 + 2 = 5.)
- Payments & pricing, IPinfo +40: IPinfo 40 (No x402, MPP or L402 (0). Plan prices and per-1,000 overage rates are public on the pricing page (20). Lite is free with no card and no request cap (20). The token comes from the dashboard after a browser signup, and no key API was found (0). 0 + 20 + 20 + 0 = 40.); SecurityTrails 0 (No x402, MPP or L402 (0). securitytrails.com/app/pricing and /corp/pricing answered a Cloudflare challenge, and the docs name no price, so no public price was read (0). Whether a free plan exists couldn't be confirmed; the usage endpoint shows only that each account has a monthly allowance (0). A key comes from a browser signup on securitytrails.com, with no programmatic route found (0). 0 + 0 + 0 + 0 = 0, scored as Contentful and Personio were on 7 October 2026 when their pricing pages were unreadable.)
- Transparency & trust, IPinfo +38: IPinfo 70 (A closed service with clear terms naming IPinfo Inc. and the governing law, with the MCP server and SDKs under Apache-2.0 (17 of 30). The privacy policy of 29 October 2026 lists processors, links a DPA and says data is kept as long as needed, with no periods (16 of 30). No deprecation policy; the legacy API is maintained for existing users with no end date (6 of 20). Processors named and hosting in the United States (16 of 20). 17 + 16 + 6 + 16 = 55.); SecurityTrails 32 (A closed service whose terms couldn't be read because of the Cloudflare challenge (5 of 30, for a known commercial product with unread terms). The privacy policy was unread and no retention statement or DPA was found (0 of 30). No deprecation policy; the operation ids carry '-old' with deprecated set to false and no notice explains them (0 of 20). No subprocessor or data location statement readable (0 of 20). 5 + 0 + 0 + 0 = 5.)
- Agent ergonomics, IPinfo +28: IPinfo 84 (Field paths such as /country return one value, the Lite and lookup objects are small, and the MCP server has six compact tools with a per-session cache (23 of 25). Batch takes up to 1,000 lookups with filter=1 to drop empty results; no pagination is needed on single lookups, and ASN and range responses have no size control (16 of 20). The only documented error is 429; the MCP server returns coded errors with a message and a suggestion (12 of 20). Every call is a read, batch is a read over POST, and the MCP tools carry tool annotations (18 of 20). One parameter per call, sensible defaults and official SDKs in eleven languages (15). 23 + 16 + 12 + 18 + 15 = 84.); SecurityTrails 56 (`include_ips` on the list endpoints and an `enrichments` list on ASI asset search, which returns only custom tags by default, size responses on part of the surface; v1 lookups return fixed shapes (12 of 25). `page` with `pages` and `max_page` on v1 lists, scroll on the DSL endpoints, cursor pagination with `limit` up to 1,000 and filters with seven operators on the ASI API (16 of 20). Errors are a 400 message, 401 and 429 text strings and 422 detail arrays, with no codes to branch on (8 of 20). The overview says the v1 API is read-only, so retries are safe; the ASI tag endpoints write with no idempotency guidance (14 of 20). One required parameter per lookup besides the key. No official SDK found, and the npm `securitytrails` package from October 2021 has no repository or homepage (6 of 15). 12 + 16 + 8 + 14 + 6 = 56.)
- Security & auth, IPinfo +28: IPinfo 60 (One access token per account, accepted as a Bearer header, HTTP Basic or a token query parameter, with no scopes found; the hosted MCP server adds OAuth with short-lived tokens (20 less 10 for the query string, plus 4 for OAuth on the MCP server, so 14). Every endpoint is a read and tools return ACCESS_DENIED outside the plan, but there is no read-only or restricted token (16 of 20). Responses are structured network data rather than third-party free text (10 of 15). The dashboard shows request graphs and lookup history per the pricing page, with no per-call log documented (8 of 15). security.txt valid until 21 August 2027 with a PGP key, a SECURITY.md with 2-day acknowledgement and a 90-day disclosure window, no bug bounty or certification found beyond a bank-grade claim (12 of 20). 14 + 16 + 10 + 8 + 12 = 60.); SecurityTrails 32 (One API key with no scopes found, accepted as an `APIKEY` header or as `apikey` in the query string, which the reference pages show on every v1 endpoint (20 less 10, so 10). Revocation and rotation couldn't be read. The v1 API is read-only by the overview's own statement; the ASI API writes tags with no approval step (14 of 20). DNS TXT values, WHOIS fields and user agent strings are third-party text, with no guidance on treating them as untrusted (5 of 15). /v1/account/usage reports monthly counts and nothing per call (3 of 15). security.txt on securitytrails.com and the security page are behind the Cloudflare challenge, api.securitytrails.com answers security.txt with 401, and no disclosure policy, bug bounty or certification was readable (0 of 20). 10 + 14 + 5 + 3 + 0 = 32.)
- Schema & documentation, IPinfo +22: IPinfo 76 (The surface graded is the REST API, with the hosted MCP server noted. A public OpenAPI 3.0 document with 48 operations, and the MCP tools carry JSON Schema inputs (25). llms.txt and llms-full.txt, and every developer page is served as Markdown (10). Each tier page says what it returns and which plan unlocks it, and the MCP tool descriptions say which tiers each option needs, with little on when not to call (14 of 20). Schemas and examples on most responses, path parameters typed, but 401 is undocumented and some operations lack the 429 response (11 of 15). Examples in several languages on every page; only 429 is documented as an error, with no error body shape (9 of 15). A new API system since 2025 with the legacy one kept, but no public changelog, no version in the path and the OpenAPI document at 1.0.0 (7 of 15). 25 + 10 + 14 + 11 + 9 + 7 = 76.); SecurityTrails 54 (The reference pages are generated from an OpenAPI document (operation ids, deprecated flags and typed schemas show on each page), but no spec is published for download and docs.securitytrails.com/openapi redirects to 404 (12 of 25). llms.txt with a Markdown twin of every page (10). Each endpoint has a one-line purpose and nothing on when to use it or not (8 of 20). Path and query parameters are typed, the DNS history type is an enum of six values, and the ASI API has enums, operators and a 1 to 1,000 limit, but the v1 filter object is untyped strings and the DSL query is a free string whose grammar isn't documented (8 of 15). Example responses on every page, with errors mostly limited to 400 and a message, 401 and 429 only on the ping page and 422 on the ASI API (8 of 15). Versioned paths (/v1, /v2) and a changelog whose dated entries stop on 28 May 2020, with one undated Project API 1.7.0 entry (8 of 15). 12 + 10 + 8 + 8 + 8 + 8 = 54.)