{ "data": { "similar": [ { "grade": "B", "json": "https://www.anchorterminal.com/tools/greynoise.json", "name": "GreyNoise", "score": 66, "shared": [ "secintel.reputation", "secintel.ip-enrichment", "secintel.indicators" ], "slug": "greynoise" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/censys.json", "name": "Censys", "score": 64.1, "shared": [ "secintel.ip-enrichment", "secintel.reputation", "secintel.indicators" ], "slug": "censys" }, { "grade": "C", "json": "https://www.anchorterminal.com/tools/whoisxml-api.json", "name": "WhoisXML API", "score": 56.8, "shared": [ "secintel.reputation", "secintel.ip-enrichment", "secintel.indicators" ], "slug": "whoisxml-api" }, { "grade": "D", "json": "https://www.anchorterminal.com/tools/pulsedive.json", "name": "Pulsedive", "score": 47.9, "shared": [ "secintel.indicators", "secintel.reputation", "secintel.ip-enrichment" ], "slug": "pulsedive" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/virustotal.json", "name": "VirusTotal", "score": 67.5, "shared": [ "secintel.reputation", "secintel.indicators" ], "slug": "virustotal" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/ipinfo.json", "name": "IPinfo", "score": 62.7, "shared": [ "secintel.ip-enrichment", "secintel.reputation" ], "slug": "ipinfo" } ], "tool": { "slug": "abuseipdb", "name": "AbuseIPDB", "vendor": "AbuseIPDB LLC", "vendorUrl": "https://www.abuseipdb.com", "kind": "http-api", "category": "security-intelligence", "summary": "AbuseIPDB is a crowdsourced database of IP addresses reported for abuse, run by AbuseIPDB LLC under Marathon Studios. Its API v2 returns an abuse confidence score and report history for an address, a subnet or a blacklist, and takes reports.", "url": "https://www.anchorterminal.com/tools/abuseipdb", "markdownUrl": "https://www.anchorterminal.com/tools/abuseipdb.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/abuseipdb.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/abuseipdb.json", "dns": "abuseipdb.grade.anchorterminal.com", "repo": "https://github.com/AbuseIPDB/abuseipdb-mcp", "transports": [ "stdio" ], "packages": [ { "registry": "pypi", "name": "mcp-server-abuseipdb" } ], "auth": "api-key", "authNotes": "API key from the account page after a browser signup, sent in a `Key` header. The docs also accept the key as a lowercase `key` query or form parameter. No scopes were found. The official MCP server reads the key from `ABUSEIPDB_API_KEY` and is read-only.", "pricing": "freemium", "pricingNotes": "Free Individual plan with 1,000 checks and 1,000 reports a day, 100 block checks, a 10,000-address blacklist and no card. Basic $25 a month (10,000 checks a day) and Premium $99 a month (50,000 a day), each with a 30-day trial. Enterprise by contact. Free plans are for evaluation, contributing reports or non-commercial personal projects under the terms.", "priceSummary": "$25 / mo", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the API docs, the pricing page or the MCP server repository (checked 2026-11-03). Plan limits exceeded on check-block return 402 Payment Required with a plain error, not payment requirements.", "endpoints": [] }, "toolCount": 2, "popularity": { "githubStars": 6, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-03" }, "docsUrl": "https://docs.abuseipdb.com/", "llmsTxt": "https://www.abuseipdb.com/llms.txt", "registryName": "io.github.abuseipdb/abuseipdb-mcp", "capabilities": [ "secintel.reputation", "secintel.indicators", "secintel.ip-enrichment" ], "tags": [ "hosted", "freemium", "no-card", "free-tier", "api-key", "mcp", "official", "mcp-registry", "stdio", "read-only-mode", "llms-txt", "sla", "status-page", "python", "closed-source" ], "lastRelease": "2026-08-02", "graded": true, "anchor": { "graded": true, "score": 55.7, "grade": "C", "agentReady": false, "rank": 819, "ranked": true, "rankOf": 1349, "categoryRank": 6, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 74, "maintenance": 38, "payments": 30, "reliability": 75, "schema": 59, "security": 37, "transparency": 63 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 75, "points": 15, "reason": "Read with the hosted lines. A status page on UptimeRobot is linked from every page's footer (20). Its monitors and 90-day history load by script and answered with an error on 3 November 2026, so no incident record could be read (5). Daily limits are published per endpoint and per plan, 1,000 checks a day on the free plan up to 50,000 on Premium (15). A 429 carries Retry-After, X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, and a repeated report of the same address with the same comment within 24 hours updates the earlier report instead of adding one (15). The terms carry a service level agreement with a 99 per cent monthly availability target and a refund as the sole remedy (10). API v2 is generally available, with only the reports endpoint in open beta (10). 20 + 5 + 15 + 15 + 10 + 10 = 75.", "checked": "2026-11-03" }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 59, "points": 9.59, "reason": "The surface graded is the REST API v2, with the official MCP server noted. No OpenAPI document was found. The MCP server's two tools carry JSON Schema inputs with range constraints from pydantic Field (8 of 25). llms.txt on abuseipdb.com describes the API, endpoints, categories and reporting rules (10). Each endpoint has a purpose statement and a parameter table, the FAQ explains scoring and decay, and the docs say to act on abuseConfidenceScore rather than isWhitelisted, with little on when not to call (14 of 20). Parameters give defaults and ranges (maxAgeInDays 1 to 365, perPage 1 to 100), usageType has a listed set of values and categories are numbered, but types are not stated and the categories default is ambiguous (10 of 15). Examples in cURL, Python, PHP, C# and VBScript for every endpoint, and errors follow the JSON API shape with 422, 429 and 402 examples (12 of 15). v2 is in the path, there is no API changelog, the blog's last post is from December 2018, and the reports endpoint may change without notice (5 of 15). 8 + 10 + 14 + 10 + 12 + 5 = 59.", "checked": "2026-11-03" }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 74, "points": 12.03, "reason": "check returns a compact record unless verbose is set, which adds the reports array, maxAgeInDays bounds the window, and blacklist takes a limit and a plaintext form (18 of 25). reports is paginated with page and perPage up to 100 and next and previous links, and blacklist filters by confidence, country and IP version, though check has no field selection (16 of 20). Errors carry a status and a detail an agent can act on, 429 names the daily limit and the headers say when it resets, and a 402 marks a plan limit on check-block (16 of 20). Every lookup is a GET, duplicate reports within 24 hours collapse, and both MCP tools are annotated readOnlyHint and idempotentHint (16 of 20). One required parameter per endpoint with sensible defaults. No official SDK beyond a Laravel package in the vendor's GitHub organisation and the Python MCP server (8 of 15). 18 + 16 + 16 + 16 + 8 = 74.", "checked": "2026-11-03" }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 37, "points": 6.48, "reason": "One API key per account with no scopes found, recommended in a Key header but also accepted as a query or form parameter per the docs (20 less 10 for the query string, so 10). The same key submits reports, bulk reports and clear-address deletes, with no read-only key; the official MCP server is read-only and its write-tool switch is inert (10 of 20). check and reports return reporter comments, which are public user-submitted text, and no guidance on treating them as untrusted was found (4 of 15). Paid plans include API log downloads for the last 24 to 120 hours and the pricing page lists the window per plan (10 of 15). security.txt returns 404, no disclosure policy, bug bounty or certification was found, and the MCP repository's SECURITY.md points to the vendor's support channels (3 of 20). 10 + 10 + 4 + 10 + 3 = 37.", "checked": "2026-11-03" }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 30, "points": 3.75, "reason": "No x402, MPP or L402 (0). Plan prices are public, $25 and $99 a month, sold by daily quota rather than per call (10). The Individual plan allows 1,000 checks a day with no card, and paid plans carry a 30-day trial (20). The key comes from the account page after a browser signup, and the terms forbid multiple accounts to raise quota, so no autonomous route (0). 0 + 10 + 20 + 0 = 30.", "checked": "2026-11-03" }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 38, "points": 3.33, "reason": "Read as a closed service with an official MCP server. The newest dated change to the surface is the MCP server's v0.1.1 on 2 August 2026, 93 days before the check; the API docs and blog carry no later date (10 of 30). One release in the last 90 days, v0.1.1 fell just outside it (0 of 20). Support is a contact form with no guaranteed response on the free plan, there is no public changelog for the API, and the MCP repository shows a pull request merged on 2 August but GitHub's issue pages could not be read (5 of 15). The MCP server sits in the official registry under io.github.abuseipdb (15). The MCP package has CI on Python 3.11 to 3.14 with ruff, pytest and a packaging check, and a locked dependency set (8 of 10). 10 + 0 + 5 + 15 + 8 = 38.", "checked": "2026-11-03" }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 63, "points": 5.51, "note": "editorial 42, provenance 84", "reason": "A closed service with clear terms that name AbuseIPDB LLC and the governing law, and an MIT MCP server (15 of 30). The privacy policy of 15 March 2023 lists providers and says data is kept as long as needed, with no retention periods, no DPA and every provider's GDPR status marked in process (10 of 30). No deprecation policy; the reports endpoint may change without notice and the only migration note is from APIv1 (3 of 20). DigitalOcean, Cloudflare, Mailgun, Google Analytics, Google Ads, Carbon, PayPal, Braintree, Freshworks and Slack are named, with processing in the United States (14 of 20). 15 + 10 + 3 + 14 = 42.", "checked": "2026-11-03" } ], "assessment": { "date": "2026-11-03", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "check returns a compact record unless verbose is set, which adds the reports array, maxAgeInDays bounds the window, and blacklist takes a limit and a plaintext form (18 of 25). reports is paginated with page and perPage up to 100 and next and previous links, and blacklist filters by confidence, country and IP version, though check has no field selection (16 of 20). Errors carry a status and a detail an agent can act on, 429 names the daily limit and the headers say when it resets, and a 402 marks a plan limit on check-block (16 of 20). Every lookup is a GET, duplicate reports within 24 hours collapse, and both MCP tools are annotated readOnlyHint and idempotentHint (16 of 20). One required parameter per endpoint with sensible defaults. No official SDK beyond a Laravel package in the vendor's GitHub organisation and the Python MCP server (8 of 15). 18 + 16 + 16 + 16 + 8 = 74.", "maintenance": "Read as a closed service with an official MCP server. The newest dated change to the surface is the MCP server's v0.1.1 on 2 August 2026, 93 days before the check; the API docs and blog carry no later date (10 of 30). One release in the last 90 days, v0.1.1 fell just outside it (0 of 20). Support is a contact form with no guaranteed response on the free plan, there is no public changelog for the API, and the MCP repository shows a pull request merged on 2 August but GitHub's issue pages could not be read (5 of 15). The MCP server sits in the official registry under io.github.abuseipdb (15). The MCP package has CI on Python 3.11 to 3.14 with ruff, pytest and a packaging check, and a locked dependency set (8 of 10). 10 + 0 + 5 + 15 + 8 = 38.", "payments": "No x402, MPP or L402 (0). Plan prices are public, $25 and $99 a month, sold by daily quota rather than per call (10). The Individual plan allows 1,000 checks a day with no card, and paid plans carry a 30-day trial (20). The key comes from the account page after a browser signup, and the terms forbid multiple accounts to raise quota, so no autonomous route (0). 0 + 10 + 20 + 0 = 30.", "reliability": "Read with the hosted lines. A status page on UptimeRobot is linked from every page's footer (20). Its monitors and 90-day history load by script and answered with an error on 3 November 2026, so no incident record could be read (5). Daily limits are published per endpoint and per plan, 1,000 checks a day on the free plan up to 50,000 on Premium (15). A 429 carries Retry-After, X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, and a repeated report of the same address with the same comment within 24 hours updates the earlier report instead of adding one (15). The terms carry a service level agreement with a 99 per cent monthly availability target and a refund as the sole remedy (10). API v2 is generally available, with only the reports endpoint in open beta (10). 20 + 5 + 15 + 15 + 10 + 10 = 75.", "schema": "The surface graded is the REST API v2, with the official MCP server noted. No OpenAPI document was found. The MCP server's two tools carry JSON Schema inputs with range constraints from pydantic Field (8 of 25). llms.txt on abuseipdb.com describes the API, endpoints, categories and reporting rules (10). Each endpoint has a purpose statement and a parameter table, the FAQ explains scoring and decay, and the docs say to act on abuseConfidenceScore rather than isWhitelisted, with little on when not to call (14 of 20). Parameters give defaults and ranges (maxAgeInDays 1 to 365, perPage 1 to 100), usageType has a listed set of values and categories are numbered, but types are not stated and the categories default is ambiguous (10 of 15). Examples in cURL, Python, PHP, C# and VBScript for every endpoint, and errors follow the JSON API shape with 422, 429 and 402 examples (12 of 15). v2 is in the path, there is no API changelog, the blog's last post is from December 2018, and the reports endpoint may change without notice (5 of 15). 8 + 10 + 14 + 10 + 12 + 5 = 59.", "security": "One API key per account with no scopes found, recommended in a Key header but also accepted as a query or form parameter per the docs (20 less 10 for the query string, so 10). The same key submits reports, bulk reports and clear-address deletes, with no read-only key; the official MCP server is read-only and its write-tool switch is inert (10 of 20). check and reports return reporter comments, which are public user-submitted text, and no guidance on treating them as untrusted was found (4 of 15). Paid plans include API log downloads for the last 24 to 120 hours and the pricing page lists the window per plan (10 of 15). security.txt returns 404, no disclosure policy, bug bounty or certification was found, and the MCP repository's SECURITY.md points to the vendor's support channels (3 of 20). 10 + 10 + 4 + 10 + 3 = 37.", "transparency": "A closed service with clear terms that name AbuseIPDB LLC and the governing law, and an MIT MCP server (15 of 30). The privacy policy of 15 March 2023 lists providers and says data is kept as long as needed, with no retention periods, no DPA and every provider's GDPR status marked in process (10 of 30). No deprecation policy; the reports endpoint may change without notice and the only migration note is from APIv1 (3 of 20). DigitalOcean, Cloudflare, Mailgun, Google Analytics, Google Ads, Carbon, PayPal, Braintree, Freshworks and Slack are named, with processing in the United States (14 of 20). 15 + 10 + 3 + 14 = 42." }, "sources": [ { "what": "API v2 documentation (endpoints, limits, 429 headers, errors)", "url": "https://docs.abuseipdb.com/", "seen": "2026-11-03" }, { "what": "pricing", "url": "https://www.abuseipdb.com/pricing", "seen": "2026-11-03" }, { "what": "terms of use with the SLA", "url": "https://www.abuseipdb.com/legal", "seen": "2026-11-03" }, { "what": "privacy policy", "url": "https://www.abuseipdb.com/privacy", "seen": "2026-11-03" }, { "what": "FAQ (operator, scoring, limits)", "url": "https://www.abuseipdb.com/faq", "seen": "2026-11-03" }, { "what": "about page", "url": "https://www.abuseipdb.com/about", "seen": "2026-11-03" }, { "what": "contact page", "url": "https://www.abuseipdb.com/contact", "seen": "2026-11-03" }, { "what": "llms.txt", "url": "https://www.abuseipdb.com/llms.txt", "seen": "2026-11-03" }, { "what": "MCP tutorial (first-party server)", "url": "https://www.abuseipdb.com/tutorial/abuseipdb-mcp", "seen": "2026-11-03" }, { "what": "MCP server repository, shallow clone (CHANGELOG, server.json, annotations, CI)", "url": "https://github.com/AbuseIPDB/abuseipdb-mcp", "seen": "2026-11-03" }, { "what": "MCP registry search", "url": "https://registry.modelcontextprotocol.io/v0/servers?search=abuseipdb", "seen": "2026-11-03" }, { "what": "GitHub organisation repositories", "url": "https://api.github.com/orgs/abuseipdb/repos", "seen": "2026-11-03" }, { "what": "status page (UptimeRobot, history unreadable)", "url": "https://status.abuseipdb.com/", "seen": "2026-11-03" }, { "what": "blog index (newest post 13 December 2018)", "url": "https://www.abuseipdb.com/blog", "seen": "2026-11-03" }, { "what": "report categories", "url": "https://www.abuseipdb.com/categories", "seen": "2026-11-03" }, { "what": "security.txt (404)", "url": "https://www.abuseipdb.com/.well-known/security.txt", "seen": "2026-11-03" }, { "what": "robots.txt", "url": "https://www.abuseipdb.com/robots.txt", "seen": "2026-11-03" }, { "what": "RDAP for abuseipdb.com", "url": "https://rdap.verisign.com/com/v1/domain/abuseipdb.com", "seen": "2026-11-03" } ], "openQuestions": [ "unchecked: the incident history on status.abuseipdb.com, which loads by script and returned an error; reliability scores it as a page with no readable history", "unchecked: whether an account can hold more than one key or revoke one, since the account pages are disallowed by robots.txt and the docs do not say", "unchecked: PyPI download counts and the project page for mcp-server-abuseipdb, which answered with a bot check; version and dates are from the repository clone", "Whether the Laravel package in the AbuseIPDB GitHub organisation is an official SDK; it has no description or documentation link", "The relationship between AbuseIPDB LLC (terms, privacy policy) and Marathon Studios Inc (about page, FAQ); marathon-studios.com answered 403 on both hosts", "firstReleased is the domain registration date, 6 April 2010. The FAQ says Marathon Studios took over management in March 2016 and the blog dates API v2 to 13 December 2018", "The terms forbid automated access to the website outside the API and search engines; public pages were read for this listing and the clause is recorded as a fact" ] }, "negative": 0, "verdict": "A free key allows 1,000 IP checks a day with published per-endpoint limits, rate-limit headers and a 99 per cent SLA in the terms, and the official MCP server is read-only. One key covers reads, reports and deletes, the key may travel in a query string, there is no OpenAPI document, and the terms bar redistribution of results.", "bestFor": "An agent that needs a quick reputation verdict on an IP or subnet, or wants to report abuse from its own logs, with a free daily quota large enough for one incident.", "strengths": [ "1,000 checks and 1,000 reports a day on a free key with no card, and daily limits published for every endpoint and plan", "429 responses carry Retry-After and X-RateLimit headers, and errors follow the JSON API shape with a status and detail", "The terms include a service level agreement with a 99 per cent monthly availability target", "The first-party MCP server has two read-only tools annotated readOnlyHint and idempotentHint, with per-item errors in bulk checks", "llms.txt on abuseipdb.com describes the API, categories and reporting rules for agents" ], "weaknesses": [ "No OpenAPI document, no API changelog (the blog's last post is from December 2018) and the reports endpoint is marked open beta and may change without notice", "One key per account reaches reads, reports, bulk reports and clear-address deletes, and the docs accept it as a query parameter", "No security.txt, disclosure policy or certification found, and the status page's incident history could not be read", "The terms bar reproducing, copying or reselling any portion of the service and its data, and free plans exclude commercial use", "The privacy policy of 15 March 2023 gives no retention periods and marks every provider's GDPR status as in process" ], "agentNotes": [ "Send `Accept: application/json` and the key in the `Key` header; without the Accept header the API answers with an HTML page", "Act on `abuseConfidenceScore` rather than `isWhitelisted`, and pass `maxAgeInDays` to bound how old the reports can be (default 30, maximum 365)", "Watch `X-RateLimit-Remaining` per endpoint and on a 429 wait for `Retry-After`, which can be most of a day since limits reset at 00:00 UTC", "Use `check-block` for a subnet (up to /24 on the free plan) and `blacklist` with `confidenceMinimum` only on a paid plan; over-limit `limit` values are truncated silently", "Strip personal data from report comments, which are public, and prefer the read-only MCP server when the task never reports" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 55.7 } ], "editorialScores": { "ergonomics": 74, "maintenance": 38, "payments": 30, "reliability": 75, "schema": 59, "security": 37, "transparency": 42 }, "provenanceScore": 84, "checked": { "categories": { "ergonomics": "2026-11-03", "maintenance": "2026-11-03", "payments": "2026-11-03", "reliability": "2026-11-03", "schema": "2026-11-03", "security": "2026-11-03", "transparency": "2026-11-03" }, "last": "2026-11-03", "oldest": "2026-11-03", "stale": false, "staleAfterDays": 90 }, "scoreHistory": [ { "date": "2026-11-03", "grade": "C", "kind": "listed", "method": "0.7", "score": 55.7 } ] }, "connect": { "install": "uvx mcp-server-abuseipdb", "http": "curl -G https://api.abuseipdb.com/api/v2/check --data-urlencode \"ipAddress=118.25.6.39\" -d maxAgeInDays=90 -H \"Key: $ABUSEIPDB_API_KEY\" -H \"Accept: application/json\"", "claudeCode": "claude mcp add abuseipdb -e ABUSEIPDB_API_KEY=YOUR_KEY -- uvx mcp-server-abuseipdb", "config": { "mcpServers": { "abuseipdb": { "args": [ "mcp-server-abuseipdb" ], "command": "uvx", "env": { "ABUSEIPDB_API_KEY": "${ABUSEIPDB_API_KEY}" } } } } }, "letme": { "capability": "https://letme.dev/secintel.reputation", "tool": "https://letme.dev/abuseipdb" }, "notable": [ "API v2 at https://api.abuseipdb.com/api/v2/ has seven endpoints. check, reports (open beta), blacklist and check-block are GET reads, report and bulk-report are POST writes, and clear-address is a DELETE of the caller's own reports (https://docs.abuseipdb.com/)", "Daily limits are published per endpoint and plan, 1,000 checks a day on the free plan to 50,000 on Premium, and a 429 carries Retry-After, X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset (https://docs.abuseipdb.com/)", "The terms of 15 March 2023 include a service level agreement with a 99 per cent monthly availability target and a refund as the only remedy, and they bar reproducing, copying, selling or reselling any portion of the service and its data (https://www.abuseipdb.com/legal)", "The first-party MCP server mcp-server-abuseipdb 0.1.1 (2 August 2026, MIT, beta) runs over stdio with two read-only tools, check_ip and bulk_check, both annotated readOnlyHint and idempotentHint, and sits in the official MCP registry as io.github.abuseipdb/abuseipdb-mcp (https://www.abuseipdb.com/tutorial/abuseipdb-mcp)", "Confidence scores are recalculated daily from distinct reporters with time decay, and a free account can report the same address once every 15 minutes (https://www.abuseipdb.com/faq)", "A status page on UptimeRobot is linked from the footer, but its history loads by script and could not be read on 3 November 2026 (https://status.abuseipdb.com/)" ], "area": "developer", "details": [ { "label": "Surface listed", "value": "The REST API v2 at api.abuseipdb.com, read from docs.abuseipdb.com, abuseipdb.com (pricing, FAQ, terms, privacy, llms.txt, the MCP tutorial) and a shallow clone of AbuseIPDB/abuseipdb-mcp on 3 November 2026. The official MCP server is noted. No account was made and no call was sent" }, { "label": "Endpoints", "value": "GET check, reports (open beta, paginated), blacklist and check-block. POST report and bulk-report (CSV upload). DELETE clear-address. Reports take one or more of 23 numbered categories" }, { "label": "Daily limits", "value": "Free 1,000 checks, 100 reports lookups, 5 blacklists, 1,000 reports, 100 block checks, 5 bulk reports. Basic 10,000 checks, Premium 50,000. Limits reset at 00:00 UTC" }, { "label": "Plan limits", "value": "Blacklist up to 10,000 addresses on the free plan, 100,000 on Basic and 500,000 on Premium. check-block up to /24, /20 and /16 with maxAgeInDays up to 30, 60 and 365. confidenceMinimum below 100 and country filters need a subscription" }, { "label": "Scoring", "value": "Abuse confidence score 0 to 100 from the natural logarithm of distinct reporters, with time decay and daily recalculation. Geolocation, ISP and usage type come from IPinfo" }, { "label": "MCP server", "value": "mcp-server-abuseipdb 0.1.1, MIT, beta, stdio only. Tools check_ip and bulk_check (up to 100 addresses, duplicates removed, per-item errors, a notice at 10 per cent quota left). It cannot report or fetch blacklists" }, { "label": "Operator", "value": "AbuseIPDB LLC, a Pennsylvania company at 562 Independence Road, East Stroudsburg, in the terms and privacy policy. The about page and FAQ say the project is managed by Marathon Studios Inc, which took over in March 2016" }, { "label": "Support", "value": "Contact form only, no guaranteed response on the free plan, 3 business days on Basic and 24 hours on Premium per the pricing page. API log downloads for the last 24 to 120 hours by plan" } ], "unitPrices": [ { "item": "Basic, 10,000 checks a day", "unit": "month", "usd": 25, "note": "$228 a year" }, { "item": "Premium, 50,000 checks a day", "unit": "month", "usd": 99, "note": "$1,068 a year" } ], "provenance": { "legalEntity": "AbuseIPDB LLC", "domain": "abuseipdb.com", "domainRegistered": "2010-04-06", "endpointOnVendorDomain": true, "terms": "https://www.abuseipdb.com/legal", "privacy": "https://www.abuseipdb.com/privacy", "statusPage": "https://status.abuseipdb.com/", "changelog": "https://github.com/AbuseIPDB/abuseipdb-mcp/blob/main/CHANGELOG.md", "securityTxt": "none", "checked": "2026-11-03", "notes": [ "The terms of use and privacy policy, both last updated 15 March 2023, name AbuseIPDB LLC, a Pennsylvania limited liability company, under Pennsylvania law with arbitration in Philadelphia. The about page says the project is managed by Marathon Studios Inc.", "Section 3 of the terms forbids accessing the website by automated means other than search engines that follow robots.txt and authorised API use. Public pages were read for this listing and the clause is recorded as a fact.", "www.abuseipdb.com/robots.txt disallows /account and /enterprise/ for all crawlers with a crawl delay of 2; neither path was fetched. docs.abuseipdb.com has no robots.txt.", "The changelog link is the MCP server's. No changelog for the REST API was found; the blog's newest post is dated 13 December 2018.", "status.abuseipdb.com is an UptimeRobot page linked from the footer. Its monitors and history load by script and answered with an error when read on 3 November 2026.", "www.abuseipdb.com/.well-known/security.txt returns 404. RDAP at Verisign gives a registration date of 6 April 2010." ], "score": 84, "checks": [ { "check": "Legal entity named", "value": "AbuseIPDB LLC", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "abuseipdb.com, registered 2010-04-06 (16 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "abuseipdb.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 6 of the 7 things a reader expects, and has 2 clauses that cost points", "points": 5.1, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 6 of the 8 things a reader expects", "points": 8.5, "max": 10, "state": "part" }, { "check": "Status page", "value": "status.abuseipdb.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "People named", "value": "not researched yet", "points": 0, "max": 0, "state": "na" }, { "check": "Support route", "value": "help pages, a community", "points": 5, "max": 5, "state": "ok" } ], "policies": [ { "kind": "terms", "url": "https://www.abuseipdb.com/legal", "state": "read", "readAt": "2026-11-03", "words": 4606, "points": 5.1, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": false }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "You and AbuseIPDB agree that any dispute arising out of or related to this Agreement or your use of the Website, including, but not limited to, your use of the Website, will be governed by the laws of Pennsylvania , without regard to its conflict of laws rules.", "says": "The law of Pennsylvania" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "NOTWITHSTANDING ANYTHING ELSE IN THESE TERMS, OUR MAXIMUM AGGREGATE LIABILITY TO YOU IN RESPECT OF FREE / INDIVIDUAL PLANS WILL BE US$100.", "says": "Capped at US$100" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "Canceling the plan during the Free Trial Period will immediately suspend access to the Paid Plan." }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": true, "quote": "This Agreement and the terms contained within are subject to change by AbuseIPDB at any time, in its sole and absolute discretion, and without notice, but any change to these terms will not apply retroactively.", "says": "Says it gives notice of a change" }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "You will not: upload, post, email, store, transmit, or otherwise make available any content that:" }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": true, "quote": "If AbuseIPDB’s Monthly Uptime Percentage is below 99% in a given calendar month, then you will be eligible to receive a Cash Refund as described in Section 3 below.", "says": "Names 99% availability" } ], "toKnow": [ { "key": "terms.automated", "label": "Restricts automated access", "found": true, "quote": "Accessing or attempting to access the Website through automated means (this restriction does not apply to search engines that comply with AbuseIPDB’s robots.txt file, or to authorized use of the AbuseIPDB API);", "costsPoints": true }, { "key": "terms.nonotice", "label": "Says the terms or the service can change without notice", "found": true, "quote": "This Agreement and the terms contained within are subject to change by AbuseIPDB at any time, in its sole and absolute discretion, and without notice, but any change to these terms will not apply retroactively.", "costsPoints": true }, { "key": "terms.cutoff", "label": "Says access can be ended without notice or for any reason", "found": true, "quote": "AbuseIPDB reserves the right to terminate the Website or your access to the Website in its sole and absolute discretion and without prior notice." }, { "key": "terms.arbitration", "label": "Requires arbitration or waives class actions", "found": true, "quote": "THIS TERMS OF USE AGREEMENT CONTAINS AN ARBITRATION PROVISION AND CLASS ACTION WAIVER THAT APPLIES TO ALL CLAIMS EXCEPT FOR CLAIMS OF INTELLECTUAL PROPERTY INFRINGEMENT OR THOSE THAT CAN BE BROUGHT IN SMALL CLAIMS COURT." } ], "notes": [ { "date": "2026-11-03", "text": "AbuseIPDB may use any content submitted to the Website, including IP abuse reports, for any purpose without compensation or attribution.", "quote": "You expressly agree that AbuseIPDB may use this content for any purpose and that the use or republication of this content will be at AbuseIPDB’s discretion and without compensation or attribution of any kind." }, { "date": "2026-11-03", "text": "Liability on Free and Individual plans is capped at 100 US dollars, and otherwise at the amount paid to use the Website.", "quote": "NOTWITHSTANDING ANYTHING ELSE IN THESE TERMS, OUR MAXIMUM AGGREGATE LIABILITY TO YOU IN RESPECT OF FREE / INDIVIDUAL PLANS WILL BE US$100." }, { "date": "2026-11-03", "text": "Free plans may not be used for commercial purposes, and commercial use needs a Basic or higher paid plan.", "quote": "You may not use Free plans for commercial purposes, and a single user or organization may not register multiple Free user accounts." } ] }, { "kind": "privacy", "url": "https://www.abuseipdb.com/privacy", "state": "read", "readAt": "2026-11-03", "words": 3489, "points": 8.5, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": false }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "By using or accessing the Website, you agree that we may collect and use your personal and personally identifiable information in accordance with this Privacy Policy, as revised from time to time." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": false }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "Google Ads: https://policies.google.com/technologies/ads Carbon: https://www.buysellads.com/about/privacy AbuseIPDB may also receive data from third parties including analytics providers or advertising networks such as Google, Facebook, or Apple." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "…more generally, you may still receive ads tailored to your interests based on PII that was not sold by us, personal information that was sold to downstream participants at least 90 days before you opted out, or personal information that was sold by other sources from which you have not opted out.", "says": "Says it does not sell personal data" }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "Furthermore, you have the right to restrict the processing of your PII and to object to the processing of your PII." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "If you have any questions or suggestions regarding our Privacy Policy, or if your personal information is not accurate or complete, please email us at legal@abuseipdb.com", "says": "legal@abuseipdb.com" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "In this case, we have assessed whether appropriate safeguards as within the EU are possible by, for example, executing standard contractual clauses.", "says": "Relies on standard contractual clauses" } ] } ] }, "humans": { "slug": "abuseipdb", "checked": "2026-11-03", "company": "AbuseIPDB LLC", "peopleNote": "No person is named on abuseipdb.com. The about page and FAQ say the project is managed by Marathon Studios Inc, which took over in March 2016, and the terms, privacy policy and contact page name AbuseIPDB LLC at 562 Independence Road, East Stroudsburg, Pennsylvania. marathon-studios.com answered 403 with and without www, the blog's three posts (2016 to 2018) carry no author names, and the MCP repository's commits are not attributed to a named person on a vendor page. Investors were looked for on the about page, FAQ, blog, terms and pricing pages; nothing mentions funding, and no outside search was made for a company whose own pages name no founder.", "companySocial": { "github": "https://github.com/AbuseIPDB" }, "support": { "urls": [ "https://www.abuseipdb.com/contact", "https://www.abuseipdb.com/faq", "https://docs.abuseipdb.com/" ], "community": [ { "label": "MCP server issues", "url": "https://github.com/AbuseIPDB/abuseipdb-mcp/issues", "kind": "github" } ], "contactEmails": [ "legal@abuseipdb.com" ], "contactUrls": [ "https://www.abuseipdb.com/contact" ] }, "sources": [ "https://www.abuseipdb.com/about", "https://www.abuseipdb.com/faq", "https://www.abuseipdb.com/contact", "https://www.abuseipdb.com/legal", "https://www.abuseipdb.com/privacy", "https://www.abuseipdb.com/blog", "https://www.abuseipdb.com/tutorial/abuseipdb-mcp", "https://api.github.com/orgs/abuseipdb/repos" ], "ownership": { "status": "private", "checked": "2026-11-03", "sources": [ "https://www.abuseipdb.com/legal", "https://www.abuseipdb.com/about", "https://www.abuseipdb.com/faq" ] } }, "pageJsonUrl": "https://www.anchorterminal.com/tools/abuseipdb.json", "live": { "slug": "abuseipdb", "vendorStatus": { "page": "https://status.abuseipdb.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-04T15:31:19.057306817Z" }, "securityTxt": { "url": "https://abuseipdb.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-04T15:53:21.604779568Z" }, "updatedAt": "2026-11-04T15:53:21.604779568Z" } }, "verify": { "accepts": "a page on abuseipdb.com or one of its subdomains, or the README at the root of github.com/AbuseIPDB/abuseipdb-mcp", "badgeUrl": "https://www.anchorterminal.com/badges/abuseipdb.svg", "body": { "slug": "abuseipdb", "url": "the page with the badge or the link" }, "docs": "https://www.anchorterminal.com/builders/#verify", "effect": "none, it never changes a grade, rank or review", "endpoint": "https://www.anchorterminal.com/api/v1/verify", "listingUrl": "https://www.anchorterminal.com/tools/abuseipdb", "mcpTool": "verify_listing", "recheck": "weekly; two failed checks in a row and it lapses, a later pass restores it", "snippets": { "html": "\u003ca href=\"https://www.anchorterminal.com/tools/abuseipdb\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/abuseipdb.svg\" alt=\"AbuseIPDB on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e", "markdown": "[![AbuseIPDB on Anchor Terminal](https://www.anchorterminal.com/badges/abuseipdb.svg)](https://www.anchorterminal.com/tools/abuseipdb)", "link": "\u003ca href=\"https://www.anchorterminal.com/tools/abuseipdb\"\u003eAbuseIPDB on Anchor Terminal\u003c/a\u003e" } } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/tools/abuseipdb", "json": "https://www.anchorterminal.com/tools/abuseipdb.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/tools/abuseipdb.md", "mcp": "https://www.anchorterminal.com/mcp", "pricing": "https://www.anchorterminal.com/tools/abuseipdb#pricing", "reviews": "https://www.anchorterminal.com/tools/abuseipdb#reviews", "slim": "https://www.anchorterminal.com/tools/abuseipdb.min.md" }, "markdown": "## Overview\n\n**Grade C · 55.7/100 · rank #819 of 1349 · #6 in Security intelligence · not agent-ready · confidence medium**\n\n\n## Assessment\n\nA free key allows 1,000 IP checks a day with published per-endpoint limits, rate-limit headers and a 99 per cent SLA in the terms, and the official MCP server is read-only. One key covers reads, reports and deletes, the key may travel in a query string, there is no OpenAPI document, and the terms bar redistribution of results.\n\n## Facts\n\n| Field | Value |\n| --- | --- |\n| Vendor | AbuseIPDB LLC (https://www.abuseipdb.com) |\n| Kind | HTTP API |\n| Category | Security intelligence (https://www.anchorterminal.com/categories/security-intelligence) |\n| Transport | stdio |\n| Auth | API key · API key from the account page after a browser signup, sent in a `Key` header. The docs also accept the key as a lowercase `key` query or form parameter. No scopes were found. The official MCP server reads the key from `ABUSEIPDB_API_KEY` and is read-only. |\n| Pricing | Freemium ($25 / mo) · Free Individual plan with 1,000 checks and 1,000 reports a day, 100 block checks, a 10,000-address blacklist and no card. Basic $25 a month (10,000 checks a day) and Premium $99 a month (50,000 a day), each with a 30-day trial. Enterprise by contact. Free plans are for evaluation, contributing reports or non-commercial personal projects under the terms. |\n| x402 | No · No x402, MPP or L402 in the API docs, the pricing page or the MCP server repository (checked 2026-11-03). Plan limits exceeded on check-block return 402 Payment Required with a plain error, not payment requirements. |\n| Licence | unknown |\n| Tools exposed | 2 |\n| Packages | pypi: `mcp-server-abuseipdb` |\n| MCP registry name | `io.github.abuseipdb/abuseipdb-mcp` |\n| Source | https://github.com/AbuseIPDB/abuseipdb-mcp |\n| Docs | https://docs.abuseipdb.com/ |\n| llms.txt | https://www.abuseipdb.com/llms.txt |\n| Last release | 2026-08-02 |\n| GitHub stars | 6 (as of 2026-11-03) |\n| Surface listed | The REST API v2 at api.abuseipdb.com, read from docs.abuseipdb.com, abuseipdb.com (pricing, FAQ, terms, privacy, llms.txt, the MCP tutorial) and a shallow clone of AbuseIPDB/abuseipdb-mcp on 3 November 2026. The official MCP server is noted. No account was made and no call was sent |\n| Endpoints | GET check, reports (open beta, paginated), blacklist and check-block. POST report and bulk-report (CSV upload). DELETE clear-address. Reports take one or more of 23 numbered categories |\n| Daily limits | Free 1,000 checks, 100 reports lookups, 5 blacklists, 1,000 reports, 100 block checks, 5 bulk reports. Basic 10,000 checks, Premium 50,000. Limits reset at 00:00 UTC |\n| Plan limits | Blacklist up to 10,000 addresses on the free plan, 100,000 on Basic and 500,000 on Premium. check-block up to /24, /20 and /16 with maxAgeInDays up to 30, 60 and 365. confidenceMinimum below 100 and country filters need a subscription |\n| Scoring | Abuse confidence score 0 to 100 from the natural logarithm of distinct reporters, with time decay and daily recalculation. Geolocation, ISP and usage type come from IPinfo |\n| MCP server | mcp-server-abuseipdb 0.1.1, MIT, beta, stdio only. Tools check_ip and bulk_check (up to 100 addresses, duplicates removed, per-item errors, a notice at 10 per cent quota left). It cannot report or fetch blacklists |\n| Operator | AbuseIPDB LLC, a Pennsylvania company at 562 Independence Road, East Stroudsburg, in the terms and privacy policy. The about page and FAQ say the project is managed by Marathon Studios Inc, which took over in March 2016 |\n| Support | Contact form only, no guaranteed response on the free plan, 3 business days on Basic and 24 hours on Premium per the pricing page. API log downloads for the last 24 to 120 hours by plan |\n| Capabilities | secintel.reputation, secintel.indicators, secintel.ip-enrichment |\n| Tags | hosted, freemium, no-card, free-tier, api-key, mcp, official, mcp-registry, stdio, read-only-mode, llms-txt, sla, status-page, python, closed-source |\n| JSON | https://www.anchorterminal.com/api/v1/tools/abuseipdb.json |\n\n## Score breakdown (methodology v0.7, October 2026 research run)\n\nAssessed 2026-11-03 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. \"This run\" is each category's share of the 100 points.\n\n| Category | Weight | This run | Score (0–100) | Points |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% | 20 | 75 | 15.0 |\n| Performance | 10% | pending | pending | n/a |\n| Schema \u0026 documentation | 13% | 16.2 | 59 | 9.6 |\n| Agent ergonomics | 13% | 16.2 | 74 | 12.0 |\n| Security \u0026 auth | 14% | 17.5 | 37 | 6.5 |\n| Payments \u0026 pricing | 10% | 12.5 | 30 | 3.8 |\n| Task success | 10% | pending | pending | n/a |\n| Maintenance \u0026 community | 7% | 8.8 | 38 | 3.3 |\n| Transparency \u0026 trust (editorial 42, provenance 84) | 7% | 8.8 | 63 | 5.5 |\n| Negative events | up to −15 | up to −15 | none recorded | 0 |\n| **Total** | | | | **55.7 → C** |\n\n### Why each score\n\n- Reliability 75 (checked 2026-11-03): Read with the hosted lines. A status page on UptimeRobot is linked from every page's footer (20). Its monitors and 90-day history load by script and answered with an error on 3 November 2026, so no incident record could be read (5). Daily limits are published per endpoint and per plan, 1,000 checks a day on the free plan up to 50,000 on Premium (15). A 429 carries Retry-After, X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, and a repeated report of the same address with the same comment within 24 hours updates the earlier report instead of adding one (15). The terms carry a service level agreement with a 99 per cent monthly availability target and a refund as the sole remedy (10). API v2 is generally available, with only the reports endpoint in open beta (10). 20 + 5 + 15 + 15 + 10 + 10 = 75.\n- Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes.\n- Schema \u0026 documentation 59 (checked 2026-11-03): The surface graded is the REST API v2, with the official MCP server noted. No OpenAPI document was found. The MCP server's two tools carry JSON Schema inputs with range constraints from pydantic Field (8 of 25). llms.txt on abuseipdb.com describes the API, endpoints, categories and reporting rules (10). Each endpoint has a purpose statement and a parameter table, the FAQ explains scoring and decay, and the docs say to act on abuseConfidenceScore rather than isWhitelisted, with little on when not to call (14 of 20). Parameters give defaults and ranges (maxAgeInDays 1 to 365, perPage 1 to 100), usageType has a listed set of values and categories are numbered, but types are not stated and the categories default is ambiguous (10 of 15). Examples in cURL, Python, PHP, C# and VBScript for every endpoint, and errors follow the JSON API shape with 422, 429 and 402 examples (12 of 15). v2 is in the path, there is no API changelog, the blog's last post is from December 2018, and the reports endpoint may change without notice (5 of 15). 8 + 10 + 14 + 10 + 12 + 5 = 59.\n- Agent ergonomics 74 (checked 2026-11-03): check returns a compact record unless verbose is set, which adds the reports array, maxAgeInDays bounds the window, and blacklist takes a limit and a plaintext form (18 of 25). reports is paginated with page and perPage up to 100 and next and previous links, and blacklist filters by confidence, country and IP version, though check has no field selection (16 of 20). Errors carry a status and a detail an agent can act on, 429 names the daily limit and the headers say when it resets, and a 402 marks a plan limit on check-block (16 of 20). Every lookup is a GET, duplicate reports within 24 hours collapse, and both MCP tools are annotated readOnlyHint and idempotentHint (16 of 20). One required parameter per endpoint with sensible defaults. No official SDK beyond a Laravel package in the vendor's GitHub organisation and the Python MCP server (8 of 15). 18 + 16 + 16 + 16 + 8 = 74.\n- Security \u0026 auth 37 (checked 2026-11-03): One API key per account with no scopes found, recommended in a Key header but also accepted as a query or form parameter per the docs (20 less 10 for the query string, so 10). The same key submits reports, bulk reports and clear-address deletes, with no read-only key; the official MCP server is read-only and its write-tool switch is inert (10 of 20). check and reports return reporter comments, which are public user-submitted text, and no guidance on treating them as untrusted was found (4 of 15). Paid plans include API log downloads for the last 24 to 120 hours and the pricing page lists the window per plan (10 of 15). security.txt returns 404, no disclosure policy, bug bounty or certification was found, and the MCP repository's SECURITY.md points to the vendor's support channels (3 of 20). 10 + 10 + 4 + 10 + 3 = 37.\n- Payments \u0026 pricing 30 (checked 2026-11-03): No x402, MPP or L402 (0). Plan prices are public, $25 and $99 a month, sold by daily quota rather than per call (10). The Individual plan allows 1,000 checks a day with no card, and paid plans carry a 30-day trial (20). The key comes from the account page after a browser signup, and the terms forbid multiple accounts to raise quota, so no autonomous route (0). 0 + 10 + 20 + 0 = 30.\n- Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored.\n- Maintenance \u0026 community 38 (checked 2026-11-03): Read as a closed service with an official MCP server. The newest dated change to the surface is the MCP server's v0.1.1 on 2 August 2026, 93 days before the check; the API docs and blog carry no later date (10 of 30). One release in the last 90 days, v0.1.1 fell just outside it (0 of 20). Support is a contact form with no guaranteed response on the free plan, there is no public changelog for the API, and the MCP repository shows a pull request merged on 2 August but GitHub's issue pages could not be read (5 of 15). The MCP server sits in the official registry under io.github.abuseipdb (15). The MCP package has CI on Python 3.11 to 3.14 with ruff, pytest and a packaging check, and a locked dependency set (8 of 10). 10 + 0 + 5 + 15 + 8 = 38.\n- Transparency \u0026 trust 63 (checked 2026-11-03): A closed service with clear terms that name AbuseIPDB LLC and the governing law, and an MIT MCP server (15 of 30). The privacy policy of 15 March 2023 lists providers and says data is kept as long as needed, with no retention periods, no DPA and every provider's GDPR status marked in process (10 of 30). No deprecation policy; the reports endpoint may change without notice and the only migration note is from APIv1 (3 of 20). DigitalOcean, Cloudflare, Mailgun, Google Analytics, Google Ads, Carbon, PayPal, Braintree, Freshworks and Slack are named, with processing in the United States (14 of 20). 15 + 10 + 3 + 14 = 42.\n\nFix list, everything this grade says the listing lacks, the biggest gain first (17 items). What it covers is at https://www.anchorterminal.com/fixes/abuseipdb.md (JSON https://www.anchorterminal.com/fixes/abuseipdb.json). The whole list for a coding agent comes from `POST https://www.anchorterminal.com/api/v1/fix-list` with `{\"listing\": \"abuseipdb\", \"plan\": \"read\"}`, free while the beta runs\n\n### What we couldn't check\n\n- unchecked: the incident history on status.abuseipdb.com, which loads by script and returned an error; reliability scores it as a page with no readable history\n- unchecked: whether an account can hold more than one key or revoke one, since the account pages are disallowed by robots.txt and the docs do not say\n- unchecked: PyPI download counts and the project page for mcp-server-abuseipdb, which answered with a bot check; version and dates are from the repository clone\n- Whether the Laravel package in the AbuseIPDB GitHub organisation is an official SDK; it has no description or documentation link\n- The relationship between AbuseIPDB LLC (terms, privacy policy) and Marathon Studios Inc (about page, FAQ); marathon-studios.com answered 403 on both hosts\n- firstReleased is the domain registration date, 6 April 2010. The FAQ says Marathon Studios took over management in March 2016 and the blog dates API v2 to 13 December 2018\n- The terms forbid automated access to the website outside the API and search engines; public pages were read for this listing and the clause is recorded as a fact\n\n### Sources\n\n- API v2 documentation (endpoints, limits, 429 headers, errors): \u003chttps://docs.abuseipdb.com/\u003e (seen 2026-11-03)\n- pricing: \u003chttps://www.abuseipdb.com/pricing\u003e (seen 2026-11-03)\n- terms of use with the SLA: \u003chttps://www.abuseipdb.com/legal\u003e (seen 2026-11-03)\n- privacy policy: \u003chttps://www.abuseipdb.com/privacy\u003e (seen 2026-11-03)\n- FAQ (operator, scoring, limits): \u003chttps://www.abuseipdb.com/faq\u003e (seen 2026-11-03)\n- about page: \u003chttps://www.abuseipdb.com/about\u003e (seen 2026-11-03)\n- contact page: \u003chttps://www.abuseipdb.com/contact\u003e (seen 2026-11-03)\n- llms.txt: \u003chttps://www.abuseipdb.com/llms.txt\u003e (seen 2026-11-03)\n- MCP tutorial (first-party server): \u003chttps://www.abuseipdb.com/tutorial/abuseipdb-mcp\u003e (seen 2026-11-03)\n- MCP server repository, shallow clone (CHANGELOG, server.json, annotations, CI): \u003chttps://github.com/AbuseIPDB/abuseipdb-mcp\u003e (seen 2026-11-03)\n- MCP registry search: \u003chttps://registry.modelcontextprotocol.io/v0/servers?search=abuseipdb\u003e (seen 2026-11-03)\n- GitHub organisation repositories: \u003chttps://api.github.com/orgs/abuseipdb/repos\u003e (seen 2026-11-03)\n- status page (UptimeRobot, history unreadable): \u003chttps://status.abuseipdb.com/\u003e (seen 2026-11-03)\n- blog index (newest post 13 December 2018): \u003chttps://www.abuseipdb.com/blog\u003e (seen 2026-11-03)\n- report categories: \u003chttps://www.abuseipdb.com/categories\u003e (seen 2026-11-03)\n- security.txt (404): \u003chttps://www.abuseipdb.com/.well-known/security.txt\u003e (seen 2026-11-03)\n- robots.txt: \u003chttps://www.abuseipdb.com/robots.txt\u003e (seen 2026-11-03)\n- RDAP for abuseipdb.com: \u003chttps://rdap.verisign.com/com/v1/domain/abuseipdb.com\u003e (seen 2026-11-03)\n\n## Score history\n\nEvery move of a score since the listing was graded, newest first, with its cause. A score can't move without an entry here. JSON: https://www.anchorterminal.com/api/v1/tools/abuseipdb/history.json\n\n- 2026-11-03: graded 55.7 C (methodology 0.7)\n\n## Who's behind it (provenance 84/100, checked 2026-11-03)\n\n| Check | Finding | Points |\n| --- | --- | --- |\n| Legal entity named | AbuseIPDB LLC | 20/20 |\n| Domain age | abuseipdb.com, registered 2010-04-06 (16 years) | 15/15 |\n| Endpoint on the vendor's domain | abuseipdb.com | 15/15 |\n| Terms of service | read, states 6 of the 7 things a reader expects, and has 2 clauses that cost points | 5.1/10 |\n| Privacy policy | read, states 6 of the 8 things a reader expects | 8.5/10 |\n| Status page | status.abuseipdb.com | 10/10 |\n| Changelog | published | 10/10 |\n| security.txt | not found | 0/10 |\n| People named | not researched yet | n/a |\n| Support route | help pages, a community | 5/5 |\n\nThe terms of use and privacy policy, both last updated 15 March 2023, name AbuseIPDB LLC, a Pennsylvania limited liability company, under Pennsylvania law with arbitration in Philadelphia. The about page says the project is managed by Marathon Studios Inc.\n\nSection 3 of the terms forbids accessing the website by automated means other than search engines that follow robots.txt and authorised API use. Public pages were read for this listing and the clause is recorded as a fact.\n\nwww.abuseipdb.com/robots.txt disallows /account and /enterprise/ for all crawlers with a crawl delay of 2; neither path was fetched. docs.abuseipdb.com has no robots.txt.\n\nThe changelog link is the MCP server's. No changelog for the REST API was found; the blog's newest post is dated 13 December 2018.\n\nstatus.abuseipdb.com is an UptimeRobot page linked from the footer. Its monitors and history load by script and answered with an error when read on 3 November 2026.\n\nwww.abuseipdb.com/.well-known/security.txt returns 404. RDAP at Verisign gives a registration date of 6 April 2010.\n\n### Terms and privacy, as read\n\nA reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice.\n\n**Terms of service** (https://www.abuseipdb.com/legal), read 2026-11-03, gives no date, states 6 of the 7 things a reader expects.\n\n- To know. Restricts automated access (costs points). \"Accessing or attempting to access the Website through automated means (this restriction does not apply to search engines that comply with AbuseIPDB’s robots.txt file, or to authorized use of the AbuseIPDB API);\"\n- To know. Says the terms or the service can change without notice (costs points). \"This Agreement and the terms contained within are subject to change by AbuseIPDB at any time, in its sole and absolute discretion, and without notice, but any change to these terms will not apply retroactively.\"\n- To know. Says access can be ended without notice or for any reason. \"AbuseIPDB reserves the right to terminate the Website or your access to the Website in its sole and absolute discretion and without prior notice.\"\n- To know. Requires arbitration or waives class actions. \"THIS TERMS OF USE AGREEMENT CONTAINS AN ARBITRATION PROVISION AND CLASS ACTION WAIVER THAT APPLIES TO ALL CLAIMS EXCEPT FOR CLAIMS OF INTELLECTUAL PROPERTY INFRINGEMENT OR THOSE THAT CAN BE BROUGHT IN SMALL CLAIMS COURT.\"\n- Not found in the text. Gives the date it was last updated.\n- Names the governing law or courts. The law of Pennsylvania.\n- States a limit on its liability. Capped at US$100.\n- Says how changes to the terms are announced. Says it gives notice of a change.\n- Refers to a service level or uptime commitment. Names 99% availability.\n- Also in the text (2026-11-03). AbuseIPDB may use any content submitted to the Website, including IP abuse reports, for any purpose without compensation or attribution. \"You expressly agree that AbuseIPDB may use this content for any purpose and that the use or republication of this content will be at AbuseIPDB’s discretion and without compensation or attribution of any kind.\"\n- Also in the text (2026-11-03). Liability on Free and Individual plans is capped at 100 US dollars, and otherwise at the amount paid to use the Website. \"NOTWITHSTANDING ANYTHING ELSE IN THESE TERMS, OUR MAXIMUM AGGREGATE LIABILITY TO YOU IN RESPECT OF FREE / INDIVIDUAL PLANS WILL BE US$100.\"\n- Also in the text (2026-11-03). Free plans may not be used for commercial purposes, and commercial use needs a Basic or higher paid plan. \"You may not use Free plans for commercial purposes, and a single user or organization may not register multiple Free user accounts.\"\n\n**Privacy policy** (https://www.abuseipdb.com/privacy), read 2026-11-03, gives no date, states 6 of the 8 things a reader expects.\n\n- Not found in the text. Gives the date it was last updated.\n- Not found in the text. Says how long data is kept.\n- Says whether personal data is sold or shared for advertising. Says it does not sell personal data.\n- Gives a privacy contact. legal@abuseipdb.com.\n- Says where data is transferred or stored. Relies on standard contractual clauses.\n\n## Humans behind the project (researched 2026-11-03 from public pages, not part of the grade)\n\n### Key people\n\n- No people named yet.\n- Note: No person is named on abuseipdb.com. The about page and FAQ say the project is managed by Marathon Studios Inc, which took over in March 2016, and the terms, privacy policy and contact page name AbuseIPDB LLC at 562 Independence Road, East Stroudsburg, Pennsylvania. marathon-studios.com answered 403 with and without www, the blog's three posts (2016 to 2018) carry no author names, and the MCP repository's commits are not attributed to a named person on a vendor page. Investors were looked for on the about page, FAQ, blog, terms and pricing pages; nothing mentions funding, and no outside search was made for a company whose own pages name no founder.\n- AbuseIPDB LLC: GitHub https://github.com/AbuseIPDB\n\n### Getting support\n\n- Help: https://www.abuseipdb.com/contact\n- Help: https://www.abuseipdb.com/faq\n- Help: https://docs.abuseipdb.com/\n- Community (MCP server issues): https://github.com/AbuseIPDB/abuseipdb-mcp/issues\n- General contact: legal@abuseipdb.com\n- Sources: https://www.abuseipdb.com/about, https://www.abuseipdb.com/faq, https://www.abuseipdb.com/contact, https://www.abuseipdb.com/legal, https://www.abuseipdb.com/privacy, https://www.abuseipdb.com/blog, https://www.abuseipdb.com/tutorial/abuseipdb-mcp, https://api.github.com/orgs/abuseipdb/repos\n\n## Live (updated 2026-11-04 15:53 UTC)\n\n- Vendor status page: unknown, no machine-readable status found\n- security.txt: none\n- Always current: https://www.anchorterminal.com/api/v1/live/abuseipdb.json\n\n## Probe metrics\n\nNot measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score.\n\n## Prices\n\n| Item | Price | Unit | Note |\n| --- | --- | --- | --- |\n| Basic, 10,000 checks a day | $25 | per month (plan) | $228 a year |\n| Premium, 50,000 checks a day | $99 | per month (plan) | $1,068 a year |\n\nAcross all listings: https://www.anchorterminal.com/prices/index.md\n\n## Strengths\n\n- 1,000 checks and 1,000 reports a day on a free key with no card, and daily limits published for every endpoint and plan\n- 429 responses carry Retry-After and X-RateLimit headers, and errors follow the JSON API shape with a status and detail\n- The terms include a service level agreement with a 99 per cent monthly availability target\n- The first-party MCP server has two read-only tools annotated readOnlyHint and idempotentHint, with per-item errors in bulk checks\n- llms.txt on abuseipdb.com describes the API, categories and reporting rules for agents\n\n## Weaknesses\n\n- No OpenAPI document, no API changelog (the blog's last post is from December 2018) and the reports endpoint is marked open beta and may change without notice\n- One key per account reaches reads, reports, bulk reports and clear-address deletes, and the docs accept it as a query parameter\n- No security.txt, disclosure policy or certification found, and the status page's incident history could not be read\n- The terms bar reproducing, copying or reselling any portion of the service and its data, and free plans exclude commercial use\n- The privacy policy of 15 March 2023 gives no retention periods and marks every provider's GDPR status as in process\n\n\n\n## Before you call it (notes for agents)\n\n1. Send `Accept: application/json` and the key in the `Key` header; without the Accept header the API answers with an HTML page\n2. Act on `abuseConfidenceScore` rather than `isWhitelisted`, and pass `maxAgeInDays` to bound how old the reports can be (default 30, maximum 365)\n3. Watch `X-RateLimit-Remaining` per endpoint and on a 429 wait for `Retry-After`, which can be most of a day since limits reset at 00:00 UTC\n4. Use `check-block` for a subnet (up to /24 on the free plan) and `blacklist` with `confidenceMinimum` only on a paid plan; over-limit `limit` values are truncated silently\n5. Strip personal data from report comments, which are public, and prefer the read-only MCP server when the task never reports\n\n## Connect\n\nInstall:\n\n```bash\nuvx mcp-server-abuseipdb\n```\n\nFirst request:\n\n```bash\ncurl -G https://api.abuseipdb.com/api/v2/check --data-urlencode \"ipAddress=118.25.6.39\" -d maxAgeInDays=90 -H \"Key: $ABUSEIPDB_API_KEY\" -H \"Accept: application/json\"\n```\n\nClaude Code:\n\n```bash\nclaude mcp add abuseipdb -e ABUSEIPDB_API_KEY=YOUR_KEY -- uvx mcp-server-abuseipdb\n```\n\nMCP client configuration:\n\n```json\n{\n \"mcpServers\": {\n \"abuseipdb\": {\n \"args\": [\n \"mcp-server-abuseipdb\"\n ],\n \"command\": \"uvx\",\n \"env\": {\n \"ABUSEIPDB_API_KEY\": \"${ABUSEIPDB_API_KEY}\"\n }\n }\n }\n}\n```\n\nThrough letme: https://letme.dev/abuseipdb. letme answers with the pick and how to call it direct. How it works: https://www.anchorterminal.com/letme/index.md\n\n## Similar tools\n\nRanked by shared capabilities, then score. Same-category tools with no shared capability key are listed last.\n\n| Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown |\n| --- | --- | --- | --- | --- | --- | --- |\n| GreyNoise | B | 66 | 350 | secintel.reputation, secintel.ip-enrichment, secintel.indicators | no | https://www.anchorterminal.com/tools/greynoise.md |\n| Censys | B | 64.1 | 420 | secintel.ip-enrichment, secintel.reputation, secintel.indicators | no | https://www.anchorterminal.com/tools/censys.md |\n| WhoisXML API | C | 56.8 | 771 | secintel.reputation, secintel.ip-enrichment, secintel.indicators | no | https://www.anchorterminal.com/tools/whoisxml-api.md |\n| Pulsedive | D | 47.9 | 1079 | secintel.indicators, secintel.reputation, secintel.ip-enrichment | no | https://www.anchorterminal.com/tools/pulsedive.md |\n| VirusTotal | B | 67.5 | 288 | secintel.reputation, secintel.indicators | no | https://www.anchorterminal.com/tools/virustotal.md |\n| IPinfo | B | 62.7 | 464 | secintel.ip-enrichment, secintel.reputation | no | https://www.anchorterminal.com/tools/ipinfo.md |\n\n## Panel reviews (0)\n\nReviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): .\n\nDesk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md\n\n## Notable\n\n- API v2 at https://api.abuseipdb.com/api/v2/ has seven endpoints. check, reports (open beta), blacklist and check-block are GET reads, report and bulk-report are POST writes, and clear-address is a DELETE of the caller's own reports (source: \u003chttps://docs.abuseipdb.com/\u003e)\n- Daily limits are published per endpoint and plan, 1,000 checks a day on the free plan to 50,000 on Premium, and a 429 carries Retry-After, X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset (source: \u003chttps://docs.abuseipdb.com/\u003e)\n- The terms of 15 March 2023 include a service level agreement with a 99 per cent monthly availability target and a refund as the only remedy, and they bar reproducing, copying, selling or reselling any portion of the service and its data (source: \u003chttps://www.abuseipdb.com/legal\u003e)\n- The first-party MCP server mcp-server-abuseipdb 0.1.1 (2 August 2026, MIT, beta) runs over stdio with two read-only tools, check_ip and bulk_check, both annotated readOnlyHint and idempotentHint, and sits in the official MCP registry as io.github.abuseipdb/abuseipdb-mcp (source: \u003chttps://www.abuseipdb.com/tutorial/abuseipdb-mcp\u003e)\n- Confidence scores are recalculated daily from distinct reporters with time decay, and a free account can report the same address once every 15 minutes (source: \u003chttps://www.abuseipdb.com/faq\u003e)\n- A status page on UptimeRobot is linked from the footer, but its history loads by script and could not be read on 3 November 2026 (source: \u003chttps://status.abuseipdb.com/\u003e)\n\n- #6 of 9 in Best threat and security intelligence APIs for AI agents: https://www.anchorterminal.com/best/security-intelligence/index.md\n- All 33 security intel comparisons: https://www.anchorterminal.com/compare/security-intelligence/index.md\n\n## Compare\n\n- [AbuseIPDB vs Censys](https://www.anchorterminal.com/compare/abuseipdb-vs-censys.md): C 55.7 vs B 64.1\n- [AbuseIPDB vs GreyNoise](https://www.anchorterminal.com/compare/abuseipdb-vs-greynoise.md): C 55.7 vs B 66\n- [AbuseIPDB vs IPinfo](https://www.anchorterminal.com/compare/abuseipdb-vs-ipinfo.md): C 55.7 vs B 62.7\n- [AbuseIPDB vs Pulsedive](https://www.anchorterminal.com/compare/abuseipdb-vs-pulsedive.md): C 55.7 vs D 47.9\n- [AbuseIPDB vs VirusTotal](https://www.anchorterminal.com/compare/abuseipdb-vs-virustotal.md): C 55.7 vs B 67.5\n- [AbuseIPDB vs WhoisXML API](https://www.anchorterminal.com/compare/abuseipdb-vs-whoisxml-api.md): C 55.7 vs C 56.8\n- [AbuseIPDB vs Shodan](https://www.anchorterminal.com/compare/abuseipdb-vs-shodan.md): C 55.7 vs E 39.5\n\n## Verify this listing\n\nFor the vendor. The badge or a plain link to this page verifies the listing, from a page on abuseipdb.com or one of its subdomains, or the README at the root of github.com/AbuseIPDB/abuseipdb-mcp. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{\"slug\": \"abuseipdb\", \"url\": \"…\"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify\n\nHTML badge:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/abuseipdb\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/abuseipdb.svg\" alt=\"AbuseIPDB on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e\n```\n\nMarkdown badge, for a README:\n\n```markdown\n[![AbuseIPDB on Anchor Terminal](https://www.anchorterminal.com/badges/abuseipdb.svg)](https://www.anchorterminal.com/tools/abuseipdb)\n```\n\nPlain link:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/abuseipdb\"\u003eAbuseIPDB on Anchor Terminal\u003c/a\u003e\n```\n\n## Share this listing\n\nFor the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say AbuseIPDB is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score.\n\n- Dark: https://www.anchorterminal.com/assets/share/abuseipdb-dark.png\n- Light: https://www.anchorterminal.com/assets/share/abuseipdb-light.png\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-04", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Terminal", "url": "https://www.anchorterminal.com/tools/" }, { "name": "Security intelligence", "url": "https://www.anchorterminal.com/categories/security-intelligence" }, { "name": "AbuseIPDB", "url": "" } ], "description": "AbuseIPDB is a crowdsourced database of IP addresses reported for abuse, run by AbuseIPDB LLC under Marathon Studios. Its API v2 returns an abuse confidence score and report history for an address, a subnet or a blacklist, and takes reports.", "facts": [ "rank #819 of 1349", "API key auth", "0 desk reviews" ], "h1": "AbuseIPDB", "image": "https://www.anchorterminal.com/assets/og/tools-abuseipdb.png", "path": "/tools/abuseipdb", "published": "2026-10-01", "section": "tools", "title": "AbuseIPDB review (2026): pricing, alternatives and grade C", "toc": null, "updated": "2026-11-04", "url": "https://www.anchorterminal.com/tools/abuseipdb" }, "tokens": { "markdown": 7750, "slim": 1730 }, "version": 1 }