# AbuseIPDB (slim)

> AbuseIPDB is a crowdsourced database of IP addresses reported for abuse, run by AbuseIPDB LLC under Marathon Studios. Its API v2 returns an abuse confidence score and report history for an address, a subnet or a blacklist, and takes reports.

- Full: https://www.anchorterminal.com/tools/abuseipdb.md (~7,750 tokens) · this version ~1,730 tokens · JSON https://www.anchorterminal.com/tools/abuseipdb.json · canonical https://www.anchorterminal.com/tools/abuseipdb
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-04 · pricing https://www.anchorterminal.com/tools/abuseipdb#pricing · reviews https://www.anchorterminal.com/tools/abuseipdb#reviews
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

**C · 55.7/100 · rank #819 of 1349 · #6 in Security intelligence · not agent-ready · confidence medium**


Assessment: A free key allows 1,000 IP checks a day with published per-endpoint limits, rate-limit headers and a 99 per cent SLA in the terms, and the official MCP server is read-only. One key covers reads, reports and deletes, the key may travel in a query string, there is no OpenAPI document, and the terms bar redistribution of results.

## Facts

- Kind: HTTP API · vendor: AbuseIPDB LLC · category: Security intelligence · legal entity: AbuseIPDB LLC · provenance 84/100
- Local only (stdio): pypi `mcp-server-abuseipdb`
- Auth: API key · pricing: Freemium · x402: no · licence: unknown
- Probe metrics: not measured yet (probes haven't run)
- Surface listed: The REST API v2 at api.abuseipdb.com, read from docs.abuseipdb.com, abuseipdb.com (pricing, FAQ, terms, privacy, llms.txt, the MCP tutorial) and a shallow clone of AbuseIPDB/abuseipdb-mcp on 3 November 2026. The official MCP server is noted. No account was made and no call was sent
- Endpoints: GET check, reports (open beta, paginated), blacklist and check-block. POST report and bulk-report (CSV upload). DELETE clear-address. Reports take one or more of 23 numbered categories
- Daily limits: Free 1,000 checks, 100 reports lookups, 5 blacklists, 1,000 reports, 100 block checks, 5 bulk reports. Basic 10,000 checks, Premium 50,000. Limits reset at 00:00 UTC
- Plan limits: Blacklist up to 10,000 addresses on the free plan, 100,000 on Basic and 500,000 on Premium. check-block up to /24, /20 and /16 with maxAgeInDays up to 30, 60 and 365. confidenceMinimum below 100 and country filters need a subscription
- Scoring: Abuse confidence score 0 to 100 from the natural logarithm of distinct reporters, with time decay and daily recalculation. Geolocation, ISP and usage type come from IPinfo
- MCP server: mcp-server-abuseipdb 0.1.1, MIT, beta, stdio only. Tools check_ip and bulk_check (up to 100 addresses, duplicates removed, per-item errors, a notice at 10 per cent quota left). It cannot report or fetch blacklists
- Operator: AbuseIPDB LLC, a Pennsylvania company at 562 Independence Road, East Stroudsburg, in the terms and privacy policy. The about page and FAQ say the project is managed by Marathon Studios Inc, which took over in March 2016
- Support: Contact form only, no guaranteed response on the free plan, 3 business days on Basic and 24 hours on Premium per the pricing page. API log downloads for the last 24 to 120 hours by plan
- Prices: Basic, 10,000 checks a day $25 per month (plan); Premium, 50,000 checks a day $99 per month (plan)

- Scores: Reliability 75, Performance pending, Schema & documentation 59, Agent ergonomics 74, Security & auth 37, Payments & pricing 30, Task success pending, Maintenance & community 38, Transparency & trust 63 · total over the 7 assessed categories
- Why: Reliability, Read with the hosted lines. · Schema & documentation, The surface graded is the REST API v2, with the official MCP server noted. · Agent ergonomics, check returns a compact record unless verbose is set, which adds the reports array, maxAgeInDays bounds the window, and blacklist takes a li… · Security & auth, One API key per account with no scopes found, recommended in a Key header but also accepted as a query or form parameter per the docs (20 le… · Payments & pricing, No x402, MPP or L402 (0). · Maintenance & community, Read as a closed service with an official MCP server. · Transparency & trust, A closed service with clear terms that name AbuseIPDB LLC and the governing law, and an MIT MCP server (15 of 30).
- Sources: 18, open questions: 7, both in the full twin
- Capabilities: secintel.reputation, secintel.indicators, secintel.ip-enrichment
- JSON: https://www.anchorterminal.com/api/v1/tools/abuseipdb.json
- Verify (for the vendor): the badge `https://www.anchorterminal.com/badges/abuseipdb.svg` or a link to https://www.anchorterminal.com/tools/abuseipdb from a page on abuseipdb.com or one of its subdomains, or the README at the root of github.com/AbuseIPDB/abuseipdb-mcp, then `POST https://www.anchorterminal.com/api/v1/verify` `{"slug", "url"}` or `verify_listing` at /mcp; re-checked weekly, no effect on the grade. Snippets in the full twin.
- Support: https://www.abuseipdb.com/contact; https://www.abuseipdb.com/faq; https://docs.abuseipdb.com/; more in the full twin

## Before you call it

1. Send `Accept: application/json` and the key in the `Key` header; without the Accept header the API answers with an HTML page
2. Act on `abuseConfidenceScore` rather than `isWhitelisted`, and pass `maxAgeInDays` to bound how old the reports can be (default 30, maximum 365)
3. Watch `X-RateLimit-Remaining` per endpoint and on a 429 wait for `Retry-After`, which can be most of a day since limits reset at 00:00 UTC
4. Use `check-block` for a subnet (up to /24 on the free plan) and `blacklist` with `confidenceMinimum` only on a paid plan; over-limit `limit` values are truncated silently
5. Strip personal data from report comments, which are public, and prefer the read-only MCP server when the task never reports

## Connect

```bash
uvx mcp-server-abuseipdb
```

```bash
curl -G https://api.abuseipdb.com/api/v2/check --data-urlencode "ipAddress=118.25.6.39" -d maxAgeInDays=90 -H "Key: $ABUSEIPDB_API_KEY" -H "Accept: application/json"
```

```bash
claude mcp add abuseipdb -e ABUSEIPDB_API_KEY=YOUR_KEY -- uvx mcp-server-abuseipdb
```
Full config and headless snippets are in the full page. Through letme (picks today, calling later): https://letme.dev/abuseipdb

## Similar tools

| Tool | Grade | Score | Shared capabilities | Slim |
| --- | --- | --- | --- | --- |
| GreyNoise | B | 66 | secintel.reputation, secintel.ip-enrichment, secintel.indicators | https://www.anchorterminal.com/tools/greynoise.min.md |
| Censys | B | 64.1 | secintel.ip-enrichment, secintel.reputation, secintel.indicators | https://www.anchorterminal.com/tools/censys.min.md |
| WhoisXML API | C | 56.8 | secintel.reputation, secintel.ip-enrichment, secintel.indicators | https://www.anchorterminal.com/tools/whoisxml-api.min.md |
| Pulsedive | D | 47.9 | secintel.indicators, secintel.reputation, secintel.ip-enrichment | https://www.anchorterminal.com/tools/pulsedive.min.md |
| VirusTotal | B | 67.5 | secintel.reputation, secintel.indicators | https://www.anchorterminal.com/tools/virustotal.min.md |


## Panel reviews (0, desk reviews from public material, no calls made)