# IPGeolocation.io MCP Server

> 17 tools for accurate IP geolocation, company information, ASN and network data, IP security, abuse contacts, time zones, astronomy, currency data and user-agent parsing.

- Type: MCP server
- Author: IPGeolocation
- License: MIT
- Trust tier: contributed (passed automated validation and a baseline maintainer review)
- Last reviewed: 2026-10-21
- Source repository: https://github.com/IPGeolocation/ipgeolocation-io-mcp
- Repo state: not archived
- Last push: 2026-11-05T10:01:41Z
- Stars: 6 (a popularity signal, not a safety signal)
- Forks: 5 (a popularity signal, not a safety signal)
- Open issues: 0
- Language: JavaScript
- Health checked at: 2026-11-05T20:35:15.821Z
- Integrations: IPGeolocation.io
- Domains: threat-intelligence, security-operations
- Tags: geolocation, osint, ip-address, asn, security
- Date added: 2026-10-21
- Transport: stdio
- Runtime: node
- Auth method: api-key
- Compatible clients: Claude Code, Claude Desktop, Cline, Codex, Cursor, Gemini CLI, VS Code Copilot, Windsurf
- Tools:
  - `lookup_ip`: IP geolocation with optional company, ASN, network, security, abuse, time zone and currency fields.
  - `bulk_lookup_ip`: IP geolocation for batches of IP addresses.
  - `get_my_ip`: Public egress IP of the server host, without an API key.
  - `lookup_company`: Company name, domain and type, alongside ASN ownership fields.
  - `lookup_currency`: Currency code, name and symbol with country metadata.
  - `lookup_network`: Route prefix, connection type and anycast status.
  - `check_security`: VPN, proxy, Tor, bot, hosting and spam indicators for an IP.
  - `bulk_security_check`: IP security indicators for batches of IP addresses.
  - `get_timezone`: Time zone details for an IP, location, airport or IANA time zone.
  - `convert_timezone`: Time conversion between source and destination time zones or locations.
  - `get_astronomy`: Sun, moon and twilight data for one date or the current time.
  - `get_astronomy_time_series`: Daily astronomy data across a date range.
  - `lookup_asn`: ASN registration and organization details, plus route and relationship datasets with WHOIS records.
  - `get_abuse_contact`: Abuse reporting contacts for an IP address.
  - `parse_user_agent`: Browser, device and operating system data from a user-agent string.
  - `bulk_parse_user_agent`: Parsed browser, device and operating system data for multiple user agents.
  - `get_cached_result`: Complete cached result pages without another API request or additional credits.
- Listing page: https://exchange.tenable.com/mcp-servers/ipgeolocation-io-mcp
- Source file: https://github.com/tenable/cyberagents-exchange/blob/main/mcp-servers/ipgeolocation-io-mcp.md

## What it does

IPGeolocation.io's official MCP server provides 17 tools for accurate IP geolocation, company information, ASN and network data, IP security (VPN, proxy, Tor, bot, hosting and spam detection), abuse contacts, time zones, astronomy, currency data and user-agent parsing.

Investigators can enrich IP indicators with location and company information. They can inspect routing and security signals and identify abuse reporting contacts. Company fields describe the company name, domain and type. ASN fields describe the autonomous system and its organization, registration, routes and relationships. IP geolocation describes network location; it does not establish a person's identity or exact address.

## How it works

The server runs as a local Node.js process over stdio. It sends lookup inputs to `https://api.ipgeolocation.io` over HTTPS and returns text and structured results to the MCP client. Authenticated requests use the `x-ipgeolocation-api-key` header. The provider receives the requested lookup data and the server's public egress IP; see the [security and privacy documentation](https://github.com/IPGeolocation/ipgeolocation-io-mcp/blob/main/SECURITY.md).

Bulk tools accept up to 250 inputs by default. Large responses use cached pagination: `get_cached_result` reads the remaining pages without another API request or additional credits. Results stay in process memory, with five-minute expiry by default; successful page reads renew a snapshot's idle expiry. Eviction or a process restart can remove cached results.

## Installation and access

Requires Node.js 22 or later. Add this entry to your client's MCP server configuration and replace the placeholder with your API key in private client settings:

```json
{
  "mcpServers": {
    "ipgeolocation": {
      "command": "npx",
      "args": ["-y", "ipgeolocation-io-mcp@latest"],
      "env": {
        "IPGEOLOCATION_API_KEY": "<YOUR_API_KEY>"
      }
    }
  }
}
```

The server starts without a key, and `get_my_ip` works without one. The other 15 API tools require a key. Cached page retrieval uses the same key and running process as the original lookup. Client-specific configuration formats and setup steps appear in the [installation guide](https://github.com/IPGeolocation/ipgeolocation-io-mcp#install-by-client).

The free plan provides 1,000 API credits per day, including accurate IP geolocation, basic ASN data, time zone details, and user-agent parsing. Company information, detailed ASN and network data, IP security, and abuse contact information require a paid plan.

The server code uses the MIT license. API access follows the account's plan and credit limits. See the [API documentation](https://ipgeolocation.io/documentation.html) for endpoint fields and billing rules.

This is the Markdown version of one of 140 listings on CyberAgents Exchange. The same listing as JSON: https://exchange.tenable.com/api/mcp-servers/ipgeolocation-io-mcp.json. The full index and how to read it: https://exchange.tenable.com/llms.txt