ipsearch-mcp: Offline IP Whois Tool with MCP for AI Client Asset Collection

Ipsearch MCP

An offline IP Whois query tool that supports querying attribution information through IPv4 addresses and reverse searching for associated IP segments through keywords. It can be used for target asset collection and now integrates the MCP protocol for easy invocation by AI clients.

Security Research and data #IP query #Asset collection #Offline tool #MCP integration .Go

rating : 2.5 points

downloads : 5.5K

update time : 2025-12-12

Open Site

What is IPSearch-MCP?

IPSearch-MCP is an offline IP information query server based on the Model Context Protocol (MCP). It allows AI assistants (such as Claude, Cursor, etc.) to directly query the attribution information of IP addresses, including Whois information such as IP segment range, network name, country of origin, detailed description, etc. This tool is particularly suitable for security researchers, network administrators, and penetration testers, enabling them to quickly collect and analyze the IP assets of target systems.

How to use IPSearch-MCP?

Using IPSearch-MCP is very simple: First, download and compile the tool. Then, place the IP database file in the correct location. Finally, configure the MCP server in an AI client that supports MCP (such as Cherry Studio). After the configuration is complete, you can directly ask questions to the AI assistant in natural language, such as 'Query the IP information of 8.8.8.8' or 'Find the IP segments belonging to Alibaba'. The AI assistant will automatically call the corresponding tool and return the query results.

Applicable scenarios

IPSearch-MCP is suitable for various scenarios: 1) Security assessment: Quickly identify the IP asset scope of the target system; 2) Network management: Query the attribution information of IP addresses; 3) Threat intelligence: Analyze the source and attribution of malicious IPs; 4) Asset discovery: Reverse search for the IP address segments owned by a company through its name; 5) Penetration testing: Collect the network asset information of the target system.

Main features

IP address query

Query the complete IP Whois information based on an IPv4 address, including IP segment range, network name, country of origin, detailed description, status information, and last modification time. It supports the standard IPv4 address format and automatically verifies the legitimacy of the address.

Reverse keyword query

Search for IP segments based on keywords in the IP Whois registration information, supporting multi-keyword combination queries (separated by commas). It can match both the descr and netname fields and return a maximum of 2000 results, which is very suitable for finding IP assets by company or institution name.

Intelligent keyword construction

It has built-in intelligent keyword construction rules. When the user provides an organization name, it will automatically generate multiple sets of keyword combinations for querying, including forms such as the first letters of pinyin, English word segmentation, and Chinese pinyin word segmentation, improving the accuracy and coverage of queries.

MCP protocol integration

It fully supports the Model Context Protocol (MCP) and can be seamlessly integrated into AI clients that support MCP, such as Claude Desktop, Cursor, etc. It communicates with the client through standard input and output, providing a standardized tool call interface.

Offline database

It uses an IP.db database in SQLite format. All queries are completed locally without the need for a network connection, protecting privacy and ensuring fast query speed. The database is updated regularly to ensure the accuracy and timeliness of information.

Advantages

Completely offline operation: All queries are completed locally without relying on external network services, protecting query privacy.

High-performance query: Optimized SQL queries and index design ensure fast query speed and rapid response.

Cross-platform support: It is implemented in pure Go, supports cross-compilation, and can run on multiple platforms such as Windows, macOS, and Linux.

Easy integration: It supports the MCP protocol and can be easily integrated into various AI assistants and workflows.

Intelligent query: It has a built-in intelligent keyword construction algorithm, improving the accuracy and coverage of reverse queries.

Limitations

Requires regular database updates: The IP database needs to be manually downloaded and updated; otherwise, the information may become outdated.

Only supports IPv4: Currently, it only supports IPv4 address queries and does not support IPv6.

Keyword query limitations: It returns a maximum of 2000 results, which may be incomplete for queries of large institutions.

Requires compilation and deployment: Non-technical users may need assistance with compilation and configuration.

Large database file: The IP.db database file is large and requires sufficient storage space.

How to use

Download and compile

First, clone the project code or download the pre-compiled version from the Release page. If you need to compile it yourself, make sure Go 1.23.0+ is installed, and then run the corresponding compilation commands.

Prepare the database

Download the IP.zip file and extract it. Place the IP.db database file in the same directory as the IPSearch executable file. Ensure that the database file is complete and readable.

Configure the MCP client

Configure the MCP server in an AI client that supports MCP (such as Cherry Studio). Add a new MCP server, select the local executable file type, and specify the path to IPSearch.

Start using

After the configuration is complete, restart the AI client. Now you can ask questions to the AI assistant in natural language, and the AI will automatically call the IPSearch tool for querying and return the results.

Usage examples

Example 1: Query information of a specific IP address

When you need to know the attribution information of an IP address, you can directly provide the IP address for querying.

Example 2: Find IP assets by company name

When you need to find the IP address segments owned by a company or institution, you can provide the company name for a reverse query.

Example 3: Asset discovery in security assessment

In security assessment or penetration testing, it is necessary to collect all network assets of the target system.

Frequently Asked Questions

Does IPSearch-MCP require a network connection?

How to update the IP database?

Which AI clients are supported?

Are there any limitations on the query results?

Can it be deployed on a server?

Related resources

GitHub repository

The source code and latest version of the IPSearch project

Technical principle article

The technical principle and implementation details of the IPSearch tool

MCP protocol documentation

The official documentation and specifications of the Model Context Protocol

Go language official website

The official website and documentation of the Go programming language

🚀 IPSearch-MCP

An offline IP Whois query tool now supporting MCP protocol integration.

This tool allows reverse IP queries based on keywords to collect target assets. It also supports automated reverse queries of IP segments by inputting the target system name using AI. Written in Go, it's fully implemented in pure Go, supporting cross - compilation for seamless operation across different platforms. It can be easily integrated into security experts' workflows.

Original project: https://github.com/SleepingBag945/IPSearch

Original project principle: https://www.freebuf.com/articles/sectool/358230.html

🚀 Quick Start

Compilation

# Clone the code
git clone <repository-url>
cd IPSearch

# Compile for the current platform
go build -o IPSearch

# Cross - compilation examples
# Linux AMD64
GOOS=linux GOARCH=amd64 go build -o IPSearch-linux-amd64

# macOS AMD64
GOOS=darwin GOARCH=amd64 go build -o IPSearch-darwin-amd64

# macOS ARM64 (M1/M2)
GOOS=darwin GOARCH=arm64 go build -o IPSearch-darwin-arm64

# Windows AMD64
GOOS=windows GOARCH=amd64 go build -o IPSearch-windows-amd64.exe

Execution

Download and compile the source code or download the appropriate IPSearch binary for your system from the Release section.
Download IP.zip, extract it, and place IP.db in the same directory as IPSearch.
Configure the corresponding MCP server in cherrystudio.
The tool communicates with the MCP client via standard input and output.

✨ Features

1. IP Query (ip_lookup)

Query the IP segment and IP Whois information based on an IPv4 address, including:

IP segment range (inetnum)
Network name (netname)
Country of origin (country)
Detailed description (descr)
Status information (status)
Last modification time (last - modified)

MCP

2. Keyword Query (keyword_lookup)

Search for IP segments based on keywords in the IP Whois registration information, supporting:

Multi - keyword combined queries (separated by commas)
Simultaneous matching of the descr and netname fields
A maximum of 2000 results returned

MCP

Reference Prompts

  - If the user provides an IPv4 address, call the ip_lookup tool to query IP Whois information and return results including IP segment, name, description, country, status, last modification, etc. Ensure basic validation of the IP before the call; prompt the user to re - enter if it's not a valid IPv4.
  - If the user provides a company name, first determine the region, institution type, and key terms, then construct multiple sets of keywords and call the keyword_lookup tool multiple times. Specific rules (prohibit the use of single high - matching keywords, e.g., zhejiang, which will return a large number of unmanageable results):
      - First: Extract the initials of the Chinese company name's pinyin. Example: Zhejiang First People's Hospital → zjdyrmyy.
      - Second: Extract the English word combinations of the company name. Example: Zhejiang Second People's Hospital → zhejiang,second,hospital.
      - Third: Extract the pinyin word combinations of the Chinese company name. Example: Zhejiang First People's Hospital → zhejiang,diyi,yiyuan.
      - Third: Format as "English region + main pinyin of the company". Example: Jilin Kunlun Machinery Co., Ltd. → jilin,kunlun.
      - Fourth: Format as "English region + main English of the company". Example: Zhejiang Wine Co., Ltd. → zhejiang,wine,ltd.
  - Try the above keyword combinations in sequence. Even if the previous one returns results, all rules must still be followed. Ensure that extra spaces are removed from the keyword strings for each search. Multiple keywords can be combined for querying if necessary (e.g., zhejiang,hospital,first and zhejiang,hospital,zjdyrmyy).
  - When returning search results, convert the IP segments to CIDR format and provide the reason for the IP segment's association with the company.
    - Example:
      1. 111.111.111.0/24 | Original description/name of the IP segment | Chinese translation
      2. 111.111.222.0/24 | Original description/name of the IP segment | Chinese translation

🔧 Technical Details

MCP Protocol Support: Operates as an MCP Server and can be integrated into AI clients supporting the MCP protocol.
Pure Go Implementation: Uses the github.com/glebarez/go - sqlite driver, supporting full cross - compilation.
Offline Database: Based on the SQLite IP.db database, no network connection is required.
High - Performance Query: Optimized SQL queries and index design.

The IP.db is an SQLite - formatted IP database. If this tool doesn't meet your requirements, you can implement your own using this database.

📚 Documentation

MCP Tool Instructions

ip_lookup

Parameters: ip (string, required) - The IPv4 address to be queried.
Returns: The IP segment and complete IP Whois information.

keyword_lookup

Parameters: keywords (string, required) - A comma - separated list of keywords.
Returns: A list of matching IP segments (maximum 2000).

📦 Installation

Dependencies

Go 1.23.0+
github.com/glebarez/go - sqlite - A pure Go SQLite driver supporting cross - compilation.
github.com/mark3labs/mcp - go - MCP protocol implementation.