Learn

An IP fact is a small, durable statement about an IP address — something that's true today and that you might want to reason about. We split them into two layers:

• ipcc — the foundation: country, public vs private, and IPv4 vs IPv6.
• ipfacts — enrichment on top of ipcc: Tor exit-node status and cloud provider classification (AWS, Azure, GCP — with the specific service tag where the provider publishes it).

Both layers are exposed via the REST API, the MCP server, and a CLI.

The ipcc lookup answers three questions, fast:

1. Country. ISO-3166 two-letter code, sourced from Azure Maps. We return "??" when the geolocation provider has no answer (private IPs, reserved ranges, unknown allocations).
2. Public vs private. RFC 1918 / RFC 4193 / loopback / link-local. Private IPs short-circuit before we hit any external provider — no leaks, no cost.
3. Address family. "IPv4" or "IPv6".

The provider abstraction means we can swap geolocation backends without consumers noticing — Azure Maps today, something else tomorrow.

The enriched lookup wraps ipcc and adds the bits you actually want when investigating a suspicious request:

{
  "ip": "20.232.0.137",
  "countryCode": "US",
  "isPublic": true,
  "addressFamily": "IPv4",
  "isTor": false,
  "azure": { "service": "AzureCloud", "region": null }
}

Private IPs return the same shape but with countryCode: "??" and azure: null — no provider calls, no telemetry, no surprise cost.

isTor reflects whether the IP is currently advertised as a Tor exit node on the public Tor consensus. We refresh the list every 30 minutes from check.torproject.org and keep it in memory for O(1) lookups.

This is a "is it on the list right now" check — not a "has this IP ever been a Tor exit" check. False negatives are possible when a node is rotating.

For Azure IPs we return the service tag that the address belongs to — "AzureCloud", "AzureFrontDoor.Frontend", "Storage.eastus", etc. Source is the official ARM Microsoft.Network/locations/{location}/serviceTags endpoint, refreshed daily.

Region is populated when the service tag carries one (Storage.eastus → "eastus"); for cloud-wide tags like AzureCloud region is null.

AWS and GCP enrichment ship next.

mcp.ipfacts.com exposes the same lookups as MCP tools so an LLM agent can call them directly:

• ipcc(ip) — free. Returns the foundation facts.
• ipfacts(ip) — paid per-call via x402 (see below). Returns the enriched shape.

Built on the official MCP C# SDK; any MCP-capable client (Claude Desktop, an Agent Framework runtime, your own client) can plug in.

The enriched ipfacts surface charges a few cents per call via the x402 protocol — HTTP 402 Payment Required with a machine-readable challenge that an agent's wallet can sign and retry. Symmetric on REST and MCP: both api.ipfacts.com/ipfacts/{ip} and the MCP ipfacts tool gate on payment; ipcc is free on both surfaces.

Why we like x402 for this: you only pay for the calls you make, agents can authorize spend without a human in the loop, and we don't have to run a billing portal for the long tail of integrations.

The free ipcc tool is not paywalled, so anything that just needs country / public-private classification stays free.

Base URL: https://api.ipfacts.com.

• Tor list: refreshed every 30 minutes.
• Azure ServiceTags: refreshed every 24 hours.
• Country lookup: Azure Maps — sub-second, no per-IP cache layer yet.
• Rate limits: none enforced today on the free REST surface; please don't make us add some.