AI导哈

RIPEstat数据API服务器

MCP服务器为RIPEstat数据API提供智能访问，支持IP地址、前缀、ASN和国家代码的网络信息查询与分析。

  • by taihen
  • Go
  • 本地部署
  • 2 星标
  • 更新于
在 GitHub 查看 taihen/mcp-ripestat

使用说明

MCP RIPEstat

A Model Context Protocol (MCP) server for the RIPEstat Data API, providing network information for IP addresses and prefixes.

[!CAUTION] This MCP server is currently under active development. It may not be stable and is subject to change. Please use with caution.

About RIPEstat

RIPEstat is a large-scale information service and the RIPE NCC's open data platform. It provides essential data on IP address space and Autonomous System Numbers (ASNs), along with related statistics for specific hostnames and countries. This service is a valuable tool for network operators, security researchers, and anyone interested in the structure and performance of the Internet, offering insights into routing, registration data, DNS, and geographical information.

For more information, visit the RIPEstat website and consult the Data API documentation.

Use Cases

Using MCP Client allows you to leverage a Large Language Model (LLM) to query RIPEStat using natural language. This means you can ask complex questions about network information, IP addresses, ASNs, and other RIPEStat data without needing to know the underlying API or query syntax. The client translates your natural language queries into appropriate API calls, making it easier and more intuitive to access and analyze RIPEStat data for research, troubleshooting, or network management tasks.

Investigation Workflows

For examples, investigation workflows, and usage patterns, see PROMPTS.

Features

This MCP server provides intelligent access to RIPEstat Data API through 7 directly accessible tools:

Consolidated Semantic Tools (6 tools that automatically detect resource types and route requests):

  • 🔍 investigateResource - Primary investigation tool with auto-detection and intelligent routing
  • 📊 analyzeRouting - BGP and routing analysis with timeframe support
  • 📋 queryRegistry - Registry and administrative data lookup
  • 🔒 validateSecurity - Security and compliance checks (RPKI, abuse contacts)
  • 🌐 exploreRelationships - Network topology and relationships
  • 🌍 searchByLocation - Geographic analysis by country

Utility Tool (1 tool):

  • 🔧 getWhatsMyIP - Get caller's public IP address

[!NOTE] Only these 7 tools are directly callable. Individual RIPEstat endpoints (like getNetworkInfo, getASOverview, etc.) are internal implementation details and are automatically called by the consolidated tools based on resource type and requested operations.

Resource Detection: Automatically identifies IP addresses, prefixes, ASNs, and country codes without requiring explicit type specification.

Operation Routing: Maps semantic operations to the most relevant RIPEstat endpoints based on resource type and context.

See ENDPOINT_PARITY for implementation status of underlying RIPEstat endpoints.

Architectural Rationale

HTTP Transport Choice: This server implements MCP over Streamable HTTP rather than stdio transport, enabling deployment as a standalone network service that multiple MCP clients can access concurrently without process spawning overhead.

Protocol Compatibility: The server implements the stateless 2026-07-28 protocol. Initialization-based Streamable HTTP revisions are disabled by default and can be enabled explicitly with MCP_ENABLE_LEGACY_PROTOCOLS=true. The retired HTTP+SSE transport is not exposed.

Concurrent Request Management: Semaphore-based rate limiting operates per-server instance rather than per protocol session, managing RIPE API quotas across stateless concurrent requests.

[!WARNING] At current stage this MCP server does not provide authentication. The initial server is intentionally public and read-only, but its upstream RIPEstat calls still consume shared service capacity. Deployments that require caller isolation or policy enforcement should add authentication and authorization at the endpoint or a trusted gateway; a firewall alone is not an identity layer.

Installation

Prerequisites

  • Go 1.26.2 or higher
  • Make
# Clone the repository
git clone https://github.com/taihen/mcp-ripestat.git
cd mcp-ripestat

# Install dependencies
make deps

# Build the application
make build

Usage

# Run the server
./bin/mcp-ripestat

# Run with custom port
./bin/mcp-ripestat --port 8081

# Enable debug logging
./bin/mcp-ripestat --debug

# Show help
./bin/mcp-ripestat --help

Health Check Endpoints

The server provides essential monitoring endpoints:

  • /status - Server status with uptime, version, and health information
  • /warmup - Warmup endpoint to prevent cold starts in containerized deployments

These endpoints are essential for load balancers, monitoring systems, and deployment orchestration.

MCP Protocol Support

Streamable HTTP Transport

• Endpoint: /mcp (streaming occurs over the same request/response channel) • Protocol: Stateless Streamable HTTP (MCP spec 2026-07-28) • Status: Primary transport; POST only; modern protocol required by default • Features: Per-request metadata, server/discover, header-based routing, cacheable deterministic tool lists, and request-scoped cancellation

JSON-RPC 2.0 Endpoint

• Endpoint: /mcp • Protocol: JSON-RPC 2.0 • Status: Recommended production endpoint (replaces REST) • Features: Stateless discovery and tool invocation

Security and compatibility configuration

  • MCP_ENABLE_LEGACY_PROTOCOLS=true enables initialization-based Streamable HTTP clients (2025-11-25, 2025-06-18, and 2025-03-26). Legacy calls do not carry the modern routing headers; gateways must authenticate and inspect their JSON-RPC bodies independently. Because the runtime is stateless, the compatibility shim does not use initialization as an authorization gate; headerless calls are treated as 2025-03-26. Keep this disabled unless needed.
  • TRUSTED_PROXIES is a comma-separated list of proxy CIDRs whose forwarding headers may identify the caller. The default is empty. Configure only proxy addresses you operate; private and loopback networks are not implicitly trusted.
  • CORS_ALLOWED_ORIGINS adds browser origins to the loopback-only defaults. Third-party web origins are opt-in.
  • RATE_LIMIT_MAX_CLIENTS bounds individually tracked rate-limit identities (default 10000); additional identities share an overflow bucket.

MCP Client Configuration

To use this MCP server locally, simply copy and paste the MCP client configuration into your MCP client

  • Cursor: macOS/Linux: ~/.cursor/mcp.json
  • Claude Code (local server): claude mcp add --transport http ripestat http://localhost:8080/mcp
  • Codex CLI (local server): codex mcp add ripestat --url http://localhost:8080/mcp

Demo Server

A demo MCP server is running at https://mcp-ripestat.taihen.org/mcp. Feel free to try it out, but there are no uptime promises.

Add Demo Server from CLI

Use user scope to make the server available across projects.

Claude Code:

claude mcp add-json ripestat --scope user '{"type":"http","url":"https://mcp-ripestat.taihen.org/mcp"}'

Codex CLI:

codex mcp add ripestat --url https://mcp-ripestat.taihen.org/mcp

Verify configuration:

claude mcp list
codex mcp list

Using the Demo Server with Codex Config File

Codex reads MCP server definitions from ~/.codex/config.toml (global) or .codex/config.toml (project-local), not from mcp-demo.json.

Add this server entry:

[mcp_servers.ripestat]
url = "https://mcp-ripestat.taihen.org/mcp"

Then restart Codex and run /mcp to verify that ripestat is connected.

You can now ask prompts such as:

  • Investigate 8.8.8.8 and summarize ownership, routing, and abuse contacts.
  • Analyze routing for AS3333 and show key anomalies.

Testing

# Run tests
make test

# Run tests with coverage report
make test-coverage

# Run end-to-end tests
make e2e-test

# Run linters
make lint

# Format code
make fmt

# Clean build artifacts
make clean

# Install dependencies
make deps

Container Images

Release builds publish multi-platform container images to GitHub Container Registry:

docker pull ghcr.io/taihen/mcp-ripestat:<version>
docker pull ghcr.io/taihen/mcp-ripestat:latest

Published images include BuildKit provenance and SBOM attestations. Release images also receive a signed GitHub Artifact Attestation for SLSA build provenance, attached to the image digest in GHCR.

Verify the provenance attestation for a release image with GitHub CLI:

gh attestation verify oci://ghcr.io/taihen/mcp-ripestat:<version> \
  --repo taihen/mcp-ripestat

The release workflow targets SLSA Build Level 2 for container images by building on GitHub-hosted Actions and publishing signed provenance for the resulting image digest.

Contributing

Contributions are welcome! Please read contributing guidelines to see how you can participate.

Development

The development process is organized into sprints, with each sprint focused on a specific feature. A detailed ledger of all the past and feature changes, divided by sprints, is available in the sprints documentation.

[!NOTE] If a particular feature is not included, please feel free to open issue to discuss it.

License

This project is licensed under the MIT License. See the license file for details.

相关 MCP