IPGeolocation.io agent skills for Claude Code, Cursor and RevampKey

4 ready-made playbooks that teach an AI agent how to do real IPGeolocation.io work: which tools to call, what to check first, and when to stop and ask you.

Download RevampKey, free I have it: connect IPGeolocation.io

Connect IPGeolocation.io once and all 4 skills install themselves and stay up to date. Mac, Windows and Linux.

All 4 IPGeolocation.io skills

Each skill is one job. You ask in plain words and the agent loads the skill that matches, then follows its steps.

Start hereRead-only16 IPGeolocation.io tools

Use the IPGeolocation.io connector safely

Shows how to pick the right IP lookup tool, batch lists without burning your credit quota, and handle quota and permission errors. The connector only reads data and asks before any bulk run.

Use it when

You have just connected IPGeolocation.io and want to know which tool to start with.
A bulk lookup failed with a quota or permission error and you need to know what to do.
You want to check a long list of IPs without exhausting your daily free-plan credits.

Tools it uses

lookup_ip
bulk_lookup_ip
bulk_security_check
bulk_parse_user_agent
check_security
lookup_company
lookup_asn
lookup_network
get_abuse_contact
get_timezone
convert_timezone
get_astronomy
get_astronomy_time_series
parse_user_agent
lookup_currency
get_my_ip

Example

I have 4,000 IPs from yesterday's logs. Can you check them all for proxies and VPNs?

Your list has 4,000 entries, and 312 are duplicates or private addresses, so 3,688 unique public IPs remain. On the free plan that is a lot of credits in one run, so I would start with a sample of 20 to confirm the output and estimate cost. Once you say yes, I will run the rest in chunks and report how many came back.

Use in RevampKeyRead the full skill →

Read-only5 IPGeolocation.io tools

Prepare an abuse report for an offending IP

Finds the network responsible for an IP address, including its ASN owner and published abuse contact, and drafts an evidence-backed abuse report. The report is for you to review and send yourself; the assistant never sends it.

Use it when

You are seeing repeated login attempts or scraping from one address and want to report the network
A hosting provider's customer is sending spam or fraud and you need the right abuse desk
You need to find out who owns an IP block before escalating an attack

Tools it uses

lookup_asn
get_abuse_contact
lookup_network
lookup_ip
check_security

Example

Our API got 4,200 login attempts from 203.0.113.45 between 02:10 and 02:40 UTC yesterday. Who do I report this to and can you draft the email?

That address belongs to a hosting provider, AS64500 Example Cloud, whose published abuse contact is abuse@examplecloud.example. The lookup shows a single static address in a hosting block, so the report is strong. I drafted it with the time window, the 4,200 attempts and two redacted log lines. Please review it and send it from your own mailbox, and include the source port if you have it so the provider can trace the customer.

Use in RevampKeyRead the full skill →

Read-only8 IPGeolocation.io tools

Enrich access logs and summarise where your traffic comes from

Enriches the unique IPs and user agents in your logs or signups with location, network, company and device details, then summarises which countries, networks and devices make up your traffic and what looks out of place. It gives an overview to read, not a block or allow verdict per address.

Use it when

You want to know which countries and networks your signups actually come from
Your logs show a spike and you need to see what drove it
You want the device and browser mix of your visitors without reading raw user agents

Tools it uses

get_my_ip
bulk_lookup_ip
lookup_company
lookup_asn
bulk_parse_user_agent
bulk_security_check
lookup_network
get_timezone

Example

Here is last week's signup log export. Where does the traffic come from, and is anything odd about it?

Of 14,200 requests from 3,150 unique IPs, 61% came from two countries, and the top cloud provider carried 18% of requests from 40 addresses. Consumer ISPs made up 74% of requests. Mobile Safari dominated devices, but 9% of requests used one outdated desktop build from a single hosting network, which is worth a closer look. City-level results are approximate.

Use in RevampKeyRead the full skill →

Read-only3 IPGeolocation.io tools

IP threat triage with AI

Judges whether one or many IP addresses are proxies, VPNs, Tor exits, bots, hosting ranges or abuse sources, and recommends block, challenge, watch or allow for each, with reasons. It asks for context before any change.

Use it when

A login or signup comes from an address you want to vet
A checkout shows a burst of orders from one range
You want a list of risky addresses from today's logs

Tools it uses

get_my_ip
check_security
bulk_security_check

Example

Should I block these 12 IPs that tried to log into customer accounts overnight?

Of the 12 addresses, 2 are Tor exits with login bursts, so I recommend blocking those. 5 sit in hosting ranges on sensitive logins, so I suggest challenging them. 4 are VPN-only and low volume, so I would watch them. 1 looks clean and I would allow it. Nothing is blocked until you confirm.

Use in RevampKeyRead the full skill →

Get all 4 without copying a file

RevampKey adds the skills when you connect IPGeolocation.io, updates them for you and removes them when you disconnect.

Download RevampKey

How IPGeolocation.io skills work

Connect IPGeolocation.io
The IPGeolocation.io MCP server gives the agent its tools.
Ask in plain words
“Our API got 4,200 login attempts from 203.0.113.45 between 02:10 and 02:40 UTC yesterday. Who do I report this to and can you draft the email?” Each SKILL.md says when it applies, so only the one that fits is loaded.
Approve any change
The agent calls the tools in order, checks its work, and shows you any change before it makes it.

How to install IPGeolocation.io skills

In RevampKey the skills install themselves when you connect IPGeolocation.io. In other tools each skill is one folder with a SKILL.md file, and you also need the IPGeolocation.io MCP server connected there.

About 1 minute · nothing to copy

Download RevampKey for Mac, Windows or Linux and sign in.
Open Connectors and connect IPGeolocation.io. All 4 skills come with it and stay up to date; they go away when you remove the connector.
Ask in plain language, for example “Our API got 4,200 login attempts from 203.0.113.45 between 02:10 and 02:40 UTC yesterday. Who do I report this to and can you draft the email?”
Download RevampKeyConnect IPGeolocation.io · 1 click
Get RevampKey to connect IPGeolocation.io
RevampKey is a free desktop app for Mac, Windows and Linux. Install it, sign in, and IPGeolocation.io is one click away with its skills already attached.
Download RevampKey
Not now? Use the skills in your current tool
for s in essentials abuse-report-prep access-log-enrichment ip-threat-triage; do curl -fsSL --create-dirs -o .claude/skills/ipgeolocation-io-mcp-server-$s/SKILL.md https://revampkey.com/marketplace/ipgeolocation-io-mcp-server/skills/$s/SKILL.md done
Other tools

Into this project’s .claude/skills folder

Connect the IPGeolocation.io MCP server in Claude Code.

Run this in your project folder to add all 4 skills:

for s in essentials abuse-report-prep access-log-enrichment ip-threat-triage; do
  curl -fsSL --create-dirs -o .claude/skills/ipgeolocation-io-mcp-server-$s/SKILL.md https://revampkey.com/marketplace/ipgeolocation-io-mcp-server/skills/$s/SKILL.md
done

Ask in plain language, for example “Our API got 4,200 login attempts from 203.0.113.45 between 02:10 and 02:40 UTC yesterday. Who do I report this to and can you draft the email?”

Into the shared .agents/skills folder

Connect the IPGeolocation.io MCP server in Cursor.

Run this in your project folder to add all 4 skills:

for s in essentials abuse-report-prep access-log-enrichment ip-threat-triage; do
  curl -fsSL --create-dirs -o .agents/skills/ipgeolocation-io-mcp-server-$s/SKILL.md https://revampkey.com/marketplace/ipgeolocation-io-mcp-server/skills/$s/SKILL.md
done

Ask in plain language, for example “Our API got 4,200 login attempts from 203.0.113.45 between 02:10 and 02:40 UTC yesterday. Who do I report this to and can you draft the email?”

Into the shared .agents/skills folder

Connect the IPGeolocation.io MCP server in Codex.

Run this in your project folder to add all 4 skills:

for s in essentials abuse-report-prep access-log-enrichment ip-threat-triage; do
  curl -fsSL --create-dirs -o .agents/skills/ipgeolocation-io-mcp-server-$s/SKILL.md https://revampkey.com/marketplace/ipgeolocation-io-mcp-server/skills/$s/SKILL.md
done

Ask in plain language, for example “Our API got 4,200 login attempts from 203.0.113.45 between 02:10 and 02:40 UTC yesterday. Who do I report this to and can you draft the email?”

Into the shared .agents/skills folder

Connect the IPGeolocation.io MCP server in VS Code.

Run this in your project folder to add all 4 skills:

for s in essentials abuse-report-prep access-log-enrichment ip-threat-triage; do
  curl -fsSL --create-dirs -o .agents/skills/ipgeolocation-io-mcp-server-$s/SKILL.md https://revampkey.com/marketplace/ipgeolocation-io-mcp-server/skills/$s/SKILL.md
done

Ask in plain language, for example “Our API got 4,200 login attempts from 203.0.113.45 between 02:10 and 02:40 UTC yesterday. Who do I report this to and can you draft the email?”

RevampKey or copy the files?

In RevampKey

One click when you connect IPGeolocation.io
Updated for you when a skill improves
Removed when you disconnect
The MCP server is set up for you
800+ other connectors, same way

Download free

Copy into your project

One command per project
Run it again to get updates
You connect the IPGeolocation.io MCP server yourself
Works in Claude Code, Cursor, Codex and VS Code

See the command

IPGeolocation.io skills FAQ

What is a IPGeolocation.io agent skill?

A SKILL.md file: a short playbook an AI agent loads when your request matches it. Each IPGeolocation.io skill describes one job, which IPGeolocation.io tools to use in which order, what to check first and when to stop and ask you.

Do the IPGeolocation.io skills change anything on their own?

4 of the 4 only read. The others tell the agent to show you the change and wait for a yes before it creates, edits or deletes anything in IPGeolocation.io.

Which tools can use these skills?

Any agent that reads the open Agent Skills format: Claude Code, Cursor, Codex, VS Code with Copilot and RevampKey. In RevampKey they are attached when you connect IPGeolocation.io; elsewhere you copy the folders into your project or skills directory.

Do I need the IPGeolocation.io MCP server too?

Yes. The skills tell the agent how to do the work; the IPGeolocation.io MCP server gives it the tools to do it. The IPGeolocation.io MCP setup guide covers every client.

IPGeolocation.io MCP server setup · This page as Markdown

Put IPGeolocation.io’s best workflows in your agent

Download RevampKey, connect IPGeolocation.io and ask your first question in about a minute.

Download RevampKey Connect IPGeolocation.io · 1 click

All 4 IPGeolocation.io skills

Use the IPGeolocation.io connector safely

Use it when

Tools it uses

Prepare an abuse report for an offending IP

Use it when

Tools it uses

Enrich access logs and summarise where your traffic comes from

Use it when

Tools it uses

IP threat triage with AI

Use it when

Tools it uses

Get all 4 without copying a file

How IPGeolocation.io skills work

How to install IPGeolocation.io skills

RevampKey or copy the files?

In RevampKey

Copy into your project

IPGeolocation.io skills FAQ

Put IPGeolocation.io’s best workflows in your agent

Skills for related tools