Look up limited public IP intelligence — cloud-hosting ranges and Tor exit nodes — from Claude, Cursor, or another MCP client. Powered by the Maskbreak fraud detection API. Requires Node.js 18+ for the local server.

Tools

Tool	What it does
`lookup_ip`	Public IPv4/IPv6 lookup: `known`, `allow` / `review` / `block`, risk score, and nullable signal/network metadata. Public-feed coverage is limited to cloud hosting and Tor.
`service_status`	Maskbreak API health, uptime, and latency

Setup

Grab a free API key at maskbreak.com/signup (1,000 lookups/hour, shared with evaluations, no card). Keyless mode uses the free web-tool endpoint, limited to 12 lookups/minute and 80/day per caller IP. Additional endpoint and abuse-protection limits can apply.

Neither mode performs a browser visit. VPN/proxy and device evidence require a browser-SDK-backed /v1/evaluate request outside these tools; service names are available only when known. Unknown IPs, false signals and allow verdicts are not proof of safety.

Claude Code

claude mcp add sentinel -e MASKBREAK_API_KEY=sk_live_your_key -- npx -y @sentinelsup/mcp

Claude Desktop

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "sentinel": {
      "command": "npx",
      "args": ["-y", "@sentinelsup/mcp"],
      "env": { "MASKBREAK_API_KEY": "sk_live_your_key" }
    }
  }
}

Cursor / other MCP clients

Any client that speaks stdio MCP works the same way: command npx, args ["-y", "@sentinelsup/mcp"], env MASKBREAK_API_KEY.

Hosted endpoint (no install)

Prefer a remote server? The same tools are hosted at https://maskbreak.com/mcp (Streamable HTTP). Point any URL-based MCP client at it; pass your API key as an Authorization: Bearer header for full quota.

Example

"What public-feed evidence is available for this IP?"

Illustrative unknown-IP response, not a live lookup:

{
  "ip": "192.0.2.1",
  "known": false,
  "verdict": "allow",
  "risk_score": 0,
  "signals": null,
  "network": null
}

Environment

Variable	Required	Default	Purpose
`MASKBREAK_API_KEY`	recommended	—	API key from your dashboard; unlocks 1,000 lookups/hour. Since v0.1.5; the older `SENTINEL_API_KEY` name is still read
`SENTINEL_BASE_URL`	no	`https://maskbreak.com`	Override for testing

Failures and local checks

Both tools return MCP isError: true for HTTP failures, malformed responses or requests that exceed the five-second timeout (including body reads). An unavailable lookup is not an allow decision.

npm ci --ignore-scripts
npm test
npm pack --dry-run --ignore-scripts
npm audit

Tests use a real stdio MCP client with loopback HTTP fixtures, without production keys. CI checks Node.js 18, 22 and 24. No package is published by these checks.