Claude IP Risk Score Connector. The full guide.
Setup, tools, prompts, rate limits, and privacy details for the Fraudlogix IP Risk Score connector for Claude. Everything you need to go from signup to your first risk lookup.
What the connector does.
The Fraudlogix IP Risk Score connector lets you check whether IP addresses are risky directly from a Claude conversation. Paste a list, attach a CSV, or quote log lines into the chat, and Claude calls the Fraudlogix IP Risk Score API to return a categorical risk level (Low, Medium, High, or Extreme) along with threat indicators such as VPN, proxy, TOR exit, datacenter, search-engine bot, masked-device, and abnormal-traffic flags.
The connector exposes two read-only tools backed by the Fraudlogix IP Risk Score API. Together they let you triage large IP lists in bulk, then drill into specific addresses for full per-IP detail. Common workflows include:
- Advertising traffic quality and ad fraud detection. Spot invalid traffic (IVT) in campaign logs, audit suspicious clicks, and validate inventory sources. The Fraudlogix data network reports a 20.64% global IVT rate, and the connector lets analysts surface that traffic without leaving Claude.
- Lead generation and form validation. Score lead-form submissions and signup events to filter out bots, masked devices, and low-quality traffic before they hit your CRM.
- Security operations and fraud investigation. Triage suspicious source IPs from server logs, SIEM alerts, or incident tickets.
- Fintech and compliance review. Flag high-risk connection types, anonymizing services, and abnormal traffic patterns during onboarding or transaction review.
- Analyst and research workflows. Any task where you need fast, accurate IP intelligence inside the assistant you already use.
The Fraudlogix IP Risk Score API is built on a real-time signal network monitoring 300 million URLs and 1.2 billion devices and IPs per month, with hourly blocklist updates and a 16-year track record in fraud and traffic-quality intelligence.
Prerequisites.
Before adding the connector, you need:
- A Fraudlogix account. Sign up at ipui.fraudlogix.com/claude if you do not already have one. The free tier includes 1,000 lookups per month with no credit card required.
- A Claude account on a plan that supports custom connectors. Connector availability depends on Anthropic’s current plan structure; check your Claude settings if you are unsure.
You do not need to install anything locally. The connector is a remote MCP server hosted by Fraudlogix.
Setup.
Step 1: Add Fraudlogix from the Claude connector directory
In Claude, open Settings, then Connectors. Search the directory for Fraudlogix and click Connect. The connector is hosted by Fraudlogix and runs on a remote MCP server, so there is nothing to install locally.
If the Fraudlogix listing is not yet visible on your account, you can add it manually. In Settings → Connectors → Add custom connector, enter the server URL https://mcp.fraudlogix.com/mcp and save. The custom-connector and directory paths are functionally identical.
Step 2: Connect your Fraudlogix account
After clicking Connect, Claude opens the Fraudlogix authorization page in a new window. Enter your Fraudlogix login credentials and click Approve. The connection is established immediately and Claude is ready to start checking IPs.
Step 3: Verify the connection
In a new chat, ask Claude:
Are you connected to Fraudlogix? Run a quick check on 8.8.8.8.
Claude should call check_ip_risk with 8.8.8.8 and return a short risk report. If you see an authentication error instead, disconnect and reconnect the connector.
Tool reference.
The connector exposes two tools. Both are read-only and idempotent, so Claude can run them without per-call confirmation.
check_ip_risk
Analyzes 1 to 50,000 IP addresses in a single call. Returns an aggregated summary (risk distribution, threat indicator counts) plus the top 20 highest-risk IPs with key flags. Use this as your starting point for any IP risk question.
Inputs (provide one of the following)
| Parameter | Type | Description |
|---|---|---|
raw_text |
string | Mixed text containing IP addresses anywhere within it (CSV rows, log lines, pasted exports, free-form notes). The server extracts all IPv4 and IPv6 addresses, including bracketed, zone-ID, and CIDR forms. |
ips |
array of strings | Pre-parsed list of IPv4 or IPv6 addresses. Use this when you already have a clean list. |
Limits: 50,000 IPs per call. For larger workloads, split across multiple calls.
Example prompt
Here are 200 IPs from yesterday’s API gateway logs. Run a risk check and tell me which ones are most concerning.
198.51.100.4 200 GET /login 203.0.113.55 401 GET /admin 192.0.2.13 200 POST /checkout ...
Example output (rendered by Claude into chat)
FraudLogix IP Risk Report — 200 IPs analysed
====================================================
Risk Distribution:
Extreme : 12
High : 34
Medium : 61
Low : 93
Threat Indicators (IPs flagged):
VPN : 28
Proxy : 15
TOR Exit Node : 4
Data Center : 41
Search Engine Bot: 6
Masked Devices : 9
Abnormal Traffic : 22
Top Fraud IPs:
203.0.113.55 [Extreme] Events:84 VPN Proxy DataCenter AbnormalTraffic
198.51.100.4 [Extreme] Events:62 VPN DataCenter
...
Tip: Use get_ip_details with specific IPs to retrieve full data for any address above.get_ip_details
Retrieves the complete Fraudlogix risk profile for a specific set of IPs. Use this after check_ip_risk when you need every field for an address, or when you want to investigate a small list directly.
Inputs (provide one of the following)
| Parameter | Type | Description |
|---|---|---|
raw_text |
string | Same extraction behavior as check_ip_risk. |
ips |
array of strings | Specific IPv4 or IPv6 addresses to look up in full detail. |
Limits: 500 IPs per call.
Returned fields per IP
- Risk level (Low, Medium, High, Extreme)
- VPN, proxy, TOR, datacenter, search-engine bot, masked-device, abnormal-traffic flags
- Risk events detected (count, past 60 days)
- ASN, organization, ISP, connection type
- City, region, country, timezone
Example prompt
Give me the full Fraudlogix profile for 8.8.8.8 and 1.1.1.1, side by side.
Claude returns the full JSON record for each address along with a plain-language summary you can copy into a ticket or report.
Example prompts.
These prompts each exercise different parts of the connector. Copy any of them into a Claude chat once the connector is connected.
1. Mixed-text triage from log lines
Check these IPs for risk. Tell me which ones are using VPNs or coming from datacenters.
2025-05-06 14:22:11 198.51.100.7 GET /api/v1/users 200 2025-05-06 14:22:14 203.0.113.42 POST /api/v1/login 401 2025-05-06 14:22:15 192.0.2.88 GET /api/v1/orders 200
2. Ad traffic quality and IVT audit
Attached is yesterday’s click log (5,000 IPs). Summarize the risk distribution, flag what percentage looks like invalid traffic (datacenter, VPN, proxy, abnormal traffic), and list the top 10 worst offenders so I can blocklist them.
3. Targeted deep-dive
For the top three Extreme-risk IPs in your last report, pull the full Fraudlogix profile and write a one-paragraph summary I can paste into our incident ticket.
4. CIDR and IPv6 handling
Check whether any of these are risky: 192.0.2.0/24, 2001:db8::1, [2001:db8::2]:443, fe80::1%eth0
The connector extracts and normalizes all four address formats automatically.
5. Lead validation
Here are 50 IPs from this week’s lead form submissions. Tell me which ones are likely bots or masked devices and which look like genuine prospects.
Rate limits & quota behavior.
Account quota
The free tier allows 1,000 lookups per month. Each IP analyzed counts as one lookup, so a single check_ip_risk call with 200 IPs uses 200 lookups. To raise the quota, upgrade your plan at ipui.fraudlogix.com/account.
When the quota is exhausted
The connector returns a clear QUOTA EXCEEDED message inside the chat with a link to the upgrade page. No partial data is returned, and no charges are incurred. After upgrading, simply ask Claude to run the lookup again.
Per-call limits
| Tool | Maximum IPs per call |
|---|---|
check_ip_risk |
50,000 |
get_ip_details |
500 |
Performance
The MCP server fans out lookups in parallel (up to 500 concurrent connections to the underlying API), and individual lookups typically return in under 50 ms. A 5,000-IP check_ip_risk call usually completes in a few seconds.
Errors
Invalid IPs are skipped and reported in the response. Authentication failures, timeouts, and request errors return actionable messages so Claude can explain what went wrong.
Privacy & data handling.
The connector is read-only. It accepts IP addresses you submit through Claude tool calls and forwards them to the Fraudlogix IP Risk Score API for analysis. It does not access your Claude conversation history, files you have uploaded to Claude, or any other Anthropic-stored data.
Your Fraudlogix API key is encrypted with AES-256-GCM during OAuth authorization and is decrypted only in memory on the MCP server during each request. It is never written to disk or to application logs.
For full details, including third-party processors, retention practices, and your data subject rights, see:
Support.
Reach out to the right person and you’ll get a faster answer:
Integration & bugs
Setup issues, tool errors, integration questions, bug reports.
Account & access
Account access, allowlisting, onboarding, key rotation.
For general questions about Fraudlogix and the IP Risk Score API, visit fraudlogix.com.