AVAILABLE

Security

IP Address & CIDR Guard

Canonicalize literal IPv4 and IPv6 values, check CIDR containment or overlap, build an exact network cover, and enforce explicit destination policy without DNS or network access.

Get an API key on RapidAPIOpenAPI →

CONTRACT

Predictable for agents. Legible for reviewers.

REST
POST /v1/ip/policy-check
MCP tool
check_ip_address_policy
Inputs
One conventional IPv4 or IPv6 literal, or bounded literal/CIDR collections depending on the operation, plus optional explicit allow, deny, and address-class policy.
Returns
CLEAR, REVIEW_REQUIRED, or BLOCKED with canonical values, exact containment or overlap evidence, address-class properties, matched networks, named findings, and an agent-readable next action.
Latency
Synchronous
Usage unit
IP operation

The focused suite also exposes /v1/ip/inspect, /v1/ip/cidr/contains, /v1/ip/cidr/overlap, and /v1/ip/cidr/summarize plus the separate /mcp/ip server. It rejects ambiguous IPv4 forms, whitespace, controls, and IPv6 zone identifiers. It never resolves DNS, opens a socket, follows a redirect, fetches geolocation or reputation data, or stores the payload. A CLEAR result applies only to the supplied literal and is not runtime network authorization.

AGENT-READABLE EXCEPTIONS

IP_DENIED_NETWORKIP_NOT_IN_ALLOWLISTIP_METADATA_TARGET_BLOCKEDIP_TRANSITION_ADDRESS_BLOCKEDIP_LOOPBACK_BLOCKEDIP_LINK_LOCAL_BLOCKEDIP_PRIVATE_BLOCKEDIP_OUTPUT_TOO_LARGE
HTTP request
POST /v1/ip/policy-check
Authorization: Bearer apc_...
Content-Type: application/json

{
  "candidate": "8.8.8.8",
  "allowed_networks": [
    "8.8.8.0/24"
  ],
  "require_allowlist": true
}
cURL (bash)
curl --request POST \
  --url 'https://api-production-9502.up.railway.app/v1/ip/policy-check' \
  --header 'Authorization: Bearer ${AP_CONTROL_API_KEY}' \
  --header 'Content-Type: application/json' \
  --data '{
  "candidate": "8.8.8.8",
  "allowed_networks": [
    "8.8.8.0/24"
  ],
  "require_allowlist": true
}'
Representative response
{
  "status": "COMPLETED",
  "decision": "CLEAR",
  "permitted": true,
  "candidate": "8.8.8.8",
  "version": 4,
  "properties": {
    "global_unicast": true,
    "private": false,
    "loopback": false,
    "link_local": false,
    "multicast": false,
    "reserved": false,
    "unspecified": false,
    "documentation": false,
    "benchmark": false,
    "shared_address_space": false,
    "known_metadata_target": false,
    "embedded_ipv4": null,
    "transition_mechanism": null
  },
  "matched_allowed_networks": [
    "8.8.8.0/24"
  ],
  "matched_denied_networks": [],
  "findings": [],
  "static_analysis_only": true,
  "dns_resolved": false,
  "network_access_performed": false,
  "payload_stored": false,
  "next_action": "Apply the same decision after DNS resolution and on every redirect, then enforce it in the network layer."
}
No DNS or network accessThe API accepts literal addresses only; it never resolves a hostname, opens a socket, follows a redirect, or retrieves geolocation or reputation data.
Exact dual-stack mathIPv4 and IPv6 containment, overlap, and summarization use canonical integer ranges and are never mixed across address families.
Runtime enforcement requiredA CLEAR literal must be checked again after DNS resolution and on every redirect, then enforced in the actual network client or egress layer.

Use IP Address & CIDR Guard through RapidAPI.

Choose a capped marketplace plan, copy the generated request, and route the structured result through your own authorized workflow.

Get an API key on RapidAPICompare marketplace controls →