VPN Detection Grounding Data

Overview

A VPN and proxy detection API. Send an IPv4 or IPv6 address to inspect its routing and hosting profile against daily updated network lists. The API flags whether the address routes through a commercial VPN or a cloud datacenter. Paid plans also return Tor exit node status, Autonomous System Numbers (ASN), and assigned risk and threat levels.

Live Test VPN Detection Grounding Data Source →

The tool

Once your client is connected to the VerveContext server, this appears in its tool list as VPNDetectionGroundingData. It is read-only and open-world — it fetches and never mutates anything on your side — so most clients call it without asking you to confirm.

Tool call

{
  "name": "VPNDetectionGroundingData",
  "arguments": {
    "ip": "103.62.49.210"
  }
}

You do not name the tool yourself; the model picks it. Asking about 103.62.49.210 in the terms this source covers is enough for it to reach for VPNDetectionGroundingData on its own — naming it explicitly also works, and is the way to force the call.

Connecting

One server URL covers every source in the catalog, including this one. Authorization is OAuth: the client opens a browser once, and there is no key to paste into a config file.

{
  "mcpServers": {
    "vervecontext": {
      "url": "https://api.vervecontext.com/v1/mcp"
    }
  }
}

Per-client setup — Claude, Cursor, VS Code, ChatGPT — is on the MCP setup page.

Arguments

These are the properties on the tool's inputSchema, so a well-behaved client validates them before the call is made. Premium arguments are accepted on every plan but only take effect on plans that include them.

Argument	Type	Description
`ip`Required	string	The IP address you want to check for VPN usage ip

What the model gets back

The result carries a structuredContent object matching the tool's declared outputSchema, so a client reads fields without parsing prose. status is "ok" and error is null on success; a null field means the value was not available for that input, not that the call failed.

Result

{
  "status": "ok",
  "error": null,
  "data": {
    "ip": "103.62.49.210",
    "is_vpn": false,
    "is_datacenter": true,
    "is_tor": false,
    "asn": "AS137409",
    "asn_name": "GSLNETWORKS-AS-AP GSL Networks Pty LTD",
    "checked_on": "2026-09-14",
    "risk_level": "Moderate",
    "threat_level": "Low"
  }
}

Response fields

Paths are relative to data. Premium fields are absent rather than zeroed on plans that do not include them, so check for presence instead of comparing to 0.

Field	Type	Example	Description
`ip`	string	`103.62.49.210`	The IP address that was checked for VPN usage
`is_vpn`	boolean	`false`	Whether the IP address is using a VPN service
`is_datacenter`	boolean	`true`	Whether the IP belongs to a datacenter or cloud provider
`is_tor`Premium	boolean	`false`	Whether the IP is a known Tor exit node; null if the Tor list could not be checked
`asn`Premium	string	`AS137409`	Autonomous System Number announcing the IP (e.g., AS16509); null if unrouted
`asn_name`Premium	string	`GSLNETWORKS-AS-AP GSL Networks Pty LTD`	Registered name of that AS (e.g., AMAZON-02), not always the company name
`checked_on`	string	`2026-09-14`	The date when the IP was last checked for VPN status
`risk_level`Premium	string	`Moderate`	Overall risk of the IP address: High for Tor exits and VPNs, Moderate for datacenter-only addresses, Low otherwise
`threat_level`Premium	string	`Low`	How strongly the IP anonymises its user: High for Tor exits, Moderate for VPNs, Low otherwise

Why ground on it

A model can produce something that looks like this answer from its training data, and be confidently out of date or simply wrong. This source returns the current value in a shape you can check, which is the difference between an answer you can cite and one you have to hedge.

Point an evaluation at is_vpn: it is the field most worth pinning a claim to, and it is either present and current or absent — never plausibly invented.

Failure modes

Errors come back as tool errors carrying a sentence the model can act on, not a bare status code. Error handling covers the full list.

Status	What it means
`400` / `422`	The arguments did not validate. The message names the offending one.
`401`	The OAuth session is invalid or expired — reconnect the server.
`403`	Blocked by a key restriction or an IP allow-list. Never a bad identity.
`404`	This source is not part of VerveContext. Check the catalog.
`429`	Out of credits, or a brief rate limit. The message tells them apart.

A call costs 10 credits each time the tool actually runs; a model that reasons about the tool without calling it costs nothing.

Use cases

Fraudulent Signup Prevention: To stop fake account spam, security platforms verify visitor IPs at registration to block traffic originating from known commercial VPNs and cloud servers.
Streaming Rights Compliance: Media providers check playback requests against datacenter and VPN flags to enforce territorial broadcasting rights on copyrighted video catalogs.
Payment Gateway Screening: When an online order is submitted, checkout systems check the buyer IP to trigger extra authentication steps if it belongs to a datacenter network.
Ad Click Validation: Advertising networks filter invalid traffic by screening incoming ad impressions for datacenter hosting IPs before recording billable user interactions.

Other ways to use VPN Detection Grounding Data

Set up VPN Detection Grounding Data on VerveContext, or reach the same source a different way. Your VerveContext account and credits work on all of them — one key, one balance.

Call it as a REST APIOne HTTPS endpoint and an x-api-key header, with SDKs for Node, Python and .NET.APIVerve →Reference →

Give it to an AI agentConnect over MCP and your agent calls it as a native tool — Claude, Cursor, ChatGPT.VerveKit →Reference →

Google Sheets or ExcelA =VERVE() formula fills a column — no script, no export, recalculates in place.VerveSheets →Reference →