VPN Detector Skill

Overview

A VPN detection and VPN lookup API for any IPv4 or IPv6 address. It checks the IP against lists of commercial VPN exit ranges and cloud and hosting datacenter ranges, refreshed daily, and returns is_vpn and is_datacenter flags as JSON. It also flags iCloud Private Relay addresses from the egress list Apple publishes, which commercial VPN lists wrongly include, so Safari users are not rated as VPN traffic. There is no separate proxy flag: proxies hosted in a datacenter show up through is_datacenter, and residential proxies are not detected. Paid plans add Tor exit node status, the ASN and network name, and a risk and threat level derived from those flags.

Live Test VPN Detector Skill Skill →

The tool

Once your client is connected to the VerveKit server, this appears in its tool list as VPNDetectorSkill. It is read-only and open-world — it fetches and never mutates anything on your side — so most clients call it without asking you to confirm.

Tool call

{
  "name": "VPNDetectorSkill",
  "arguments": {
    "ip": "103.62.49.210"
  }
}

You do not name the tool yourself; the model picks it. Asking about 103.62.49.210 in the terms this skill covers is enough for it to reach for VPNDetectorSkill on its own — naming it explicitly also works, and is the way to force the call.

Connecting

One server URL covers every skill in the catalog, including this one. Authorization is OAuth: the client opens a browser once, and there is no key to paste into a config file.

{
  "mcpServers": {
    "vervekit": {
      "url": "https://api.vervekit.com/v1/mcp"
    }
  }
}

Per-client setup — Claude, Cursor, VS Code, ChatGPT — is on the MCP setup page.

Arguments

These are the properties on the tool's inputSchema, so a well-behaved client validates them before the call is made. Premium arguments are accepted on every plan but only take effect on plans that include them.

Argument	Type	Description
`ip`Required	string	The IP address you want to check for VPN usage ip

What the model gets back

The result carries a structuredContent object matching the tool's declared outputSchema, so a client reads fields without parsing prose. status is "ok" and error is null on success; a null field means the value was not available for that input, not that the call failed.

Result

{
  "status": "ok",
  "error": null,
  "data": {
    "ip": "103.62.49.210",
    "is_vpn": false,
    "is_datacenter": true,
    "is_tor": false,
    "is_relay": false,
    "is_public": true,
    "asn": "AS137409",
    "asn_name": "GSLNETWORKS-AS-AP GSL Networks Pty LTD",
    "hosting_provider": null,
    "checked_on": "2026-10-26",
    "risk_level": "Moderate",
    "threat_level": "Low"
  }
}

Response fields

Paths are relative to data. Premium fields are absent rather than zeroed on plans that do not include them, so check for presence instead of comparing to 0.

Field	Type	Example	Description
`ip`	string	`103.62.49.210`	The IP address that was checked for VPN usage
`is_vpn`	boolean	`false`	Whether the IP address is using a VPN service
`is_datacenter`	boolean	`true`	Whether the IP belongs to a datacenter or cloud provider
`is_tor`Premium	boolean	`false`	Whether the IP is a known Tor exit node; null if the Tor list could not be checked
`is_relay`	boolean	`false`	Whether the IP is an iCloud Private Relay egress address, from the list Apple publishes; these users are ordinary Safari users even when is_vpn is also true. Null if the relay list could not be checked
`is_public`	boolean	`true`	Whether the IP is publicly routable; false for private, loopback, link-local and reserved addresses
`asn`Premium	string	`AS137409`	Autonomous System Number announcing the IP (e.g., AS16509); null if unrouted
`asn_name`Premium	string	`GSLNETWORKS-AS-AP GSL Networks Pty LTD`	Registered name of that AS (e.g., AMAZON-02), not always the company name
`hosting_provider`Premium	object	`null`	The cloud or hosting company the IP belongs to, such as Amazon Web Services, Google Cloud, DigitalOcean, Hetzner or M247, for about 30 providers that carry most server, VPN and bot traffic; null for home and mobile networks and for providers not on the list
`checked_on`	string	`2026-10-26`	The date when the IP was last checked for VPN status
`risk_level`Premium	string	`Moderate`	Overall risk of the IP address: High for Tor exits and VPNs, Moderate for iCloud Private Relay and datacenter-only addresses, Low otherwise
`threat_level`Premium	string	`Low`	How strongly the IP anonymises its user: High for Tor exits, Moderate for VPNs, Low otherwise

Failure modes

Errors come back as tool errors carrying a sentence the model can act on, not a bare status code. Error handling covers the full list.

Status	What it means
`400` / `422`	The arguments did not validate. The message names the offending one.
`401`	The OAuth session is invalid or expired — reconnect the server.
`403`	Blocked by a key restriction or an IP allow-list. Never a bad identity.
`404`	This skill is not part of VerveKit. Check the catalog.
`429`	Out of credits, or a brief rate limit. The message tells them apart.

A call costs 10 credits each time the tool actually runs; a model that reasons about the tool without calling it costs nothing.

Use cases

Fraudulent Signup Prevention: To stop fake account spam, security platforms verify visitor IPs at registration to block traffic originating from known commercial VPNs and cloud servers.
Streaming Rights Compliance: Media providers check playback requests against datacenter and VPN flags to enforce territorial broadcasting rights on copyrighted video catalogs.
Payment Gateway Screening: When an online order is submitted, checkout systems check the buyer IP to trigger extra authentication steps if it belongs to a datacenter network.
Ad Click Validation: Advertising networks filter invalid traffic by screening incoming ad impressions for datacenter hosting IPs before recording billable user interactions.

Other ways to use VPN Detector Skill

Set up VPN Detector Skill on VerveKit, or reach the same source a different way. Your VerveKit account and credits work on all of them — one key, one balance.

Call it as a REST APIOne HTTPS endpoint and an x-api-key header, with SDKs for Node, Python and .NET.APIVerve →Reference →

Google Sheets or ExcelA =VERVE() formula fills a column — no script, no export, recalculates in place.VerveSheets →Reference →

Ground an agent on itA cited, machine-checkable fact your model can't produce on its own.VerveContext →Reference →

Pages that use this skill:

Block fake signupsGuides