Packetrove

Official5 tools

by euyuil · TypeScript

Open-source IP address and CIDR tools for network calculations and public IP lookup.

io.github.euyuil/packetrove — MCP Server

The io.github.euyuil/packetrove MCP server provides open-source IP address and CIDR tools for network calculations and public IP lookup. It is intended to support workflows that need accurate network math and identification of public IP details.

🛠️ Key Features

IP address tools
CIDR tools
Network calculations
Public IP lookup

🚀 Use Cases

Calculating network-related values from IPs and CIDR ranges
Looking up information associated with a public IP address

⚡ Developer Benefits

Availability of open-source tooling
Supports network calculation and lookup tasks within MCP contexts

⚠️ Limitations

Only IP address/CIDR functions are described; no other capabilities are specified in the provided data.

Topics

cidrdeveloper-toolsipv4ipv6mcpnetwork-toolsnetworkingtypescript

Captured live from the server via tools/list.

cidr-cover

Use when combining a selected group of firewall allowlist or blocklist entries into one smallest covering CIDR, or when checking the exact extra coverage. Accept 1 to 1,000 IP addresses or CIDRs from one address family, up to 64 characters each; normalize host bits and count overlaps once. Return the canonical CIDR, inclusive range, and exact decimal-string counts, including additionalAddressCount. The range may allow or block additional addresses. This computes one CIDR for the supplied inputs; it does not optimize an entire list against an entry limit or change firewall rules. Remote MCP calls submit inputs to this server; the calculation makes no outbound network requests. Operational events record the tool name, success or error, a controlled error code, and a traffic source classification. Verified automated checks may also record an automation run identifier. Events exclude inputs, results, raw request headers, and automation tokens. Cloudflare may attach platform metadata. Privacy policy: https://packetrove.com/privacy.

Parameters1

inputs

array

required

IP addresses or CIDRs from one address family. Surrounding whitespace is ignored during parsing; CIDRs with host bits are normalized.

Raw schema

{
  "type": "object",
  "properties": {
    "inputs": {
      "minItems": 1,
      "maxItems": 1000,
      "type": "array",
      "items": {
        "type": "string",
        "minLength": 1,
        "maxLength": 64
      },
      "description": "IP addresses or CIDRs from one address family. Surrounding whitespace is ignored during parsing; CIDRs with host bits are normalized."
    }
  },
  "required": [
    "inputs"
  ],
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "additionalProperties": false
}

cidr-subtract

Use to prepare WireGuard AllowedIPs exceptions or calculate remaining address space relative to supplied include and exclude lists. Compute union(include) minus union(exclude) as a minimal sorted canonical CIDR list, without adding addresses. Use one address family, a nonempty include list, and at most 1000 entries across both lists, up to 64 characters each. Exclude may be empty. Normalize host bits and count overlaps once. Return cidrs, normalizedInclude, normalizedExclude, and exact decimal-string includedAddressCount, removedAddressCount, remainingAddressCount. Complete removal returns an empty list; more than 10000 output CIDRs returns an error without a partial result. Error issues identify include or exclude and the zero-based entry index. Remote calls submit inputs to this server; the browser calculates locally. This does not inspect live allocation, configure WireGuard, or change firewall rules. Operational events record the tool name, success or error, a controlled error code, and a traffic source classification. Verified automated checks may also record an automation run identifier. Events exclude inputs, results, raw request headers, and automation tokens. Cloudflare may attach platform metadata. Privacy policy: https://packetrove.com/privacy.

Parameters2

include	array	required	The nonempty included address space. Use at most 1,000 entries across include and exclude, from one address family.
exclude	array	required	Ranges to remove from the included address space. An empty array simplifies the exact include union.

Raw schema

{
  "type": "object",
  "properties": {
    "include": {
      "minItems": 1,
      "maxItems": 1000,
      "type": "array",
      "items": {
        "type": "string",
        "minLength": 1,
        "maxLength": 64
      },
      "description": "The nonempty included address space. Use at most 1,000 entries across include and exclude, from one address family."
    },
    "exclude": {
      "maxItems": 1000,
      "type": "array",
      "items": {
        "type": "string",
        "minLength": 1,
        "maxLength": 64
      },
      "description": "Ranges to remove from the included address space. An empty array simplifies the exact include union."
    }
  },
  "required": [
    "include",
    "exclude"
  ],
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "additionalProperties": false
}

range-to-cidrs

Use to prepare an exact CIDR allowlist from one inclusive start/end IPv4 or IPv6 range. Pass start and end IP addresses of the same family, without CIDR prefixes, at most 64 characters each; end must be at or after start. Return canonical range.first and range.last, minimal sorted cidrs, cidrCount, and exact decimal-string addressCount, without adding addresses. Equal endpoints return one /32 or /128; complete address spaces return /0. Invalid inputs identify the start or end field; reversed endpoints are never swapped. Browser calculations stay local; remote MCP calls submit endpoints to this server. This does not inspect live address usage, modify firewall rules, or export vendor-specific ACLs. Operational events record the tool name, success or error, a controlled error code, and a traffic source classification. Verified automated checks may also record an automation run identifier. Events exclude inputs, results, raw request headers, and automation tokens. Cloudflare may attach platform metadata. Privacy policy: https://packetrove.com/privacy.

Parameters2

start	string	required	Inclusive start IP address. Use IPv4 or IPv6 without a CIDR prefix; surrounding whitespace is ignored.
end	string	required	Inclusive end IP address, in the same family and at or after start. Endpoints are never silently swapped.

Raw schema

{
  "type": "object",
  "properties": {
    "start": {
      "type": "string",
      "minLength": 1,
      "maxLength": 64,
      "description": "Inclusive start IP address. Use IPv4 or IPv6 without a CIDR prefix; surrounding whitespace is ignored."
    },
    "end": {
      "type": "string",
      "minLength": 1,
      "maxLength": 64,
      "description": "Inclusive end IP address, in the same family and at or after start. Endpoints are never silently swapped."
    }
  },
  "required": [
    "start",
    "end"
  ],
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "additionalProperties": false
}

certificate-bundle

Use to inspect a supplied PEM certificate bundle before TLS configuration. Accept pem with 1–16 CERTIFICATE blocks and at most 49152 UTF-8 bytes, optional ASCII DNS hostname, and optional zero-based leafIndex. Reject private keys and unsupported blocks without echoing them. Return original certificate positions, Subject, Issuer, Common Name, SANs, validity, CA and Key Usage flags, SHA-256 fingerprints, independently checked candidate links, explicit leaf ambiguity, and stable findings with severity, observed evidence, and nextAction. Verify signatures cryptographically; name matching alone is not verification. Missing supplied issuers are informational, and a failed candidate does not invalidate another viable path. Hostname checks use DNS SAN with one-label complete leftmost wildcards and no Common Name fallback. Results use this server's evaluation time and do not establish client trust, full RFC 5280 path validity, revocation status, or deployment safety. This remote call transmits certificates and hostname to the server; the website checks locally. Certificate input and details never enter application logs. Do not submit private keys. Operational events record the tool name, success or error, a controlled error code, and a traffic source classification. Verified automated checks may also record an automation run identifier. Events exclude inputs, results, raw request headers, and automation tokens. Cloudflare may attach platform metadata. Privacy policy: https://packetrove.com/privacy.

Parameters3

pem	string	required	One or more PEM CERTIFICATE blocks, with only whitespace between blocks. At most 48 KiB of UTF-8 and 16 blocks. Private keys and other block types are rejected.
hostname	string	optional	Optional ASCII DNS hostname, including pre-converted IDNA A-labels. No URL, port, IP address, or wildcard. Blank skips identity checking.
leafIndex	integer	optional	Zero-based original position of a non-CA certificate. Required to resolve multiple possible leaves for hostname checking.

Raw schema

{
  "type": "object",
  "properties": {
    "pem": {
      "type": "string",
      "maxLength": 49152,
      "description": "One or more PEM CERTIFICATE blocks, with only whitespace between blocks. At most 48 KiB of UTF-8 and 16 blocks. Private keys and other block types are rejected."
    },
    "hostname": {
      "description": "Optional ASCII DNS hostname, including pre-converted IDNA A-labels. No URL, port, IP address, or wildcard. Blank skips identity checking.",
      "type": "string",
      "maxLength": 255
    },
    "leafIndex": {
      "description": "Zero-based original position of a non-CA certificate. Required to resolve multiple possible leaves for hostname checking.",
      "type": "integer",
      "minimum": 0,
      "maximum": 15
    }
  },
  "required": [
    "pem"
  ],
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "additionalProperties": false
}

public-ip

Use to inspect the public IPv4 or IPv6 address observed for the connection making this MCP tool call. Takes an empty object and returns ip and family. This is the MCP client connection: a hosted AI client may observe its own exit address, not the user device address. If the user needs their browser or computer connection, direct them to the web tool or a CLI running on that machine. A VPN or proxy changes the observed path. One call observes one address family; it does not discover private local addresses, an address before a proxy, or both address families. The application does not store or log results, and no firewall rules are changed. Cloudflare Worker subrequests can have platform-specific address semantics; the result is not an identity proof. Operational events record the tool name, success or error, a controlled error code, and a traffic source classification. Verified automated checks may also record an automation run identifier. Events exclude inputs, results, raw request headers, and automation tokens. Cloudflare may attach platform metadata. Privacy policy: https://packetrove.com/privacy.

Parameters

No parameters.

Raw schema

{
  "type": "object",
  "properties": {},
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "additionalProperties": false
}

README.md7 KBView on GitHub

Packetrove logo

Packetrove

Network tools for humans and agents.

Packetrove helps developers and network administrators simplify firewall IP lists, subtract networks, convert IP ranges to CIDRs, and check a connection's public IP, and inspect PEM certificate bundles. Use the website for a quick calculation, the API or CLI for scripts, or connect AI agents through Model Context Protocol (MCP).

Website · CIDR calculator · CIDR subtraction · IP range to CIDRs · My Public IP · Certificate Bundle Checker

What you can do

Cover an IP list with one CIDR. Find the smallest IPv4 or IPv6 network covering your inputs, with its full address range and exact additional coverage.
Subtract CIDR lists exactly. Remove excluded networks and copy the smallest CIDR list representing the remaining addresses, without adding addresses.
Convert an IP range exactly. Enter inclusive start and end addresses and copy the minimal CIDR list covering that range, with an exact address count.
Check a connection's public IP. See and copy the IPv4 or IPv6 address observed for the connection making the request.
Inspect a PEM certificate bundle. Paste text or import a file in the browser. Review candidate issuer signatures, validity, duplicates, and an optional DNS hostname, with evidence and next steps.

The website supports ten languages. Hosted tools require no account or API key. All five tools are available through the website, Web API, and MCP. The CLI provides covering-CIDR calculations and public IP lookup.

Browse example results in the homepage gallery, then open a tool to enter your own inputs. Gallery previews use documentation addresses and make no live lookups.

Quick start

Open the CIDR calculator, or call the API:

curl https://api.packetrove.com/v1/cidr-cover \
  -H 'Content-Type: application/json' \
  -d '{"inputs":["203.0.113.1","203.0.113.2","203.0.113.6"]}'

The result is 203.0.113.0/29: eight addresses, including five beyond the three inputs. Review this expansion before using it in an allowlist or blocklist. API address counts are decimal strings to preserve exact IPv6 values.

Use it your way

Interface	Get started
Website	Browse the tools
Web API	Interactive reference · API contract
Command-line interface (CLI)	`npm install --global @packetrove/cli` · CLI guide
Model Context Protocol (MCP)	Connection guide · Technical guide
OpenAI plugin package	Draft package and ZIP build · Not published

The website's main navigation opens browser tools. Its footer groups the API, MCP, and CLI guides; the CLI guide is in English.

Tools share flat public names across interfaces. For changes to existing calls and commands, see the name migration guide.

Privacy and scope

Website CIDR calculations and certificate checks run locally in your browser; CLI calculations run offline. API and remote MCP calculations send inputs to the server.
Certificate checks accept public certificates only and reject private keys. They do not validate full trust paths, revocation, or deployment safety.
Public IP checks make a network request and observe one address family per check. A VPN or proxy supplies its exit address; a hosted MCP client may observe a different connection from your computer's. Browser and CLI lookups have a ten-second deadline and a 64 KiB response limit.
The application does not store or log returned IP addresses. Lookup results and errors are not cached.
MCP execution counts use operational events with the tool name, outcome, controlled error code, and traffic source. Verified automated checks may also record an automation run identifier. Inputs, results, raw request headers, and automation tokens are excluded. The deployment guide describes the free-tier limits and per-tool queries.
Optional MCP submit-feedback is disabled by default. When enabled, it sends a user-authorized synthetic report to hello@packetrove.com by email, with approximate IP-based quotas and mailbox retention managed manually. See the MCP guide.
The Privacy Policy describes remote input processing, browser storage, operational error logs, hosting, retention, and user choices. Cloudflare's platform processing is separate from application storage and logging.

For input formats, limits, and detailed behavior, see the covering-CIDR, CIDR subtraction, IP range conversion, certificate diagnostics, and public IP guides.

Development

Use the Node.js version in .node-version and the pnpm version in package.json. Local development needs no production credentials.

pnpm install
pnpm dev:web

Open http://127.0.0.1:5173. For the API and MCP, run pnpm dev:api in another terminal; they listen at http://localhost:8787. Local public IP lookup requires Cloudflare connection metadata and reports CLIENT_IP_UNAVAILABLE without it. See Contributing for complete setup, checks, and Git hooks.

Documentation and contributing

License

Packetrove is licensed under the MIT License. Bundled components retain their own licenses; see the website notices and CLI notices. Vendored validation schemas retain their Apache-2.0 license and provenance.

Install

Tools (5)

cidr-covercidr-subtractrange-to-cidrscertificate-bundlepublic-ip

Remote endpoint

Streamable HTTP

Hosted server - connect over the network, no local install.

url

https://api.packetrove.com/mcp

Add to VS Code Add to Cursor

claude_desktop_config.json

json

{
  "mcpServers": {
    "packetrove": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://api.packetrove.com/mcp"
      ]
    }
  }
}

Desktop config is stdio-only; this bridges via mcp-remote. Native remote: Settings > Connectors.

io.github.euyuil/packetrove — MCP Server

🛠️ Key Features

🚀 Use Cases

⚡ Developer Benefits

⚠️ Limitations

Topics

cidr-cover

cidr-subtract

range-to-cidrs

certificate-bundle

public-ip

Packetrove

What you can do

Quick start

Use it your way

Privacy and scope

Development

Documentation and contributing

License

Install

Remote endpoint

Related servers