automateyournetwork/gtrace-ip-enrichment
workspace/skills/gtrace-ip-enrichment/SKILL.md
IP address enrichment — ASN ownership lookup, geolocation (city/region/country/coordinates), and reverse DNS resolution. Use when identifying who owns an IP address, locating an IP geographically, resolving reverse DNS for a traceroute hop, or enriching unknown IPs from logs or flow data.
$ install --global
skillsauthnpx skillsauth add automateyournetwork/netclaw gtrace-ip-enrichmentInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 20, 2026, 3:29 AM5.3s1 file scanned
SKILL.md
- name:
- gtrace-ip-enrichment
- description:
- IP address enrichment — ASN ownership lookup, geolocation (city/region/country/coordinates), and reverse DNS resolution. Use when identifying who owns an IP address, locating an IP geographically, resolving reverse DNS for a traceroute hop, or enriching unknown IPs from logs or flow data.
- license:
- Apache-2.0
- user-invocable:
- true
- { "openclaw":
- { "requires": { "bins": ["python3", "gtrace"], "env": ["GTRACE_MCP_BIN"] } } }
IP Address Enrichment with gtrace
How to Call the gtrace MCP Tools
python3 $MCP_CALL "gtrace mcp" TOOL_NAME '{"param":"value"}'
When to Use
- Identify who owns an IP address (ASN, organization name, network range)
- Determine the geographic location of an IP (city, region, country, coordinates)
- Resolve an IP address to its PTR/reverse DNS hostname
- Enrich traceroute hop data with ASN and geo context
- Investigate unknown IPs appearing in logs, flow data, or routing tables
- Map network paths to physical geography for latency analysis
Available Tools
| Tool | Purpose |
|------|---------|
| asn_lookup | Look up ASN, organization, and network range for an IP |
| geo_lookup | Get geographic location (city, region, country, lat/lon) for an IP |
| reverse_dns | Resolve an IP to its PTR record (reverse DNS hostname) |
Workflow: IP Investigation
When asked "who owns this IP?" or "where is this IP?":
Step 1: ASN Lookup
Identify the Autonomous System and organization that owns the IP.
python3 $MCP_CALL "gtrace mcp" asn_lookup '{"ip":"8.8.8.8"}'
Returns: ASN number, organization name, network CIDR, registry (ARIN, RIPE, APNIC, etc.)
Step 2: Geolocation
Determine the physical location of the IP.
python3 $MCP_CALL "gtrace mcp" geo_lookup '{"ip":"8.8.8.8"}'
Returns: City, region/state, country, latitude/longitude, timezone
Step 3: Reverse DNS
Resolve the IP to its PTR record for hostname identification.
python3 $MCP_CALL "gtrace mcp" reverse_dns '{"ip":"8.8.8.8"}'
Returns: PTR hostname (e.g., dns.google)
Workflow: Traceroute Hop Enrichment
After running a traceroute (via gtrace-path-analysis skill), enrich each hop with ASN and geo data:
- Run
tracerouteto get the path with hop IPs - For each hop IP, run
asn_lookupto identify the network owner - For key hops (transit boundaries, high-latency hops), run
geo_lookupto map physical location - Use
reverse_dnson hops to identify router naming conventions (often reveals ISP, POP location, interface type)
# Example: enrich a traceroute hop
python3 $MCP_CALL "gtrace mcp" asn_lookup '{"ip":"72.14.215.85"}'
python3 $MCP_CALL "gtrace mcp" geo_lookup '{"ip":"72.14.215.85"}'
python3 $MCP_CALL "gtrace mcp" reverse_dns '{"ip":"72.14.215.85"}'
Workflow: BGP Peer Identification
When investigating BGP peers or routes:
- Get the peer IP from
bgp_get_peers(protocol-participation skill) - Run
asn_lookupto verify the peer's ASN matches what BGP reports - Run
geo_lookupto confirm the peer's physical location - Run
reverse_dnsto identify the peer's hostname and operator
Tool Parameters
asn_lookup
ip(required): IPv4 or IPv6 address to look up
geo_lookup
ip(required): IPv4 or IPv6 address to geolocate
reverse_dns
ip(required): IPv4 or IPv6 address to resolve
Output Format
- asn_lookup — ASN number, organization name, network CIDR prefix, RIR (ARIN/RIPE/APNIC/LACNIC/AFRINIC)
- geo_lookup — city, region/state, country, country code, latitude, longitude, timezone
- reverse_dns — PTR hostname, or indication that no PTR record exists
Important Rules
- These tools require internet access for IP intelligence lookups
- Geolocation accuracy varies — typically city-level for broadband, region-level for mobile/cloud
- ASN lookup is the most reliable enrichment — it uses RIR delegation data
- Reverse DNS depends on the IP owner having configured PTR records
- Use all three tools together for comprehensive IP enrichment
- Cross-reference ASN data with BGP RIB entries for routing consistency verification
- Record all IP enrichment in GAIT
Related Skills
automateyournetwork/humanrail-escalation
testing
VerifiedTrustedCommunity
Human-in-the-loop escalation via HumanRail — route low-confidence agent decisions, pre-destructive operation approvals, and ambiguous incident tickets to real human engineers. Human answers are verified and returned as structured output. Workers are paid via Lightning Network. Use when the agent is uncertain, when a destructive change needs explicit human sign-off beyond a ServiceNow CR, or when an ambiguous ticket requires human triage before automated handling.
491SKILL.mdUpdated May 12, 2026
automateyournetwork/eve-ng-node-operations
testing
VerifiedTrustedCommunity
Manage EVE-NG node lifecycle. Use when listing nodes, checking runtime state, creating or deleting nodes, starting or stopping nodes or whole labs, verifying node details, or wiping node NVRAM back to factory defaults.
491SKILL.mdUpdated May 12, 2026
automateyournetwork/eve-ng-lab-management
development
VerifiedTrustedCommunity
Manage EVE-NG labs and platform inventory. Use when listing labs, checking lab metadata, creating or deleting labs, importing or exporting lab archives, checking EVE-NG health or auth, or verifying available node images before build work.
491SKILL.mdUpdated May 12, 2026
automateyournetwork/eve-ng-console-ops
tools
VerifiedTrustedCommunity
Execute live CLI commands on running EVE-NG nodes over telnet console. Use when running show commands, making live config changes, verifying protocol state, testing connectivity, checking console readiness, or interacting with IOS, Junos, VPCS, EOS, or NX-OS nodes.
491SKILL.mdUpdated May 12, 2026