# MAC Address Lookup MCP Server

Connect compatible AI assistants to MACLookup for MAC address and IEEE prefix lookups, including OUI registrations. Look up registered organizations, process up to 50 inputs per call, and inspect address classifications and optional fingerprint candidates.

Registration data identifies a prefix assignee or company identifier, not a specific device. Fingerprint candidates indicate compatible address patterns, not confirmed devices or platforms.

Guide reviewed: 2026-11-04. Canonical page: https://maclookup.app/mcp

## Connect your AI assistant

Add this endpoint to a client that supports remote Streamable HTTP MCP servers.

No API key or OAuth sign-in is required.

Production endpoint: https://mcp.maclookup.app/mcp

Transport: Streamable HTTP, stateless.

1. Add the endpoint using your client’s remote MCP configuration.
2. Confirm that the client lists lookup_mac and batch_lookup_mac.
3. Ask the assistant to use MACLookup explicitly, then inspect the tool result.

### Cursor

Merge this server into your existing project configuration.

Configuration: .cursor/mcp.json

```json
{
  "mcpServers": {
    "maclookup": {
      "url": "https://mcp.maclookup.app/mcp"
    }
  }
}
```

[Official Cursor documentation](https://cursor.com/docs/mcp)

### Visual Studio Code

Use the VS Code workspace format. Its top-level key is servers.

Configuration: .vscode/mcp.json

```json
{
  "servers": {
    "maclookup": {
      "type": "http",
      "url": "https://mcp.maclookup.app/mcp"
    }
  }
}
```

[Official Visual Studio Code documentation](https://code.visualstudio.com/docs/agent-customization/mcp-servers)

### Claude

Use Claude’s remote custom-connector flow and enter this endpoint. Availability and controls depend on your account and organization.

Configuration: Remote custom connector

```text
https://mcp.maclookup.app/mcp
```

[Official Claude documentation](https://support.claude.com/en/articles/11175166-get-started-with-custom-connectors-using-remote-mcp)

### Codex

Add this table to your existing Codex configuration, or run the CLI command below instead. After connecting, confirm that both MACLookup tools are listed.

Configuration: ~/.codex/config.toml

```toml
[mcp_servers.maclookup]
url = "https://mcp.maclookup.app/mcp"
```

Alternatively, run:

```sh
codex mcp add maclookup --url https://mcp.maclookup.app/mcp
```

[Official Codex documentation](https://developers.openai.com/codex/mcp)

### Google Antigravity

In Antigravity IDE, open MCP Servers, select Manage MCP Servers, then View raw config. Merge this entry into your existing mcpServers configuration. For workspace-only setup, use .agents/mcp_config.json instead of the global file.

Configuration: ~/.gemini/config/mcp_config.json

```json
{
  "mcpServers": {
    "maclookup": {
      "serverUrl": "https://mcp.maclookup.app/mcp"
    }
  }
}
```

[Official Google Antigravity documentation](https://antigravity.google/docs/mcp)

Configuration formats follow the linked client documentation. These instructions are not a certification of an editor or account connection.

Tool selection depends on your client, model and permissions. Ask the assistant to use MACLookup explicitly when you need a lookup, and inspect the tool result.

### Registered organizations

Use MACLookup to group these MAC addresses by registered organization. Keep unmatched inputs separate, and label locally administered addresses without treating them as necessarily unmatched or randomized.

### Fingerprint candidates

Analyze 02:42:0A:00:00:02 with MACLookup using include: ["classificationDetails", "fingerprint"]. Explain the evidence and limitations of each candidate without claiming that a running container was observed.

## Available tools

### lookup_mac

Look up a full Ethernet MAC or a 24-, 28- or 36-bit prefix. The result separates registration, address bits and optional signature analysis.

Tool arguments (not an HTTP body):

```json
{
  "mac": "00:1A:2B:3C:4D:5E",
  "include": [
    "formats",
    "classificationDetails"
  ]
}
```

### batch_lookup_mac

Process 1–50 strings in one call. Input order, duplicates and individual invalid-address results are preserved. One batch costs one POST.

Tool arguments (not an HTTP body):

```json
{
  "macAddresses": [
    "001A2B",
    "02:42:0A:00:00:02",
    "GG:00:00:00:00:00",
    "001A2B"
  ],
  "include": [
    "fingerprint"
  ]
}
```

Tool parameters

| Tool | Parameter | Type | Required | Meaning and constraints |
| --- | --- | --- | --- | --- |
| lookup_mac | mac | string | Yes | Full 48-bit MAC or 24-, 28- or 36-bit hexadecimal prefix. Maximum 80 UTF-8 bytes in the original input, before trimming or separator cleanup. |
| batch_lookup_mac | macAddresses | string[] | Yes | 1–50 input strings. Each original string has the same 80-byte limit. Input order and duplicates are preserved. |
| Both | include | string[] | No | Optional output groups. Names are case-sensitive. Omit the field or pass an empty array for the core response. Unknown names fail the whole tool call; repeated options are computed once. |

A batch shares one include list. Requested groups can be omitted when unavailable or inapplicable.

Optional output groups — include

| Value | Meaning |
| --- | --- |
| formats | Full-MAC colon, hyphen, dotted and plain notation. |
| derivedAddresses | Theoretical modified EUI-64 and IPv6 link-local values for nonzero unicast full MACs. |
| addressRange | Matched global block bounds; omitted for CID and misses. |
| registryDates | Available registry-record update date; not an assignment or device observation date. |
| registrantDetails | Available registry postal details or a details-withheld indicator. |
| classificationDetails | First-octet I/G and U/L bits, plus a SLAP quadrant when applicable. |
| fingerprint | All active matching signature candidates, evidence references and context limits. Full MAC required. |

## Supported MAC addresses and prefixes

Accept full 48-bit Ethernet MAC addresses or exactly 24-, 28- or 36-bit hexadecimal prefixes. Leading zeros and address bits are preserved. EUI-64 inputs are not supported. The service does not perform Bluetooth-specific address interpretation or device identification.

Inputs are case-insensitive. Surrounding whitespace is trimmed; colons, hyphens, dots, underscores and ASCII spaces may be mixed. The original input must fit within 80 UTF-8 bytes before cleanup. Embedded tabs, embedded newlines and a 0x prefix are not supported.

For a full MAC or prefix, lookup selects the longest eligible registration prefix. The requested prefix length can differ from the matched registration length. Bits are not cleared to force a vendor match.

Accepted lengths and example notation

| Input | Length | Examples |
| --- | --- | --- |
| Full MAC | 48 bits · 12 hex digits | 00:1A:2B:3C:4D:5E · 00-1a-2b-3c-4d-5e · 001a.2b3c.4d5e · 001A2B3C4D5E |
| Prefix | 24 bits · 6 hex digits | 001A2B · 00:1A:2B · 000000 |
| Prefix | 28 bits · 7 hex digits | 0055DA0 · 70B3D5F |
| Prefix | 36 bits · 9 hex digits | 70B3D5FC1 |

## Understand the results

Registration, address-bit facts, automatic special-use classifications and optional fingerprints answer different questions. A signature candidate can coexist with no registry assignment. Registry country and postal data describe the registration, not a device’s location.

Locally administered does not mean randomized. Docker-, QEMU- or protocol-compatible bytes do not prove an active container, virtual machine or protocol. Keep all competing fingerprint candidates. Decoded IP values are candidates, not an IP inventory.

Some fingerprint rules require packet or frame context that this MCP tool does not accept as input. When contextStatus is missing, interpret the candidate using only the available address-pattern evidence; the missing context has not been checked. For example, ERPS-compatible 01:19:A7:00:00:01 retains its byte-pattern candidate but omits the decoded Ring ID because destination-role and Ethernet OAM context are missing.

Derived IPv6 and modified EUI-64 values are theoretical calculations. MACLookup does not check assignment, SLAAC use or reachability. A fingerprint-decoded IPv6 multicast group is not a device’s unicast IPv6 address.

Four independent result layers

| Layer | What it tells you |
| --- | --- |
| Registry assignment | matched, not_found or invalid_input. assignment contains the actual matched prefix and registrant when available. |
| Address bits | For a full MAC: unicast, multicast or broadcast, plus universal or local administration. Prefixes have mac: null. |
| Special use | Automatic numeric-pattern facts and possible-use hints, independent of include and registration. Multiple facts can apply. |
| Fingerprint | Requested byte-compatible candidates, rule-pack version, source references and missing-context limits. Attribution labels are not measured probabilities. |

Registration families

| Family | Prefix length | Meaning |
| --- | --- | --- |
| MA-L | 24 bits | Global block · 16,777,216 addresses |
| MA-M | 28 bits | Global block · 1,048,576 addresses |
| MA-S / IAB | 36 bits | Global block · 4,096 addresses |
| CID | 24 bits | Company identifier; no allocated global MAC-block count. Can match a local address. |

Missing, empty and zero values

| Value | Interpretation |
| --- | --- |
| assignment: null | No selected registration; a valid miss can still have useful bit facts or fingerprints. |
| registrant: null on a matched record | Organization details unavailable. detailsWithheld: true means registration details withheld, not a missing registration. |
| mac: null with query.kind: prefix | Full-MAC classification is inapplicable. Optional classificationDetails can describe prefix bits. |
| specialUse: null | No automatic catalog fact for this input. |
| fingerprint omitted | Not requested, or invalid input. Do not interpret as a negative analysis. |
| fingerprint.status: not_applicable | A prefix returns reason: requires_full_mac; fingerprint analysis requires a full MAC. |
| fingerprint.matches: [] | No fingerprint rule matched this address. |
| Other requested groups omitted | Unavailable or inapplicable; omitted derivedAddresses does not prove absence of IPv6. |
| index: 0 · group: 0 · mdLevel: 0 · false | Real values. Preserve them along with empty arrays. |

## Limits and error handling

These production limits were checked against the server reference on 4 November 2026. MCP allowance is independent of REST API and website quotas. REST API keys do not increase it.

POSTs reaching quota admission count before protocol or tool validation, including initialization, discovery, notifications and schema-invalid calls. One batch costs one POST. Clients sharing a visible IP identity share allowance; IPv6 identities are grouped by /64.

Respect Retry-After when it is provided. Avoid immediate retry loops and unnecessary reinitialization. Check the documented error response before retrying; HTTP 200 alone does not establish that the tool call succeeded. Quota-rejected attempts increment both POST counters. Reduce batch size or optional groups after a response-budget error; no truncated success payload is promised.

HTTP 200 does not guarantee success. Inspect the JSON-RPC error, result.isError and every item’s lookupStatus. A valid registration miss is a normal result. GET on the transport endpoint returns 405; use /mcp/docs for the readable service reference.

Documented deployment limits

| Limit | Allowance |
| --- | --- |
| Batch | 1–50 inputs per call |
| Original input | 80 UTF-8 bytes per string |
| POST requests | 10 per second and 10,000 per six hours per IP identity |
| Request body | 256 KiB |
| Complete response budget | 4 MiB, including envelope and JSON text fallback |
| Concurrent POST capacity | 64 per process |

Failure layers

| Layer | Handling |
| --- | --- |
| HTTP / connection | Handle method, Origin, body-size, capacity and unexpected content-type failures. Browser Origins need an explicit service allowlist. |
| JSON-RPC | Inspect the error object; HTTP 200 can carry a protocol error. |
| MCP tool | result.isError: true fails the whole call, including invalid argument schemas and recognizable quota rejections. Other quota failures can use HTTP 429. |
| Item validation | invalid_input affects one accepted string; valid batch siblings still execute. A wrong property/type, unknown include, empty or oversized batch fails the whole call. |

Individual input error codes

| Code | Cause |
| --- | --- |
| INPUT_TOO_LONG | Original UTF-8 bytes exceed the ceiling before normalization. |
| INVALID_MAC_FORMAT | Unsupported character remains after cleanup. |
| INVALID_PREFIX_LENGTH | Unsupported cleaned length below 12 hex digits. |
| UNSUPPORTED_ADDRESS_LENGTH | More than 12 hex digits. |

## Request and response examples

Recorded examples from production and test deployments; each example identifies its capture source and dataset. Dataset 2.2.26110320. These are recorded examples; opening this guide sends no lookup request.

### Registered organization

Complete core response for one full MAC. Registration identifies the prefix assignee, not a specific device.

Captured on 4 November 2026 from the production deployment at https://mcp.maclookup.app/mcp. Server v18.2.0; protocol 2025-11-25; dataset 2.2.26110320.

- Registry status: matched

- Registered organization: Ayecom Technology Co., Ltd.

- Matched registration: 001A2B · 24 bits · MA-L

- Address bits: Unicast · universally administered

Tool: lookup_mac. Recorded tool arguments:

```json
{
  "mac": "00:1A:2B:3C:4D:5E"
}
```

Complete structuredContent payload

```json
{
  "assignment": {
    "addressCount": 16777216,
    "assignmentScope": "global_mac_block",
    "assignmentType": "MA-L",
    "prefix": "001A2B",
    "prefixLength": 24,
    "registrant": {
      "countryCode": "TW",
      "name": "Ayecom Technology Co., Ltd."
    }
  },
  "input": "00:1A:2B:3C:4D:5E",
  "lookupStatus": "matched",
  "mac": {
    "address": "00:1A:2B:3C:4D:5E",
    "addressType": "unicast",
    "administrationType": "universal",
    "isBroadcast": false,
    "isLocallyAdministered": false,
    "isMulticast": false
  },
  "query": {
    "kind": "mac48",
    "lookupUrl": "https://maclookup.app/macaddress/001a2b",
    "normalized": "00:1A:2B:3C:4D:5E"
  },
  "schemaVersion": "1.0",
  "source": {
    "datasetUpdatedAt": "2026-11-03T20:34:09.722278159Z",
    "datasetVersion": "2.2.26110320",
    "provider": "maclookup.app"
  },
  "specialUse": null
}
```

### Three inputs, three complete results

Complete batch response for a registered MAC, a locally administered address with a Docker-compatible candidate, and an invalid input. Order and indices are preserved. The decoded IPv4 candidate does not establish an observed container or assigned IP. This JSON is the complete structuredContent payload, not the JSON-RPC envelope or the full MCP tool result.

Captured on 4 November 2026 from the production deployment at https://mcp.maclookup.app/mcp. Server v18.2.0; protocol 2025-11-25; dataset 2.2.26110320.

- Results: 3 inputs · 3 ordered results

- Registry summary: 1 matched · 1 not found · 1 invalid

- Fingerprint interpretation: Docker-compatible pattern · candidate IPv4 10.0.0.2

- Invalid input: INVALID_MAC_FORMAT at index 2

Tool: batch_lookup_mac. Recorded tool arguments:

```json
{
  "macAddresses": [
    "00:1A:2B:3C:4D:5E",
    "02:42:0A:00:00:02",
    "GG:00:00:00:00:00"
  ],
  "include": [
    "fingerprint"
  ]
}
```

Complete structuredContent payload

```json
{
  "results": [
    {
      "assignment": {
        "addressCount": 16777216,
        "assignmentScope": "global_mac_block",
        "assignmentType": "MA-L",
        "prefix": "001A2B",
        "prefixLength": 24,
        "registrant": {
          "countryCode": "TW",
          "name": "Ayecom Technology Co., Ltd."
        }
      },
      "fingerprint": {
        "matches": [],
        "notice": "Byte matches and decoded candidates do not prove device, platform, protocol, ownership or observed configuration",
        "rulePackVersion": "2026-10-29.2",
        "sources": [],
        "status": "analyzed"
      },
      "index": 0,
      "input": "00:1A:2B:3C:4D:5E",
      "lookupStatus": "matched",
      "mac": {
        "address": "00:1A:2B:3C:4D:5E",
        "addressType": "unicast",
        "administrationType": "universal",
        "isBroadcast": false,
        "isLocallyAdministered": false,
        "isMulticast": false
      },
      "query": {
        "kind": "mac48",
        "lookupUrl": "https://maclookup.app/macaddress/001a2b",
        "normalized": "00:1A:2B:3C:4D:5E"
      },
      "specialUse": null
    },
    {
      "assignment": null,
      "fingerprint": {
        "matches": [
          {
            "attribution": "medium",
            "candidate": "Docker bridge-compatible",
            "category": "container",
            "contextStatus": "not_required",
            "decoded": {
              "candidateIPv4": "10.0.0.2"
            },
            "id": "docker-ipv4-embedded",
            "sourceID": "P5"
          }
        ],
        "notice": "Byte matches and decoded candidates do not prove device, platform, protocol, ownership or observed configuration",
        "rulePackVersion": "2026-10-29.2",
        "sources": [
          {
            "edition": "archived source snapshot",
            "id": "P5",
            "section": "NetworkSettings and network inspection examples",
            "type": "vendor-doc",
            "url": "https://github.com/moby/moby/blob/master/api/docs/v1.24.md"
          }
        ],
        "status": "analyzed"
      },
      "index": 1,
      "input": "02:42:0A:00:00:02",
      "lookupStatus": "not_found",
      "mac": {
        "address": "02:42:0A:00:00:02",
        "addressType": "unicast",
        "administrationType": "local",
        "isBroadcast": false,
        "isLocallyAdministered": true,
        "isMulticast": false
      },
      "query": {
        "kind": "mac48",
        "lookupUrl": "https://maclookup.app/search/result?mac=02420a000002",
        "normalized": "02:42:0A:00:00:02"
      },
      "specialUse": null
    },
    {
      "assignment": null,
      "error": {
        "code": "INVALID_MAC_FORMAT",
        "message": "Input must be a valid 48-bit MAC or 24/28/36-bit prefix within the configured byte limit"
      },
      "index": 2,
      "input": "GG:00:00:00:00:00",
      "lookupStatus": "invalid_input",
      "mac": null,
      "specialUse": null
    }
  ],
  "schemaVersion": "1.0",
  "source": {
    "datasetUpdatedAt": "2026-11-03T20:34:09.722278159Z",
    "datasetVersion": "2.2.26110320",
    "provider": "maclookup.app"
  },
  "summary": {
    "invalid": 1,
    "matched": 1,
    "notFound": 1,
    "total": 3
  }
}
```

### A prefix can match a shorter registration

Recorded item at index 5 of the 50-input batch. Equivalent single-call arguments are shown; this response is a batch item, not a single-call envelope. This example resolves the requested 28-bit prefix to the 24-bit parent registration held by IEEE Registration Authority. It does not identify the organization holding a more specific assignment within that range. A full MAC address or a more specific prefix may resolve to a more specific registered organization.

Captured on 4 November 2026 from the test deployment. Dataset 2.2.26110320.

- Requested prefix: 70B3D5F · 28 bits

- Matched registration: 70B3D5 · 24 bits · MA-L

- Registered organization: IEEE Registration Authority

- Fingerprint: not_applicable · requires_full_mac

Tool: lookup_mac. Equivalent single-call arguments:

```json
{
  "mac": "70B3D5F",
  "include": [
    "addressRange",
    "registryDates",
    "registrantDetails",
    "classificationDetails",
    "fingerprint"
  ]
}
```

Recorded batch item; index preserved

```json
{
  "addressRange": {
    "addressCount": 16777216,
    "endAddress": "70:B3:D5:FF:FF:FF",
    "startAddress": "70:B3:D5:00:00:00"
  },
  "assignment": {
    "addressCount": 16777216,
    "assignmentScope": "global_mac_block",
    "assignmentType": "MA-L",
    "prefix": "70B3D5",
    "prefixLength": 24,
    "registrant": {
      "countryCode": "US",
      "name": "IEEE Registration Authority"
    }
  },
  "classificationDetails": {
    "firstOctetHex": "70",
    "igBitSet": false,
    "ulBitSet": false
  },
  "fingerprint": {
    "reason": "requires_full_mac",
    "status": "not_applicable"
  },
  "index": 5,
  "input": "70B3D5F",
  "lookupStatus": "matched",
  "mac": null,
  "query": {
    "kind": "prefix",
    "lookupUrl": "https://maclookup.app/macaddress/70b3d5",
    "normalized": "70B3D5F",
    "prefixLength": 28
  },
  "registrantDetails": {
    "postalAddress": "445 Hoes Lane, Piscataway NJ 08554, US"
  },
  "registryDates": {
    "updatedOn": "2016-04-27"
  },
  "specialUse": null
}
```

### A signature without a registry match

Recorded item at index 7 of the same batch. Docker-compatible bytes and the decoded IPv4 candidate do not establish an observed container or assigned IP.

Captured on 4 November 2026 from the test deployment. Dataset 2.2.26110320.

- Registry status: not_found · no selected assignment

- Address bits: Unicast · locally administered

- Signature candidate: Docker bridge-compatible

- IPv4 candidate: 10.0.0.2 · not observed

- Theoretical IPv6 link-local: fe80::42:aff:fe00:2

Tool: lookup_mac. Equivalent single-call arguments:

```json
{
  "mac": "02:42:0A:00:00:02",
  "include": [
    "fingerprint",
    "derivedAddresses",
    "classificationDetails",
    "formats"
  ]
}
```

Recorded batch item; index preserved

```json
{
  "assignment": null,
  "classificationDetails": {
    "firstOctetHex": "02",
    "igBitSet": false,
    "slapQuadrant": "AAI",
    "ulBitSet": true
  },
  "derivedAddresses": {
    "derivationMethod": "modified_eui64",
    "derivedOnly": true,
    "ipv6LinkLocal": "fe80::42:aff:fe00:2",
    "modifiedEui64": "00:42:0A:FF:FE:00:00:02"
  },
  "fingerprint": {
    "matches": [
      {
        "attribution": "medium",
        "candidate": "Docker bridge-compatible",
        "category": "container",
        "contextStatus": "not_required",
        "decoded": {
          "candidateIPv4": "10.0.0.2"
        },
        "id": "docker-ipv4-embedded",
        "sourceID": "P5"
      }
    ],
    "notice": "Byte matches and decoded candidates do not prove device, platform, protocol, ownership or observed configuration",
    "rulePackVersion": "2026-10-29.2",
    "sources": [
      {
        "edition": "archived source snapshot",
        "id": "P5",
        "section": "NetworkSettings and network inspection examples",
        "type": "vendor-doc",
        "url": "https://github.com/moby/moby/blob/master/api/docs/v1.24.md"
      }
    ],
    "status": "analyzed"
  },
  "formats": {
    "cisco": "0242.0a00.0002",
    "colon": "02:42:0A:00:00:02",
    "hyphen": "02-42-0A-00-00-02",
    "plain": "02420A000002"
  },
  "index": 7,
  "input": "02:42:0A:00:00:02",
  "lookupStatus": "not_found",
  "mac": {
    "address": "02:42:0A:00:00:02",
    "addressType": "unicast",
    "administrationType": "local",
    "isBroadcast": false,
    "isLocallyAdministered": true,
    "isMulticast": false
  },
  "query": {
    "kind": "mac48",
    "lookupUrl": "https://maclookup.app/search/result?mac=02420a000002",
    "normalized": "02:42:0A:00:00:02"
  },
  "specialUse": null
}
```

### Extended batch example — 50 inputs (response excerpt)

Recorded 50-input request with a response excerpt showing positions 0, 7, 34 and 41. Other result rows are omitted. Duplicate positions remain separate; invalid input does not suppress valid siblings.

Captured on 4 November 2026 from the test deployment. Dataset 2.2.26110320.

- Total positions: 50 · duplicates included

- Registry summary: 21 matched · 21 not found · 8 invalid

- Duplicate positions: 0 and 41 · retained independently

- Invalid position: 34 · INVALID_MAC_FORMAT

Tool: batch_lookup_mac. Complete recorded 50-input tool arguments:

```json
{
  "macAddresses": [
    "00:1A:2B:3C:4D:5E",
    "00-1a-2b-3c-4d-5e",
    "001a.2b3c.4d5e",
    " 00__1a..2b--3c::4d 5e ",
    "001A2B",
    "70B3D5F",
    "70B3D5FC1",
    "02:42:0A:00:00:02",
    "0A:58:0A:00:00:02",
    "52:54:00:12:34:56",
    "00:00:5E:00:01:01",
    "00:00:5E:00:01:00",
    "00:00:0C:07:AC:00",
    "00:00:0C:9F:F0:00",
    "00:07:B4:00:00:01",
    "01:19:A7:00:00:01",
    "01:80:C2:00:00:30",
    "01:00:5E:00:00:FB",
    "33:33:00:00:00:FB",
    "33:33:FF:12:34:56",
    "01:80:C2:00:00:0E",
    "FF:FF:FF:FF:FF:FF",
    "00:00:00:00:00:00",
    "000000",
    "000000123456",
    "02:00:00:12:34:56",
    "06:00:00:12:34:56",
    "0A:00:00:12:34:56",
    "0E:00:00:12:34:56",
    "33:33:00",
    "01:00:5E",
    "01:00:5E:0",
    "01:1A:2B:3C:4D:5E",
    "",
    "GG:00:00:00:00:00",
    "001A2",
    "001A2B3C",
    "001A2B3C4D5E6",
    "00\t1A2B3C4D5E",
    "0x001A2B3C4D5E",
    "000000000000000000000000000000000000000000000000000000000000000000000000000000000",
    "00:1A:2B:3C:4D:5E",
    "AA:BB:CC:DD:EE:FF",
    "00:50:C2",
    "00:50:C2:00:00:01",
    "70B3D5000",
    "00:1B:C5:00:00:00",
    "00:00:5E:00:53:01",
    "01:00:5E:80:00:01",
    "01:00:5E:00:00:00"
  ],
  "include": [
    "formats",
    "derivedAddresses",
    "addressRange",
    "registryDates",
    "registrantDetails",
    "classificationDetails",
    "fingerprint"
  ]
}
```

Response excerpt; 46 result rows omitted

```json
{
  "schemaVersion": "1.0",
  "summary": {
    "invalid": 8,
    "matched": 21,
    "notFound": 21,
    "total": 50
  },
  "results": [
    {
      "addressRange": {
        "addressCount": 16777216,
        "endAddress": "00:1A:2B:FF:FF:FF",
        "startAddress": "00:1A:2B:00:00:00"
      },
      "assignment": {
        "addressCount": 16777216,
        "assignmentScope": "global_mac_block",
        "assignmentType": "MA-L",
        "prefix": "001A2B",
        "prefixLength": 24,
        "registrant": {
          "countryCode": "TW",
          "name": "Ayecom Technology Co., Ltd."
        }
      },
      "classificationDetails": {
        "firstOctetHex": "00",
        "igBitSet": false,
        "ulBitSet": false
      },
      "derivedAddresses": {
        "derivationMethod": "modified_eui64",
        "derivedOnly": true,
        "ipv6LinkLocal": "fe80::21a:2bff:fe3c:4d5e",
        "modifiedEui64": "02:1A:2B:FF:FE:3C:4D:5E"
      },
      "fingerprint": {
        "matches": [],
        "notice": "Byte matches and decoded candidates do not prove device, platform, protocol, ownership or observed configuration",
        "rulePackVersion": "2026-10-29.2",
        "sources": [],
        "status": "analyzed"
      },
      "formats": {
        "cisco": "001a.2b3c.4d5e",
        "colon": "00:1A:2B:3C:4D:5E",
        "hyphen": "00-1A-2B-3C-4D-5E",
        "plain": "001A2B3C4D5E"
      },
      "index": 0,
      "input": "00:1A:2B:3C:4D:5E",
      "lookupStatus": "matched",
      "mac": {
        "address": "00:1A:2B:3C:4D:5E",
        "addressType": "unicast",
        "administrationType": "universal",
        "isBroadcast": false,
        "isLocallyAdministered": false,
        "isMulticast": false
      },
      "query": {
        "kind": "mac48",
        "lookupUrl": "https://maclookup.app/macaddress/001a2b",
        "normalized": "00:1A:2B:3C:4D:5E"
      },
      "registrantDetails": {
        "postalAddress": "No. 25, R&D Road 2, Science-Based Industrial Park, Hsinchu  300, TW"
      },
      "registryDates": {
        "updatedOn": "2015-11-17"
      },
      "specialUse": null
    },
    {
      "assignment": null,
      "classificationDetails": {
        "firstOctetHex": "02",
        "igBitSet": false,
        "slapQuadrant": "AAI",
        "ulBitSet": true
      },
      "derivedAddresses": {
        "derivationMethod": "modified_eui64",
        "derivedOnly": true,
        "ipv6LinkLocal": "fe80::42:aff:fe00:2",
        "modifiedEui64": "00:42:0A:FF:FE:00:00:02"
      },
      "fingerprint": {
        "matches": [
          {
            "attribution": "medium",
            "candidate": "Docker bridge-compatible",
            "category": "container",
            "contextStatus": "not_required",
            "decoded": {
              "candidateIPv4": "10.0.0.2"
            },
            "id": "docker-ipv4-embedded",
            "sourceID": "P5"
          }
        ],
        "notice": "Byte matches and decoded candidates do not prove device, platform, protocol, ownership or observed configuration",
        "rulePackVersion": "2026-10-29.2",
        "sources": [
          {
            "edition": "archived source snapshot",
            "id": "P5",
            "section": "NetworkSettings and network inspection examples",
            "type": "vendor-doc",
            "url": "https://github.com/moby/moby/blob/master/api/docs/v1.24.md"
          }
        ],
        "status": "analyzed"
      },
      "formats": {
        "cisco": "0242.0a00.0002",
        "colon": "02:42:0A:00:00:02",
        "hyphen": "02-42-0A-00-00-02",
        "plain": "02420A000002"
      },
      "index": 7,
      "input": "02:42:0A:00:00:02",
      "lookupStatus": "not_found",
      "mac": {
        "address": "02:42:0A:00:00:02",
        "addressType": "unicast",
        "administrationType": "local",
        "isBroadcast": false,
        "isLocallyAdministered": true,
        "isMulticast": false
      },
      "query": {
        "kind": "mac48",
        "lookupUrl": "https://maclookup.app/search/result?mac=02420a000002",
        "normalized": "02:42:0A:00:00:02"
      },
      "specialUse": null
    },
    {
      "assignment": null,
      "error": {
        "code": "INVALID_MAC_FORMAT",
        "message": "Input must be a valid 48-bit MAC or 24/28/36-bit prefix within the configured byte limit"
      },
      "index": 34,
      "input": "GG:00:00:00:00:00",
      "lookupStatus": "invalid_input",
      "mac": null,
      "specialUse": null
    },
    {
      "addressRange": {
        "addressCount": 16777216,
        "endAddress": "00:1A:2B:FF:FF:FF",
        "startAddress": "00:1A:2B:00:00:00"
      },
      "assignment": {
        "addressCount": 16777216,
        "assignmentScope": "global_mac_block",
        "assignmentType": "MA-L",
        "prefix": "001A2B",
        "prefixLength": 24,
        "registrant": {
          "countryCode": "TW",
          "name": "Ayecom Technology Co., Ltd."
        }
      },
      "classificationDetails": {
        "firstOctetHex": "00",
        "igBitSet": false,
        "ulBitSet": false
      },
      "derivedAddresses": {
        "derivationMethod": "modified_eui64",
        "derivedOnly": true,
        "ipv6LinkLocal": "fe80::21a:2bff:fe3c:4d5e",
        "modifiedEui64": "02:1A:2B:FF:FE:3C:4D:5E"
      },
      "fingerprint": {
        "matches": [],
        "notice": "Byte matches and decoded candidates do not prove device, platform, protocol, ownership or observed configuration",
        "rulePackVersion": "2026-10-29.2",
        "sources": [],
        "status": "analyzed"
      },
      "formats": {
        "cisco": "001a.2b3c.4d5e",
        "colon": "00:1A:2B:3C:4D:5E",
        "hyphen": "00-1A-2B-3C-4D-5E",
        "plain": "001A2B3C4D5E"
      },
      "index": 41,
      "input": "00:1A:2B:3C:4D:5E",
      "lookupStatus": "matched",
      "mac": {
        "address": "00:1A:2B:3C:4D:5E",
        "addressType": "unicast",
        "administrationType": "universal",
        "isBroadcast": false,
        "isLocallyAdministered": false,
        "isMulticast": false
      },
      "query": {
        "kind": "mac48",
        "lookupUrl": "https://maclookup.app/macaddress/001a2b",
        "normalized": "00:1A:2B:3C:4D:5E"
      },
      "registrantDetails": {
        "postalAddress": "No. 25, R&D Road 2, Science-Based Industrial Park, Hsinchu  300, TW"
      },
      "registryDates": {
        "updatedOn": "2015-11-17"
      },
      "specialUse": null
    }
  ],
  "source": {
    "datasetUpdatedAt": "2026-11-03T20:34:09.722278159Z",
    "datasetVersion": "2.2.26110320",
    "provider": "maclookup.app"
  }
}
```

### Example prompts

- Extract MAC addresses from this interface listing, then use batch_lookup_mac. Preserve order and duplicates, and keep invalid inputs separate.

- Look up 70B3D5F. Explain the requested prefix length and the actual matched registration length.

## Data and privacy

Your MCP client sends the address or prefix arguments required for each call. MACLookup does not scan your network, contact devices, collect an ARP table or require a raw interface listing. Extract addresses before submitting a batch.

Responses echo the submitted input. Your client and model provider may handle tool arguments and results under their own policies. Operational request metadata can include IP address, user agent and Cloudflare metadata; no zero-logging or retention guarantee is made here.

This guide uses recorded demonstration data. Opening this page or copying configuration does not execute an MCP lookup.

[MACLookup privacy policy](https://maclookup.app/privacy)

## Frequently asked questions

### What does a MAC vendor lookup identify?

It returns a registration associated with a MAC prefix. The registered organization may differ from the finished device’s brand. A match does not identify its model, owner or current location.

### Do I need an API key?

No. This MCP service accepts keyless requests. Adding a REST API key does not increase the MCP allowance.

### Which addresses and prefixes are supported?

Full 48-bit Ethernet MACs and 24-, 28- or 36-bit hexadecimal prefixes. Supported separators are normalized. The input limit is 80 original UTF-8 bytes.

### How many inputs can I submit together?

The production deployment accepts 1–50 strings through batch_lookup_mac. It preserves order and duplicates, and reports invalid address strings individually. Empty or oversized batches fail the whole call.

### What happens if the exact prefix is not registered?

Lookup tries eligible shorter prefixes, most specific first. query keeps the requested prefix; assignment reports the actual selected registration. No eligible registration returns not_found.

### Can a local address have a registration?

Yes. A CID can match a locally administered address. It identifies an organization without allocating a global MAC block. Local administration alone does not prove randomization.

### Can MACLookup identify Docker, a virtual machine or a protocol?

Request include: ["fingerprint"] for byte-compatible candidates. They do not prove a running platform or observed protocol. Multiple candidates can match; missing frame context limits decoding.

### Can I analyze a prefix with fingerprinting?

Registration lookup accepts supported prefixes. Fingerprinting requires a complete Ethernet MAC. Prefix analysis returns not_applicable with reason requires_full_mac.

### Does a missing registration mean a rogue device?

No. It means no eligible registration was found in the loaded snapshot. Use inventory and network context before drawing security conclusions.

### Are returned IPv6 addresses observed on my network?

No. derivedAddresses contains theoretical modified EUI-64/link-local calculations. Fingerprint-decoded IPv6 values describe compatible multicast groups. Neither establishes an observed device address or reachability.

### How current is the database?

Read source.datasetVersion and, when available, source.datasetUpdatedAt. The timestamp is the snapshot’s recorded update event, not a live IEEE check or device observation.

### Why can HTTP 200 still contain an error?

MCP tool failures, including recognizable quota rejections, can use HTTP 200 with result.isError: true. Inspect protocol, tool and item errors, and respect Retry-After.

### Does the server scan my network?

No. It looks up addresses or prefixes supplied by the client. It does not contact devices or observe traffic.

### Will an assistant always use the server automatically?

No. Tool selection depends on the client, model, permissions and task. Ask the assistant to use MACLookup and inspect the tool result.

## Technical reference and data version

Each result identifies its loaded registry snapshot. datasetUpdatedAt, when available, reports the snapshot’s recorded update event, not a live IEEE verification, a device observation or the serving replica’s load time.

These examples are snapshots, not live configuration. The server, protocol, application schema, dataset and fingerprint rule-pack have independent versions. Later requests can return different registrations.

Use a compatible MCP client or SDK to handle protocol negotiation and requests.

The served technical reference documents protocol framing and error handling. For recognizable quota-rejected tool calls, the tool error text reports the retry delay in seconds as well as the HTTP Retry-After header. If your client hides headers, inspect that error text; other HTTP failures may require access through the client or SDK. Do not assume every assistant reads headers automatically.

Example dataset: 2.2.26110320. Snapshot update event: 2026-11-03T20:34:09.722278159Z. Fingerprint rule-pack: 2026-10-29.2.

[Production endpoint technical reference](https://mcp.maclookup.app/mcp/docs)

[HTML guide](https://maclookup.app/mcp)

[REST API documentation](https://maclookup.app/api-v2/documentation)