4 new MCP tools + 4 REST endpoints

IRR — checks all IRR databases (RIPE, RADB, ARIN, APNIC…) for route objects matching the claimed origin ASN; reports consistency and missing coverage
Route Leak — detects BGP hijacks (multiple origin ASNs) and route leaks (AS-path loops / valley-free violations) with confidence scoring
Looking Glass — shows full AS paths + BGP communities from up to 50 RIPE RIS vantage points around the world, with geographic region labels
Route Stability — analyses withdrawal/re-announcement cycles over 1–168 hours, computing a 0–100 stability score and uptime %

Author: duksh

README.md

@@ -73,7 +73,7 @@ If `peerglass` is not in your PATH, use:
 }
 ```
 
-Restart Claude Desktop. All **27 tools** become immediately available.
+Restart Claude Desktop. All **31 tools** become immediately available.
 
 ### Start the REST API
 
@@ -138,7 +138,7 @@ Interactive docs at: http://localhost:8000/docs
 
 ---
 
-## All 27 MCP Tools
+## All 31 MCP Tools
 
 ### Phase 1 — Registry Queries
 
@@ -297,7 +297,7 @@ Interactive docs (Swagger UI): http://localhost:8000/docs
 │   Claude (LLM)              REST Clients                │
 │       │ MCP / stdio              │ HTTP                 │
 │       ▼                          ▼                      │
-│   server.py (27 tools)      api.py (25 endpoints)       │
+│   server.py (31 tools)      api.py (25 endpoints)       │
 │       │                          │                      │
 │       └──────────┬───────────────┘                      │
 │                  ▼                                       │
@@ -374,10 +374,10 @@ You should run both — they catch different categories of problems.
 | 4 | Protocol header | `Accept: application/rdap+json` is set |
 | 5 | User-Agent | Updated to `peerglass/1.0.0` |
 | 6 | MCP server name | `"peerglass"` |
-| 7 | Tool count | Exactly 17 `@mcp.tool()` decorators in `server.py` |
+| 7 | Tool count | Exactly 27 `@mcp.tool()` decorators in `server.py` |
 | 8 | REST endpoints | All 25 routes present in `api.py` |
 | 9 | FastAPI runtime | TestClient hits 3 endpoints in-memory, validates responses |
-| 10 | README | PeerGlass branding, 27 tools, RDAP note all present |
+| 10 | README | PeerGlass branding, 31 tools, RDAP note all present |
 
 **How to run:**
 
@@ -402,7 +402,7 @@ PEERGLASS — COMPLETE TEST SUITE
 ...
 
 ✅ ALL TESTS PASSED — 0 errors
-  Python files: 7  |  MCP tools: 27  |  REST endpoints: 25
+  Python files: 7  |  MCP tools: 31  |  REST endpoints: 29
   Protocol: RDAP throughout (RFC 7480-7484)
   Branding: PeerGlass throughout
 ============================================================

api.py

@@ -94,6 +94,10 @@ def _real_ip(request: Request) -> str:
     format_ct_logs_md,
     format_threat_intel_md,
     format_passive_dns_md,
+    format_irr_result_md,
+    format_route_leak_md,
+    format_looking_glass_md,
+    format_route_stability_md,
     to_json,
 )
 from normalizer import normalize_ip_response, normalize_asn_response
@@ -185,7 +189,7 @@ async def root():
         "description": "Internet resource intelligence: RIR + BGP + RPKI + PeeringDB",
         "docs": "/docs",
         "redoc": "/redoc",
-        "tools": 27,
+        "tools": 31,
         "endpoints": {
             "ip":              "/v1/ip/{ip}",
             "asn":             "/v1/asn/{asn}",
@@ -212,6 +216,10 @@ async def root():
             "ct_logs":         "/v1/ct/{domain}",
             "threat_intel":    "/v1/threat/{ip}",
             "passive_dns":     "/v1/pdns/{resource}",
+            "irr":             "/v1/irr?prefix=...&asn=...",
+            "route_leak":      "/v1/route-leak/{prefix}",
+            "looking_glass":   "/v1/looking-glass/{prefix}",
+            "route_stability": "/v1/stability/{prefix}",
             "cache_stats":     "/v1/meta/cache",
             "server_status":   "/v1/meta/status",
         },
@@ -1089,6 +1097,105 @@ async def passive_dns(
     return _resp(md, jsn, format)
 
 
+# ──────────────────────────────────────────────────────────────
+# Sprint 4 — BGP Depth endpoints
+# ──────────────────────────────────────────────────────────────
+
+@app.get(
+    "/v1/irr",
+    tags=["BGP"],
+    summary="IRR route-object consistency check",
+)
+@limiter.limit(_DEFAULT_RATE)
+async def check_irr_endpoint(
+    request: Request,
+    prefix: str = Query(..., description="CIDR prefix e.g. 1.1.1.0/24"),
+    asn: str    = Query(..., description="Origin ASN e.g. AS13335 or 13335"),
+    format: str = FORMAT_QUERY,
+):
+    """Check IRRExplorer for route objects covering *prefix* and validate against *asn*."""
+    cache_key = cache_module.make_irr_key(prefix, asn)
+    cached    = cache_module.get(cache_key)
+    if cached:
+        return _resp(cached["markdown"], cached["json"], format)
+    result = await rir_client.check_irr(prefix, asn)
+    md  = format_irr_result_md(result)
+    jsn = to_json(result)
+    cache_module.set(cache_key, {"markdown": md, "json": jsn}, cache_module.TTL_IRR)
+    return _resp(md, jsn, format)
+
+
+@app.get(
+    "/v1/route-leak/{prefix:path}",
+    tags=["BGP"],
+    summary="BGP route leak / hijack detection",
+)
+@limiter.limit(_DEFAULT_RATE)
+async def detect_route_leak_endpoint(
+    request: Request,
+    prefix: str,
+    format: str = FORMAT_QUERY,
+):
+    """Detect potential route leaks or hijacks for a prefix using RIPE Stat BGP-state."""
+    cache_key = cache_module.make_route_leak_key(prefix)
+    cached    = cache_module.get(cache_key)
+    if cached:
+        return _resp(cached["markdown"], cached["json"], format)
+    result = await rir_client.detect_route_leak(prefix)
+    md  = format_route_leak_md(result)
+    jsn = to_json(result)
+    cache_module.set(cache_key, {"markdown": md, "json": jsn}, cache_module.TTL_ROUTE_LEAK)
+    return _resp(md, jsn, format)
+
+
+@app.get(
+    "/v1/looking-glass/{prefix:path}",
+    tags=["BGP"],
+    summary="BGP looking glass — AS paths from RIPE RIS collectors",
+)
+@limiter.limit(_DEFAULT_RATE)
+async def looking_glass_endpoint(
+    request: Request,
+    prefix: str,
+    vantage_points: int = Query(default=10, ge=1, le=50, description="Max entries to return"),
+    format: str = FORMAT_QUERY,
+):
+    """Show BGP routing table entries with full AS paths from RIPE RIS vantage points."""
+    cache_key = cache_module.make_looking_glass_key(prefix, vantage_points)
+    cached    = cache_module.get(cache_key)
+    if cached:
+        return _resp(cached["markdown"], cached["json"], format)
+    result = await rir_client.get_looking_glass(prefix, vantage_points)
+    md  = format_looking_glass_md(result)
+    jsn = to_json(result)
+    cache_module.set(cache_key, {"markdown": md, "json": jsn}, cache_module.TTL_LOOKING_GLASS)
+    return _resp(md, jsn, format)
+
+
+@app.get(
+    "/v1/stability/{prefix:path}",
+    tags=["BGP"],
+    summary="BGP route stability / flap analysis",
+)
+@limiter.limit(_DEFAULT_RATE)
+async def route_stability_endpoint(
+    request: Request,
+    prefix: str,
+    hours: int = Query(default=24, ge=1, le=168, description="Analysis window in hours (max 168 = 7 days)"),
+    format: str = FORMAT_QUERY,
+):
+    """Analyse BGP route flap history and compute a stability score for a prefix."""
+    cache_key = cache_module.make_route_stability_key(prefix, hours)
+    cached    = cache_module.get(cache_key)
+    if cached:
+        return _resp(cached["markdown"], cached["json"], format)
+    result = await rir_client.get_route_stability(prefix, hours)
+    md  = format_route_stability_md(result)
+    jsn = to_json(result)
+    cache_module.set(cache_key, {"markdown": md, "json": jsn}, cache_module.TTL_ROUTE_STABILITY)
+    return _resp(md, jsn, format)
+
+
 # ──────────────────────────────────────────────────────────────
 # OpenAI / Gemini function-calling schema endpoint
 # ──────────────────────────────────────────────────────────────
@@ -1375,5 +1482,64 @@ async def openai_tools(request: Request):
                 },
             },
         },
+        {
+            "type": "function",
+            "function": {
+                "name": "rir_check_irr",
+                "description": "IRR route-object consistency check via IRRExplorer — validates that a prefix has correct route objects matching the expected origin ASN.",
+                "parameters": {
+                    "type": "object",
+                    "properties": {
+                        "prefix": {"type": "string", "description": "CIDR prefix e.g. 1.1.1.0/24"},
+                        "asn":    {"type": "string", "description": "Expected origin ASN e.g. AS13335"},
+                    },
+                    "required": ["prefix", "asn"],
+                },
+            },
+        },
+        {
+            "type": "function",
+            "function": {
+                "name": "rir_detect_route_leak",
+                "description": "Detect BGP route leaks or hijacks — checks for multiple origin ASNs and AS-path loops.",
+                "parameters": {
+                    "type": "object",
+                    "properties": {
+                        "prefix": {"type": "string", "description": "CIDR prefix e.g. 1.1.1.0/24"},
+                    },
+                    "required": ["prefix"],
+                },
+            },
+        },
+        {
+            "type": "function",
+            "function": {
+                "name": "rir_looking_glass",
+                "description": "BGP looking glass — shows AS paths and communities from RIPE RIS vantage points around the world.",
+                "parameters": {
+                    "type": "object",
+                    "properties": {
+                        "prefix":         {"type": "string",  "description": "CIDR prefix e.g. 1.1.1.0/24"},
+                        "vantage_points": {"type": "integer", "description": "Max entries (default 10)"},
+                    },
+                    "required": ["prefix"],
+                },
+            },
+        },
+        {
+            "type": "function",
+            "function": {
+                "name": "rir_route_stability",
+                "description": "BGP route stability / flap analysis — computes a 0–100 stability score and lists state-change events.",
+                "parameters": {
+                    "type": "object",
+                    "properties": {
+                        "prefix": {"type": "string",  "description": "CIDR prefix e.g. 1.1.1.0/24"},
+                        "hours":  {"type": "integer", "description": "Analysis window in hours (default 24, max 168)"},
+                    },
+                    "required": ["prefix"],
+                },
+            },
+        },
     ]
     return {"tools": tools, "count": len(tools), "base_url": "https://api.peerglass.io"}

cache.py

@@ -53,6 +53,12 @@
 TTL_THREAT_INTEL = 3_600     # 1 hour     — Shodan/GreyNoise refreshes hourly
 TTL_PASSIVE_DNS  = 86_400    # 24 hours   — PDNS history rarely changes
 
+# Sprint 4 — BGP depth
+TTL_IRR              = 3_600   # 1 hour     — IRR route objects are fairly stable
+TTL_ROUTE_LEAK       = 300     # 5 minutes  — BGP state can shift quickly
+TTL_LOOKING_GLASS    = 300     # 5 minutes  — live routing table snapshots
+TTL_ROUTE_STABILITY  = 900     # 15 minutes — stability window is time-sensitive
+
 # ── In-memory store ─────────────────────────────────────────
 _STORE: dict[str, tuple[Any, float]] = {}
 
@@ -165,6 +171,19 @@ def make_threat_intel_key(ip: str) -> str:
 def make_passive_dns_key(resource: str) -> str:
     return _make_key("passive_dns", resource.lower().strip())
 
+# Sprint 4 — BGP depth
+def make_irr_key(prefix: str, asn: str) -> str:
+    return _make_key("irr", prefix.strip(), asn.upper().lstrip("AS"))
+
+def make_route_leak_key(prefix: str) -> str:
+    return _make_key("route_leak", prefix.strip())
+
+def make_looking_glass_key(prefix: str, vantage_points: int) -> str:
+    return _make_key("looking_glass", prefix.strip(), int(vantage_points))
+
+def make_route_stability_key(prefix: str, hours: int) -> str:
+    return _make_key("route_stability", prefix.strip(), int(hours))
+
 
 # ── Monitor Store — persistent baselines for change detection ──
 # Separate from the TTL cache: baselines never expire automatically.