CIDR math: IPv4 and IPv6 overlap, adjacency, merge, subtract, membership

$0.005 USDC per call · Developer and security · POST /api/v1/cidr-math · Id cidr-math

Computes exact CIDR relations for agents planning networks, firewall rules or allow-lists: for up to 200 IPv4/IPv6 blocks it reports which pairs are equal, nested, partially overlapping or merely adjacent, the minimal merged CIDR list, a subtraction (blocks minus exclusions), address membership with the most specific match, or each block's first/last address, count and host-bits-set errors. It does not resolve hostnames, look up ownership or routing, interpret IPv6 zone ids, or decide whether an overlap is intentional; IPv4-mapped IPv6 stays a separate family unless normalizeMapped is true.

What you get

Subnet overlap and off-by-one boundary mistakes in firewall and VPC plans are exact arithmetic; one call replaces a hand calculation.

Call it

Send the JSON body below to https://agents.writerslogic.com/api/v1/cidr-math. An unpaid request answers 402 with the price and how to pay; a request that fails with a 5xx status is not charged.

curl -i -X POST https://agents.writerslogic.com/api/v1/cidr-math \
  -H 'content-type: application/json' \
  -d '{"op":"relations","ranges":["10.0.0.0/24","10.0.1.0/24","10.0.0.128/25","2001:db8::/32"]}'

Input

Field	Type	Required	Description
`op`	string; one of "inspect", "relations", "merge", "subtract", "contains"	yes	inspect: normalize each range and flag host bits set. relations: pairwise equal/contains/overlap/adjacent/disjoint (pass only when no two ranges intersect). merge: minimal CIDR cover of the union. subtract: ranges minus exclude. contains: which ranges contain each address (pass only when every address is covered).
`ranges`	array<string; length 0..100>; max 200 items	yes	CIDR (10.0.0.0/8, 2001:db8::/32), a bare address (a /32 or /128), or an inclusive range 10.0.0.1-10.0.0.9.
`exclude`	array<string; length 0..100>; max 200 items	no	Only for op=subtract.
`addresses`	array<string; length 0..64>; max 500 items	no	Only for op=contains.
`normalizeMapped`	boolean	no	Treat ::ffff:a.b.c.d (and prefixes of 96 bits or longer inside ::ffff:0:0/96) as the IPv4 block a.b.c.d. Default false.

Example request body

{
  "op": "relations",
  "ranges": [
    "10.0.0.0/24",
    "10.0.1.0/24",
    "10.0.0.128/25",
    "2001:db8::/32"
  ]
}

Result

The response is { "data": ..., "_provenance": ... }. data carries these fields; _provenance is a signed W3C Verifiable Credential with a C2PA-style manifest, checked free at POST /api/v1/verify-provenance.

Field	Type	Required	Description
`status`	string; one of "pass", "fail", "unknown", "unsupported"	no	pass: every rule held. fail: a rule was violated (see witnesses). unknown: the input lacks the evidence to decide. unsupported: outside what this engine covers. Missing evidence is never a pass.
`op`	string	no
`ranges`	array<object>	no
`pairs`	array<object>	no	relations: every non-disjoint pair (adjacent included) by range index.
`cidrs`	array<string>	no	merge/subtract: resulting CIDR blocks in address order.
`matches`	array<object>	no
`total`	integer	no	Number of CIDR blocks before truncation.
`truncated`	boolean	no
`witnesses`	array<object>	no
`versions`	object	no	Every semantic dependency of this answer (engine, tables and their as-of dates, tokenizer, calendar, rounding profile).
`limits`	array<string>	no
`deterministic`	boolean	no	Always true: pure code, no model.

Pay and connect

Available through: x402 (USDC on Base), MCP. MCP clients reach it through the infra-preflight-kit package.

Machine-readable

This agent as JSON (schemas, example, OpenAPI operation)
Free signed sample response
OpenAPI 3.1 · Catalog · Index of every agent