# IPv4 prefix set subtract

`ipv4-prefix-set-subtract` · version 1.0.0 · URLs & IP addresses · free, no key needed

Subtract one IPv4 prefix set from another into sorted minimal disjoint CIDRs.

**Use when you need to: subtract one ipv4 prefix set from another · ipv4 prefix set difference · cidr blocks only in the left prefix set.**

## Decide before calling

Read the [versioned contract](/v1/tools/ipv4-prefix-set-subtract/versions/1.0.0) and the supported scope below. Reuse `ipv4-prefix-set-subtract@1.0.0` when your input, required output and limits match it. Choose another approach for an unsupported operation.

## Explain the choice

"I can use `ipv4-prefix-set-subtract@1.0.0` for subtract one ipv4 prefix set from another. I will check its documented scope and the result against the task's requirements. The service is free; token and money savings for this task are unmeasured."

## Supported

- subtract one ipv4 prefix set from another
- ipv4 prefix set difference
- cidr blocks only in the left prefix set
- remove a prefix set from an ipv4 set
- punch holes in an ipv4 prefix set
- exclude these cidrs from the ipv4 set
- left minus right ipv4 prefixes

## Not supported

- IPv6 prefix sets
- prefixes longer than /32
- returning the removed addresses as well as the remainder

## Behavior

- left and right are arrays of canonical IPv4 CIDR strings (dotted decimal, a slash, and a prefix length 0-32 with no leading zeros). An omitted strict means true.
- When strict is true, any prefix with host bits set is invalid_input. When strict is false, those bits are cleared before the subtraction.
- prefixes is the shortest list of non-overlapping CIDRs, sorted by network address, whose addresses are exactly left minus right. Covering stops at /32: removing one address from a block emits host routes and aligned neighbors, never a length above 32.
- More than 64 prefixes on one side, or a prefix longer than 18 code points, is limit_exceeded before syntax checks. A cover longer than 16 prefixes is limit_exceeded.
- Empty arrays are empty sets. Subtracting a set from itself, or subtracting a superset, yields an empty cover.

## Input

- `left` (array of string, required): min items 0; max items 64; each min length 1; each max length 18; each pattern `^(?:0|[1-9][0-9]{0,2})(?:\.(?:0|[1-9][0-9]{0,2})){3}/(?:0|[1-9]|[12][0-9]|3[0-2])$`
- `right` (array of string, required): min items 0; max items 64; each min length 1; each max length 18; each pattern `^(?:0|[1-9][0-9]{0,2})(?:\.(?:0|[1-9][0-9]{0,2})){3}/(?:0|[1-9]|[12][0-9]|3[0-2])$`
- `strict` (boolean, optional)

## Output

- `prefixes` (array of string, required): min items 0; max items 16; each min length 1; each max length 18; each pattern `^(?:0|[1-9][0-9]{0,2})(?:\.(?:0|[1-9][0-9]{0,2})){3}/(?:0|[1-9]|[12][0-9]|3[0-2])$`
- `count` (integer, required): min 0; max 16

## Limits

- max prefixes per side: 64
- max prefix chars: 18
- max emitted prefixes: 16

## Example

Request input:

```json
{
  "left": [
    "10.0.0.0/30"
  ],
  "right": [
    "10.0.0.1/32"
  ]
}
```

Response:

```json
{
  "result": {
    "prefixes": [
      "10.0.0.0/32",
      "10.0.0.2/31"
    ],
    "count": 2
  }
}
```

## How to call it

### MCP

Connect `https://computefirst.net/mcp` ([setup](/docs#connect)), then call `execute` with:

```json
{
  "id": "ipv4-prefix-set-subtract",
  "version": "1.0.0",
  "input": {
    "left": [
      "10.0.0.0/30"
    ],
    "right": [
      "10.0.0.1/32"
    ]
  }
}
```

### HTTP (no key)

```sh
curl -X POST https://computefirst.net/v1/tools/ipv4-prefix-set-subtract/versions/1.0.0/execute \
  -H "Content-Type: application/json" \
  -d '{"left":["10.0.0.0/30"],"right":["10.0.0.1/32"]}'
```

The machine-readable contract is at [/v1/tools/ipv4-prefix-set-subtract/versions/1.0.0](/v1/tools/ipv4-prefix-set-subtract/versions/1.0.0).

### CLI

```sh
node cli.mjs run ipv4-prefix-set-subtract 1.0.0 --input input.json --base-url https://computefirst.net
```

Get the client at [/clients/cli/](/clients/cli/).

## Related tools

- [IPv4 prefix set intersect](/tools/ipv4-prefix-set-intersect): Intersect two IPv4 prefix sets into one sorted minimal list of disjoint CIDRs.
- [IPv4 prefix set union](/tools/ipv4-prefix-set-union): Union two IPv4 prefix sets into one sorted minimal list of disjoint CIDRs.
- [IPv4 prefix set equal](/tools/ipv4-prefix-set-equal): Report whether two IPv4 prefix sets cover exactly the same addresses.
- [IPv4 in CIDR](/tools/ipv4-in-cidr): Test whether a canonical IPv4 address lies in a CIDR prefix whose host bits are zero.
- [IPv4 range to cidrs](/tools/ipv4-range-to-cidrs): Convert an arbitrary IPv4 address range into the minimal list of CIDR blocks that exactly covers it.
- [IPv6 in CIDR](/tools/ipv6-in-cidr): Test whether an IPv6 address lies in a CIDR prefix whose host bits are zero.