# mcp-whoisxmlapi [Health: Active]

**Category:** 💬 Communication  
**Repository:** https://github.com/whoisxmlapi/mcp-whoisxmlapi  
**GitHub Stars:** 0  
**npm Downloads (last month):** 3010  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/mcp-whoisxmlapi-2

## Description
32 WHOIS, DNS, IP, threat intelligence, email, and bulk tools for AI agents via WhoisXML API.

## Tools
Capabilities this server exposes over MCP:

- **whois** — Current WHOIS/RDAP registration data for a domain — registrar, dates, nameservers, status, contacts.
- **whois_history** — Full timeline of WHOIS changes — ownership transfers, registrar moves, nameserver swaps.
- **domain_info** — Enriched WHOIS profile combining current + historical records to fill redacted fields.
- **reverse_whois** — Every domain whose WHOIS record contains a free-text term (name, email, org, address).
- **reverse_whois_advanced** — Field-specific WHOIS searches (e.g. `RegistrantContact.Organization`), up to 4 terms.
- **domain_reputation** — 0–100 trust score from live infrastructure and configuration checks.
- **typosquatting** — Check whether a domain belongs to a typosquatting group, or expand the full group.
- **categorization** — Classify a domain into IAB Content Taxonomy v3.1 categories.
- **dns_lookup** — Current DNS records — A, AAAA, MX, NS, SOA, TXT, CNAME, PTR, SRV, CAA, DS, DNSKEY, or all.
- **dns_history** — Historical DNS records (forward) or domains historically on an IP (reverse).
- **reverse_dns** — Search DNS records by pattern and return matching domains.
- **reverse_ip** — Every domain currently pointing at an IP, with first-/last-seen dates.
- **reverse_mx** — Every domain using a specific MX server.
- **reverse_ns** — Every domain delegated to a specific nameserver.
- **subdomain_lookup** — Enumerate a domain's known subdomains with seen timestamps, paging past the 10,000-per-request cap.
- **domain_and_subdomain_discovery** — Domains/subdomains of any age containing search terms (wildcards supported; `since` filters by first-seen date).
- **ssl_certificates** — TLS certificate details — issuer, validity, SANs, chain trust.
- **ipgeolocation** — Country, region, city, ISP, ASN for an IP, domain, or email.
- **ip_netblocks** — CIDR ranges, ASN, organisation, and each block's last-modified date for IP/ASN/org.
- **vpn_proxy_detection** — Whether an IP is a known VPN, proxy, Tor exit, relay, hosting or CDN address, with a 0–100 risk score.
- **threat_intelligence** — Check a domain, URL, IP, CIDR, or file hash against malware/phishing/spam/botnet feeds.
- **brand_alert** — Newly added/dropped/updated domains containing brand terms — typosquat & lookalike monitoring.
- **registrant_alert** — New/changed domains whose WHOIS registrant fields match search terms.
- **email_verification** — Syntax, MX, and SMTP deliverability checks; flags disposable/free/catch-all.
- **disposable_email_check** — Boolean verdict on disposable/temporary email providers.
- **website_screenshot** — Capture a web page screenshot, returned as a native image content block.
- **bulk_whois** — WHOIS for up to 10,000 domains in one call (native bulk, async `job_id` if long-running).
- **bulk_email_verification** — Email verification for up to 10,000 addresses (native bulk, async if long-running).
- **bulk_vpn_proxy_detection** — VPN & proxy detection for up to 100 IPs in one call (native batch, always inline; Starter plan or higher).
- **bulk_dns_lookup** — DNS lookups for up to 200 domains, fanned out concurrently.
- **bulk_ip_geolocation** — IP geolocation for up to 200 IPs, fanned out concurrently.
- **bulk_subdomain_lookup** — Subdomain discovery for up to 200 apex domains.
- **bulk_job_status** — Progress of an in-flight bulk job.
- **bulk_job_results** — Full per-input results of a completed bulk job.
- **account_balance** — Credits left on each product of your WhoisXML account, and which tools spend them. Free.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "mcp-whoisxmlapi": {
    "command": "npx",
    "args": ["-y","@whoisxmlapidotcom/mcp-whoisxmlapi"],
    "env": {
      "WHOISXMLAPI_TOKEN": ""
    }
  }
}
```

**Requires environment variables:** `WHOISXMLAPI_TOKEN` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What mcp-whoisxmlapi does

mcp-whoisxmlapi exposes WhoisXML API data and operations as MCP tools for AI clients. Its coverage spans current and historical WHOIS, DNS records, IP infrastructure, geolocation, threat intelligence, email validation, website screenshots, and bulk processing.

Domain investigation tools retrieve registration and RDAP details, reconstruct WHOIS changes, enrich profiles with historical records, search for domains connected to names or organizations, identify typosquatting groups, calculate domain reputation scores, and assign IAB Content Taxonomy v3.1 categories. DNS and infrastructure tools cover record lookups, historical DNS, reverse searches, nameservers, MX hosts, IP addresses, subdomains, domain discovery, and TLS certificates.

IP-focused tools return location, ISP, ASN, network block, VPN, proxy, Tor, hosting, and CDN indicators. Threat intelligence accepts domains, URLs, IP addresses, CIDR ranges, and file hashes. Email tools check syntax, mail configuration, SMTP deliverability, and disposable-provider status. The screenshot tool returns a captured webpage as a native image content block.

## How it works

The server communicates with MCP clients over a hosted endpoint or a local process. The hosted endpoint is available at `https://mcp-hosted.whoisxmlapi.com/mcp` and uses OAuth with a WhoisXML API key. Local deployments pass requests to WhoisXML API using the `WHOISXMLAPI_TOKEN` environment variable.

Bulk operations support different input limits and execution models. WHOIS and email verification accept up to 10,000 inputs and may return an asynchronous `job_id` for long-running work. VPN and proxy detection handles up to 100 IPs inline, while DNS and IP geolocation support up to 200 inputs with concurrent fan-out. Subdomain lookup also supports up to 200 apex domains. Bulk job status and result tools retrieve progress and completed per-input results.

## Setup and configuration

A hosted deployment needs an MCP client that supports remote connections. Add the hosted URL to the client's MCP configuration and complete OAuth authentication with a WhoisXML API key.

For a local npm setup, configure the client to run:

```json
{
  "command": "npx",
  "args": ["-y", "@whoisxmlapidotcom/mcp-whoisxmlapi"],
  "env": { "WHOISXMLAPI_TOKEN": "at_YOUR_KEY" }
}
```

Docker users can run the published image with the token supplied as an environment variable:

```bash
docker run -i --rm -e WHOISXMLAPI_TOKEN=at_YOUR_KEY whoisxmlapidotcom/mcp-whoisxmlapi
```

Claude Desktop users can install the downloadable `.mcpb` package and enter the API key when prompted. The package is distributed through npm, and a Docker image is also available.

## Tools and capabilities

- Inspect current, historical, enriched, reverse, and field-specific WHOIS data.
- Query current and historical DNS, reverse DNS, reverse IP, reverse MX, and reverse NS data.
- Discover subdomains, related domains, TLS certificate details, and IP network blocks.
- Assess domain reputation, typosquatting, threat indicators, VPN or proxy use, and content categories.
- Monitor brand terms and registrant fields for domain changes.
- Verify email addresses and identify disposable email providers.
- Capture website screenshots as image content.
- Run bulk WHOIS, email, DNS, IP geolocation, subdomain, and VPN or proxy checks.
- Track asynchronous bulk jobs and retrieve their results.
- Check remaining WhoisXML account credits and the products used by tools.

## Limitations and notes

API usage depends on the WhoisXML API account and its available credits. Bulk VPN and proxy detection requires the Starter plan or higher. Individual bulk tools have separate input limits, and some large operations complete asynchronously rather than returning all results immediately. WHOIS data can include redacted fields; the domain information tool uses historical records to supplement those profiles when possible.

_Full upstream README: https://allmcps.com/mcp/mcp-whoisxmlapi-2/readme_