MCP Whoisxmlapi

What mcp-whoisxmlapi does

mcp-whoisxmlapi exposes WhoisXML API data and operations as MCP tools for AI clients. Its coverage spans current and historical WHOIS, DNS records, IP infrastructure, geolocation, threat intelligence, email validation, website screenshots, and bulk processing.

Domain investigation tools retrieve registration and RDAP details, reconstruct WHOIS changes, enrich profiles with historical records, search for domains connected to names or organizations, identify typosquatting groups, calculate domain reputation scores, and assign IAB Content Taxonomy v3.1 categories. DNS and infrastructure tools cover record lookups, historical DNS, reverse searches, nameservers, MX hosts, IP addresses, subdomains, domain discovery, and TLS certificates.

IP-focused tools return location, ISP, ASN, network block, VPN, proxy, Tor, hosting, and CDN indicators. Threat intelligence accepts domains, URLs, IP addresses, CIDR ranges, and file hashes. Email tools check syntax, mail configuration, SMTP deliverability, and disposable-provider status. The screenshot tool returns a captured webpage as a native image content block.

How it works

The server communicates with MCP clients over a hosted endpoint or a local process. The hosted endpoint is available at https://mcp-hosted.whoisxmlapi.com/mcp and uses OAuth with a WhoisXML API key. Local deployments pass requests to WhoisXML API using the WHOISXMLAPI_TOKEN environment variable.

Bulk operations support different input limits and execution models. WHOIS and email verification accept up to 10,000 inputs and may return an asynchronous job_id for long-running work. VPN and proxy detection handles up to 100 IPs inline, while DNS and IP geolocation support up to 200 inputs with concurrent fan-out. Subdomain lookup also supports up to 200 apex domains. Bulk job status and result tools retrieve progress and completed per-input results.

Setup and configuration

A hosted deployment needs an MCP client that supports remote connections. Add the hosted URL to the client's MCP configuration and complete OAuth authentication with a WhoisXML API key.

For a local npm setup, configure the client to run:

{
  "command": "npx",
  "args": ["-y", "@whoisxmlapidotcom/mcp-whoisxmlapi"],
  "env": { "WHOISXMLAPI_TOKEN": "at_YOUR_KEY" }
}

Docker users can run the published image with the token supplied as an environment variable:

docker run -i --rm -e WHOISXMLAPI_TOKEN=at_YOUR_KEY whoisxmlapidotcom/mcp-whoisxmlapi

Claude Desktop users can install the downloadable .mcpb package and enter the API key when prompted. The package is distributed through npm, and a Docker image is also available.

Tools and capabilities

• Inspect current, historical, enriched, reverse, and field-specific WHOIS data.
• Query current and historical DNS, reverse DNS, reverse IP, reverse MX, and reverse NS data.
• Discover subdomains, related domains, TLS certificate details, and IP network blocks.
• Assess domain reputation, typosquatting, threat indicators, VPN or proxy use, and content categories.
• Monitor brand terms and registrant fields for domain changes.
• Verify email addresses and identify disposable email providers.
• Capture website screenshots as image content.
• Run bulk WHOIS, email, DNS, IP geolocation, subdomain, and VPN or proxy checks.
• Track asynchronous bulk jobs and retrieve their results.
• Check remaining WhoisXML account credits and the products used by tools.

Limitations and notes

API usage depends on the WhoisXML API account and its available credits. Bulk VPN and proxy detection requires the Starter plan or higher. Individual bulk tools have separate input limits, and some large operations complete asynchronously rather than returning all results immediately. WHOIS data can include redacted fields; the domain information tool uses historical records to supplement those profiles when possible.