MCP Whoisxmlapi

io.github.whois-api-llc

34 WHOIS, DNS, IP, threat intelligence, email, and bulk tools for AI agents via WhoisXML API.

Add to Cursor Add to VS Code Run on PlugMCP

1{2  "mcpServers": {3    "io.github.whois-api-llc-mcp-whoisxmlapi": {4      "command": "npx",5      "args": [6        "-y",7        "@whoisxmlapidotcom/[email protected]"8      ],9      "env": {10        "WHOISXMLAPI_TOKEN": "<secret>"11      }12    }13  }14}

.cursor/mcp.jsonMCP server

Transport: stdio
Status: Local

Power your agent

Add this server

The publisher's own command. Not a PlugMCP endpoint.

Add to Cursor Add to VS Code Run on PlugMCP

Host a copy with our keys and logs.

Local command

npx -y @whoisxmlapidotcom/[email protected]

Credentials from the publisher

WHOISXMLAPI_TOKEN — WhoisXML API key (get one at https://whoisxmlapi.com)

Claude Code has no install link for a local command. Copy the command below and run it in a terminal.

shClaude Code

1WHOISXMLAPI_TOKEN=<secret> claude mcp add io.github.whois-api-llc-mcp-whoisxmlapi -- npx -y @whoisxmlapidotcom/mcp-whoisxmlapi@1.9.0

Run in a terminal.

jsonClaude Desktop

1{2  "mcpServers": {3    "io.github.whois-api-llc-mcp-whoisxmlapi": {4      "command": "npx",5      "args": [6        "-y",7        "@whoisxmlapidotcom/[email protected]"8      ],9      "env": {10        "WHOISXMLAPI_TOKEN": "<secret>"11      }12    }13  }14}

claude_desktop_config.json

Local · npmPublisher installStep-by-step: add this in Claude

Remote URL or a command on your machine? How the two installs differ

Run on PlugMCP

Host a copy with our keys and logs.

A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.

Launch

Server facts

Local

Transport: stdio
Version: 1.9.0
API key: WHOISXMLAPI_TOKEN
Last checked: 2026-10-27

Stars: —
Tools: —
Uptime: —

Tools

No tool list yet. Remote servers get one after the first health check.

FAQ

Questions

How do I install MCP Whoisxmlapi?

Copy the stdio config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.

Does MCP Whoisxmlapi need an API key?

The publisher lists these environment variables: WHOISXMLAPI_TOKEN.

What transport does MCP Whoisxmlapi use?

MCP Whoisxmlapi runs locally over stdio.

When was MCP Whoisxmlapi last checked?

Last checked 2026-10-27. 34 WHOIS, DNS, IP, threat intelligence, email, and bulk tools for AI agents via WhoisXML API.

From the publisher

Documentation

WhoisXML API MCP Server

The official WhoisXML API MCP server: 32 first-party tools for WHOIS, DNS, IP geolocation, threat intelligence, typosquatting, email verification, and native bulk lookups — in Claude, Cursor, VS Code, LobeChat, or any MCP client.

Documentation: https://mcp.whoisxmlapi.com
npm package: @whoisxmlapidotcom/mcp-whoisxmlapi
Docker image: whoisxmlapidotcom/mcp-whoisxmlapi
MCP Registry: io.github.whois-api-llc/mcp-whoisxmlapi

This repository is the public listing home for the server. Distribution is via the hosted endpoint, npm, and Docker Hub; the implementation source is maintained privately by Whois API, Inc.

Hosted endpoint (no install)

Connect any remote-capable MCP client to the hosted server — authentication is via OAuth with your WhoisXML API key:

https://mcp-hosted.whoisxmlapi.com/mcp

{
  "mcpServers": {
    "whoisxmlapi": {
      "url": "https://mcp-hosted.whoisxmlapi.com/mcp"
    }
  }
}

Run locally

Requires a WhoisXML API key — get one at https://whoisxmlapi.com.

npm:

{
  "mcpServers": {
    "whoisxmlapi": {
      "command": "npx",
      "args": ["-y", "@whoisxmlapidotcom/mcp-whoisxmlapi"],
      "env": { "WHOISXMLAPI_TOKEN": "at_YOUR_KEY" }
    }
  }
}

Docker:

docker run -i --rm -e WHOISXMLAPI_TOKEN=at_YOUR_KEY whoisxmlapidotcom/mcp-whoisxmlapi

Tools (32)

Domain intelligence

Tool	What it does
`whois`	Current WHOIS/RDAP registration data for a domain — registrar, dates, nameservers, status, contacts.
`whois_history`	Full timeline of WHOIS changes — ownership transfers, registrar moves, nameserver swaps.
`domain_info`	Enriched WHOIS profile combining current + historical records to fill redacted fields.
`reverse_whois`	Every domain whose WHOIS record contains a free-text term (name, email, org, address).
`reverse_whois_advanced`	Field-specific WHOIS searches (e.g. `RegistrantContact.Organization`), up to 4 terms.
`domain_reputation`	0–100 trust score from live infrastructure and configuration checks.
`typosquatting`	Check whether a domain belongs to a typosquatting group, or expand the full group.
`categorization`	Classify a domain into IAB Content Taxonomy v3.1 categories.

DNS & infrastructure

Tool	What it does
`dns_lookup`	Current DNS records — A, AAAA, MX, NS, SOA, TXT, CNAME, PTR, SRV, CAA, DS, DNSKEY, or all.
`dns_history`	Historical DNS records (forward) or domains historically on an IP (reverse).
`reverse_dns`	Search DNS records by pattern and return matching domains.
`reverse_ip`	Every domain currently pointing at an IP, with first-/last-seen dates.
`reverse_mx`	Every domain using a specific MX server.
`reverse_ns`	Every domain delegated to a specific nameserver.
`subdomain_lookup`	Enumerate up to 10,000 known subdomains of a domain with seen timestamps.
`domain_and_subdomain_discovery`	Newly-registered domains/subdomains containing search terms (wildcards supported).
`ssl_certificates`	TLS certificate details — issuer, validity, SANs, chain trust.

IP intelligence

Tool	What it does
`ipgeolocation`	Country, region, city, ISP, ASN for an IP, domain, or email.
`ip_netblocks`	CIDR ranges, ASN, organisation, and registration dates for IP/ASN/org.

Threat & brand protection

Tool	What it does
`threat_intelligence`	Check a domain, URL, IP, CIDR, or file hash against malware/phishing/spam/botnet feeds.
`brand_alert`	Newly added/dropped/updated domains containing brand terms — typosquat & lookalike monitoring.
`registrant_alert`	New/changed domains whose WHOIS registrant fields match search terms.

Email

Tool	What it does
`email_verification`	Syntax, MX, and SMTP deliverability checks; flags disposable/role/free/catch-all.
`disposable_email_check`	Boolean verdict on disposable/temporary email providers.

Screenshots

Tool	What it does
`website_screenshot`	Capture a web page screenshot, returned as a native image content block.

Native bulk

Tool	What it does
`bulk_whois`	WHOIS for up to 10,000 domains in one call (native bulk, async `job_id` if long-running).
`bulk_email_verification`	Email verification for up to 10,000 addresses (native bulk, async if long-running).
`bulk_dns_lookup`	DNS lookups for up to 200 domains, fanned out concurrently.
`bulk_ip_geolocation`	IP geolocation for up to 200 IPs, fanned out concurrently.
`bulk_subdomain_lookup`	Subdomain discovery for up to 200 apex domains.
`bulk_job_status`	Progress of an in-flight bulk job.
`bulk_job_results`	Full per-input results of a completed bulk job.

Example prompts

"Look up the WHOIS for suspicious-domain.com and tell me if it's suspicious."
"Find all subdomains of example.com and check their DNS history."
"Check the threat intelligence reputation of 203.0.113.7 and what's hosted there."

MCP Whoisxmlapi

io.github.whois-api-llc

34 WHOIS, DNS, IP, threat intelligence, email, and bulk tools for AI agents via WhoisXML API.

Communication

Add to Cursor Add to VS Code Run on PlugMCP

GitHub npm

Add to Cursor Add to VS Code Run on PlugMCP

1{2  "mcpServers": {3    "io.github.whois-api-llc-mcp-whoisxmlapi": {4      "command": "npx",5      "args": [6        "-y",7        "@whoisxmlapidotcom/[email protected]"8      ],9      "env": {10        "WHOISXMLAPI_TOKEN": "<secret>"11      }12    }13  }14}

.cursor/mcp.jsonMCP server

Transport: stdio
Status: Local

Power your agent

Add this server

The publisher's own command. Not a PlugMCP endpoint.

Add to Cursor Add to VS Code Run on PlugMCP

Host a copy with our keys and logs.

Local command

npx -y @whoisxmlapidotcom/[email protected]

Credentials from the publisher

WHOISXMLAPI_TOKEN — WhoisXML API key (get one at https://whoisxmlapi.com)

Claude Code has no install link for a local command. Copy the command below and run it in a terminal.

shClaude Code

1WHOISXMLAPI_TOKEN=<secret> claude mcp add io.github.whois-api-llc-mcp-whoisxmlapi -- npx -y @whoisxmlapidotcom/mcp-whoisxmlapi@1.9.0

Run in a terminal.

jsonClaude Desktop

1{2  "mcpServers": {3    "io.github.whois-api-llc-mcp-whoisxmlapi": {4      "command": "npx",5      "args": [6        "-y",7        "@whoisxmlapidotcom/[email protected]"8      ],9      "env": {10        "WHOISXMLAPI_TOKEN": "<secret>"11      }12    }13  }14}

claude_desktop_config.json

Local · npmPublisher installStep-by-step: add this in Claude

Remote URL or a command on your machine? How the two installs differ

Run on PlugMCP

Host a copy with our keys and logs.

A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.

Launch

Server facts

Local

Transport: stdio
Version: 1.9.0
API key: WHOISXMLAPI_TOKEN
Last checked: 2026-10-27

Stars: —
Tools: —
Uptime: —

Tools

No tool list yet. Remote servers get one after the first health check.

FAQ

Questions

How do I install MCP Whoisxmlapi?

Copy the stdio config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.

Does MCP Whoisxmlapi need an API key?

The publisher lists these environment variables: WHOISXMLAPI_TOKEN.

What transport does MCP Whoisxmlapi use?

MCP Whoisxmlapi runs locally over stdio.

When was MCP Whoisxmlapi last checked?

Last checked 2026-10-27. 34 WHOIS, DNS, IP, threat intelligence, email, and bulk tools for AI agents via WhoisXML API.

From the publisher

Documentation

WhoisXML API MCP Server

Documentation: https://mcp.whoisxmlapi.com
npm package: @whoisxmlapidotcom/mcp-whoisxmlapi
Docker image: whoisxmlapidotcom/mcp-whoisxmlapi
MCP Registry: io.github.whois-api-llc/mcp-whoisxmlapi

This repository is the public listing home for the server. Distribution is via the hosted endpoint, npm, and Docker Hub; the implementation source is maintained privately by Whois API, Inc.

Hosted endpoint (no install)

Connect any remote-capable MCP client to the hosted server — authentication is via OAuth with your WhoisXML API key:

https://mcp-hosted.whoisxmlapi.com/mcp

{
  "mcpServers": {
    "whoisxmlapi": {
      "url": "https://mcp-hosted.whoisxmlapi.com/mcp"
    }
  }
}

Run locally

Requires a WhoisXML API key — get one at https://whoisxmlapi.com.

npm:

{
  "mcpServers": {
    "whoisxmlapi": {
      "command": "npx",
      "args": ["-y", "@whoisxmlapidotcom/mcp-whoisxmlapi"],
      "env": { "WHOISXMLAPI_TOKEN": "at_YOUR_KEY" }
    }
  }
}

Docker:

docker run -i --rm -e WHOISXMLAPI_TOKEN=at_YOUR_KEY whoisxmlapidotcom/mcp-whoisxmlapi

Tools (32)

Domain intelligence

Tool	What it does
`whois`	Current WHOIS/RDAP registration data for a domain — registrar, dates, nameservers, status, contacts.
`whois_history`	Full timeline of WHOIS changes — ownership transfers, registrar moves, nameserver swaps.
`domain_info`	Enriched WHOIS profile combining current + historical records to fill redacted fields.
`reverse_whois`	Every domain whose WHOIS record contains a free-text term (name, email, org, address).
`reverse_whois_advanced`	Field-specific WHOIS searches (e.g. `RegistrantContact.Organization`), up to 4 terms.
`domain_reputation`	0–100 trust score from live infrastructure and configuration checks.
`typosquatting`	Check whether a domain belongs to a typosquatting group, or expand the full group.
`categorization`	Classify a domain into IAB Content Taxonomy v3.1 categories.

DNS & infrastructure

Tool	What it does
`dns_lookup`	Current DNS records — A, AAAA, MX, NS, SOA, TXT, CNAME, PTR, SRV, CAA, DS, DNSKEY, or all.
`dns_history`	Historical DNS records (forward) or domains historically on an IP (reverse).
`reverse_dns`	Search DNS records by pattern and return matching domains.
`reverse_ip`	Every domain currently pointing at an IP, with first-/last-seen dates.
`reverse_mx`	Every domain using a specific MX server.
`reverse_ns`	Every domain delegated to a specific nameserver.
`subdomain_lookup`	Enumerate up to 10,000 known subdomains of a domain with seen timestamps.
`domain_and_subdomain_discovery`	Newly-registered domains/subdomains containing search terms (wildcards supported).
`ssl_certificates`	TLS certificate details — issuer, validity, SANs, chain trust.

IP intelligence

Tool	What it does
`ipgeolocation`	Country, region, city, ISP, ASN for an IP, domain, or email.
`ip_netblocks`	CIDR ranges, ASN, organisation, and registration dates for IP/ASN/org.

Threat & brand protection

Tool	What it does
`threat_intelligence`	Check a domain, URL, IP, CIDR, or file hash against malware/phishing/spam/botnet feeds.
`brand_alert`	Newly added/dropped/updated domains containing brand terms — typosquat & lookalike monitoring.
`registrant_alert`	New/changed domains whose WHOIS registrant fields match search terms.

Email

Tool	What it does
`email_verification`	Syntax, MX, and SMTP deliverability checks; flags disposable/role/free/catch-all.
`disposable_email_check`	Boolean verdict on disposable/temporary email providers.

Screenshots

Tool	What it does
`website_screenshot`	Capture a web page screenshot, returned as a native image content block.

Native bulk

Tool	What it does
`bulk_whois`	WHOIS for up to 10,000 domains in one call (native bulk, async `job_id` if long-running).
`bulk_email_verification`	Email verification for up to 10,000 addresses (native bulk, async if long-running).
`bulk_dns_lookup`	DNS lookups for up to 200 domains, fanned out concurrently.
`bulk_ip_geolocation`	IP geolocation for up to 200 IPs, fanned out concurrently.
`bulk_subdomain_lookup`	Subdomain discovery for up to 200 apex domains.
`bulk_job_status`	Progress of an in-flight bulk job.
`bulk_job_results`	Full per-input results of a completed bulk job.

Example prompts

"Look up the WHOIS for suspicious-domain.com and tell me if it's suspicious."
"Find all subdomains of example.com and check their DNS history."
"Check the threat intelligence reputation of 203.0.113.7 and what's hosted there."