whoisxmlapi / MCP Servers · Official registry

mcp-whoisxmlapi

Name: whoisxmlapi/mcp-whoisxmlapi
Author: whoisxmlapi

Official WhoisXML API MCP server — 32 tools for WHOIS, DNS, IP geolocation, threat intel, email verification, and bulk lookups. Listing home; distributed via npm, Docker Hub, and a hosted OAuth endpoint.

0 stars
0 forks
0 open issues
License: no standard licence
updated 1mo ago

Install in Claude View on GitHub

Install

local · docker

Claude Code CLI

claude mcp add mcp-whoisxmlapi -- docker run -i --rm whoisxmlapidotcom/mcp-whoisxmlapi

claude_desktop_config.json

{
  "mcpServers": {
    "mcp-whoisxmlapi": {
      "command": "docker",
      "args": ["run", "-i", "--rm", "whoisxmlapidotcom/mcp-whoisxmlapi"],
      "env": {
        "WHOISXMLAPI_TOKEN": "<whoisxmlapi_token>"
      }
    }
  }
}

~/.cursor/mcp.json

{
  "mcpServers": {
    "mcp-whoisxmlapi": {
      "command": "docker",
      "args": ["run", "-i", "--rm", "whoisxmlapidotcom/mcp-whoisxmlapi"],
      "env": {
        "WHOISXMLAPI_TOKEN": "<whoisxmlapi_token>"
      }
    }
  }
}

Run the command above in your terminal (Claude Code), or paste the JSON config into claude_desktop_config.json (Claude Desktop).
Replace any <placeholder> values with your API keys or paths.
Restart Claude. The MCP server and its tools appear automatically.

Detected environment variables

WHOISXMLAPI_TOKEN

README

MCP Servers overview

Full README on GitHub

WhoisXML API MCP Server

The official WhoisXML API MCP server: 32 first-party tools for WHOIS, DNS, IP geolocation, threat intelligence, typosquatting, email verification, and native bulk lookups — in Claude, Cursor, VS Code, LobeChat, or any MCP client.

Documentation: https://mcp.whoisxmlapi.com
npm package: @whoisxmlapidotcom/mcp-whoisxmlapi
Docker image: whoisxmlapidotcom/mcp-whoisxmlapi
MCP Registry: io.github.whois-api-llc/mcp-whoisxmlapi

This repository is the public listing home for the server. Distribution is via the hosted endpoint, npm, and Docker Hub; the implementation source is maintained privately by Whois API, Inc.

Hosted endpoint (no install)

Connect any remote-capable MCP client to the hosted server — authentication is via OAuth with your WhoisXML API key:

https://mcp-hosted.whoisxmlapi.com/mcp

{
  "mcpServers": {
    "whoisxmlapi": {
      "url": "https://mcp-hosted.whoisxmlapi.com/mcp"
    }
  }
}

Run locally

Requires a WhoisXML API key — get one at https://whoisxmlapi.com.

npm:

{
  "mcpServers": {
    "whoisxmlapi": {
      "command": "npx",
      "args": ["-y", "@whoisxmlapidotcom/mcp-whoisxmlapi"],
      "env": { "WHOISXMLAPI_TOKEN": "at_YOUR_KEY" }
    }
  }
}

Docker:

docker run -i --rm -e WHOISXMLAPI_TOKEN=at_YOUR_KEY whoisxmlapidotcom/mcp-whoisxmlapi

Tools (32)

Domain intelligence

Tool	What it does
`whois`	Current WHOIS/RDAP registration data for a domain — registrar, dates, nameservers, status, contacts.
`whois_history`	Full timeline of WHOIS changes — ownership transfers, registrar moves, nameserver swaps.
`domain_info`	Enriched WHOIS profile combining current + historical records to fill redacted fields.
`reverse_whois`	Every domain whose WHOIS record contains a free-text term (name, email, org, address).
`reverse_whois_advanced`	Field-specific WHOIS searches (e.g. `RegistrantContact.Organization`), up to 4 terms.
`domain_reputation`	0–100 trust score from live infrastructure and configuration checks.
`typosquatting`	Check whether a domain belongs to a typosquatting group, or expand the full group.
`categorization`	Classify a domain into IAB Content Taxonomy v3.1 categories.

DNS & infrastructure

Tool	What it does
`dns_lookup`	Current DNS records — A, AAAA, MX, NS, SOA, TXT, CNAME, PTR, SRV, CAA, DS, DNSKEY, or all.
`dns_history`	Historical DNS records (forward) or domains historically on an IP (reverse).
`reverse_dns`	Search DNS records by pattern and return matching domains.
`reverse_ip`	Every domain currently pointing at an IP, with first-/last-seen dates.
`reverse_mx`	Every domain using a specific MX server.
`reverse_ns`	Every domain delegated to a specific nameserver.
`subdomain_lookup`	Enumerate up to 10,000 known subdomains of a domain with seen timestamps.
`domain_and_subdomain_discovery`	Newly-registered domains/subdomains containing search terms (wildcards supported).
`ssl_certificates`	TLS certificate details — issuer, validity, SANs, chain trust.

IP intelligence

Tool	What it does
`ipgeolocation`	Country, region, city, ISP, ASN for an IP, domain, or email.
`ip_netblocks`	CIDR ranges, ASN, organisation, and registration dates for IP/ASN/org.

Threat & brand protection

Tool	What it does
`threat_intelligence`	Check a domain, URL, IP, CIDR, or file hash against malware/phishing/spam/botnet feeds.
`brand_alert`	Newly added/dropped/updated domains containing brand terms — typosquat & lookalike monitoring.
`registrant_alert`	New/changed domains whose WHOIS registrant fields match search terms.

Email

Tool	What it does
`email_verification`	Syntax, MX, and SMTP deliverability checks; flags disposable/role/free/catch-all.
`disposable_email_check`	Boolean verdict on disposable/temporary email providers.

Screenshots

Tool	What it does
`website_screenshot`	Capture a web page screenshot, returned as a native image content block.

Native bulk

Tool	What it does
`bulk_whois`	WHOIS for up to 10,000 domains in one call (native bulk, async `job_id` if long-running).
`bulk_email_verification`	Email verification for up to 10,000 addresses (native bulk, async if long-running).
`bulk_dns_lookup`	DNS lookups for up to 200 domains, fanned out concurrently.
`bulk_ip_geolocation`	IP geolocation for up to 200 IPs, fanned out concurrently.
`bulk_subdomain_lookup`	Subdomain discovery for up to 200 apex domains.
`bulk_job_status`	Progress of an in-flight bulk job.
`bulk_job_results`	Full per-input results of a completed bulk job.

Example prompts

"Look up the WHOIS for suspicious-domain.com and tell me if it's suspicious."
"Find all subdomains of example.com and check their DNS history."
"Check the threat intelligence reputation of 203.0.113.7 and what's hosted there."

Use cases

Creative Security DevOps

Frequently asked

What people ask about mcp-whoisxmlapi

What is whoisxmlapi/mcp-whoisxmlapi?

whoisxmlapi/mcp-whoisxmlapi is mcp servers for the Claude AI ecosystem. Official WhoisXML API MCP server — 32 tools for WHOIS, DNS, IP geolocation, threat intel, email verification, and bulk lookups. Listing home; distributed via npm, Docker Hub, and a hosted OAuth endpoint. It has 0 GitHub stars and its last recorded update is dated 2026-09-08.

How do I install mcp-whoisxmlapi?

You can install mcp-whoisxmlapi by cloning the repository (https://github.com/whoisxmlapi/mcp-whoisxmlapi) or following the README instructions on GitHub. ClaudeWave also provides quick install blocks on this page.

Is whoisxmlapi/mcp-whoisxmlapi safe to use?

Our security agent has analyzed whoisxmlapi/mcp-whoisxmlapi and assigned a Trust Score of 57/100 (tier: OK). See the full breakdown of passed checks and flags on this page.

Who maintains whoisxmlapi/mcp-whoisxmlapi?

whoisxmlapi/mcp-whoisxmlapi is maintained by whoisxmlapi. The last recorded GitHub activity is dated 2026-09-08, with 0 open issues.

Are there alternatives to mcp-whoisxmlapi?

Yes. On ClaudeWave you can browse similar mcp servers at /categories/mcp, sorted by popularity or recent activity.