Summary
This connects Claude to WhoisXML API's suite of 30 domain intelligence tools, covering WHOIS lookups, DNS queries, IP geolocation, and threat data. You'd reach for it when building agents that need to investigate domains, validate email addresses, check domain availability, or pull threat intelligence on suspicious IPs. The breadth here is the point: instead of integrating a dozen different APIs, you get domain registration history, DNS records, reverse IP lookups, and bulk domain tools all through one MCP connection. Useful for security research workflows, brand monitoring, or any agent that needs to quickly pull authoritative data about internet infrastructure.
Fastest browser for AI agents to run web automation tasks, always free.
Download Free life-time →
Notes, actions and memory. Without a meeting bot. First month 100% off.
Download for free →
belt cli automatically finds the best tools and skills for your agent. image, video, music, tts...
one prompt install →
Connect your Claude agent to live crypto prices and trading routes via 1inch
Get the MCP →
Block distracting apps from your iPhone permanently without a 3rd party app. Free and open source.
Block now (100% free) →Tools
Public tool metadata for what this MCP can expose to an agent.
27 tools
bulk_dns_lookupRun DNS lookups for up to 200 domain names per call. Emulated bulk (no native upstream bulk endpoint): the server fans out single DNS lookups concurrently and returns a unified envelope. Each input consumes 1 credit. For larger jobs, split client-side.2 params
Run DNS lookups for up to 200 domain names per call. Emulated bulk (no native upstream bulk endpoint): the server fans out single DNS lookups concurrently and returns a unified envelope. Each input consumes 1 credit. For larger jobs, split client-side.
Parameters* required
domain_namesarrayDomain names to look up (1 credit per domain, max 200 per call).
query_typestringComma-separated DNS query types (A, MX, NS, SOA, etc.) or "all". Applied uniformly to all inputs.default: A
bulk_email_verificationRun email verification for up to 10,000 emails per call. Native bulk (uses WhoisXML's Bulk Email Verification API). Each email consumes 1 credit. Returns inline if completes within 20s, otherwise returns a job_id to poll via bulk_job_status / bulk_job_results.1 params
Run email verification for up to 10,000 emails per call. Native bulk (uses WhoisXML's Bulk Email Verification API). Each email consumes 1 credit. Returns inline if completes within 20s, otherwise returns a job_id to poll via bulk_job_status / bulk_job_results.
Parameters* required
emailsarrayEmail addresses to verify (1 credit per email, max 10000 per call).
bulk_ip_geolocationRun IP geolocation lookups for up to 200 IP addresses per call. Emulated bulk (no native upstream bulk endpoint exists; the WhoisXML bulk-IP-geo product is CSV-only via web UI). The server fans out single IP geolocation lookups concurrently and returns a unified envelope. Each...1 params
Run IP geolocation lookups for up to 200 IP addresses per call. Emulated bulk (no native upstream bulk endpoint exists; the WhoisXML bulk-IP-geo product is CSV-only via web UI). The server fans out single IP geolocation lookups concurrently and returns a unified envelope. Each...
Parameters* required
ip_addressesarrayIP addresses to look up (1 credit per IP, max 200 per call).
bulk_job_resultsFetch full per-input results for a completed native bulk job (created by bulk_whois or bulk_email_verification). If the job is still in-flight, returns status=running with progress; caller should retry later. Note: per-input order may differ from the original input order — the...1 params
Fetch full per-input results for a completed native bulk job (created by bulk_whois or bulk_email_verification). If the job is still in-flight, returns status=running with progress; caller should retry later. Note: per-input order may differ from the original input order — the...
Parameters* required
job_idstringOpaque job identifier returned by a bulk_* tool when status=running.
bulk_job_statusCheck progress of an in-flight bulk job created by bulk_whois or bulk_email_verification. Returns status (running|completed) and progress counters. Use bulk_job_results once status=completed.1 params
Check progress of an in-flight bulk job created by bulk_whois or bulk_email_verification. Returns status (running|completed) and progress counters. Use bulk_job_results once status=completed.
Parameters* required
job_idstringOpaque job identifier returned by a bulk_* tool when status=running.
bulk_subdomain_lookupDiscover subdomains for up to 200 domains per call. Emulated bulk (no native upstream bulk endpoint): the server fans out single subdomain lookups concurrently and returns a unified envelope. Reuses the in-memory cache of subdomain_lookup, so re-querying recently-fetched domai...1 params
Discover subdomains for up to 200 domains per call. Emulated bulk (no native upstream bulk endpoint): the server fans out single subdomain lookups concurrently and returns a unified envelope. Reuses the in-memory cache of subdomain_lookup, so re-querying recently-fetched domai...
Parameters* required
domain_namesarrayDomain names to look up (1 credit per uncached domain, max 200 per call).
bulk_whoisRun WHOIS lookups for up to 10,000 domains per call. Native bulk (uses WhoisXML's Bulk WHOIS API). Each domain consumes 1 credit. Returns inline if completes within 20s, otherwise returns a job_id to poll via bulk_job_status / bulk_job_results.1 params
Run WHOIS lookups for up to 10,000 domains per call. Native bulk (uses WhoisXML's Bulk WHOIS API). Each domain consumes 1 credit. Returns inline if completes within 20s, otherwise returns a job_id to poll via bulk_job_status / bulk_job_results.
Parameters* required
domainsarrayDomain names to look up (1 credit per domain, max 10000 per call).
categorizationClassify a URL or domain into IAB content categories, website groups, and content classifications. Returns category labels with confidence scores for content filtering and brand safety.2 params
Classify a URL or domain into IAB content categories, website groups, and content classifications. Returns category labels with confidence scores for content filtering and brand safety.
Parameters* required
minimum_confidencenumberMinimum confidence for predictions. Higher value = fewer false positives.default: 0.55
urlstringURL or domain name to categorize.
dns_historyGet historical DNS records for a domain (forward) or find domains associated with an IP (reverse).5 params
Get historical DNS records for a domain (forward) or find domains associated with an IP (reverse).
Parameters* required
domain_namestringRequired if "forward" search type. Domain name to search.
ip_addressstringRequired if "reverse" search type. IP address to search. IPv4 returns A records, IPv6 returns AAAA records.
limitnumberMaximum records to return. Range: 1-1000. Recommended: 50.
record_typestringDNS record type: "a" or "aaaa". Case insensitive.one of
a · A · aaaa · AAAAsearch_typestringSearch type: "forward" or "reverse".one of
forward · reversedns_lookupPerform DNS record lookups for a domain. Supports A, AAAA, MX, NS, SOA, TXT, CNAME, PTR, SRV, CAA, DS, and DNSKEY record types, or "all" to retrieve every record type at once.2 params
Perform DNS record lookups for a domain. Supports A, AAAA, MX, NS, SOA, TXT, CNAME, PTR, SRV, CAA, DS, and DNSKEY record types, or "all" to retrieve every record type at once.
Parameters* required
domain_namestringDomain name to query.
query_typestringComma-separated DNS query types (A, MX, NS, SOA, etc.) or "all".default: A
domain_and_subdomain_discoveryFind newly registered domains and subdomains containing search terms, returning registration dates. Supports wildcard (*) patterns for partial matching — without wildcards the search is exact. Multiple terms use AND logic; use separate API calls for OR logic.5 params
Find newly registered domains and subdomains containing search terms, returning registration dates. Supports wildcard (*) patterns for partial matching — without wildcards the search is exact. Multiple terms use AND logic; use separate API calls for OR logic.
Parameters* required
domain_search_termsstringComma-separated domain search terms (combined with AND logic). Max 4 items. Case insensitive. Must use wildcards for partial matches otherwise the search will be exact.
domain_search_terms_excludestringComma-separated domain search terms to exclude. Max 4 items. Case insensitive.
sincestringSearch domains/subdomains discovered since this date. Format: YYYY-MM-DD.
subdomains_search_termsstringComma-separated subdomain search terms (combined with AND logic). Max 4 items. Case insensitive.
subdomains_search_terms_excludestringComma-separated subdomain search terms to exclude. Max 4 items. Case insensitive.
domain_infoGet enriched WHOIS registration information for a domain. Combines current WHOIS data with historical records to fill missing or redacted fields. Works for active and expired domains.1 params
Get enriched WHOIS registration information for a domain. Combines current WHOIS data with historical records to fill missing or redacted fields. Works for active and expired domains.
Parameters* required
domain_namestringDomain name to query (e.g., example.com).
email_verificationVerify an email address via syntax check, DNS MX lookup, and SMTP deliverability test. Also detects disposable/temporary addresses, role-based addresses (e.g. info@, noreply@), free email providers, and catch-all domains.6 params
Verify an email address via syntax check, DNS MX lookup, and SMTP deliverability test. Also detects disposable/temporary addresses, role-based addresses (e.g. info@, noreply@), free email providers, and catch-all domains.
Parameters* required
check_if_email_is_catch_allbooleanCheck if email is catch-all.default: true
check_if_email_is_disposablebooleanCheck if email is disposable.default: true
check_if_email_is_freebooleanCheck if email is free.default: true
emailstringEmail address to verify.
validate_using_dnsbooleanValidate using DNS records.default: true
validate_using_smtpbooleanValidate using SMTP.default: true
ip_netblocksLook up IP netblocks by IP address, ASN, or organization name. Returns CIDR ranges, ASN number and name, organization info, and registration/update dates for each matching netblock.6 params
Look up IP netblocks by IP address, ASN, or organization name. Returns CIDR ranges, ASN number and name, organization info, and registration/update dates for each matching netblock.
Parameters* required
asnstringASN number to search.
from_needlestringPagination needle from previous page's "inetnum" response.
ip_addressstringIPv4 or IPv6 address to search.
limitnumberMaximum records per page. Max: 1000.default: 100
netmask_valuenumberNetmask value: 0-32 for IPv4, 0-128 for IPv6.
organizationsstringComma-separated organization search terms.
ipgeolocationGet location data for IP addresses, domains, or email addresses. Uses caller's IP if no address provided.4 params
Get location data for IP addresses, domains, or email addresses. Uses caller's IP if no address provided.
Parameters* required
domain_namestringDomain address. Cannot be used with ip_address or email_address.
email_addressstringEmail address. Cannot be used with ip_address or domain_name.
ip_addressstringIPv4 or IPv6 address. Cannot be used with domain_name or email_address.
reverse_ipbooleanIf true, returns 5 domains associated with the IP address.
reverse_dnsFind DNS records matching search criteria. Returns domains and DNS record values. Multiple search terms are combined with AND logic - results must match ALL terms. Use separate API calls for OR logic. Must use wildcards in the "term" field for partial matches otherwise the sea...5 params
Find DNS records matching search criteria. Returns domains and DNS record values. Multiple search terms are combined with AND logic - results must match ALL terms. Use separate API calls for OR logic. Must use wildcards in the "term" field for partial matches otherwise the sea...
Parameters* required
include_additional_checksbooleanIf true, performs wildcard and domain activeness checks. Extra cost.default: false
limitnumberMaximum records to return. Recommended to start with 10 and increase if needed. Max: 1000.default: 10
previewbooleanIf true, returns just the domain names without additional information.default: false
record_typestringDNS record type: "soa", "txt", or "cname".one of
soa · txt · cname · SOA · TXT · CNAMEtermsarraySearch terms array defining what to search for in DNS records (combined with AND logic). Must use wildcards for partial matches otherwise the search will be exact.
reverse_ipFind all domains sharing the same IP address and connection dates.4 params
Find all domains sharing the same IP address and connection dates.
Parameters* required
from_needlestringPagination needle from previous response. Max 300 records per page.
include_additional_checksbooleanIf true, performs additional DNS checks (wildcard, domain activeness). Slower but more detailed.
ipv4_addressstringIPv4 address to search.
previewbooleanIf true, returns just the domain names without additional information.default: false
reverse_mxFind all services sharing the same MX server and connection dates.4 params
Find all services sharing the same MX server and connection dates.
Parameters* required
from_needlestringPagination needle from previous response. Max 300 records per page.
include_additional_checksbooleanIf true, performs wildcard and domain activeness checks. Extra cost.
mx_hostnamestringMX hostname to search.
previewbooleanIf true, returns just the domain names without additional information.default: false
reverse_nsFind all services sharing the same NS nameserver and connection dates.4 params
Find all services sharing the same NS nameserver and connection dates.
Parameters* required
from_needlestringPagination needle from previous response. Max 300 records per page.
include_additional_checksbooleanIf true, performs wildcard and domain activeness checks. Extra cost.
ns_hostnamestringNS nameserver hostname to search.
previewbooleanIf true, returns just the domain names without additional information.default: false
reverse_whoisFind domains whose WHOIS records contain specific search terms. Supports wildcard searches with * and partial string matching. Multiple terms use AND logic — domains must match ALL terms. Use separate API calls for OR logic.11 params
Find domains whose WHOIS records contain specific search terms. Supports wildcard searches with * and partial string matching. Multiple terms use AND logic — domains must match ALL terms. Use separate API calls for OR logic.
Parameters* required
count_onlybooleanIf true, returns only count (no credit usage). If false, returns domain list.default: false
created_date_fromstringSearch domains created after this date. Format: YYYY-MM-DD.
created_date_tostringSearch domains created before this date. Format: YYYY-MM-DD.
excluded_search_termsstringComma-separated search terms to exclude. Max 4 items. Case insensitive.
include_audit_datesbooleanIf true, includes domain list and last audit date.default: true
included_search_termsstringComma-separated search terms to include (combined with AND logic). Max 4 items. Case insensitive.
punycodebooleanIf true, encodes domain names to Punycode.
search_afterstringPagination needle from previous page's "nextPageSearchAfter" value.
search_typestringSearch type: "current" or "historic". "current" searches current records, "historic" searches all records.
updated_date_fromstringSearch domains updated after this date. Format: YYYY-MM-DD.
updated_date_tostringSearch domains updated before this date. Format: YYYY-MM-DD.
reverse_whois_advancedFind domains using advanced field-specific search on WHOIS records. Each search term targets a specific WHOIS field (e.g., RegistrantContact.Organization, DomainName, NameServers) with optional exact match and exclude flags. Up to 4 search terms combined with AND logic.10 params
Find domains using advanced field-specific search on WHOIS records. Each search term targets a specific WHOIS field (e.g., RegistrantContact.Organization, DomainName, NameServers) with optional exact match and exclude flags. Up to 4 search terms combined with AND logic.
Parameters* required
count_onlybooleanIf true, returns only count (no credit usage). If false, returns domain list.default: false
created_date_fromstringSearch domains created after this date. Format: YYYY-MM-DD.
created_date_tostringSearch domains created before this date. Format: YYYY-MM-DD.
include_audit_datesbooleanIf true, includes domain list and last audit date.default: true
punycodebooleanIf true, encodes domain names to Punycode.
search_afterstringPagination needle from previous page's "nextPageSearchAfter" value.
search_termsstringJSON array of search term objects (max 4). Each object has: "field" (required, WHOIS field to search), "term" (required, search string, case insensitive, supports wildcards), "exclude" (optional bo...
search_typestringSearch type: "current" or "historic". "current" searches current records, "historic" searches all records.
updated_date_fromstringSearch domains updated after this date. Format: YYYY-MM-DD.
updated_date_tostringSearch domains updated before this date. Format: YYYY-MM-DD.
ssl_certificatesRetrieve TLS certificate details for a domain, including issuer, validity period (not-before/not-after), subject alternative names (SANs), and chain trust status. Optionally returns the full certificate chain.3 params
Retrieve TLS certificate details for a domain, including issuer, validity period (not-before/not-after), subject alternative names (SANs), and chain trust status. Optionally returns the full certificate chain.
Parameters* required
domainstringThe domain name to check TLS certificate for (e.g., example.com)
include_chainbooleanWhether to include the full certificate chain in the response; defaults to falsedefault: false
use_fresh_databooleanWhether to get fresh data instead of cached results; defaults to falsedefault: false
subdomain_lookupDiscover all known subdomains of a domain, including first-seen and last-seen timestamps for each. Can return thousands of subdomains; use pagination to retrieve large result sets.3 params
Discover all known subdomains of a domain, including first-seen and last-seen timestamps for each. Can return thousands of subdomains; use pagination to retrieve large result sets.
Parameters* required
domain_namestringDomain name to lookup subdomains for.
limitnumberNumber of results to return (1-500, default 500).default: 500
next_page_tokenstringIMPORTANT: To fetch the next page, copy the "next_page_token" value from the previous response and pass it here. Do not use "search_after" or any other parameter name - only "next_page_token" is ac...
threat_intelligenceCheck if an IoC (domain, URL, IP, CIDR, or file hash) appears in known malware, phishing, spam, or botnet databases. Returns threat classification, severity, and source feed details.2 params
Check if an IoC (domain, URL, IP, CIDR, or file hash) appears in known malware, phishing, spam, or botnet databases. Returns threat classification, severity, and source feed details.
Parameters* required
limitnumberMaximum records per page. Max: 10,000. Every 100 records = 1 credit.
search_termstringIoC to check: domain, URL, IP, CIDR, or hash. Supports wildcards for domains, URLs, IPs.
typosquattingCheck whether a domain is part of a known typosquatting group, or expand all domains across all groups the queried domain belongs to. Use mode="probe" for a fast triage check (returns inGroup boolean + groupId). Use mode="group" for the heavy follow-up that returns every domai...2 params
Check whether a domain is part of a known typosquatting group, or expand all domains across all groups the queried domain belongs to. Use mode="probe" for a fast triage check (returns inGroup boolean + groupId). Use mode="group" for the heavy follow-up that returns every domai...
Parameters* required
domainstringDomain to check (e.g. "gogle.com").
modestringResponse shape: "probe" for boolean + groupId only (fast); "group" for full list of domains across all groups (heavier, more credits).one of
probe · groupdefault: probewhoisGet WHOIS data for a domain, returning registrar name, creation/expiry/updated dates, nameservers, domain status codes, and registrant/admin/tech contact info (when not redacted). Supports both WHOIS and RDAP protocols.12 params
Get WHOIS data for a domain, returning registrar name, creation/expiry/updated dates, nameservers, domain status codes, and registrant/admin/tech contact info (when not redacted). Supports both WHOIS and RDAP protocols.
Parameters* required
domainstringDomain name to query.
fetch_whois_from_registry_onlybooleanIf true, returns only registry WHOIS data, not registrar data.
force_refreshbooleanIf true, forces hard refresh. Costs 5 API calls.
get_host_ip_whois_on_no_domain_databooleanIf true, returns host IP WHOIS when domain WHOIS is unavailable.
get_registrar_proxy_databooleanIf true, includes registrar WHOIS proxy info in "privateWhoisProxy".
include_domain_availabilitybooleanIf true, includes domain availability status.
include_ip_for_domain_queriedbooleanIf true, includes hosting IP address for the domain.
parse_registrar_raw_textbooleanIf true, provides parsed format for registrar information.
parse_registry_raw_textbooleanIf true, provides parsed format for registry information.
prefer_refresh_even_if_incompletebooleanIf true, provides most up-to-date but potentially incomplete data.
query_typestringQuery type: "auto", "whois", or "rdap". "rdap" is only supported in domain queries but might not be available for all domains. "auto" will always choose correctly.one of
auto · whois · rdapdefault: autoremove_raw_textbooleanIf true, removes raw text from WHOIS output.
whois_historyGet the full timeline of WHOIS changes for a domain, showing ownership transfers, registrar changes, nameserver updates, and contact modifications over time. Supports pagination for domains with many historical records.12 params
Get the full timeline of WHOIS changes for a domain, showing ownership transfers, registrar changes, nameserver updates, and contact modifications over time. Supports pagination for domains with many historical records.
Parameters* required
created_date_fromstringSearch domains created after this date. Format: YYYY-MM-DD.
created_date_tostringSearch domains created before this date. Format: YYYY-MM-DD.
domain_namestringDomain name to search.
expired_date_fromstringSearch domains expired after this date. Format: YYYY-MM-DD.
expired_date_tostringSearch domains expired before this date. Format: YYYY-MM-DD.
limitnumberNumber of records to return (1-100, default 100).default: 100
next_page_tokenstringIMPORTANT: To fetch the next page, copy the "next_page_token" value from the previous response and pass it here. Do not use "search_after" or any other parameter name - only "next_page_token" is ac...
preview_modebooleanIf true, returns only the number of records but no data. It's 50 times cheaper than the full response.default: false
since_datestringReturn results from this date onwards. Format: YYYY-MM-DD.
skip_live_whois_recordsbooleanIf true, excludes most recent WHOIS record. Recommended to set to false for faster responses.default: false
updated_date_fromstringSearch domains updated after this date. Format: YYYY-MM-DD.
updated_date_tostringSearch domains updated before this date. Format: YYYY-MM-DD.
Featured
Fastest browser for AI agents to run web automation tasks, always free.
Download Free life-time →Notes, actions and memory. Without a meeting bot. First month 100% off.
Download for free →belt cli automatically finds the best tools and skills for your agent. image, video, music, tts...
one prompt install →Connect your Claude agent to live crypto prices and trading routes via 1inch
Get the MCP →Block distracting apps from your iPhone permanently without a 3rd party app. Free and open source.
Block now (100% free) →Configuration
WHOISXMLAPI_TOKEN*secretWhoisXML API key (get one at https://whoisxmlapi.com)
Registryactive
Package@whoisxmlapidotcom/mcp-whoisxmlapi
TransportSTDIO
AuthRequired
UpdatedMay 31, 2026