Summary
This connects Claude to WhoisXML API's suite of 30 domain intelligence tools, covering WHOIS lookups, DNS queries, IP geolocation, and threat data. You'd reach for it when building agents that need to investigate domains, validate email addresses, check domain availability, or pull threat intelligence on suspicious IPs. The breadth here is the point: instead of integrating a dozen different APIs, you get domain registration history, DNS records, reverse IP lookups, and bulk domain tools all through one MCP connection. Useful for security research workflows, brand monitoring, or any agent that needs to quickly pull authoritative data about internet infrastructure.
Keep your Mac awake while Claude Code and 40+ AI agents run. Sleeps when they're idle.
One time payment $9 →
Integrate web data into your AI product. One API to scrape website & brand data.
Get API Key Now →
Agent, run crypto. Access onchain data & trade routes via 1inch.
Install now →
On Capafy, your Skill runs online 24/7 as an agent product, and you get paid every time someone uses it.
Start earning →
Tools
Public tool metadata for what this MCP can expose to an agent.
27 tools
bulk_dns_lookupRun DNS lookups for up to 200 domain names per call. Emulated bulk (no native upstream bulk endpoint): the server fans out single DNS lookups concurrently and returns a unified envelope. Each input consumes 1 credit. For larger jobs, split client-side.2 params
Run DNS lookups for up to 200 domain names per call. Emulated bulk (no native upstream bulk endpoint): the server fans out single DNS lookups concurrently and returns a unified envelope. Each input consumes 1 credit. For larger jobs, split client-side.
Parameters* required
query_typestringComma-separated DNS query types (A, MX, NS, SOA, etc.) or "all". Applied uniformly to all inputs.default: A
domain_namesarrayDomain names to look up (1 credit per domain, max 200 per call).
bulk_email_verificationRun email verification for up to 10,000 emails per call. Native bulk (uses WhoisXML's Bulk Email Verification API). Each email consumes 1 credit. Returns inline if completes within 20s, otherwise returns a job_id to poll via bulk_job_status / bulk_job_results.1 params
Run email verification for up to 10,000 emails per call. Native bulk (uses WhoisXML's Bulk Email Verification API). Each email consumes 1 credit. Returns inline if completes within 20s, otherwise returns a job_id to poll via bulk_job_status / bulk_job_results.
Parameters* required
emailsarrayEmail addresses to verify (1 credit per email, max 10000 per call).
bulk_ip_geolocationRun IP geolocation lookups for up to 200 IP addresses per call. Emulated bulk (no native upstream bulk endpoint exists; the WhoisXML bulk-IP-geo product is CSV-only via web UI). The server fans out single IP geolocation lookups concurrently and returns a unified envelope. Each...1 params
Run IP geolocation lookups for up to 200 IP addresses per call. Emulated bulk (no native upstream bulk endpoint exists; the WhoisXML bulk-IP-geo product is CSV-only via web UI). The server fans out single IP geolocation lookups concurrently and returns a unified envelope. Each...
Parameters* required
ip_addressesarrayIP addresses to look up (1 credit per IP, max 200 per call).
bulk_job_resultsFetch full per-input results for a completed native bulk job (created by bulk_whois or bulk_email_verification). If the job is still in-flight, returns status=running with progress; caller should retry later. Note: per-input order may differ from the original input order — the...1 params
Fetch full per-input results for a completed native bulk job (created by bulk_whois or bulk_email_verification). If the job is still in-flight, returns status=running with progress; caller should retry later. Note: per-input order may differ from the original input order — the...
Parameters* required
job_idstringOpaque job identifier returned by a bulk_* tool when status=running.
bulk_job_statusCheck progress of an in-flight bulk job created by bulk_whois or bulk_email_verification. Returns status (running|completed) and progress counters. Use bulk_job_results once status=completed.1 params
Check progress of an in-flight bulk job created by bulk_whois or bulk_email_verification. Returns status (running|completed) and progress counters. Use bulk_job_results once status=completed.
Parameters* required
job_idstringOpaque job identifier returned by a bulk_* tool when status=running.
bulk_subdomain_lookupDiscover subdomains for up to 200 domains per call. Emulated bulk (no native upstream bulk endpoint): the server fans out single subdomain lookups concurrently and returns a unified envelope. Reuses the in-memory cache of subdomain_lookup, so re-querying recently-fetched domai...1 params
Discover subdomains for up to 200 domains per call. Emulated bulk (no native upstream bulk endpoint): the server fans out single subdomain lookups concurrently and returns a unified envelope. Reuses the in-memory cache of subdomain_lookup, so re-querying recently-fetched domai...
Parameters* required
domain_namesarrayDomain names to look up (1 credit per uncached domain, max 200 per call).
bulk_whoisRun WHOIS lookups for up to 10,000 domains per call. Native bulk (uses WhoisXML's Bulk WHOIS API). Each domain consumes 1 credit. Returns inline if completes within 20s, otherwise returns a job_id to poll via bulk_job_status / bulk_job_results.1 params
Run WHOIS lookups for up to 10,000 domains per call. Native bulk (uses WhoisXML's Bulk WHOIS API). Each domain consumes 1 credit. Returns inline if completes within 20s, otherwise returns a job_id to poll via bulk_job_status / bulk_job_results.
Parameters* required
domainsarrayDomain names to look up (1 credit per domain, max 10000 per call).
categorizationClassify a URL or domain into IAB content categories, website groups, and content classifications. Returns category labels with confidence scores for content filtering and brand safety.2 params
Classify a URL or domain into IAB content categories, website groups, and content classifications. Returns category labels with confidence scores for content filtering and brand safety.
Parameters* required
urlstringURL or domain name to categorize.
minimum_confidencenumberMinimum confidence for predictions. Higher value = fewer false positives.default: 0.55
dns_historyGet historical DNS records for a domain (forward) or find domains associated with an IP (reverse).5 params
Get historical DNS records for a domain (forward) or find domains associated with an IP (reverse).
Parameters* required
limitnumberMaximum records to return. Range: 1-1000. Recommended: 50.
ip_addressstringRequired if "reverse" search type. IP address to search. IPv4 returns A records, IPv6 returns AAAA records.
domain_namestringRequired if "forward" search type. Domain name to search.
record_typestringDNS record type: "a" or "aaaa". Case insensitive.one of
a · A · aaaa · AAAAsearch_typestringSearch type: "forward" or "reverse".one of
forward · reversedns_lookupPerform DNS record lookups for a domain. Supports A, AAAA, MX, NS, SOA, TXT, CNAME, PTR, SRV, CAA, DS, and DNSKEY record types, or "all" to retrieve every record type at once.2 params
Perform DNS record lookups for a domain. Supports A, AAAA, MX, NS, SOA, TXT, CNAME, PTR, SRV, CAA, DS, and DNSKEY record types, or "all" to retrieve every record type at once.
Parameters* required
query_typestringComma-separated DNS query types (A, MX, NS, SOA, etc.) or "all".default: A
domain_namestringDomain name to query.
domain_and_subdomain_discoveryFind newly registered domains and subdomains containing search terms, returning registration dates. Supports wildcard (*) patterns for partial matching — without wildcards the search is exact. Multiple terms use AND logic; use separate API calls for OR logic.5 params
Find newly registered domains and subdomains containing search terms, returning registration dates. Supports wildcard (*) patterns for partial matching — without wildcards the search is exact. Multiple terms use AND logic; use separate API calls for OR logic.
Parameters* required
sincestringSearch domains/subdomains discovered since this date. Format: YYYY-MM-DD.
domain_search_termsstringComma-separated domain search terms (combined with AND logic). Max 4 items. Case insensitive. Must use wildcards for partial matches otherwise the search will be exact.
subdomains_search_termsstringComma-separated subdomain search terms (combined with AND logic). Max 4 items. Case insensitive.
domain_search_terms_excludestringComma-separated domain search terms to exclude. Max 4 items. Case insensitive.
subdomains_search_terms_excludestringComma-separated subdomain search terms to exclude. Max 4 items. Case insensitive.
domain_infoGet enriched WHOIS registration information for a domain. Combines current WHOIS data with historical records to fill missing or redacted fields. Works for active and expired domains.1 params
Get enriched WHOIS registration information for a domain. Combines current WHOIS data with historical records to fill missing or redacted fields. Works for active and expired domains.
Parameters* required
domain_namestringDomain name to query (e.g., example.com).
email_verificationVerify an email address via syntax check, DNS MX lookup, and SMTP deliverability test. Also detects disposable/temporary addresses, role-based addresses (e.g. info@, noreply@), free email providers, and catch-all domains.6 params
Verify an email address via syntax check, DNS MX lookup, and SMTP deliverability test. Also detects disposable/temporary addresses, role-based addresses (e.g. info@, noreply@), free email providers, and catch-all domains.
Parameters* required
emailstringEmail address to verify.
validate_using_dnsbooleanValidate using DNS records.default: true
validate_using_smtpbooleanValidate using SMTP.default: true
check_if_email_is_freebooleanCheck if email is free.default: true
check_if_email_is_catch_allbooleanCheck if email is catch-all.default: true
check_if_email_is_disposablebooleanCheck if email is disposable.default: true
ip_netblocksLook up IP netblocks by IP address, ASN, or organization name. Returns CIDR ranges, ASN number and name, organization info, and registration/update dates for each matching netblock.6 params
Look up IP netblocks by IP address, ASN, or organization name. Returns CIDR ranges, ASN number and name, organization info, and registration/update dates for each matching netblock.
Parameters* required
asnstringASN number to search.
limitnumberMaximum records per page. Max: 1000.default: 100
ip_addressstringIPv4 or IPv6 address to search.
from_needlestringPagination needle from previous page's "inetnum" response.
netmask_valuenumberNetmask value: 0-32 for IPv4, 0-128 for IPv6.
organizationsstringComma-separated organization search terms.
ipgeolocationGet location data for IP addresses, domains, or email addresses. Uses caller's IP if no address provided.4 params
Get location data for IP addresses, domains, or email addresses. Uses caller's IP if no address provided.
Parameters* required
ip_addressstringIPv4 or IPv6 address. Cannot be used with domain_name or email_address.
reverse_ipbooleanIf true, returns 5 domains associated with the IP address.
domain_namestringDomain address. Cannot be used with ip_address or email_address.
email_addressstringEmail address. Cannot be used with ip_address or domain_name.
reverse_dnsFind DNS records matching search criteria. Returns domains and DNS record values. Multiple search terms are combined with AND logic - results must match ALL terms. Use separate API calls for OR logic. Must use wildcards in the "term" field for partial matches otherwise the sea...5 params
Find DNS records matching search criteria. Returns domains and DNS record values. Multiple search terms are combined with AND logic - results must match ALL terms. Use separate API calls for OR logic. Must use wildcards in the "term" field for partial matches otherwise the sea...
Parameters* required
limitnumberMaximum records to return. Recommended to start with 10 and increase if needed. Max: 1000.default: 10
termsarraySearch terms array defining what to search for in DNS records (combined with AND logic). Must use wildcards for partial matches otherwise the search will be exact.
previewbooleanIf true, returns just the domain names without additional information.default: false
record_typestringDNS record type: "soa", "txt", or "cname".one of
soa · txt · cname · SOA · TXT · CNAMEinclude_additional_checksbooleanIf true, performs wildcard and domain activeness checks. Extra cost.default: false
reverse_ipFind all domains sharing the same IP address and connection dates.4 params
Find all domains sharing the same IP address and connection dates.
Parameters* required
previewbooleanIf true, returns just the domain names without additional information.default: false
from_needlestringPagination needle from previous response. Max 300 records per page.
ipv4_addressstringIPv4 address to search.
include_additional_checksbooleanIf true, performs additional DNS checks (wildcard, domain activeness). Slower but more detailed.
reverse_mxFind all services sharing the same MX server and connection dates.4 params
Find all services sharing the same MX server and connection dates.
Parameters* required
previewbooleanIf true, returns just the domain names without additional information.default: false
from_needlestringPagination needle from previous response. Max 300 records per page.
mx_hostnamestringMX hostname to search.
include_additional_checksbooleanIf true, performs wildcard and domain activeness checks. Extra cost.
reverse_nsFind all services sharing the same NS nameserver and connection dates.4 params
Find all services sharing the same NS nameserver and connection dates.
Parameters* required
previewbooleanIf true, returns just the domain names without additional information.default: false
from_needlestringPagination needle from previous response. Max 300 records per page.
ns_hostnamestringNS nameserver hostname to search.
include_additional_checksbooleanIf true, performs wildcard and domain activeness checks. Extra cost.
reverse_whoisFind domains whose WHOIS records contain specific search terms. Supports wildcard searches with * and partial string matching. Multiple terms use AND logic — domains must match ALL terms. Use separate API calls for OR logic.11 params
Find domains whose WHOIS records contain specific search terms. Supports wildcard searches with * and partial string matching. Multiple terms use AND logic — domains must match ALL terms. Use separate API calls for OR logic.
Parameters* required
punycodebooleanIf true, encodes domain names to Punycode.
count_onlybooleanIf true, returns only count (no credit usage). If false, returns domain list.default: false
search_typestringSearch type: "current" or "historic". "current" searches current records, "historic" searches all records.
search_afterstringPagination needle from previous page's "nextPageSearchAfter" value.
created_date_tostringSearch domains created before this date. Format: YYYY-MM-DD.
updated_date_tostringSearch domains updated before this date. Format: YYYY-MM-DD.
created_date_fromstringSearch domains created after this date. Format: YYYY-MM-DD.
updated_date_fromstringSearch domains updated after this date. Format: YYYY-MM-DD.
include_audit_datesbooleanIf true, includes domain list and last audit date.default: true
excluded_search_termsstringComma-separated search terms to exclude. Max 4 items. Case insensitive.
included_search_termsstringComma-separated search terms to include (combined with AND logic). Max 4 items. Case insensitive.
reverse_whois_advancedFind domains using advanced field-specific search on WHOIS records. Each search term targets a specific WHOIS field (e.g., RegistrantContact.Organization, DomainName, NameServers) with optional exact match and exclude flags. Up to 4 search terms combined with AND logic.10 params
Find domains using advanced field-specific search on WHOIS records. Each search term targets a specific WHOIS field (e.g., RegistrantContact.Organization, DomainName, NameServers) with optional exact match and exclude flags. Up to 4 search terms combined with AND logic.
Parameters* required
punycodebooleanIf true, encodes domain names to Punycode.
count_onlybooleanIf true, returns only count (no credit usage). If false, returns domain list.default: false
search_typestringSearch type: "current" or "historic". "current" searches current records, "historic" searches all records.
search_afterstringPagination needle from previous page's "nextPageSearchAfter" value.
search_termsstringJSON array of search term objects (max 4). Each object has: "field" (required, WHOIS field to search), "term" (required, search string, case insensitive, supports wildcards), "exclude" (optional boolean, exclude matches, default false), "exact_match" (optional boolean, exact field match vs substring, default false). Valid fields: DomainName, RegistrarName, NameServers, Email, WhoisServer, Status, and contact fields like RegistrantContact.Organization, AdminContact.Email, etc.
created_date_tostringSearch domains created before this date. Format: YYYY-MM-DD.
updated_date_tostringSearch domains updated before this date. Format: YYYY-MM-DD.
created_date_fromstringSearch domains created after this date. Format: YYYY-MM-DD.
updated_date_fromstringSearch domains updated after this date. Format: YYYY-MM-DD.
include_audit_datesbooleanIf true, includes domain list and last audit date.default: true
ssl_certificatesRetrieve TLS certificate details for a domain, including issuer, validity period (not-before/not-after), subject alternative names (SANs), and chain trust status. Optionally returns the full certificate chain.3 params
Retrieve TLS certificate details for a domain, including issuer, validity period (not-before/not-after), subject alternative names (SANs), and chain trust status. Optionally returns the full certificate chain.
Parameters* required
domainstringThe domain name to check TLS certificate for (e.g., example.com)
include_chainbooleanWhether to include the full certificate chain in the response; defaults to falsedefault: false
use_fresh_databooleanWhether to get fresh data instead of cached results; defaults to falsedefault: false
subdomain_lookupDiscover all known subdomains of a domain, including first-seen and last-seen timestamps for each. Can return thousands of subdomains; use pagination to retrieve large result sets.3 params
Discover all known subdomains of a domain, including first-seen and last-seen timestamps for each. Can return thousands of subdomains; use pagination to retrieve large result sets.
Parameters* required
limitnumberNumber of results to return (1-500, default 500).default: 500
domain_namestringDomain name to lookup subdomains for.
next_page_tokenstringIMPORTANT: To fetch the next page, copy the "next_page_token" value from the previous response and pass it here. Do not use "search_after" or any other parameter name - only "next_page_token" is accepted.
threat_intelligenceCheck if an IoC (domain, URL, IP, CIDR, or file hash) appears in known malware, phishing, spam, or botnet databases. Returns threat classification, severity, and source feed details.2 params
Check if an IoC (domain, URL, IP, CIDR, or file hash) appears in known malware, phishing, spam, or botnet databases. Returns threat classification, severity, and source feed details.
Parameters* required
limitnumberMaximum records per page. Max: 10,000. Every 100 records = 1 credit.
search_termstringIoC to check: domain, URL, IP, CIDR, or hash. Supports wildcards for domains, URLs, IPs.
typosquattingCheck whether a domain is part of a known typosquatting group, or expand all domains across all groups the queried domain belongs to. Use mode="probe" for a fast triage check (returns inGroup boolean + groupId). Use mode="group" for the heavy follow-up that returns every domai...2 params
Check whether a domain is part of a known typosquatting group, or expand all domains across all groups the queried domain belongs to. Use mode="probe" for a fast triage check (returns inGroup boolean + groupId). Use mode="group" for the heavy follow-up that returns every domai...
Parameters* required
modestringResponse shape: "probe" for boolean + groupId only (fast); "group" for full list of domains across all groups (heavier, more credits).one of
probe · groupdefault: probedomainstringDomain to check (e.g. "gogle.com").
whoisGet WHOIS data for a domain, returning registrar name, creation/expiry/updated dates, nameservers, domain status codes, and registrant/admin/tech contact info (when not redacted). Supports both WHOIS and RDAP protocols.12 params
Get WHOIS data for a domain, returning registrar name, creation/expiry/updated dates, nameservers, domain status codes, and registrant/admin/tech contact info (when not redacted). Supports both WHOIS and RDAP protocols.
Parameters* required
domainstringDomain name to query.
query_typestringQuery type: "auto", "whois", or "rdap". "rdap" is only supported in domain queries but might not be available for all domains. "auto" will always choose correctly.one of
auto · whois · rdapdefault: autoforce_refreshbooleanIf true, forces hard refresh. Costs 5 API calls.
remove_raw_textbooleanIf true, removes raw text from WHOIS output.
parse_registry_raw_textbooleanIf true, provides parsed format for registry information.
get_registrar_proxy_databooleanIf true, includes registrar WHOIS proxy info in "privateWhoisProxy".
parse_registrar_raw_textbooleanIf true, provides parsed format for registrar information.
include_domain_availabilitybooleanIf true, includes domain availability status.
include_ip_for_domain_queriedbooleanIf true, includes hosting IP address for the domain.
fetch_whois_from_registry_onlybooleanIf true, returns only registry WHOIS data, not registrar data.
prefer_refresh_even_if_incompletebooleanIf true, provides most up-to-date but potentially incomplete data.
get_host_ip_whois_on_no_domain_databooleanIf true, returns host IP WHOIS when domain WHOIS is unavailable.
whois_historyGet the full timeline of WHOIS changes for a domain, showing ownership transfers, registrar changes, nameserver updates, and contact modifications over time. Supports pagination for domains with many historical records.12 params
Get the full timeline of WHOIS changes for a domain, showing ownership transfers, registrar changes, nameserver updates, and contact modifications over time. Supports pagination for domains with many historical records.
Parameters* required
limitnumberNumber of records to return (1-100, default 100).default: 100
since_datestringReturn results from this date onwards. Format: YYYY-MM-DD.
domain_namestringDomain name to search.
preview_modebooleanIf true, returns only the number of records but no data. It's 50 times cheaper than the full response.default: false
created_date_tostringSearch domains created before this date. Format: YYYY-MM-DD.
expired_date_tostringSearch domains expired before this date. Format: YYYY-MM-DD.
next_page_tokenstringIMPORTANT: To fetch the next page, copy the "next_page_token" value from the previous response and pass it here. Do not use "search_after" or any other parameter name - only "next_page_token" is accepted.
updated_date_tostringSearch domains updated before this date. Format: YYYY-MM-DD.
created_date_fromstringSearch domains created after this date. Format: YYYY-MM-DD.
expired_date_fromstringSearch domains expired after this date. Format: YYYY-MM-DD.
updated_date_fromstringSearch domains updated after this date. Format: YYYY-MM-DD.
skip_live_whois_recordsbooleanIf true, excludes most recent WHOIS record. Recommended to set to false for faster responses.default: false
Featured
Keep your Mac awake while Claude Code and 40+ AI agents run. Sleeps when they're idle.
One time payment $9 →Integrate web data into your AI product. One API to scrape website & brand data.
Get API Key Now →Agent, run crypto. Access onchain data & trade routes via 1inch.
Install now →On Capafy, your Skill runs online 24/7 as an agent product, and you get paid every time someone uses it.
Start earning →Configuration
WHOISXMLAPI_TOKEN*secretWhoisXML API key (get one at https://whoisxmlapi.com)
Registryactive
Package@whoisxmlapidotcom/mcp-whoisxmlapi
TransportSTDIO
AuthRequired
UpdatedMay 31, 2026