WhoisFreaks

Domain typosquatting search

domainDiscovery

Read-onlyIdempotent

Find registered domains that look like typo variants of a brand name (typosquats such as paypa1.com or paypal-secure.net), or that match a wildcard pattern, across more than 1,500 TLDs. Use this for brand protection, phishing detection, or tracking look-alike registrations. Provide exactly one of keyword or pattern. For subdomains that imitate a brand on unrelated domains, such as login.paypa1.example.com, use subdomainTyposquatting. To find domains whose name simply contains a word use reverseWhoisLookup with keyword. To judge how risky a result is use domainReputation; for its owner use liveWhoisLookup. Costs 5 credits per page (100 domains by default). A search can take up to two minutes. Returns each domain with its creation, expiry and last-seen dates and whether it has been dropped, plus the total count. When there are more, the result has a nextPageToken: pass it as pageToken, with the same keyword or pattern, to get the next page. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "domainDiscovery"
  }
}

Input Schema

Name	Required	Description
`keyword`	No	Brand or name to find typo variants of: 3 to 63 letters, digits or hyphens, one label without a dot. Example: paypal (not paypal.com)
`pattern`	No	Wildcard search instead of keyword: '' matches any characters, at most 3 asterisks, at least 5 other characters and 63 in total. Example: paypa*
`fetchSize`	No	Domains per page, 1 to 10000. Default: 100
`pageToken`	No	nextPageToken from the previous result, to get the next page. Pass the same keyword or pattern with it.

Schema Changelog

Changes observed during successful MCP inspections.

First observedNov 13, 2026

TDQS

A4.8/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the annotations: annotations only say read-only and open-world, while the description adds credit cost (5 per page), latency (up to two minutes), API key source (WHOISFREAKS_API_KEY or hosted key), the fact that nothing is created, and a mapping of failure modes to HTTP codes (401, 403, 404, 429). This is exactly the operational context annotations cannot carry.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads purpose, then alternatives, then cost, then return shape, then error behavior — a sensible priority order. It is dense and the final behavior paragraph is long, but nearly every sentence carries information an agent needs; trimming would lose the error-code mapping.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description takes on the return-value burden and does so: each domain comes back with creation, expiry, last-seen dates, a dropped flag, plus total count and nextPageToken for pagination. Cost, auth, latency, and error handling are all covered, leaving no material gap for a 4-parameter read tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds a real constraint absent from the schema: keyword and pattern are mutually exclusive and only one may be supplied. It also clarifies the pagination contract — pass pageToken together with the same keyword or pattern — which the pageToken field only partially implies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Find registered domains that look like typo variants of a brand name'), gives concrete examples (paypa1.com, paypal-secure.net), and distinguishes itself from subdomainTyposquatting and reverseWhoisLookup by name. An agent can pick this tool without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly names the use cases (brand protection, phishing detection, look-alike tracking) and routes four alternatives to their exact conditions: subdomainTyposquatting for subdomains on unrelated domains, reverseWhoisLookup for substring matches, domainReputation for risk scoring, liveWhoisLookup for ownership. It also states the mutual-exclusion rule ('Provide exactly one of keyword or pattern').

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All WhoisFreaks tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.