domain-security-mcp-server

WHOIS Lookup

whois_lookup

Read-onlyIdempotent

Retrieve domain registration details (registrar, expiry dates, name servers, status) via raw WHOIS. Automatically resolves the authoritative WHOIS server and follows referrals without an API key.

Instructions

Look up domain registration data over the raw WHOIS protocol (port 43): registrar, creation/update/expiry dates, name servers and domain status. Resolves the correct WHOIS server via IANA and follows registrar referrals. No API key.

Args:

domain (string): the domain to look up.
response_format ('markdown' | 'json'): output format (default 'markdown'). JSON includes the raw WHOIS text.

Returns: { domain, registrar, created, updated, expires, name_servers[], status[], whois_server }.

Example: "Who is the registrar for openai.com and when does it expire?" -> whois_lookup(domain="openai.com"). Errors: returns an error if no WHOIS server answers (some ccTLDs restrict or rate-limit WHOIS).

Input Schema

TableJSON Schema

Name	Required	Description	Default
`domain`	Yes	Domain to look up, e.g. 'example.com'.
`response_format`	No	Output format: 'markdown' for a human-readable summary (default) or 'json' for the full structured payload.	markdown

Output Schema

TableJSON Schema

Name	Required	Description	Default
`raw`	Yes
`domain`	Yes
`status`	Yes
`created`	No
`expires`	No
`updated`	No
`registrar`	No
`name_servers`	Yes
`whois_server`	No
`registrant_org`	No

Schema Changelog

Changes observed during successful MCP inspections.

Changed4 schema fields changedv1.2.1Sep 14, 2026

changedInput schema / $schema

Previous value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"

removedInput schema / additionalProperties
```
Removed value: -false
```
addedInput schema / properties / domain / maxLength
```
Added value: +253
```

changedOutput schema / $schema

Previous value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"

First observedv1.0.0Jun 8, 2026

TDQS

A4.1/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations (readOnlyHint=true, idempotentHint=true, destructiveHint=false) already cover the safety profile, lowering the bar. The description genuinely adds context beyond the annotations: IANA server resolution and registrar referral following, port 43 mechanics, no-auth requirement, and an honest error disclosure about ccTLD restrictions and rate limits. It stops short of 5 because it doesn't mention potential slowness of referral chases or timeouts.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The opening sentence is strong and front-loaded, but the description runs roughly five paragraphs and the Args/Returns sections largely duplicate parameter and output descriptions already present in the input schema and output schema. The unique contributions (referral resolution, error caveat, example) are edited and placed well, but duplicated content prevents a higher score.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 2-parameter, 1-required-parametered tool with full schema description coverage, rich annotations, an output schema, and an error disclaimer, the description covers everything an agent needs to invoke it correctly: protocol behavior, failure outcomes, output format selection, and a natural-language trigger example. Nothing material is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and both parameters are fully described in the input schema, so the baseline of 3 applies. The description adds only marginal value: it clarifies that JSON output embeds the raw WHOIS text, which is a slight semantic addition over the schema's 'full structured payload.'

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific action and resource — 'Look up domain registration data over the raw WHOIS protocol (port 43)' — and enumerates the exact output dimensions (registrar, dates, name servers, status). It differentiates itself from DNS/email-security siblings (dns_lookup, spf_check, ssl_certificate) by being explicitly about registration data over WHOIS, so an agent can distinguish it without opening sibling schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The example ('Who is the registrar for openai.com and when does it expire?' -> whois_lookup(domain="openai.com")) gives a clear concrete trigger, and the 'No API key' note plus the ccTLD restriction caveat set expectations. It lacks an explicit when-not-to-use or named alternative routes (e.g., 'use dns_lookup for records'), so it stops short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.