contrastapi

Overview Schema Source Related Servers Discussions Admin

WHOIS Lookup

whois_lookup

Read-onlyIdempotent

Retrieve WHOIS registration data to verify domain ownership, age, and expiration. Get registrar, creation/expiry dates, nameservers, and status for any root domain.

Instructions

Retrieve WHOIS registration data: registrar, creation/expiry dates, nameservers, status. Use to verify domain ownership, age, expiration; for full audit use domain_report. Free: 30/hr, Pro: 500/hr. Returns {domain, whois: {registrar, creation_date, expiry_date, updated_date, name_servers, status, raw_length, error}, summary}.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "domain": "<domain>"
    },
    "name": "whois_lookup"
  }
}

Input Schema

Name	Required	Description	Default
`domain`	Yes	Root domain to query WHOIS for (e.g. 'example.com', 'github.com')

Output Schema

Name	Required	Description	Default
`result`	Yes

Schema Changelog

Changes observed during successful MCP inspections.

Changed1 schema field changedv1.34.4Jul 5, 2026

changedOutput schema / $defs / PivotHint / properties / tool / enum

Previous value: -[
-  "cve_lookup",
-  "cve_search",
-  "cve_leading",
-  "bulk_cve_lookup",
-  "calculate_risk_score",
-  "get_cvss_details",
-  "exploit_lookup",
-  "kev_detail",
-  "cwe_lookup",
-  "subdomain_enum",
-  "ssl_check",
-  "tech_fingerprint",
-  "asn_lookup",
-  "ip_lookup",
-  "ioc_lookup",
-  "bulk_ioc_lookup",
-  "hash_lookup",
-  "threat_intel",
-  "threat_report",
-  "audit_domain",
-  "domain_report",
-  "dns_lookup",
-  "whois_lookup",
-  "wayback_lookup",
-  "scan_headers",
-  "check_headers",
-  "check_secrets",
-  "check_injection",
-  "check_dependencies",
-  "email_mx",
-  "email_security_posture",
-  "email_disposable",
-  "email_verify",
-  "robots_txt",
-  "redirect_chain",
-  "brand_assets",
-  "seo_audit",
-  "phone_lookup",
-  "username_lookup",
-  "password_check",
-  "phishing_check",
-  "atlas_technique_lookup",
-  "atlas_technique_search",
-  "bulk_atlas_technique_lookup",
-  "atlas_case_study_lookup",
-  "atlas_case_study_search",
-  "d3fend_defense_lookup",
-  "d3fend_defense_search",
-  "d3fend_defense_for_attack",
-  "d3fend_attack_coverage",
-  "sigma_rule_lookup",
-  "bulk_sigma_rule_lookup",
-  "tech_stack_cve_audit",
-  "contrast_scan"
-]New value: +[
+  "cve_lookup",
+  "cve_search",
+  "cve_leading",
+  "bulk_cve_lookup",
+  "calculate_risk_score",
+  "get_cvss_details",
+  "exploit_lookup",
+  "kev_detail",
+  "cwe_lookup",
+  "subdomain_enum",
+  "ssl_check",
+  "tech_fingerprint",
+  "asn_lookup",
+  "ip_lookup",
+  "ioc_lookup",
+  "bulk_ioc_lookup",
+  "hash_lookup",
+  "threat_intel",
+  "threat_report",
+  "audit_domain",
+  "domain_report",
+  "dns_lookup",
+  "whois_lookup",
+  "wayback_lookup",
+  "scan_headers",
+  "check_headers",
+  "check_secrets",
+  "check_injection",
+  "check_dependencies",
+  "email_mx",
+  "email_security_posture",
+  "email_disposable",
+  "email_verify",
+  "robots_txt",
+  "redirect_chain",
+  "brand_assets",
+  "seo_audit",
+  "geo_audit",
+  "phone_lookup",
+  "username_lookup",
+  "password_check",
+  "phishing_check",
+  "atlas_technique_lookup",
+  "atlas_technique_search",
+  "bulk_atlas_technique_lookup",
+  "atlas_case_study_lookup",
+  "atlas_case_study_search",
+  "d3fend_defense_lookup",
+  "d3fend_defense_search",
+  "d3fend_defense_for_attack",
+  "d3fend_attack_coverage",
+  "sigma_rule_lookup",
+  "bulk_sigma_rule_lookup",
+  "tech_stack_cve_audit",
+  "contrast_scan"
+]

Changed1 schema field changedv1.33.23Jun 13, 2026

changedOutput schema / $defs / PivotHint / properties / tool / enum

Previous value: -[
-  "cve_lookup",
-  "cve_search",
-  "cve_leading",
-  "bulk_cve_lookup",
-  "calculate_risk_score",
-  "get_cvss_details",
-  "exploit_lookup",
-  "kev_detail",
-  "cwe_lookup",
-  "subdomain_enum",
-  "ssl_check",
-  "tech_fingerprint",
-  "asn_lookup",
-  "ip_lookup",
-  "ioc_lookup",
-  "bulk_ioc_lookup",
-  "hash_lookup",
-  "threat_intel",
-  "threat_report",
-  "audit_domain",
-  "domain_report",
-  "dns_lookup",
-  "whois_lookup",
-  "wayback_lookup",
-  "scan_headers",
-  "check_headers",
-  "check_secrets",
-  "check_injection",
-  "check_dependencies",
-  "email_mx",
-  "email_security_posture",
-  "email_disposable",
-  "email_verify",
-  "robots_txt",
-  "redirect_chain",
-  "brand_assets",
-  "seo_audit",
-  "phone_lookup",
-  "username_lookup",
-  "password_check",
-  "phishing_check",
-  "atlas_technique_lookup",
-  "atlas_technique_search",
-  "bulk_atlas_technique_lookup",
-  "atlas_case_study_lookup",
-  "atlas_case_study_search",
-  "d3fend_defense_lookup",
-  "d3fend_defense_search",
-  "d3fend_defense_for_attack",
-  "d3fend_attack_coverage",
-  "sigma_rule_lookup",
-  "bulk_sigma_rule_lookup",
-  "tech_stack_cve_audit"
-]New value: +[
+  "cve_lookup",
+  "cve_search",
+  "cve_leading",
+  "bulk_cve_lookup",
+  "calculate_risk_score",
+  "get_cvss_details",
+  "exploit_lookup",
+  "kev_detail",
+  "cwe_lookup",
+  "subdomain_enum",
+  "ssl_check",
+  "tech_fingerprint",
+  "asn_lookup",
+  "ip_lookup",
+  "ioc_lookup",
+  "bulk_ioc_lookup",
+  "hash_lookup",
+  "threat_intel",
+  "threat_report",
+  "audit_domain",
+  "domain_report",
+  "dns_lookup",
+  "whois_lookup",
+  "wayback_lookup",
+  "scan_headers",
+  "check_headers",
+  "check_secrets",
+  "check_injection",
+  "check_dependencies",
+  "email_mx",
+  "email_security_posture",
+  "email_disposable",
+  "email_verify",
+  "robots_txt",
+  "redirect_chain",
+  "brand_assets",
+  "seo_audit",
+  "phone_lookup",
+  "username_lookup",
+  "password_check",
+  "phishing_check",
+  "atlas_technique_lookup",
+  "atlas_technique_search",
+  "bulk_atlas_technique_lookup",
+  "atlas_case_study_lookup",
+  "atlas_case_study_search",
+  "d3fend_defense_lookup",
+  "d3fend_defense_search",
+  "d3fend_defense_for_attack",
+  "d3fend_attack_coverage",
+  "sigma_rule_lookup",
+  "bulk_sigma_rule_lookup",
+  "tech_stack_cve_audit",
+  "contrast_scan"
+]

Addedv1.33.21May 31, 2026
Removedv1.33.14May 22, 2026
Addedv1.33.1May 15, 2026
Removedv1.33.0May 15, 2026
Addedv1.32.0May 12, 2026
Removedv1.30.2May 9, 2026

Changed1 schema field changedv1.29.1May 8, 2026

changedOutput schema / $defs / PivotHint / properties / tool / enum

Previous value: -[
-  "cve_lookup",
-  "cve_search",
-  "cve_leading",
-  "bulk_cve_lookup",
-  "exploit_lookup",
-  "kev_detail",
-  "cwe_lookup",
-  "subdomain_enum",
-  "ssl_check",
-  "tech_fingerprint",
-  "asn_lookup",
-  "ip_lookup",
-  "ioc_lookup",
-  "bulk_ioc_lookup",
-  "hash_lookup",
-  "threat_intel",
-  "threat_report",
-  "audit_domain",
-  "domain_report",
-  "dns_lookup",
-  "whois_lookup",
-  "wayback_lookup",
-  "scan_headers",
-  "check_headers",
-  "check_secrets",
-  "check_injection",
-  "check_dependencies",
-  "email_mx",
-  "email_disposable",
-  "email_verify",
-  "robots_txt",
-  "redirect_chain",
-  "brand_assets",
-  "seo_audit",
-  "phone_lookup",
-  "username_lookup",
-  "password_check",
-  "phishing_check",
-  "atlas_technique_lookup",
-  "atlas_technique_search",
-  "bulk_atlas_technique_lookup",
-  "atlas_case_study_lookup",
-  "atlas_case_study_search",
-  "d3fend_defense_lookup",
-  "d3fend_defense_search",
-  "d3fend_defense_for_attack",
-  "d3fend_attack_coverage"
-]New value: +[
+  "cve_lookup",
+  "cve_search",
+  "cve_leading",
+  "bulk_cve_lookup",
+  "calculate_risk_score",
+  "get_cvss_details",
+  "exploit_lookup",
+  "kev_detail",
+  "cwe_lookup",
+  "subdomain_enum",
+  "ssl_check",
+  "tech_fingerprint",
+  "asn_lookup",
+  "ip_lookup",
+  "ioc_lookup",
+  "bulk_ioc_lookup",
+  "hash_lookup",
+  "threat_intel",
+  "threat_report",
+  "audit_domain",
+  "domain_report",
+  "dns_lookup",
+  "whois_lookup",
+  "wayback_lookup",
+  "scan_headers",
+  "check_headers",
+  "check_secrets",
+  "check_injection",
+  "check_dependencies",
+  "email_mx",
+  "email_disposable",
+  "email_verify",
+  "robots_txt",
+  "redirect_chain",
+  "brand_assets",
+  "seo_audit",
+  "phone_lookup",
+  "username_lookup",
+  "password_check",
+  "phishing_check",
+  "atlas_technique_lookup",
+  "atlas_technique_search",
+  "bulk_atlas_technique_lookup",
+  "atlas_case_study_lookup",
+  "atlas_case_study_search",
+  "d3fend_defense_lookup",
+  "d3fend_defense_search",
+  "d3fend_defense_for_attack",
+  "d3fend_attack_coverage"
+]

Changed1 schema field changedv1.25.0May 2, 2026

changedOutput schema / $defs / PivotHint / properties / tool / enum

Previous value: -[
-  "cve_lookup",
-  "cve_search",
-  "cve_leading",
-  "bulk_cve_lookup",
-  "exploit_lookup",
-  "kev_detail",
-  "cwe_lookup",
-  "subdomain_enum",
-  "ssl_check",
-  "tech_fingerprint",
-  "asn_lookup",
-  "ip_lookup",
-  "ioc_lookup",
-  "bulk_ioc_lookup",
-  "hash_lookup",
-  "threat_intel",
-  "threat_report",
-  "audit_domain",
-  "domain_report",
-  "dns_lookup",
-  "whois_lookup",
-  "wayback_lookup",
-  "scan_headers",
-  "check_headers",
-  "check_secrets",
-  "check_injection",
-  "check_dependencies",
-  "email_mx",
-  "email_disposable",
-  "phone_lookup",
-  "username_lookup",
-  "password_check",
-  "phishing_check",
-  "atlas_technique_lookup",
-  "atlas_technique_search",
-  "bulk_atlas_technique_lookup",
-  "atlas_case_study_lookup",
-  "atlas_case_study_search",
-  "d3fend_defense_lookup",
-  "d3fend_defense_search",
-  "d3fend_defense_for_attack",
-  "d3fend_attack_coverage"
-]New value: +[
+  "cve_lookup",
+  "cve_search",
+  "cve_leading",
+  "bulk_cve_lookup",
+  "exploit_lookup",
+  "kev_detail",
+  "cwe_lookup",
+  "subdomain_enum",
+  "ssl_check",
+  "tech_fingerprint",
+  "asn_lookup",
+  "ip_lookup",
+  "ioc_lookup",
+  "bulk_ioc_lookup",
+  "hash_lookup",
+  "threat_intel",
+  "threat_report",
+  "audit_domain",
+  "domain_report",
+  "dns_lookup",
+  "whois_lookup",
+  "wayback_lookup",
+  "scan_headers",
+  "check_headers",
+  "check_secrets",
+  "check_injection",
+  "check_dependencies",
+  "email_mx",
+  "email_disposable",
+  "email_verify",
+  "robots_txt",
+  "redirect_chain",
+  "brand_assets",
+  "seo_audit",
+  "phone_lookup",
+  "username_lookup",
+  "password_check",
+  "phishing_check",
+  "atlas_technique_lookup",
+  "atlas_technique_search",
+  "bulk_atlas_technique_lookup",
+  "atlas_case_study_lookup",
+  "atlas_case_study_search",
+  "d3fend_defense_lookup",
+  "d3fend_defense_search",
+  "d3fend_defense_for_attack",
+  "d3fend_attack_coverage"
+]

Addedv1.23.0May 2, 2026
Removedv1.0.18May 1, 2026

Changed4 schema fields changedv1.0.1Apr 21, 2026

changedInput schema / properties / domain / description

Previous value: -""New value: +"Root domain to query WHOIS for (e.g. 'example.com', 'github.com')"

addedInput schema / properties / domain / title
```
Added value: +"Domain"
```
addedInput schema / title
```
Added value: +"whois_lookupArguments"
```

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "properties": {
+    "result": {
+      "title": "Result",
+      "type": "string"
+    }
+  },
+  "required": [
+    "result"
+  ],
+  "title": "whois_lookupOutput",
+  "type": "object"
+}

First observedv1.0.0Mar 27, 2026

TDQS

A4.5/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, destructiveHint=false, etc. Description adds return structure details and rate limits, providing context beyond annotations. No contradiction. Moderate added value.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three concise sentences, each serving a purpose: purpose/data, usage/alternative, return/limits. Front-loaded and no wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter, read-only tool with annotations covering safety and output schema hinted in description, all necessary context is provided: purpose, usage, rate limits, return fields. Complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Only one parameter 'domain' with schema description covering 100%. Description does not add additional semantic details beyond what's in the input schema. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description starts with 'Retrieve WHOIS registration data: registrar, creation/expiry dates, nameservers, status.' This clearly states the action (retrieve) and resource (WHOIS data) with specific fields. It distinguishes from sibling 'domain_report' by noting 'for full audit use domain_report'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use: 'Use to verify domain ownership, age, expiration' and when not: 'for full audit use domain_report'. Also includes rate limits: 'Free: 30/hr, Pro: 500/hr', aiding in resource management.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

WHOIS Lookup

Instructions

Tool call template

Input Schema

Output Schema

Schema Changelog

TDQS

Other Tools