whois_domain
Perform WHOIS/RDAP lookups to retrieve domain registration details including registrar, dates, nameservers, and contact information for OSINT investigations.
Instructions
RDAP/WHOIS lookup for a domain. Returns registrar, registration/expiration dates, nameservers, and contact entities.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | Yes | Domain name to look up |
Implementation Reference
- src/whois/index.ts:33-101 (handler)The handler function whoisDomain performs the RDAP lookup for a given domain and processes the results.
export async function whoisDomain(domain: string): Promise<RdapDomainResult> { await limiter.acquire(); const res = await fetch(`https://rdap.org/domain/${domain}`); if (!res.ok) throw new Error(`RDAP domain lookup failed: ${res.status} ${res.statusText}`); const data = await res.json(); const nameservers: string[] = []; if (data.nameservers) { for (const ns of data.nameservers) { if (ns.ldhName) nameservers.push(ns.ldhName); } } const entities: RdapDomainResult["entities"] = []; if (data.entities) { for (const ent of data.entities) { const roles = ent.roles ?? []; const vcard = ent.vcardArray?.[1]; let name: string | undefined; let email: string | undefined; let phone: string | undefined; if (vcard) { for (const field of vcard) { if (field[0] === "fn") name = field[3]; if (field[0] === "email") email = field[3]; if (field[0] === "tel") phone = field[3]; } } for (const role of roles) { entities.push({ role, name, email, phone }); } } } // Extract dates from events let registrationDate: string | undefined; let expirationDate: string | undefined; let lastUpdated: string | undefined; if (data.events) { for (const evt of data.events) { if (evt.eventAction === "registration") registrationDate = evt.eventDate; if (evt.eventAction === "expiration") expirationDate = evt.eventDate; if (evt.eventAction === "last changed") lastUpdated = evt.eventDate; } } // Extract registrar from entities let registrar: string | undefined; const registrarEntity = data.entities?.find((e: any) => e.roles?.includes("registrar")); if (registrarEntity?.vcardArray?.[1]) { const fn = registrarEntity.vcardArray[1].find((f: any) => f[0] === "fn"); if (fn) registrar = fn[3]; } return { domain: data.ldhName ?? domain, status: data.status ?? [], registrar, registrationDate, expirationDate, lastUpdated, nameservers, entities, port43: data.port43, }; } - src/whois/index.ts:7-17 (schema)Interface defining the shape of the whoisDomain output.
interface RdapDomainResult { domain: string; status: string[]; registrar?: string; registrationDate?: string; expirationDate?: string; lastUpdated?: string; nameservers: string[]; entities: { role: string; name?: string; email?: string; phone?: string }[]; port43?: string; } - src/protocol/tools.ts:90-96 (registration)Registration of the whois_domain MCP tool in the protocols definition file.
const whoisDomainTool: ToolDef = { name: "whois_domain", description: "RDAP/WHOIS lookup for a domain. Returns registrar, registration/expiration dates, nameservers, and contact entities.", schema: { domain: z.string().describe("Domain name to look up"), }, execute: async (args) => json(await whoisDomain(args.domain as string)),