whois_ip
Perform RDAP/WHOIS lookups on IP addresses to identify network ownership, CIDR ranges, geographic location, and responsible entities for reconnaissance and analysis.
Instructions
RDAP/WHOIS lookup for an IP address. Returns network name, CIDR range, country, and responsible entities.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| ip | Yes | IP address to look up |
Implementation Reference
- src/whois/index.ts:105-145 (handler)The implementation of the whoisIp tool which queries the rdap.org API for IP information.
export async function whoisIp(ip: string): Promise<RdapIpResult> { await limiter.acquire(); const res = await fetch(`https://rdap.org/ip/${ip}`); if (!res.ok) throw new Error(`RDAP IP lookup failed: ${res.status} ${res.statusText}`); const data = await res.json(); const entities: RdapIpResult["entities"] = []; if (data.entities) { for (const ent of data.entities) { const roles = ent.roles ?? []; const vcard = ent.vcardArray?.[1]; let name: string | undefined; if (vcard) { const fn = vcard.find((f: any) => f[0] === "fn"); if (fn) name = fn[3]; } for (const role of roles) { entities.push({ role, name }); } } } // Build CIDR from cidr0_cidrs let cidr: string | undefined; if (data.cidr0_cidrs?.[0]) { const c = data.cidr0_cidrs[0]; cidr = `${c.v4prefix ?? c.v6prefix}/${c.length}`; } return { ip, name: data.name, type: data.type, startAddress: data.startAddress, endAddress: data.endAddress, cidr, country: data.country, entities, port43: data.port43, }; } - src/protocol/tools.ts:99-106 (registration)The tool registration and tool definition for whois_ip in the protocol/tools layer.
const whoisIpTool: ToolDef = { name: "whois_ip", description: "RDAP/WHOIS lookup for an IP address. Returns network name, CIDR range, country, and responsible entities.", schema: { ip: z.string().describe("IP address to look up"), }, execute: async (args) => json(await whoisIp(args.ip as string)), }; - src/whois/index.ts:19-29 (schema)The type definition for the RDAP IP lookup result.
interface RdapIpResult { ip: string; name?: string; type?: string; startAddress?: string; endAddress?: string; cidr?: string; country?: string; entities: { role: string; name?: string }[]; port43?: string; }