Skip to main content
Glama
Sign In
WHOIS MCP Server

WHOIS MCP Server

by dadepo
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Remote

inet-registry-mcp

MCP server for Internet registry and registry-adjacent data used by network operators.

Today it starts with RIR data: ownership and contact lookups, abuse discovery, IRR route objects, AS-SET expansion, authenticated registry lookups, maintained-object inventory, and basic registry data quality checks.

This project currently runs from a local checkout. It has not been published to npm yet.

Scope

The project is organized around Internet registry systems and registry-adjacent data sources:

  • numbering: RIR/RDAP data, IP and ASN allocation data, authenticated inventory, abuse and contact lookup

  • routing: IRR route/route6/aut-num/as-set, RPKI ROA validation, BGP origin visibility, bogon and martian checks

  • naming: DNS delegation, DNSSEC validation, reverse DNS, IANA root and TLD data

  • interconnection: PeeringDB ASN, org, IX, facility, policy, and contact lookup

  • metadata: geofeeds, abuse contacts, and source-of-truth consistency audits

Not all of that exists yet. The current implementation starts with the RIR and IRR pieces.

Related MCP server: Domain Tools (WHOIS + DNS)

Current Coverage

Tool category

RIPE NCC

ARIN

APNIC

AfriNIC

LACNIC

Public registry query

Yes

Yes

Yes

Yes

Yes

Contact card

Yes

Yes

Yes

Yes

Yes

Route object validation

Yes

Yes

No

No

No

AS-SET expansion

Yes

Yes

No

No

No

Authenticated object lookup

Yes

Yes

Yes

Not implemented

Not implemented

Authenticated resource inventory

Yes

Partial

Yes

Not implemented

Not implemented

Registry data quality audit

Yes

Yes

Yes

Not implemented

Not implemented

Not implemented means this server does not yet expose a tested read-only authenticated path for that RIR. It does not mean the RIR has no authenticated services.

Current workflows:

  • look up ownership and registration data for IPs and ASNs

  • find abuse, admin, and technical contacts

  • validate RIPE and ARIN route objects

  • expand RIPE and ARIN AS-SETs

  • list authenticated RIPE maintained objects

  • fetch authenticated RIPE and ARIN registry objects

  • audit authenticated RIPE and ARIN registry objects for basic data quality issues

Install From Source

git clone https://github.com/dadepo/inet-registry-mcp.git
cd inet-registry-mcp
npm ci

Optional local config:

cp env.example .env

All public RIR tools are enabled by default. Edit .env only when you want to disable a registry, change timeouts, change HTTP bind settings, or configure authenticated read-only lookups.

Running Locally

There is no default transport. Pick one explicitly.

For stdio, which is what most local MCP clients use:

npm --silent run dev:stdio

For HTTP:

npm run dev:http

The HTTP endpoint is:

http://127.0.0.1:8000/mcp

To bind somewhere else:

HTTP_HOST=0.0.0.0 HTTP_PORT=9000 npm run dev:http

npm run dev intentionally exits with guidance. Use dev:stdio or dev:http.

Claude Code

From this repo directory:

claude mcp add --transport stdio inet-registry-mcp -- npm --silent run dev:stdio

Or point Claude Code at the local bin script:

claude mcp add --transport stdio inet-registry-mcp -- /absolute/path/to/inet-registry-mcp/bin/inet-registry-mcp.js

For HTTP mode, start the HTTP server first:

claude mcp add --transport http inet-registry-mcp-http http://127.0.0.1:8000/mcp

Claude Desktop

After npm ci, add a stdio server that points at your local checkout:

{
  "mcpServers": {
    "inet-registry-mcp": {
      "command": "/absolute/path/to/inet-registry-mcp/bin/inet-registry-mcp.js"
    }
  }
}

Claude Desktop config locations:

  • macOS: ~/Library/Application Support/Claude/claude_desktop_config.json

  • Windows: %APPDATA%\Claude\claude_desktop_config.json

  • Linux: ~/.config/Claude/claude_desktop_config.json

For HTTP mode:

{
  "mcpServers": {
    "inet-registry-mcp-http": {
      "url": "http://127.0.0.1:8000/mcp"
    }
  }
}

Example Prompts

Who owns 8.8.8.8?
Who should I contact about abuse from 1.1.1.1?
Is there a RIPE route object for 193.0.0.0/21 originated by AS3333?
Expand AS-RIPENCC to direct members only.
Show me all objects maintained by DADEPO-TEST-MNT.
Run a registry data quality audit for RIPE maintainer DADEPO-TEST-MNT.

Configuration

Environment variables:

# Auth profile. production is the default. Use test to point supported
# authenticated calls at RIR test environments.
INET_REGISTRY_MCP_PROFILE=production

# Enable or disable RIR support. All default to true.
SUPPORT_RIPE=true
SUPPORT_ARIN=true
SUPPORT_APNIC=true
SUPPORT_AFRINIC=true
SUPPORT_LACNIC=true

# Timeouts and cache settings.
HTTP_TIMEOUT_SECONDS=10
PORT43_CONNECT_TIMEOUT_SECONDS=5
PORT43_READ_TIMEOUT_SECONDS=5
CACHE_TTL_SECONDS=60
CACHE_MAX_ITEMS=512

# Custom User-Agent string.
USER_AGENT=inet-registry-mcp/1.0

# HTTP transport settings.
HTTP_HOST=127.0.0.1
HTTP_PORT=8000

Authenticated Read-Only Tools

Authenticated support uses one global profile:

INET_REGISTRY_MCP_PROFILE=production
# or
INET_REGISTRY_MCP_PROFILE=test

There are no *_AUTH_ENABLED flags. A capability is available when its credential is present.

Authenticated lookup tools return the object values received from the RIR. Local MCP credentials such as API keys are still redacted if they appear in responses or URLs.

# RIPE Database REST API authenticated object lookup, maintained-object inventory, and audit.
# Accepts either the full Basic header value or the base64 part; "Basic "
# is added automatically when omitted.
RIPE_API_KEY=

# ARIN Reg-RWS authenticated object lookup, audit, and configured inventory.
ARIN_API_KEY=

# ARIN inventory is read from explicit handles because Reg-RWS does not expose
# one generic account inventory endpoint through this tool yet.
ARIN_INVENTORY_ORG_HANDLES=
ARIN_INVENTORY_NET_HANDLES=
ARIN_INVENTORY_POC_HANDLES=
ARIN_INVENTORY_CUSTOMER_HANDLES=
ARIN_INVENTORY_DELEGATION_NAMES=
ARIN_INVENTORY_TICKET_NUMBERS=

# APNIC Registry API authenticated object lookup, account resource inventory,
# and audit. APNIC calls are account-scoped, so prompts must name the APNIC
# member account to query.
APNIC_API_KEY=

Current authenticated scope:

  • RIPE: object lookup, maintained-object inventory by inverse mnt-by lookup, and data quality audit.

  • ARIN: object lookup and data quality audit; inventory works for handles listed in ARIN_INVENTORY_*.

  • APNIC: object lookup, account resource inventory, and data quality audit through the APNIC Registry API. APNIC Registry API calls require the APNIC member account in the prompt or tool arguments; the server does not keep a default account. Inventory follows Registry API pagination links on the configured registry host, up to 10 pages per dataset, and marks the last record with pages_truncated: true when more pages remain.

  • AfriNIC, LACNIC: auth status reports configuration, but authenticated inventory/object/audit calls return not_supported until provider-specific read paths are implemented.

Supported endpoint overrides for local testing:

RIPE_DATABASE_REST_BASE=
ARIN_REG_REST_BASE=
APNIC_REGISTRY_BASE=
LACNIC_REGISTRATION_BASE=

With INET_REGISTRY_MCP_PROFILE=test, supported authenticated calls use the RIPE TEST DB, ARIN OT&E, and APNIC Registry API testbed (https://registry-testbed.apnic.net/registry-api/v1) endpoint defaults where available. Override APNIC_REGISTRY_BASE if APNIC issues a different test Registry API base with your credentials; bare-host overrides get the standard /registry-api/v1 path appended automatically.

Example APNIC prompts:

Show the authenticated APNIC resource inventory for account MEM-EXAMPLE.
Using APNIC account MEM-EXAMPLE, show the authenticated WHOIS object mntner APNIC-TEST-MNT.

Endpoints

Default public endpoints:

  • RIPE NCC: whois.ripe.net, https://rest.db.ripe.net, https://rdap.db.ripe.net

  • ARIN: whois.arin.net, https://whois.arin.net/rest, https://rdap.arin.net/registry

  • APNIC: whois.apnic.net, https://registry-api.apnic.net/registry-api/v1, https://rdap.apnic.net

  • AfriNIC: whois.afrinic.net, https://rdap.afrinic.net/rdap

  • LACNIC: whois.lacnic.net, https://rdap.lacnic.net/rdap

Development

Run tests:

npm test

Run type checking:

npm run typecheck

Compile TypeScript:

npm run build

License

MIT. See LICENSE.

Available Tools

14 tools
afrinic_contact_cardA

PREFERRED TOOL for retrieving contact information (abuse, NOC, admin, tech) for IP addresses, ASNs, or organizations from the AfriNIC database. This tool is specifically for the AfriNIC RIR (African region). Use this when you need to CONTACT someone about: abuse reports, security incidents, network issues, or administrative matters. Keywords: 'contact', 'abuse', 'who should I contact', 'report', 'incident', 'NOC', 'technical support', 'admin'. Automatically resolves organization details and extracts contact information including abuse mailboxes, technical contacts, administrative contacts, and phone numbers from AfriNIC database. Perfect for incident response, network troubleshooting, and compliance reporting for AfriNIC-managed resources. Returns structured contact data with clear categorization of contact types and purposes.

Inputs: ip, asn, org. Returns: object

afrinic_whois_queryA

Perform raw WHOIS queries against the AfriNIC database to get complete object information in RPSL format. This tool is specifically for the AfriNIC RIR (African region). Use ONLY when you need full object details or administrative data from AfriNIC. DO NOT use for contact information - use afrinic_contact_card for abuse, NOC, admin, or tech contacts. This returns raw AfriNIC database records with all attributes for detailed analysis.

Inputs: query (required), flags. Returns: object

apnic_contact_cardA

PREFERRED TOOL for retrieving contact information (abuse, NOC, admin, tech) for IP addresses, ASNs, or organizations from the APNIC database. This tool is specifically for the APNIC RIR (Asia-Pacific region - East Asia, Oceania, South Asia, Southeast Asia). Use this when you need to CONTACT someone about: abuse reports, security incidents, network issues, or administrative matters. Keywords: 'contact', 'abuse', 'who should I contact', 'report', 'incident', 'NOC', 'technical support', 'admin'. Automatically resolves organization details and extracts contact information including abuse mailboxes, technical contacts, administrative contacts, and phone numbers from APNIC database. Perfect for incident response, network troubleshooting, and compliance reporting for APNIC-managed resources. Returns structured contact data with clear categorization of contact types and purposes.

Inputs: ip, asn, org. Returns: object

apnic_whois_queryA

Perform raw WHOIS queries against the APNIC database to get complete object information in RPSL format. This tool is specifically for the APNIC RIR (Asia-Pacific region - East Asia, Oceania, South Asia, Southeast Asia). Use ONLY when you need full object details or administrative data from APNIC. DO NOT use for contact information - use apnic_contact_card for abuse, NOC, admin, or tech contacts. DO NOT use for route validation - use apnic_validate_route_object for checking if route objects exist. DO NOT use for AS-SET expansion - use apnic_expand_as_set for getting ASN lists. This returns raw APNIC database records with all attributes for detailed analysis.

Inputs: query (required), flags. Returns: object

arin_contact_cardA

PREFERRED TOOL for retrieving contact information (abuse, NOC, admin, tech) for IP addresses, ASNs, or organizations from the ARIN database. This tool is specifically for the ARIN RIR (North America region - United States, Canada, parts of Caribbean). Use this when you need to CONTACT someone about: abuse reports, security incidents, network issues, or administrative matters. Keywords: 'contact', 'abuse', 'who should I contact', 'report', 'incident', 'NOC', 'technical support', 'admin'. Automatically resolves organization details and extracts POC (Point of Contact) information including abuse mailboxes, technical contacts, administrative contacts, and phone numbers from ARIN database. Perfect for incident response, network troubleshooting, and compliance reporting for ARIN-managed resources. Returns structured contact data with clear categorization of contact types and purposes.

Inputs: ip, asn, org. Returns: object

arin_expand_as_setA

Efficiently expand AS-SET objects from the ARIN IRR database into concrete ASNs with configurable depth. This tool is specifically for the ARIN RIR (North America region - United States, Canada, parts of Caribbean). Use this instead of whois_query when you need ASNs from an ARIN AS-SET. CRITICAL: For 'top-level', 'direct', or 'immediate' members, use max_depth=1. For complete expansion, use max_depth=10+. Large AS-SETs may have nested structures - choose depth carefully to balance completeness vs speed. Automatically handles recursive expansion, deduplication, and cycle detection. Perfect for network analysis, route filtering, and policy generation for ARIN-managed AS-SETs.

Inputs: setname (required), max_depth. Returns: object

arin_validate_route_objectA

PREFERRED TOOL for validating route object registration in the ARIN database. This tool is specifically for the ARIN RIR (North America region - United States, Canada, parts of Caribbean). Use this when you need to CHECK, VERIFY, or VALIDATE if a route object exists for a prefix-ASN pair in ARIN. Keywords: 'route validation', 'check route', 'verify route', 'route exists', 'BGP security', 'route filtering', 'IRR coverage', 'RPKI validation'. Automatically handles IPv4/IPv6 detection and returns simple exists/not-found status. Much faster and more accurate than parsing raw WHOIS data for route validation in ARIN database.

Inputs: prefix (required), origin_asn (required). Returns: object

arin_whois_queryA

Perform raw WHOIS queries against the ARIN database to get complete object information in RPSL format. This tool is specifically for the ARIN RIR (North America region - United States, Canada, parts of Caribbean). Use ONLY when you need full object details or administrative data from ARIN. DO NOT use for contact information - use arin_contact_card for abuse, NOC, admin, or tech contacts. DO NOT use for route validation - use arin_validate_route_object for checking if route objects exist. DO NOT use for AS-SET expansion - use arin_expand_as_set for getting ASN lists. This returns raw ARIN database records with all attributes for detailed analysis.

Inputs: query (required), flags. Returns: object

lacnic_contact_cardA

PREFERRED TOOL for retrieving contact information (abuse, NOC, admin, tech) for IP addresses, ASNs, or organizations from the LACNIC database. This tool is specifically for the LACNIC RIR (Latin America and Caribbean region). Use this when you need to CONTACT someone about: abuse reports, security incidents, network issues, or administrative matters. Keywords: 'contact', 'abuse', 'who should I contact', 'report', 'incident', 'NOC', 'technical support', 'admin'. Automatically resolves organization details and extracts contact information including abuse mailboxes, technical contacts, administrative contacts, and phone numbers from LACNIC database. Perfect for incident response, network troubleshooting, and compliance reporting for LACNIC-managed resources. Returns structured contact data with clear categorization of contact types and purposes.

Inputs: ip, asn, org. Returns: object

lacnic_whois_queryA

Perform raw WHOIS queries against the LACNIC database to get complete object information in RPSL format. This tool is specifically for the LACNIC RIR (Latin America and Caribbean region). Use ONLY when you need full object details or administrative data from LACNIC. DO NOT use for contact information - use lacnic_contact_card for abuse, NOC, admin, or tech contacts. This returns raw LACNIC database records with all attributes for detailed analysis.

Inputs: query (required), flags. Returns: object

ripe_contact_cardA

PREFERRED TOOL for retrieving contact information (abuse, NOC, admin, tech) for IP addresses, ASNs, or organizations from the RIPE NCC database. This tool is specifically for the RIPE RIR (Europe/Middle East/Central Asia region). Use this when you need to CONTACT someone about: abuse reports, security incidents, network issues, or administrative matters. Keywords: 'contact', 'abuse', 'who should I contact', 'report', 'incident', 'NOC', 'technical support', 'admin'. Automatically resolves organization details and extracts abuse mailboxes, NOC contacts, phone numbers, and administrative information from RIPE database. Perfect for incident response, network troubleshooting, and compliance reporting for RIPE-managed resources. Returns structured contact data with clear categorization of contact types and purposes.

Inputs: ip, asn, org. Returns: object

ripe_expand_as_setA

Efficiently expand AS-SET objects from the RIPE NCC database into concrete ASNs with configurable depth. This tool is specifically for the RIPE RIR (Europe/Middle East/Central Asia region). Use this instead of whois_query when you need ASNs from a RIPE AS-SET. CRITICAL: For 'top-level', 'direct', or 'immediate' members, use max_depth=1. For complete expansion, use max_depth=10+. Large AS-SETs like 'AS-RETN' have hundreds of nested AS-SETs - choose depth carefully to balance completeness vs speed. Automatically handles recursive expansion, deduplication, and cycle detection. Perfect for network analysis, route filtering, and policy generation for RIPE-managed AS-SETs.

Inputs: setname (required), max_depth. Returns: object

ripe_validate_route_objectA

PREFERRED TOOL for validating route object registration in the RIPE NCC database. This tool is specifically for the RIPE RIR (Europe/Middle East/Central Asia region). Use this when you need to CHECK, VERIFY, or VALIDATE if a route object exists for a prefix-ASN pair in RIPE. Keywords: 'route validation', 'check route', 'verify route', 'route exists', 'BGP security', 'route filtering', 'IRR coverage', 'RPKI validation'. Automatically handles IPv4/IPv6 detection and returns simple exists/not-found status. Much faster and more accurate than parsing raw WHOIS data for route validation in RIPE database.

Inputs: prefix (required), origin_asn (required). Returns: object

ripe_whois_queryA

Perform raw WHOIS queries against the RIPE NCC database to get complete object information in RPSL format. This tool is specifically for the RIPE RIR (Europe/Middle East/Central Asia region). Use ONLY when you need full object details or administrative data from RIPE. DO NOT use for contact information - use ripe_contact_card for abuse, NOC, admin, or tech contacts. DO NOT use for route validation - use ripe_validate_route_object for checking if route objects exist. DO NOT use for AS-SET expansion - use ripe_expand_as_set for getting ASN lists. This returns raw RIPE database records with all attributes for detailed analysis.

Inputs: query (required), flags. Returns: object

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    Deploy Server
    One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

    TDQS

    A4.6/5.0

    Scored across 14 tools

    Disambiguation5/5

    Each tool has a clearly distinct purpose with minimal overlap. The server provides contact cards, raw WHOIS queries, route validation, and AS-SET expansion for each RIR, and descriptions explicitly differentiate them (e.g., 'DO NOT use for contact information - use X_contact_card'). This prevents misselection and ensures agents can easily choose the correct tool for specific tasks like incident response or network analysis.

    Naming Consistency5/5

    Tool names follow a highly consistent pattern: all use snake_case with a structure of 'rir_operation_object' (e.g., arin_contact_card, ripe_validate_route_object). This predictability makes it easy for agents to understand and navigate the toolset, as the naming convention clearly indicates the RIR, operation type, and target resource across all 14 tools.

    Tool Count5/5

    With 14 tools, the count is well-scoped for a WHOIS server covering multiple RIRs. Each tool earns its place by providing specialized functions (contact retrieval, raw queries, route validation, AS-SET expansion) across five RIRs, ensuring comprehensive coverage without redundancy. This aligns with the server's purpose of detailed network and contact information lookup.

    Completeness5/5

    The toolset offers complete coverage for WHOIS-related tasks across all major RIRs. It includes contact retrieval, raw data queries, route validation, and AS-SET expansion, addressing key use cases like incident response, network troubleshooting, and compliance. There are no obvious gaps; agents can perform full CRUD-like operations (e.g., query, validate, expand) for each region without dead ends.

    Maintenance

    ActivityInactive
    ResponsivenessNo recent community issues

    Resources

    Related MCP Connectors

    Related MCP Servers