Skip to main content
Glama

WhoisFreaks MCP Server

A Model Context Protocol (MCP) server that exposes the full WhoisFreaks API suite as AI-callable tools. Works with Claude Desktop, Cursor, Windsurf, VS Code, Continue, Zed, and any other MCP-compatible AI client.

Three ways to use it — pick what fits your setup:

Method

Requires

Best for

⭐ Easiest

Hosted server

Just your API key

Everyone — nothing to install

Docker (pre-built image)

Docker

Running it on your own machine or VM

Build from source

Java 17 + Maven

Contributors / custom builds

Connect it to any MCP client via Streamable HTTP (/mcp endpoint, hosted or self-hosted) or stdio (local).

Every user brings their own WhoisFreaks API key — the HTTP server stores no key of its own and uses the key sent with each request.


Table of Contents

  1. Tools Reference (22 tools)

  2. Hosted Server (no install)

  3. Quick Start

  4. Prerequisites

  5. Platform Integration

  6. Example Prompts

  7. Troubleshooting


Related MCP server: Domain Availability Checker MCP

Tools Reference

WHOIS Tools

Tool

Description

liveWhoisLookup

Real-time WHOIS data for any domain — registrar, registrant, dates, nameservers

bulkWhoisLookup

Real-time WHOIS data for up to 100 domains in one request

whoisHistory

Complete ownership history timeline for a domain

reverseWhoisLookup

Find all domains registered by an email address, owner name or company, or whose name contains a keyword

IP & ASN WHOIS Tools

Tool

Description

ipWhoisLookup

WHOIS registration data for any IPv4 or IPv6 address

asnWhoisLookup

WHOIS data for an Autonomous System Number (e.g. AS15169)

DNS Tools

Tool

Description

dnsLookup

Live DNS records — A, AAAA, MX, NS, CNAME, SOA, TXT, SPF, or all — and PTR records for an IP

bulkDnsLookup

Live DNS records for up to 100 domains and 100 IPs in one request

dnsHistory

Historical DNS records with full change timeline

reverseDnsLookup

Find all domains pointing to a given IP or range, mail server or nameserver

IP Intelligence Tools

Tool

Description

ipGeolocation

Country, city, region, ISP, and coordinates for any IP address

bulkIpGeolocation

Geolocation for up to 100 IP addresses in one request

ipSecurity

IP reputation: VPN, proxy, Tor exit node, relay, bot, spam and known-attacker signals

bulkIpSecurity

IP reputation for up to 100 IP addresses in one request

Domain Tools

Tool

Description

domainAvailability

Check if a domain is available to register, with optional suggestions

bulkDomainAvailability

Check up to 100 domains, or one name across up to 100 extensions (TLDs)

subdomainLookup

Enumerate all known subdomains for a domain, with status and date filters

domainDiscovery

Find registered domains that are typo variants of a brand (typosquatting), by keyword or wildcard pattern

subdomainTyposquatting

Find subdomains on any domain that contain a typo variant of a brand, such as login.paypa1.example.com

domainReputation

Risk verdict, trust score, DGA analysis, threat-feed matches and email security for a domain

SSL Tools

Tool

Description

sslLookup

SSL/TLS certificate details — issuer, expiry, SANs, chain, and raw output

Account Tools

Tool

Description

apiKeyUsage

Credits and subscription requests used by your API key (costs nothing)

The API's key rotation endpoint has no tool on purpose: it would replace the key the MCP client uses and hand the new one to the AI. Rotate keys in the billing dashboard.

The tools call the endpoints of the WhoisFreaks OpenAPI spec and cost the same credits as calling the API directly; the credit usage page lists them. Bulk tools cost credits for each item.


Hosted Server (no install)

Point any MCP client that supports remote servers at:

https://mcp.whoisfreaks.com

(https://mcp.whoisfreaks.com/mcp is the same endpoint, for clients or configs that expect that path)

and send your WhoisFreaks API key (get one free) in one of these ways:

Method

Example

Use with

Authorization header

Authorization: Bearer YOUR_API_KEY

Claude Code, Cursor, VS Code, Windsurf, Continue

X-API-Key header

X-API-Key: YOUR_API_KEY

Any client that supports custom headers

Query parameter

https://mcp.whoisfreaks.com/?apiKey=YOUR_API_KEY

Clients without custom headers (claude.ai / Claude Desktop custom connectors)

Prefer a header when your client supports one — URLs with keys can end up in logs and history.

Claude Code

claude mcp add --transport http whoisfreaks https://mcp.whoisfreaks.com \
  --header "Authorization: Bearer YOUR_API_KEY"

claude.ai / Claude Desktop — Settings → Connectors → Add custom connector, URL:

https://mcp.whoisfreaks.com/?apiKey=YOUR_API_KEY

Cursor (~/.cursor/mcp.json), Windsurf, and other JSON-configured clients:

{
  "mcpServers": {
    "whoisfreaks": {
      "url": "https://mcp.whoisfreaks.com",
      "headers": { "Authorization": "Bearer YOUR_API_KEY" }
    }
  }
}

VS Code (.vscode/mcp.json):

{
  "servers": {
    "whoisfreaks": {
      "type": "http",
      "url": "https://mcp.whoisfreaks.com",
      "headers": { "Authorization": "Bearer YOUR_API_KEY" }
    }
  }
}

Without a key the server still connects and lists its tools, but every tool call returns an error explaining how to add one. API usage is billed to the key you send.


Quick Start

No Java or Maven required. Pull the pre-built image directly from Docker Hub and run.

The container runs the same multi-user HTTP server as the hosted one: it needs no API key of its own — clients send theirs with each request (see Hosted Server for the ways to send it). Get a free key at billing.whoisfreaks.com/signup.


Option 1 — Direct docker run (simplest)

docker run -d \
  --name whoisfreaks-mcp \
  --restart unless-stopped \
  -p 3100:3100 \
  whoisfreaks/mcp-server:latest

The MCP server is now live at http://localhost:3100/mcp.


Create a docker-compose.yml:

services:
  whoisfreaks-mcp:
    image: whoisfreaks/mcp-server:latest
    container_name: whoisfreaks-mcp
    restart: unless-stopped
    ports:
      - "3100:3100"

Start it:

docker compose up -d

Serving it publicly (HTTPS)

Put a reverse proxy with TLS in front of port 3100. Caddy example (Caddyfile), which obtains a certificate automatically:

mcp.example.com {
    reverse_proxy localhost:3100
}

Nginx example:

location / {
    proxy_pass http://127.0.0.1:3100;
    proxy_http_version 1.1;
    proxy_set_header Host $host;
    proxy_buffering off;          # stream responses as they are produced
    proxy_read_timeout 300s;      # some WHOIS lookups are slow
}

The server is stateless (no MCP sessions), so you can run several containers behind a load balancer without sticky sessions.

To set up a machine and deploy to it without Docker (nginx, HTTPS, rate limiting, rollback), see ansible/.


Verify Docker is working

# Container should show as "Up"
docker ps

# Health check
curl http://localhost:3100/health
# → {"status":"ok"}

# List all 22 registered tools (any key works for listing; tool calls need a valid one)
curl -s http://localhost:3100/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "Authorization: Bearer your-api-key-here" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Use with Claude Desktop (Docker stdio mode)

To run the server locally over stdio instead of HTTP, override the Docker entrypoint and pass your key as an environment variable:

{
  "mcpServers": {
    "whoisfreaks": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-e", "WHOISFREAKS_API_KEY=your-api-key-here",
        "--entrypoint", "java",
        "whoisfreaks/mcp-server:latest",
        "-jar", "app.jar"
      ]
    }
  }
}

No port mapping needed here — Claude Desktop talks to the container directly via stdio.


Build from Source

Only needed if you want to modify the code or build a custom version.

Prerequisites:

Requirement

Minimum Version

Notes

Java (JDK)

17

Check with java -version

Maven

3.8

Check with mvn -version

WhoisFreaks API Key

—

Get yours at billing.whoisfreaks.com/signup

Clone and build:

git clone https://github.com/whoisfreaks/whoisfreaks-mcp-server.git
cd whoisfreaks-mcp-server
mvn clean package -q

This produces a single self-contained fat JAR:

target/whoisfreaks-mcp-server-2.1.0.jar

Tip: Note the absolute path to this JAR — you will need it in the platform configs below. Example: /Users/yourname/whoisfreaks-mcp-server/target/whoisfreaks-mcp-server-2.1.0.jar


Prerequisites

Requirement

Notes

Docker

Required for the recommended Docker path

Java 17 + Maven 3.8

Required only if building from source

WhoisFreaks API Key

Free at billing.whoisfreaks.com/signup


Platform Integration

1. Claude Desktop

The simplest setup is the hosted server as a custom connector (Settings → Connectors → Add custom connector). To run it locally instead, Claude Desktop launches the MCP server as a subprocess via stdio using claude_desktop_config.json:

Config file location:

OS

Path

macOS

~/Library/Application Support/Claude/claude_desktop_config.json

Windows

%APPDATA%\Claude\claude_desktop_config.json

Linux

~/.config/Claude/claude_desktop_config.json


⭐ Option A — Docker (recommended, no Java needed)

{
  "mcpServers": {
    "whoisfreaks": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-e", "WHOISFREAKS_API_KEY=your-api-key-here",
        "--entrypoint", "java",
        "whoisfreaks/mcp-server:latest",
        "-jar", "app.jar"
      ]
    }
  }
}

Docker must be running before you open Claude Desktop. The image is pulled automatically on first use.


Option B — JAR directly (requires Java 17)

{
  "mcpServers": {
    "whoisfreaks": {
      "command": "java",
      "args": ["-jar", "/absolute/path/to/whoisfreaks-mcp-server-2.1.0.jar"],
      "env": {
        "WHOISFREAKS_API_KEY": "your-api-key-here"
      }
    }
  }
}

Steps (both options):

  1. Paste the config above into the config file (create it if it doesn't exist)

  2. Save the file

  3. Quit Claude Desktop completely (Cmd+Q on macOS / taskbar exit on Windows)

  4. Reopen Claude Desktop

  5. Click the hammer icon (Tools) in the chat input — you should see 22 WhoisFreaks tools listed

Verify it works: Type Who owns google.com? and Claude will automatically call liveWhoisLookup.


2. Cursor IDE

Cursor supports both remote (HTTP) and stdio servers. Config file: ~/.cursor/mcp.json

⭐ Option A — HTTP (hosted, or your own container)

{
  "mcpServers": {
    "whoisfreaks": {
      "url": "https://mcp.whoisfreaks.com",
      "headers": { "Authorization": "Bearer your-api-key-here" }
    }
  }
}

For your own container use http://localhost:3100/mcp (start it with docker run -d -p 3100:3100 whoisfreaks/mcp-server:latest).


Option B — Docker via stdio (no port needed)

{
  "mcpServers": {
    "whoisfreaks": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-e", "WHOISFREAKS_API_KEY=your-api-key-here",
        "--entrypoint", "java",
        "whoisfreaks/mcp-server:latest",
        "-jar", "app.jar"
      ]
    }
  }
}

Option C — JAR directly (requires Java 17)

{
  "mcpServers": {
    "whoisfreaks": {
      "command": "java",
      "args": ["-jar", "/absolute/path/to/whoisfreaks-mcp-server-2.1.0.jar"],
      "env": {
        "WHOISFREAKS_API_KEY": "your-api-key-here"
      }
    }
  }
}

Steps:

  1. Save ~/.cursor/mcp.json with your chosen option

  2. Restart Cursor

  3. Open the AI Panel (Cmd+L) → you should see a tools indicator showing WhoisFreaks tools

  4. Ask: Check the SSL certificate for github.com


3. Windsurf IDE

Windsurf (by Codeium) supports MCP via its Cascade AI sidebar.

Config file location:

OS

Path

macOS

~/.codeium/windsurf/mcp_config.json

Windows

%USERPROFILE%\.codeium\windsurf\mcp_config.json

Linux

~/.codeium/windsurf/mcp_config.json

⭐ Option A — Docker via stdio (recommended)

{
  "mcpServers": {
    "whoisfreaks": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-e", "WHOISFREAKS_API_KEY=your-api-key-here",
        "--entrypoint", "java",
        "whoisfreaks/mcp-server:latest",
        "-jar", "app.jar"
      ]
    }
  }
}

Option B — JAR directly (requires Java 17)

{
  "mcpServers": {
    "whoisfreaks": {
      "command": "java",
      "args": ["-jar", "/absolute/path/to/whoisfreaks-mcp-server-2.1.0.jar"],
      "env": {
        "WHOISFREAKS_API_KEY": "your-api-key-here"
      }
    }
  }
}

Steps:

  1. Save the config with your chosen option

  2. Restart Windsurf

  3. Open Cascade sidebar → look for the MCP tools indicator (plug icon)

  4. Ask: Find all subdomains of tesla.com

Note: Windsurf requires Cascade to be in Write mode for tool use. Toggle it from the Cascade header if tools are not being called.


4. VS Code + GitHub Copilot

VS Code supports MCP tools through the GitHub Copilot extension (Chat Participants / Tools feature).

Config file (.vscode/mcp.json in your workspace, or ~/.vscode/mcp.json globally):

⭐ Option A — HTTP (hosted, or your own container)

{
  "servers": {
    "whoisfreaks": {
      "type": "http",
      "url": "https://mcp.whoisfreaks.com",
      "headers": { "Authorization": "Bearer your-api-key-here" }
    }
  }
}

For your own container use http://localhost:3100/mcp (start it with docker run -d -p 3100:3100 whoisfreaks/mcp-server:latest).

Option B — Docker via stdio

{
  "servers": {
    "whoisfreaks": {
      "type": "stdio",
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-e", "WHOISFREAKS_API_KEY=your-api-key-here",
        "--entrypoint", "java",
        "whoisfreaks/mcp-server:latest",
        "-jar", "app.jar"
      ]
    }
  }
}

Option C — JAR directly (requires Java 17)

{
  "servers": {
    "whoisfreaks": {
      "type": "stdio",
      "command": "java",
      "args": ["-jar", "/absolute/path/to/whoisfreaks-mcp-server-2.1.0.jar"],
      "env": {
        "WHOISFREAKS_API_KEY": "your-api-key-here"
      }
    }
  }
}

Steps:

  1. Make sure you have the GitHub Copilot Chat extension installed (v1.99+)

  2. Save the config file above with your chosen option

  3. Open Copilot Chat (Ctrl+Shift+I / Cmd+Shift+I)

  4. Switch the model to Agent mode using the dropdown

  5. Click the Tools button — WhoisFreaks tools should appear in the list

  6. Ask: What are the MX records for github.com?

Requirement: VS Code 1.99+ and GitHub Copilot Chat extension are required for MCP tool support.


5. Continue.dev

Continue is an open-source AI coding assistant with MCP support for VS Code and JetBrains IDEs.

Config file (~/.continue/config.json):

⭐ Option A — HTTP (hosted, or your own container)

{
  "mcpServers": [
    {
      "name": "whoisfreaks",
      "url": "https://mcp.whoisfreaks.com/?apiKey=your-api-key-here",
      "transport": "streamable-http"
    }
  ]
}

For your own container use http://localhost:3100/mcp?apiKey=... (start it with docker run -d -p 3100:3100 whoisfreaks/mcp-server:latest).

Option B — Docker via stdio

{
  "mcpServers": [
    {
      "name": "whoisfreaks",
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-e", "WHOISFREAKS_API_KEY=your-api-key-here",
        "--entrypoint", "java",
        "whoisfreaks/mcp-server:latest",
        "-jar", "app.jar"
      ]
    }
  ]
}

Option C — JAR directly (requires Java 17)

{
  "mcpServers": [
    {
      "name": "whoisfreaks",
      "command": "java",
      "args": ["-jar", "/absolute/path/to/whoisfreaks-mcp-server-2.1.0.jar"],
      "env": {
        "WHOISFREAKS_API_KEY": "your-api-key-here"
      }
    }
  ]
}

Steps:

  1. Install the Continue extension from the VS Code Marketplace or JetBrains Plugin Marketplace

  2. Edit ~/.continue/config.json with your chosen option

  3. Reload the window (Cmd+Shift+P → Reload Window)

  4. Open Continue sidebar — tools from WhoisFreaks will be available in chat

  5. Ask: Look up IP geolocation for 1.1.1.1


6. Zed Editor

Zed has a built-in AI assistant with MCP support via its assistant configuration.

Config file (~/.config/zed/settings.json):

⭐ Option A — Docker via stdio (recommended)

{
  "assistant": {
    "mcp_servers": {
      "whoisfreaks": {
        "command": "docker",
        "args": [
          "run", "-i", "--rm",
          "-e", "WHOISFREAKS_API_KEY=your-api-key-here",
          "--entrypoint", "java",
          "whoisfreaks/mcp-server:latest",
          "-jar", "app.jar"
        ]
      }
    }
  }
}

Option B — JAR directly (requires Java 17)

{
  "assistant": {
    "mcp_servers": {
      "whoisfreaks": {
        "command": "java",
        "args": ["-jar", "/absolute/path/to/whoisfreaks-mcp-server-2.1.0.jar"],
        "env": {
          "WHOISFREAKS_API_KEY": "your-api-key-here"
        }
      }
    }
  }
}

Steps:

  1. Open Zed → Zed menu → Settings (or Cmd+,)

  2. Add the mcp_servers block to your existing settings JSON using your chosen option

  3. Save and restart Zed

  4. Open the AI panel (Cmd+?) → tools will be listed under the tools indicator

  5. Ask: Is the domain myapp.io available?


Example Prompts

Once configured in any client above, try these prompts:

# WHOIS
Who owns the domain apple.com? Give me full WHOIS details.
Show me the complete ownership history for whoisfreaks.com.
Find all domains registered by admin@google.com.

# IP & ASN WHOIS
What organization owns the IP address 8.8.8.8?
Look up ASN information for AS15169.

# DNS
What are the MX and NS records for github.com?
Has facebook.com changed its IP addresses in the last 2 years? (DNS history)
Which domains are pointing to the IP 104.21.0.0? (reverse DNS)

# IP Intelligence
Where is 1.1.1.1 located? What ISP runs it?
Is 185.220.101.45 a Tor exit node or a VPN?

# Domain Tools
Is mycompany.io available to register? Suggest 5 alternatives.
Which of mycompany .com, .io, .ai and .dev are still available? (bulk availability)
List all known subdomains of tesla.com.
Find typosquats of 'paypal' registered recently. (domain typosquatting)
Are there phishing subdomains that imitate 'paypal' on other domains? (subdomain typosquatting)
Is suspicious-login-portal.com safe? Give me a verdict. (domain reputation)

# Bulk
Get the WHOIS records of these 20 domains and list their registrars and expiry dates.
Which of these IPs from my logs are VPNs, proxies or Tor exit nodes?

# Account
How many credits do I have left on my WhoisFreaks key?

# SSL
Check the SSL certificate for github.com — who issued it and when does it expire?

Environment Variables

Variable

Required

Description

WHOISFREAKS_API_KEY

stdio mode only

Your API key from whoisfreaks.com/billing. Without it the server still starts and lists its tools, but every tool call returns a WHOISFREAKS_API_KEY is not set error. Not used in HTTP mode, where each request carries the caller's own key.

MCP_TRANSPORT

No

http to run the hosted HTTP server (same as the --http flag). The Docker image runs HTTP mode by default.

PORT

No

HTTP port. Default: 3100.


Troubleshooting

API Errors

Problem

Cause

Fix

WHOISFREAKS_API_KEY is not set (stdio)

Missing env var

Add -e WHOISFREAKS_API_KEY=your-key to the Docker command, or add it to the env block in your client config

No WhoisFreaks API key was sent (HTTP)

Client sent no key

Add Authorization: Bearer your-key, an X-API-Key header, or ?apiKey=your-key to the URL, then reconnect

Unauthorized (HTTP 401)

Invalid or inactive API key, or the plan, credits or surcharge limit are used up

The message includes the API's own reason. Check the key and usage at whoisfreaks.com/billing, or ask the assistant to run apiKeyUsage

Not supported (HTTP 403)

WhoisFreaks does not support the domain's extension (TLD), or it is inactive

Try another domain

No data found (HTTP 404)

Domain/IP/ASN not in database

Double-check the input value is correct

Rate limit reached (HTTP 429)

Too many requests per minute

Wait for the number of seconds in the message, or upgrade your plan

Too large (HTTP 413)

A bulk list has more than 100 items

Split the list; the bulk tools also refuse more than 100 items before calling the API

Timeout (HTTP 408)

Upstream WHOIS server is slow

Retry — some TLDs have slow WHOIS servers

did not answer within ... seconds

The API took too long (60 s for single lookups, 240 s for bulk lookups and typosquatting searches)

Try again later

Docker Errors

Problem

Cause

Fix

Cannot connect to Docker daemon

Docker Desktop not running

Open Docker Desktop and wait for the engine to start

Container exits immediately

Port in use or wrong entrypoint

Check logs: docker logs whoisfreaks-mcp

port 3100 already in use

Another process on port 3100

Stop it: docker rm -f whoisfreaks-mcp then retry

no such image

Image not pulled yet

Run docker pull whoisfreaks/mcp-server:latest first

Claude Desktop: tools not appearing with Docker config

Docker not in PATH seen by the app

Use the full Docker path: /usr/local/bin/docker as the command

lstat deploy: no such file or directory (CI/CD)

Relative path issue in GitHub Actions

Use ${{ github.workspace }}/deploy/Dockerfile for absolute paths

Gateway connection refused on port 3100

Container not running or port not mapped

Run docker ps — ensure -p 3100:3100 is in the run command

504 / timeouts behind Nginx

Nginx proxy timeout shorter than a slow lookup

Add proxy_read_timeout 300s; and proxy_buffering off; to your Nginx location block

Client Errors

Problem

Cause

Fix

Tools not visible in client

Config not saved or client not restarted

Save config → fully quit and reopen the client

UnsupportedClassVersionError (JAR mode)

Java version too old

Upgrade to Java 17+ (java -version to check)

Wrong JAR path

Relative path in config

Use the full absolute path to the JAR

Cursor shows tools but doesn't call them

Agent mode not enabled

Switch Cursor to Agent mode, not Chat mode

Claude Desktop skips whoisfreaks entry

url used in claude_desktop_config.json

That file needs command/args (stdio). For a URL, add a custom connector in Settings → Connectors instead

Client can't connect to /sse

Pre-2.0 SSE endpoint was removed

Use the /mcp URL (Streamable HTTP)

Windsurf tools not called

Wrong Cascade mode

Switch Cascade to Write mode from the Cascade header


Available Tools

22 tools
apiKeyUsageAPI key usageA
Read-onlyIdempotent
Inspect

Show how much of the WhoisFreaks API key's allowance is used: pay-as-you-go credits bought and used, and the subscription's status, request limit, requests used and surcharge requests. Use this before a large job (a bulk lookup, many pages of reverse WHOIS or typosquatting results) to check there is enough left, or when a lookup fails with a plan or credit limit error. Returns the key (masked), its credits and its subscription usage; a part the account does not have is left out. Behavior: read-only. Reads the usage of your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request); it looks nothing up and changes nothing. If the key is invalid the result is a short message (HTTP 401) instead of data.

Inputs: no named parameters.

asnWhoisLookupASN WHOIS lookupA
Read-onlyIdempotent
Inspect

Get the registry WHOIS record for an autonomous system (ASN): the network operator behind a set of IP routes. Use this when you have an AS number (for example from ipWhoisLookup or ipGeolocation output) and need the operator's name, country, contacts or the IP prefixes it announces. If you only have an IP address, call ipWhoisLookup first to get its ASN. Returns the organisation name and description, country of registration, announced IPv4 and IPv6 prefixes, peering information, admin and technical contacts, and AS sets and blocks. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).

Inputs: asn (required), format.

bulkDnsLookupBulk DNS lookupA
Read-onlyIdempotent
Inspect

Resolve the current DNS records of up to 100 domains, and the PTR records of up to 100 IP addresses, in one request. Use this instead of calling dnsLookup many times, for example to check the mail servers of a list of domains or to name a list of IPs from logs. Provide domainNames, ipAddresses, or both. For one domain or IP use dnsLookup. Lists longer than 100 go in several calls; files of up to 3 million entries are handled by the Bulk Tool in the WhoisFreaks billing dashboard, not by this tool. Costs 1 credit per domain or IP. A large batch can take a few minutes. Returns one entry per domain or IP, with the same record fields as dnsLookup. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).

Inputs: type, format, cnameDepth, domainNames, +1 more.

bulkDomainAvailabilityBulk domain availability checkA
Read-onlyIdempotent
Inspect

Check whether many domain names can be registered, in one request: either up to 100 full domain names, or one name across up to 100 extensions (TLDs). Use this to pick an available name across extensions such as .com, .io and .ai (pass domain and tlds), or to check a list of candidate names (pass domainNames). For one name, or for name ideas, use domainAvailability with suggestions=true. Uses API credits for each domain checked. An invalid name returns its own error entry while the other names still return results. Returns each domain with its availability: AVAILABLE, UNAVAILABLE or UNKNOWN. Availability can change at any moment, and this check does not reserve anything. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).

Inputs: tlds, domain, format, domainNames.

bulkIpGeolocationBulk IP geolocationA
Read-onlyIdempotent
Inspect

Look up the location and network of up to 100 IPv4 or IPv6 addresses in one request. Use this instead of calling ipGeolocation many times, for example to map the visitors or attackers in a log. For one IP use ipGeolocation. For threat signals on many IPs use bulkIpSecurity. Costs 1 credit per IP answered. Returns one entry per IP, with the same fields as ipGeolocation. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).

Inputs: ips (required).

bulkIpSecurityBulk IP reputation checkA
Read-onlyIdempotent
Inspect

Check the reputation of up to 100 IPv4 or IPv6 addresses in one request: VPN, proxy, Tor, relay, spam, known-attacker and bot signals for each. Use this instead of calling ipSecurity many times, for example to screen the IPs behind a wave of sign-ups or failed logins. For one IP use ipSecurity. For location only use bulkIpGeolocation. Costs 1 credit per IP answered. An invalid IP returns its own error entry while the other IPs still return results. Returns one entry per IP, with the same fields as ipSecurity. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).

Inputs: ips (required).

bulkWhoisLookupBulk WHOIS lookupA
Read-onlyIdempotent
Inspect

Get the current WHOIS records of up to 100 domains in one request, queried live. Use this instead of calling liveWhoisLookup many times, for example to audit a domain portfolio or enrich a list of domains taken from logs. For one domain use liveWhoisLookup. Lists of more than 100 domains go in several calls; files of up to 3 million domains are handled by the Bulk Tool in the WhoisFreaks billing dashboard, not by this tool. Costs 1 credit per domain. A large batch can take a few minutes. Returns one WHOIS record per domain, with the same fields as liveWhoisLookup. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).

Inputs: domainNames (required), format.

dnsHistoryDNS historyA
Read-onlyIdempotent
Inspect

Get the historical DNS records of a domain, showing how its A, MX, NS and other records changed over time. Use this for investigations and migrations: earlier hosting IPs (for example the origin IP behind a CDN), past mail servers, or name server changes. For the current records only use dnsLookup. For ownership changes use whoisHistory. Costs 2 credits per page. Returns past records with the dates they were observed. Results are paginated: raise page to get more, and filter by type to reduce output. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).

Inputs: domainName (required), page, type, format.

dnsLookupDNS lookupA
Read-onlyIdempotent
Inspect

Resolve a domain's current DNS records live: A, AAAA, MX, NS, CNAME, SOA, TXT and SPF. With ipAddress it also does a reverse (PTR) lookup of an IP address. Use this to see where a domain points now: its IP addresses, mail servers, name servers, or TXT records such as SPF, DKIM and DMARC. For how records changed over time use dnsHistory. To go the other way and find domains that use a given IP, mail server or name server use reverseDnsLookup. For many domains or IPs at once use bulkDnsLookup. type=all (the default) returns every record type in one call; pass one type or a short list such as mx,txt to keep the result small. cnameDepth follows CNAME chains, for example for www hosts behind a CDN. Returns the records grouped by type. A domain with no records of the requested type returns an empty list or a "no data found" message. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).

Inputs: type, format, ipAddress, cnameDepth, +2 more.

domainAvailabilityDomain availability checkA
Read-onlyIdempotent
Inspect

Check whether a domain name is available to register, using both DNS and WHOIS data. Use this before suggesting or buying a domain name. Set suggestions=true to also get alternative names with other extensions, each marked available or not; count sets how many (5-100). To check a list of names, or one name across many extensions, use bulkDomainAvailability. For details about who owns a registered domain use liveWhoisLookup. Costs 1 credit, plus 1 credit per 5 suggestions. Returns the availability (AVAILABLE or UNAVAILABLE), or with suggestions a list of names each with domainAvailability true or false. Availability can change at any moment, and this check does not reserve the domain. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).

Inputs: domain (required), count, format, suggestions.

domainDiscoveryDomain typosquatting searchA
Read-onlyIdempotent
Inspect

Find registered domains that look like typo variants of a brand name (typosquats such as paypa1.com or paypal-secure.net), or that match a wildcard pattern, across more than 1,500 TLDs. Use this for brand protection, phishing detection, or tracking look-alike registrations. Provide exactly one of keyword or pattern. For subdomains that imitate a brand on unrelated domains, such as login.paypa1.example.com, use subdomainTyposquatting. To find domains whose name simply contains a word use reverseWhoisLookup with keyword. To judge how risky a result is use domainReputation; for its owner use liveWhoisLookup. Costs 5 credits per page (100 domains by default). A search can take up to two minutes. Returns each domain with its creation, expiry and last-seen dates and whether it has been dropped, plus the total count. When there are more, the result has a nextPageToken: pass it as pageToken, with the same keyword or pattern, to get the next page. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).

Inputs: keyword, pattern, fetchSize, pageToken.

domainReputationDomain reputation checkA
Read-onlyIdempotent
Inspect

Assess how risky a domain is, live: a verdict (safe, low_risk, suspicious, malicious or unknown) with its confidence and severity, a trust score with the positive and negative signals behind it, DGA (algorithmically generated name) analysis, matches in threat-intelligence feeds, email security (SPF, DKIM, DMARC and mail servers), and a recommended action. Use this to triage a suspicious domain from an email, a log or a domainDiscovery result before deciding whether to block it. For the domain's owner use liveWhoisLookup, for its certificate sslLookup, and for an IP address ipSecurity. Costs 5 credits. An unknown or unregistered domain still returns an assessment; lookups that failed are listed under errors and only leave out their signals. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).

Inputs: domainName (required).

ipGeolocationIP geolocationA
Read-onlyIdempotent
Inspect

Look up where an IPv4 or IPv6 address is located and which network it belongs to. Use this for country, region, city, coordinates, ISP, ASN, connection type and local currency, for example to localise a visitor or see where a server is hosted. The location is an estimate and is most reliable at country level. For many IPs at once use bulkIpGeolocation. For VPN, proxy, Tor and threat signals use ipSecurity. For the registered owner of the IP block and its abuse contact use ipWhoisLookup. Private and reserved addresses (10.x, 192.168.x, 127.x and similar) cannot be geolocated and return a "non-routable IP" (HTTP 423) message. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).

Inputs: ip (required).

ipSecurityIP reputation checkA
Read-onlyIdempotent
Inspect

Check the reputation of an IPv4 or IPv6 address: VPN, proxy (including residential), Tor exit node, privacy relay, spam and known-attacker activity, bots by type and operator, and whether it belongs to a cloud provider or a corporate secure web gateway. Use this for fraud checks, sign-up or login screening, or triaging a suspicious IP from logs. For many IPs at once use bulkIpSecurity. For location and ISP only use ipGeolocation. For the registered owner and abuse contact use ipWhoisLookup. Returns a threat score from 0 to 100, a flag and confidence score for each signal, provider names where known, and the IP's location, network (route, anycast, CDN) and ASN. A clean result means no signals were found, not that the IP is guaranteed safe. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).

Inputs: ip (required).

ipWhoisLookupIP WHOIS lookupA
Read-onlyIdempotent
Inspect

Get the registry WHOIS record for an IPv4 or IPv6 address: who the IP block is allocated to. Use this to find the owning organisation, CIDR range, AS number and abuse contact of an IP, for example to report abuse. For city, ISP and coordinates use ipGeolocation. For VPN, proxy, Tor and threat signals use ipSecurity. For details about the autonomous system itself use asnWhoisLookup. For domains hosted on the IP use reverseDnsLookup. Returns the network range (inetnum/inet6num) and CIDR, owning organisation and ASN, admin, technical and abuse contacts, route objects, and the raw WHOIS text. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).

Inputs: ip (required), format.

liveWhoisLookupLive WHOIS lookupA
Read-onlyIdempotent
Inspect

Get the current WHOIS registration record for a domain, queried live from WHOIS servers and RDAP. Use this to find who owns a domain now, its registrar, creation and expiry dates, name servers or status. For past owners and changes over time use whoisHistory. For many domains at once use bulkWhoisLookup. To find domains owned by a person, email or company use reverseWhoisLookup. To check whether an unregistered name can be bought use domainAvailability. Pass a bare domain (example.com), not a URL. Returns registrar and registry details, creation/update/expiry dates, registrant, admin and technical contacts (often privacy-redacted), name servers, domain status flags and the raw WHOIS text. When the registrar does not answer, the result is marked as a partial record (HTTP 206); when no live lookup works, as the latest stored record (HTTP 210). Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).

Inputs: domainName (required), format.

reverseDnsLookupReverse DNS searchA
Read-onlyIdempotent
Inspect

Find domains whose DNS records point to a given value: an IP address or range, mail server, name server or other record value. Use this to see which other sites share a hosting IP, which domains use a mail server or name server, or to map infrastructure during an investigation. Set type to match the value: a for an IPv4 address or range (default), aaaa for IPv6, mx for a mail server, ns for a name server. For a domain's own records use dnsLookup. For the registered owner of an IP block use ipWhoisLookup. exact=false (the default) enables '*' wildcard matching, for example *.cloudflare.com. sort=desc with sortBy=lastSeen puts the most recently seen domains first. Costs 5 credits per page of up to 100 domains. Popular IPs and name servers can match millions of domains, so use page and stop once you have enough. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).

Inputs: value (required), page, sort, type, +3 more.

reverseWhoisLookupReverse WHOIS searchA
Read-onlyIdempotent
Inspect

Find domains whose WHOIS records contain a given email, registrant name or company, or whose name contains a keyword, across 4.6 billion WHOIS records. Use this to map everything a person or organisation has registered, for example when investigating a phishing actor or auditing a company's domain portfolio. Provide exactly one of email, owner, company or keyword. To look up the owner of one known domain use liveWhoisLookup. To find look-alike domains of a brand (typosquats) use domainDiscovery. mode=mini returns a short summary per domain and 100 domains per page, against 50 full records per page in the default mode. Costs 5 credits per page, so prefer mini when you only need the list of domains. Results are paginated: the response gives the total pages, and page selects the next one. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).

Inputs: mode, page, email, exact, +4 more.

sslLookupSSL certificate lookupA
Read-onlyIdempotent
Inspect

Get the SSL/TLS certificate a domain currently serves, fetched live. Use this to check expiry dates, the issuer, covered hostnames (SANs) or key type, or to debug HTTPS errors. Set chain=true to include intermediate and root certificates when diagnosing trust-chain problems, and sslRaw=true only when you need the raw OpenSSL output, which is long. For DNS records use dnsLookup; for domain ownership use liveWhoisLookup; for an overall risk verdict on the domain use domainReputation. Costs 1 credit, plus 1 credit per 2 certificates with chain=true. Returns each certificate's subject (common name, organisation), issuer, validity dates, serial number, signature algorithm, key algorithm and size, and extensions: covered hostnames (SANs), key usages, issuer and OCSP URLs, and certificate policies. A domain with no certificate returns a "no data found" (HTTP 404) message. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).

Inputs: domainName (required), chain, format, sslRaw.

subdomainLookupSubdomain lookupA
Read-onlyIdempotent
Inspect

List the known subdomains of a domain (for example api.example.com or mail.example.com) from the WhoisFreaks subdomain database. Use this for attack-surface mapping, finding exposed services, or auditing a company's hosts. It looks up subdomains already discovered by WhoisFreaks rather than scanning the target, so it only knows subdomains that have been observed. To get a subdomain's DNS records use dnsLookup. To find look-alike domains of a brand use domainDiscovery, and look-alike subdomains on other domains use subdomainTyposquatting. status=active keeps only subdomains that currently resolve; after and before (YYYY-MM-DD) filter by when a subdomain was discovered. Costs 2 credits per page. Results are paginated, so large domains may need several pages. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).

Inputs: domain (required), page, after, before, +2 more.

subdomainTyposquattingSubdomain typosquatting searchA
Read-onlyIdempotent
Inspect

Find subdomains, on any domain, that contain a typo variant of a brand name or match a wildcard pattern as one of their labels, for example login.paypa1.example.com. Phishing pages often hide a brand inside a subdomain of an unrelated domain, so these hosts never show up in domainDiscovery. Use this for brand protection and phishing hunting. Provide exactly one of keyword or pattern. For the subdomains of one domain use subdomainLookup. To judge how risky a result's domain is use domainReputation. Costs 5 credits per page (100 subdomains by default). Returns each subdomain with its registrable domain, whether it is active, and its first-seen, last-seen and inactive-from dates, plus the total count. When there are more, the result has a nextPageToken: pass it as pageToken, with the same keyword or pattern, to get the next page. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).

Inputs: keyword, pattern, fetchSize, pageToken.

whoisHistoryWHOIS historyA
Read-onlyIdempotent
Inspect

Get the historical WHOIS records of a domain: deduplicated snapshots ordered from newest to oldest, going back as far as 1986. Use this to see previous owners, registrar transfers, past contacts, name server changes, or when a domain expired and was re-registered. For only the current record use liveWhoisLookup. For DNS changes over time use dnsHistory. Costs 2 credits. Every record comes back in one response; there are no pages. Returns a list of snapshots, each with the registrar, dates, contacts and name servers recorded at that time. A domain with no recorded history returns a "no data found" message. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).

Inputs: domainName (required), format.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    TDQS

    A4.5/5.0

    Scored across 22 tools

    Disambiguation4/5

    Most tools have clearly distinct targets (DNS vs WHOIS vs IP vs SSL vs availability), and the descriptions explicitly cross-reference sibling tools to steer selection. A few subtle boundaries remain—domainDiscovery vs subdomainTyposquatting vs reverseWhoisLookup with a keyword—that require careful reading, but they are documented distinctions.

    Naming Consistency4/5

    All names are camelCase and largely follow a resource+action pattern (dnsLookup, liveWhoisLookup, ipGeolocation, sslLookup) with a consistent 'bulk' prefix for batch variants. Minor deviations like domainDiscovery, domainReputation, and subdomainTyposquatting lack the trailing action verb but remain predictable.

    Tool Count4/5

    22 tools is on the heavy side, but the surface covers genuinely separate domains (WHOIS, DNS, IP geo/security, SSL, subdomains, typosquatting, availability, usage). The bulk variants are justified by real payload-size constraints rather than redundancy, so each tool earns its place.

    Completeness5/5

    Comprehensive coverage: current/historical/bulk/reverse for both WHOIS and DNS, IP WHOIS, ASN WHOIS, geolocation and security with bulk forms, SSL inspection, availability, subdomain enumeration, typosquat detection, reputation, and API key usage. No obvious lifecycle gaps remain for a domain/IP intelligence service.

    Maintenance

    ActivityMaintained
    ResponsivenessNo recent community issues

    Related MCP Connectors

    Related MCP Servers

    • A
      license
      A
      quality
      D
      maintenance
      A Model Context Protocol server that allows AI agents to perform WHOIS lookups, enabling users to directly ask the AI about domain availability, ownership, registration details, and other domain information.
      4
      184 npm
      60
      MIT
    • A
      license
      A
      quality
      B
      maintenance
      A Model Context Protocol (MCP) server that enables Claude Desktop to check domain availability across 50+ TLDs. Features DNS/WHOIS verification, bulk checking, and smart suggestions. Zero-clone installation via uvx.
      2
      61
      Mozilla Public 2.0
    • A
      license
      A
      quality
      B
      maintenance
      A Model Context Protocol (MCP) server that provides comprehensive WHOIS lookup capabilities using the IP2WHOIS API. This server allows AI agents to query domain registration details, including expiry dates, registrar information, and registrant data.
      2
      1
      MIT
    • A
      license
      Not graded
      quality
      D
      maintenance
      A comprehensive MCP server that exposes multiple OSINT tools to AI assistants like Claude, enabling sophisticated reconnaissance and information gathering tasks using industry-standard OSINT tools.
      249
      MIT