Whoisfreaks
Summary: This MCP server turns the WhoisFreaks API into AI-callable, read-only lookup tools for domain, DNS, IP, ASN and SSL investigations — though the schema as provided registers 14 tools, not the 22 advertised in the README.
WHOIS — current registration record (
liveWhoisLookup), ownership timeline (whoisHistory), and reverse search by email, owner, company or keyword (reverseWhoisLookup)IP & ASN WHOIS — who an IPv4/IPv6 block is allocated to, with abuse contacts (
ipWhoisLookup); network operator details and announced prefixes for an ASN (asnWhoisLookup)DNS — live A/AAAA/MX/NS/CNAME/SOA/TXT/SPF records (
dnsLookup), historical record changes (dnsHistory), and reverse lookup of domains pointing at an IP, mail or name server (reverseDnsLookup)IP intelligence — country/city/ISP/coordinates (
ipGeolocation) and risk signals such as VPN, proxy, Tor exit node, bot/spam activity with a threat score (ipSecurity)Domain — availability checking with optional suggestions (
domainAvailability), subdomain enumeration with date/status filters (subdomainLookup), and keyword or wildcard discovery of look-alike/typosquat domains across 888M+ names (domainDiscovery)SSL — issuer, expiry, SANs, chain and raw output for a domain's certificate (
sslLookup)Behaviour — all tools are read-only, idempotent and billed in WhoisFreaks credits to the caller's API key; failures return short error messages (missing key, 404 no data, 429 rate limit, credit/plan limits)
Not present in this schema — the bulk tools (
bulkWhoisLookup,bulkDnsLookup,bulkIpGeolocation,bulkIpSecurity,bulkDomainAvailability),subdomainTyposquatting,domainReputationandapiKeyUsagedescribed in the README
This server has a remotely hosted endpoint. Open its connector listing for connection details, authentication requirements, and setup instructions:
WhoisFreaks MCP Server
A Model Context Protocol (MCP) server that exposes the full WhoisFreaks API suite as AI-callable tools. Works with Claude Desktop, Cursor, Windsurf, VS Code, Continue, Zed, and any other MCP-compatible AI client.
Three ways to use it — pick what fits your setup:
Method | Requires | Best for | |
⭐ Easiest | Just your API key | Everyone — nothing to install | |
Docker (pre-built image) | Docker | Running it on your own machine or VM | |
Build from source | Java 17 + Maven | Contributors / custom builds |
Connect it to any MCP client via Streamable HTTP (/mcp endpoint, hosted or self-hosted) or stdio (local).
Every user brings their own WhoisFreaks API key — the HTTP server stores no key of its own and uses the key sent with each request.
Table of Contents
Related MCP server: Domain Availability Checker MCP
Tools Reference
WHOIS Tools
Tool | Description |
| Real-time WHOIS data for any domain — registrar, registrant, dates, nameservers |
| Real-time WHOIS data for up to 100 domains in one request |
| Complete ownership history timeline for a domain |
| Find all domains registered by an email address, owner name or company, or whose name contains a keyword |
IP & ASN WHOIS Tools
Tool | Description |
| WHOIS registration data for any IPv4 or IPv6 address |
| WHOIS data for an Autonomous System Number (e.g. AS15169) |
DNS Tools
Tool | Description |
| Live DNS records — A, AAAA, MX, NS, CNAME, SOA, TXT, SPF, or all — and PTR records for an IP |
| Live DNS records for up to 100 domains and 100 IPs in one request |
| Historical DNS records with full change timeline |
| Find all domains pointing to a given IP or range, mail server or nameserver |
IP Intelligence Tools
Tool | Description |
| Country, city, region, ISP, and coordinates for any IP address |
| Geolocation for up to 100 IP addresses in one request |
| IP reputation: VPN, proxy, Tor exit node, relay, bot, spam and known-attacker signals |
| IP reputation for up to 100 IP addresses in one request |
Domain Tools
Tool | Description |
| Check if a domain is available to register, with optional suggestions |
| Check up to 100 domains, or one name across up to 100 extensions (TLDs) |
| Enumerate all known subdomains for a domain, with status and date filters |
| Find registered domains that are typo variants of a brand (typosquatting), by keyword or wildcard pattern |
| Find subdomains on any domain that contain a typo variant of a brand, such as login.paypa1.example.com |
| Risk verdict, trust score, DGA analysis, threat-feed matches and email security for a domain |
SSL Tools
Tool | Description |
| SSL/TLS certificate details — issuer, expiry, SANs, chain, and raw output |
Account Tools
Tool | Description |
| Credits and subscription requests used by your API key (costs nothing) |
The API's key rotation endpoint has no tool on purpose: it would replace the key the MCP client uses and hand the new one to the AI. Rotate keys in the billing dashboard.
The tools call the endpoints of the WhoisFreaks OpenAPI spec and cost the same credits as calling the API directly; the credit usage page lists them. Bulk tools cost credits for each item.
Hosted Server (no install)
Point any MCP client that supports remote servers at:
https://mcp.whoisfreaks.com(https://mcp.whoisfreaks.com/mcp is the same endpoint, for clients or configs that expect that path)
and send your WhoisFreaks API key (get one free) in one of these ways:
Method | Example | Use with |
|
| Claude Code, Cursor, VS Code, Windsurf, Continue |
|
| Any client that supports custom headers |
Query parameter |
| Clients without custom headers (claude.ai / Claude Desktop custom connectors) |
Prefer a header when your client supports one — URLs with keys can end up in logs and history.
Claude Code
claude mcp add --transport http whoisfreaks https://mcp.whoisfreaks.com \
--header "Authorization: Bearer YOUR_API_KEY"claude.ai / Claude Desktop — Settings → Connectors → Add custom connector, URL:
https://mcp.whoisfreaks.com/?apiKey=YOUR_API_KEYCursor (~/.cursor/mcp.json), Windsurf, and other JSON-configured clients:
{
"mcpServers": {
"whoisfreaks": {
"url": "https://mcp.whoisfreaks.com",
"headers": { "Authorization": "Bearer YOUR_API_KEY" }
}
}
}VS Code (.vscode/mcp.json):
{
"servers": {
"whoisfreaks": {
"type": "http",
"url": "https://mcp.whoisfreaks.com",
"headers": { "Authorization": "Bearer YOUR_API_KEY" }
}
}
}Without a key the server still connects and lists its tools, but every tool call returns an error explaining how to add one. API usage is billed to the key you send.
Quick Start
⭐ Recommended — Docker
No Java or Maven required. Pull the pre-built image directly from Docker Hub and run.
The container runs the same multi-user HTTP server as the hosted one: it needs no API key of its own — clients send theirs with each request (see Hosted Server for the ways to send it). Get a free key at billing.whoisfreaks.com/signup.
Option 1 — Direct docker run (simplest)
docker run -d \
--name whoisfreaks-mcp \
--restart unless-stopped \
-p 3100:3100 \
whoisfreaks/mcp-server:latestThe MCP server is now live at http://localhost:3100/mcp.
Option 2 — Docker Compose (recommended for production / VM)
Create a docker-compose.yml:
services:
whoisfreaks-mcp:
image: whoisfreaks/mcp-server:latest
container_name: whoisfreaks-mcp
restart: unless-stopped
ports:
- "3100:3100"Start it:
docker compose up -dServing it publicly (HTTPS)
Put a reverse proxy with TLS in front of port 3100. Caddy example (Caddyfile), which obtains a certificate automatically:
mcp.example.com {
reverse_proxy localhost:3100
}Nginx example:
location / {
proxy_pass http://127.0.0.1:3100;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_buffering off; # stream responses as they are produced
proxy_read_timeout 300s; # some WHOIS lookups are slow
}The server is stateless (no MCP sessions), so you can run several containers behind a load balancer without sticky sessions.
To set up a machine and deploy to it without Docker (nginx, HTTPS, rate limiting, rollback), see ansible/.
Verify Docker is working
# Container should show as "Up"
docker ps
# Health check
curl http://localhost:3100/health
# → {"status":"ok"}
# List all 22 registered tools (any key works for listing; tool calls need a valid one)
curl -s http://localhost:3100/mcp \
-H "Content-Type: application/json" \
-H "Accept: application/json, text/event-stream" \
-H "Authorization: Bearer your-api-key-here" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'Use with Claude Desktop (Docker stdio mode)
To run the server locally over stdio instead of HTTP, override the Docker entrypoint and pass your key as an environment variable:
{
"mcpServers": {
"whoisfreaks": {
"command": "docker",
"args": [
"run", "-i", "--rm",
"-e", "WHOISFREAKS_API_KEY=your-api-key-here",
"--entrypoint", "java",
"whoisfreaks/mcp-server:latest",
"-jar", "app.jar"
]
}
}
}No port mapping needed here — Claude Desktop talks to the container directly via stdio.
Build from Source
Only needed if you want to modify the code or build a custom version.
Prerequisites:
Requirement | Minimum Version | Notes |
Java (JDK) | 17 | Check with |
Maven | 3.8 | Check with |
WhoisFreaks API Key | — | Get yours at billing.whoisfreaks.com/signup |
Clone and build:
git clone https://github.com/whoisfreaks/whoisfreaks-mcp-server.git
cd whoisfreaks-mcp-server
mvn clean package -qThis produces a single self-contained fat JAR:
target/whoisfreaks-mcp-server-2.1.0.jarTip: Note the absolute path to this JAR — you will need it in the platform configs below. Example:
/Users/yourname/whoisfreaks-mcp-server/target/whoisfreaks-mcp-server-2.1.0.jar
Prerequisites
Requirement | Notes |
Docker | Required for the recommended Docker path |
Java 17 + Maven 3.8 | Required only if building from source |
WhoisFreaks API Key | Free at billing.whoisfreaks.com/signup |
Platform Integration
1. Claude Desktop
The simplest setup is the hosted server as a custom connector (Settings → Connectors → Add custom connector). To run it locally instead, Claude Desktop launches the MCP server as a subprocess via stdio using claude_desktop_config.json:
Config file location:
OS | Path |
macOS |
|
Windows |
|
Linux |
|
⭐ Option A — Docker (recommended, no Java needed)
{
"mcpServers": {
"whoisfreaks": {
"command": "docker",
"args": [
"run", "-i", "--rm",
"-e", "WHOISFREAKS_API_KEY=your-api-key-here",
"--entrypoint", "java",
"whoisfreaks/mcp-server:latest",
"-jar", "app.jar"
]
}
}
}Docker must be running before you open Claude Desktop. The image is pulled automatically on first use.
Option B — JAR directly (requires Java 17)
{
"mcpServers": {
"whoisfreaks": {
"command": "java",
"args": ["-jar", "/absolute/path/to/whoisfreaks-mcp-server-2.1.0.jar"],
"env": {
"WHOISFREAKS_API_KEY": "your-api-key-here"
}
}
}
}Steps (both options):
Paste the config above into the config file (create it if it doesn't exist)
Save the file
Quit Claude Desktop completely (
Cmd+Qon macOS / taskbar exit on Windows)Reopen Claude Desktop
Click the hammer icon (Tools) in the chat input — you should see 22 WhoisFreaks tools listed
Verify it works: Type Who owns google.com? and Claude will automatically call liveWhoisLookup.
2. Cursor IDE
Cursor supports both remote (HTTP) and stdio servers. Config file: ~/.cursor/mcp.json
⭐ Option A — HTTP (hosted, or your own container)
{
"mcpServers": {
"whoisfreaks": {
"url": "https://mcp.whoisfreaks.com",
"headers": { "Authorization": "Bearer your-api-key-here" }
}
}
}For your own container use
http://localhost:3100/mcp(start it withdocker run -d -p 3100:3100 whoisfreaks/mcp-server:latest).
Option B — Docker via stdio (no port needed)
{
"mcpServers": {
"whoisfreaks": {
"command": "docker",
"args": [
"run", "-i", "--rm",
"-e", "WHOISFREAKS_API_KEY=your-api-key-here",
"--entrypoint", "java",
"whoisfreaks/mcp-server:latest",
"-jar", "app.jar"
]
}
}
}Option C — JAR directly (requires Java 17)
{
"mcpServers": {
"whoisfreaks": {
"command": "java",
"args": ["-jar", "/absolute/path/to/whoisfreaks-mcp-server-2.1.0.jar"],
"env": {
"WHOISFREAKS_API_KEY": "your-api-key-here"
}
}
}
}Steps:
Save
~/.cursor/mcp.jsonwith your chosen optionRestart Cursor
Open the AI Panel (
Cmd+L) → you should see a tools indicator showing WhoisFreaks toolsAsk:
Check the SSL certificate for github.com
3. Windsurf IDE
Windsurf (by Codeium) supports MCP via its Cascade AI sidebar.
Config file location:
OS | Path |
macOS |
|
Windows |
|
Linux |
|
⭐ Option A — Docker via stdio (recommended)
{
"mcpServers": {
"whoisfreaks": {
"command": "docker",
"args": [
"run", "-i", "--rm",
"-e", "WHOISFREAKS_API_KEY=your-api-key-here",
"--entrypoint", "java",
"whoisfreaks/mcp-server:latest",
"-jar", "app.jar"
]
}
}
}Option B — JAR directly (requires Java 17)
{
"mcpServers": {
"whoisfreaks": {
"command": "java",
"args": ["-jar", "/absolute/path/to/whoisfreaks-mcp-server-2.1.0.jar"],
"env": {
"WHOISFREAKS_API_KEY": "your-api-key-here"
}
}
}
}Steps:
Save the config with your chosen option
Restart Windsurf
Open Cascade sidebar → look for the MCP tools indicator (plug icon)
Ask:
Find all subdomains of tesla.com
Note: Windsurf requires Cascade to be in Write mode for tool use. Toggle it from the Cascade header if tools are not being called.
4. VS Code + GitHub Copilot
VS Code supports MCP tools through the GitHub Copilot extension (Chat Participants / Tools feature).
Config file (.vscode/mcp.json in your workspace, or ~/.vscode/mcp.json globally):
⭐ Option A — HTTP (hosted, or your own container)
{
"servers": {
"whoisfreaks": {
"type": "http",
"url": "https://mcp.whoisfreaks.com",
"headers": { "Authorization": "Bearer your-api-key-here" }
}
}
}For your own container use
http://localhost:3100/mcp(start it withdocker run -d -p 3100:3100 whoisfreaks/mcp-server:latest).
Option B — Docker via stdio
{
"servers": {
"whoisfreaks": {
"type": "stdio",
"command": "docker",
"args": [
"run", "-i", "--rm",
"-e", "WHOISFREAKS_API_KEY=your-api-key-here",
"--entrypoint", "java",
"whoisfreaks/mcp-server:latest",
"-jar", "app.jar"
]
}
}
}Option C — JAR directly (requires Java 17)
{
"servers": {
"whoisfreaks": {
"type": "stdio",
"command": "java",
"args": ["-jar", "/absolute/path/to/whoisfreaks-mcp-server-2.1.0.jar"],
"env": {
"WHOISFREAKS_API_KEY": "your-api-key-here"
}
}
}
}Steps:
Make sure you have the GitHub Copilot Chat extension installed (v1.99+)
Save the config file above with your chosen option
Open Copilot Chat (
Ctrl+Shift+I/Cmd+Shift+I)Switch the model to Agent mode using the dropdown
Click the Tools button — WhoisFreaks tools should appear in the list
Ask:
What are the MX records for github.com?
Requirement: VS Code 1.99+ and GitHub Copilot Chat extension are required for MCP tool support.
5. Continue.dev
Continue is an open-source AI coding assistant with MCP support for VS Code and JetBrains IDEs.
Config file (~/.continue/config.json):
⭐ Option A — HTTP (hosted, or your own container)
{
"mcpServers": [
{
"name": "whoisfreaks",
"url": "https://mcp.whoisfreaks.com/?apiKey=your-api-key-here",
"transport": "streamable-http"
}
]
}For your own container use
http://localhost:3100/mcp?apiKey=...(start it withdocker run -d -p 3100:3100 whoisfreaks/mcp-server:latest).
Option B — Docker via stdio
{
"mcpServers": [
{
"name": "whoisfreaks",
"command": "docker",
"args": [
"run", "-i", "--rm",
"-e", "WHOISFREAKS_API_KEY=your-api-key-here",
"--entrypoint", "java",
"whoisfreaks/mcp-server:latest",
"-jar", "app.jar"
]
}
]
}Option C — JAR directly (requires Java 17)
{
"mcpServers": [
{
"name": "whoisfreaks",
"command": "java",
"args": ["-jar", "/absolute/path/to/whoisfreaks-mcp-server-2.1.0.jar"],
"env": {
"WHOISFREAKS_API_KEY": "your-api-key-here"
}
}
]
}Steps:
Install the Continue extension from the VS Code Marketplace or JetBrains Plugin Marketplace
Edit
~/.continue/config.jsonwith your chosen optionReload the window (
Cmd+Shift+P→Reload Window)Open Continue sidebar — tools from WhoisFreaks will be available in chat
Ask:
Look up IP geolocation for 1.1.1.1
6. Zed Editor
Zed has a built-in AI assistant with MCP support via its assistant configuration.
Config file (~/.config/zed/settings.json):
⭐ Option A — Docker via stdio (recommended)
{
"assistant": {
"mcp_servers": {
"whoisfreaks": {
"command": "docker",
"args": [
"run", "-i", "--rm",
"-e", "WHOISFREAKS_API_KEY=your-api-key-here",
"--entrypoint", "java",
"whoisfreaks/mcp-server:latest",
"-jar", "app.jar"
]
}
}
}
}Option B — JAR directly (requires Java 17)
{
"assistant": {
"mcp_servers": {
"whoisfreaks": {
"command": "java",
"args": ["-jar", "/absolute/path/to/whoisfreaks-mcp-server-2.1.0.jar"],
"env": {
"WHOISFREAKS_API_KEY": "your-api-key-here"
}
}
}
}
}Steps:
Open Zed →
Zedmenu →Settings(orCmd+,)Add the
mcp_serversblock to your existing settings JSON using your chosen optionSave and restart Zed
Open the AI panel (
Cmd+?) → tools will be listed under the tools indicatorAsk:
Is the domain myapp.io available?
Example Prompts
Once configured in any client above, try these prompts:
# WHOIS
Who owns the domain apple.com? Give me full WHOIS details.
Show me the complete ownership history for whoisfreaks.com.
Find all domains registered by admin@google.com.
# IP & ASN WHOIS
What organization owns the IP address 8.8.8.8?
Look up ASN information for AS15169.
# DNS
What are the MX and NS records for github.com?
Has facebook.com changed its IP addresses in the last 2 years? (DNS history)
Which domains are pointing to the IP 104.21.0.0? (reverse DNS)
# IP Intelligence
Where is 1.1.1.1 located? What ISP runs it?
Is 185.220.101.45 a Tor exit node or a VPN?
# Domain Tools
Is mycompany.io available to register? Suggest 5 alternatives.
Which of mycompany .com, .io, .ai and .dev are still available? (bulk availability)
List all known subdomains of tesla.com.
Find typosquats of 'paypal' registered recently. (domain typosquatting)
Are there phishing subdomains that imitate 'paypal' on other domains? (subdomain typosquatting)
Is suspicious-login-portal.com safe? Give me a verdict. (domain reputation)
# Bulk
Get the WHOIS records of these 20 domains and list their registrars and expiry dates.
Which of these IPs from my logs are VPNs, proxies or Tor exit nodes?
# Account
How many credits do I have left on my WhoisFreaks key?
# SSL
Check the SSL certificate for github.com — who issued it and when does it expire?Environment Variables
Variable | Required | Description |
| stdio mode only | Your API key from whoisfreaks.com/billing. Without it the server still starts and lists its tools, but every tool call returns a |
| No |
|
| No | HTTP port. Default: |
Troubleshooting
API Errors
Problem | Cause | Fix |
| Missing env var | Add |
| Client sent no key | Add |
| Invalid or inactive API key, or the plan, credits or surcharge limit are used up | The message includes the API's own reason. Check the key and usage at whoisfreaks.com/billing, or ask the assistant to run |
| WhoisFreaks does not support the domain's extension (TLD), or it is inactive | Try another domain |
| Domain/IP/ASN not in database | Double-check the input value is correct |
| Too many requests per minute | Wait for the number of seconds in the message, or upgrade your plan |
| A bulk list has more than 100 items | Split the list; the bulk tools also refuse more than 100 items before calling the API |
| Upstream WHOIS server is slow | Retry — some TLDs have slow WHOIS servers |
| The API took too long (60 s for single lookups, 240 s for bulk lookups and typosquatting searches) | Try again later |
Docker Errors
Problem | Cause | Fix |
| Docker Desktop not running | Open Docker Desktop and wait for the engine to start |
Container exits immediately | Port in use or wrong entrypoint | Check logs: |
| Another process on port 3100 | Stop it: |
| Image not pulled yet | Run |
Claude Desktop: tools not appearing with Docker config | Docker not in PATH seen by the app | Use the full Docker path: |
| Relative path issue in GitHub Actions | Use |
Gateway | Container not running or port not mapped | Run |
| Nginx proxy timeout shorter than a slow lookup | Add |
Client Errors
Problem | Cause | Fix |
Tools not visible in client | Config not saved or client not restarted | Save config → fully quit and reopen the client |
| Java version too old | Upgrade to Java 17+ ( |
Wrong JAR path | Relative path in config | Use the full absolute path to the JAR |
Cursor shows tools but doesn't call them | Agent mode not enabled | Switch Cursor to Agent mode, not Chat mode |
Claude Desktop skips whoisfreaks entry |
| That file needs |
Client can't connect to | Pre-2.0 SSE endpoint was removed | Use the |
Windsurf tools not called | Wrong Cascade mode | Switch Cascade to Write mode from the Cascade header |
Links
WhoisFreaks API Documentation: https://whoisfreaks.com/documentation
API Key & Billing: https://whoisfreaks.com/billing
MCP Protocol Specification: https://modelcontextprotocol.io
MCP Inspector (test tool):
npx @modelcontextprotocol/inspectorIssues & Support: Open an issue on GitHub
Available Tools
22 toolsapiKeyUsageAPI key usageARead-onlyIdempotentInspect
Show how much of the WhoisFreaks API key's allowance is used: pay-as-you-go credits bought and used, and the subscription's status, request limit, requests used and surcharge requests. Use this before a large job (a bulk lookup, many pages of reverse WHOIS or typosquatting results) to check there is enough left, or when a lookup fails with a plan or credit limit error. Returns the key (masked), its credits and its subscription usage; a part the account does not have is left out. Behavior: read-only. Reads the usage of your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request); it looks nothing up and changes nothing. If the key is invalid the result is a short message (HTTP 401) instead of data.
Inputs: no named parameters.
asnWhoisLookupASN WHOIS lookupARead-onlyIdempotentInspect
Get the registry WHOIS record for an autonomous system (ASN): the network operator behind a set of IP routes. Use this when you have an AS number (for example from ipWhoisLookup or ipGeolocation output) and need the operator's name, country, contacts or the IP prefixes it announces. If you only have an IP address, call ipWhoisLookup first to get its ASN. Returns the organisation name and description, country of registration, announced IPv4 and IPv6 prefixes, peering information, admin and technical contacts, and AS sets and blocks. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).
Inputs: asn (required), format.
bulkDnsLookupBulk DNS lookupARead-onlyIdempotentInspect
Resolve the current DNS records of up to 100 domains, and the PTR records of up to 100 IP addresses, in one request. Use this instead of calling dnsLookup many times, for example to check the mail servers of a list of domains or to name a list of IPs from logs. Provide domainNames, ipAddresses, or both. For one domain or IP use dnsLookup. Lists longer than 100 go in several calls; files of up to 3 million entries are handled by the Bulk Tool in the WhoisFreaks billing dashboard, not by this tool. Costs 1 credit per domain or IP. A large batch can take a few minutes. Returns one entry per domain or IP, with the same record fields as dnsLookup. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).
Inputs: type, format, cnameDepth, domainNames, +1 more.
bulkDomainAvailabilityBulk domain availability checkARead-onlyIdempotentInspect
Check whether many domain names can be registered, in one request: either up to 100 full domain names, or one name across up to 100 extensions (TLDs). Use this to pick an available name across extensions such as .com, .io and .ai (pass domain and tlds), or to check a list of candidate names (pass domainNames). For one name, or for name ideas, use domainAvailability with suggestions=true. Uses API credits for each domain checked. An invalid name returns its own error entry while the other names still return results. Returns each domain with its availability: AVAILABLE, UNAVAILABLE or UNKNOWN. Availability can change at any moment, and this check does not reserve anything. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).
Inputs: tlds, domain, format, domainNames.
bulkIpGeolocationBulk IP geolocationARead-onlyIdempotentInspect
Look up the location and network of up to 100 IPv4 or IPv6 addresses in one request. Use this instead of calling ipGeolocation many times, for example to map the visitors or attackers in a log. For one IP use ipGeolocation. For threat signals on many IPs use bulkIpSecurity. Costs 1 credit per IP answered. Returns one entry per IP, with the same fields as ipGeolocation. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).
Inputs: ips (required).
bulkIpSecurityBulk IP reputation checkARead-onlyIdempotentInspect
Check the reputation of up to 100 IPv4 or IPv6 addresses in one request: VPN, proxy, Tor, relay, spam, known-attacker and bot signals for each. Use this instead of calling ipSecurity many times, for example to screen the IPs behind a wave of sign-ups or failed logins. For one IP use ipSecurity. For location only use bulkIpGeolocation. Costs 1 credit per IP answered. An invalid IP returns its own error entry while the other IPs still return results. Returns one entry per IP, with the same fields as ipSecurity. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).
Inputs: ips (required).
bulkWhoisLookupBulk WHOIS lookupARead-onlyIdempotentInspect
Get the current WHOIS records of up to 100 domains in one request, queried live. Use this instead of calling liveWhoisLookup many times, for example to audit a domain portfolio or enrich a list of domains taken from logs. For one domain use liveWhoisLookup. Lists of more than 100 domains go in several calls; files of up to 3 million domains are handled by the Bulk Tool in the WhoisFreaks billing dashboard, not by this tool. Costs 1 credit per domain. A large batch can take a few minutes. Returns one WHOIS record per domain, with the same fields as liveWhoisLookup. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).
Inputs: domainNames (required), format.
dnsHistoryDNS historyARead-onlyIdempotentInspect
Get the historical DNS records of a domain, showing how its A, MX, NS and other records changed over time. Use this for investigations and migrations: earlier hosting IPs (for example the origin IP behind a CDN), past mail servers, or name server changes. For the current records only use dnsLookup. For ownership changes use whoisHistory. Costs 2 credits per page. Returns past records with the dates they were observed. Results are paginated: raise page to get more, and filter by type to reduce output. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).
Inputs: domainName (required), page, type, format.
dnsLookupDNS lookupARead-onlyIdempotentInspect
Resolve a domain's current DNS records live: A, AAAA, MX, NS, CNAME, SOA, TXT and SPF. With ipAddress it also does a reverse (PTR) lookup of an IP address. Use this to see where a domain points now: its IP addresses, mail servers, name servers, or TXT records such as SPF, DKIM and DMARC. For how records changed over time use dnsHistory. To go the other way and find domains that use a given IP, mail server or name server use reverseDnsLookup. For many domains or IPs at once use bulkDnsLookup. type=all (the default) returns every record type in one call; pass one type or a short list such as mx,txt to keep the result small. cnameDepth follows CNAME chains, for example for www hosts behind a CDN. Returns the records grouped by type. A domain with no records of the requested type returns an empty list or a "no data found" message. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).
Inputs: type, format, ipAddress, cnameDepth, +2 more.
domainAvailabilityDomain availability checkARead-onlyIdempotentInspect
Check whether a domain name is available to register, using both DNS and WHOIS data. Use this before suggesting or buying a domain name. Set suggestions=true to also get alternative names with other extensions, each marked available or not; count sets how many (5-100). To check a list of names, or one name across many extensions, use bulkDomainAvailability. For details about who owns a registered domain use liveWhoisLookup. Costs 1 credit, plus 1 credit per 5 suggestions. Returns the availability (AVAILABLE or UNAVAILABLE), or with suggestions a list of names each with domainAvailability true or false. Availability can change at any moment, and this check does not reserve the domain. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).
Inputs: domain (required), count, format, suggestions.
domainDiscoveryDomain typosquatting searchARead-onlyIdempotentInspect
Find registered domains that look like typo variants of a brand name (typosquats such as paypa1.com or paypal-secure.net), or that match a wildcard pattern, across more than 1,500 TLDs. Use this for brand protection, phishing detection, or tracking look-alike registrations. Provide exactly one of keyword or pattern. For subdomains that imitate a brand on unrelated domains, such as login.paypa1.example.com, use subdomainTyposquatting. To find domains whose name simply contains a word use reverseWhoisLookup with keyword. To judge how risky a result is use domainReputation; for its owner use liveWhoisLookup. Costs 5 credits per page (100 domains by default). A search can take up to two minutes. Returns each domain with its creation, expiry and last-seen dates and whether it has been dropped, plus the total count. When there are more, the result has a nextPageToken: pass it as pageToken, with the same keyword or pattern, to get the next page. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).
Inputs: keyword, pattern, fetchSize, pageToken.
domainReputationDomain reputation checkARead-onlyIdempotentInspect
Assess how risky a domain is, live: a verdict (safe, low_risk, suspicious, malicious or unknown) with its confidence and severity, a trust score with the positive and negative signals behind it, DGA (algorithmically generated name) analysis, matches in threat-intelligence feeds, email security (SPF, DKIM, DMARC and mail servers), and a recommended action. Use this to triage a suspicious domain from an email, a log or a domainDiscovery result before deciding whether to block it. For the domain's owner use liveWhoisLookup, for its certificate sslLookup, and for an IP address ipSecurity. Costs 5 credits. An unknown or unregistered domain still returns an assessment; lookups that failed are listed under errors and only leave out their signals. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).
Inputs: domainName (required).
ipGeolocationIP geolocationARead-onlyIdempotentInspect
Look up where an IPv4 or IPv6 address is located and which network it belongs to. Use this for country, region, city, coordinates, ISP, ASN, connection type and local currency, for example to localise a visitor or see where a server is hosted. The location is an estimate and is most reliable at country level. For many IPs at once use bulkIpGeolocation. For VPN, proxy, Tor and threat signals use ipSecurity. For the registered owner of the IP block and its abuse contact use ipWhoisLookup. Private and reserved addresses (10.x, 192.168.x, 127.x and similar) cannot be geolocated and return a "non-routable IP" (HTTP 423) message. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).
Inputs: ip (required).
ipSecurityIP reputation checkARead-onlyIdempotentInspect
Check the reputation of an IPv4 or IPv6 address: VPN, proxy (including residential), Tor exit node, privacy relay, spam and known-attacker activity, bots by type and operator, and whether it belongs to a cloud provider or a corporate secure web gateway. Use this for fraud checks, sign-up or login screening, or triaging a suspicious IP from logs. For many IPs at once use bulkIpSecurity. For location and ISP only use ipGeolocation. For the registered owner and abuse contact use ipWhoisLookup. Returns a threat score from 0 to 100, a flag and confidence score for each signal, provider names where known, and the IP's location, network (route, anycast, CDN) and ASN. A clean result means no signals were found, not that the IP is guaranteed safe. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).
Inputs: ip (required).
ipWhoisLookupIP WHOIS lookupARead-onlyIdempotentInspect
Get the registry WHOIS record for an IPv4 or IPv6 address: who the IP block is allocated to. Use this to find the owning organisation, CIDR range, AS number and abuse contact of an IP, for example to report abuse. For city, ISP and coordinates use ipGeolocation. For VPN, proxy, Tor and threat signals use ipSecurity. For details about the autonomous system itself use asnWhoisLookup. For domains hosted on the IP use reverseDnsLookup. Returns the network range (inetnum/inet6num) and CIDR, owning organisation and ASN, admin, technical and abuse contacts, route objects, and the raw WHOIS text. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).
Inputs: ip (required), format.
liveWhoisLookupLive WHOIS lookupARead-onlyIdempotentInspect
Get the current WHOIS registration record for a domain, queried live from WHOIS servers and RDAP. Use this to find who owns a domain now, its registrar, creation and expiry dates, name servers or status. For past owners and changes over time use whoisHistory. For many domains at once use bulkWhoisLookup. To find domains owned by a person, email or company use reverseWhoisLookup. To check whether an unregistered name can be bought use domainAvailability. Pass a bare domain (example.com), not a URL. Returns registrar and registry details, creation/update/expiry dates, registrant, admin and technical contacts (often privacy-redacted), name servers, domain status flags and the raw WHOIS text. When the registrar does not answer, the result is marked as a partial record (HTTP 206); when no live lookup works, as the latest stored record (HTTP 210). Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).
Inputs: domainName (required), format.
reverseDnsLookupReverse DNS searchARead-onlyIdempotentInspect
Find domains whose DNS records point to a given value: an IP address or range, mail server, name server or other record value. Use this to see which other sites share a hosting IP, which domains use a mail server or name server, or to map infrastructure during an investigation. Set type to match the value: a for an IPv4 address or range (default), aaaa for IPv6, mx for a mail server, ns for a name server. For a domain's own records use dnsLookup. For the registered owner of an IP block use ipWhoisLookup. exact=false (the default) enables '*' wildcard matching, for example *.cloudflare.com. sort=desc with sortBy=lastSeen puts the most recently seen domains first. Costs 5 credits per page of up to 100 domains. Popular IPs and name servers can match millions of domains, so use page and stop once you have enough. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).
Inputs: value (required), page, sort, type, +3 more.
reverseWhoisLookupReverse WHOIS searchARead-onlyIdempotentInspect
Find domains whose WHOIS records contain a given email, registrant name or company, or whose name contains a keyword, across 4.6 billion WHOIS records. Use this to map everything a person or organisation has registered, for example when investigating a phishing actor or auditing a company's domain portfolio. Provide exactly one of email, owner, company or keyword. To look up the owner of one known domain use liveWhoisLookup. To find look-alike domains of a brand (typosquats) use domainDiscovery. mode=mini returns a short summary per domain and 100 domains per page, against 50 full records per page in the default mode. Costs 5 credits per page, so prefer mini when you only need the list of domains. Results are paginated: the response gives the total pages, and page selects the next one. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).
Inputs: mode, page, email, exact, +4 more.
sslLookupSSL certificate lookupARead-onlyIdempotentInspect
Get the SSL/TLS certificate a domain currently serves, fetched live. Use this to check expiry dates, the issuer, covered hostnames (SANs) or key type, or to debug HTTPS errors. Set chain=true to include intermediate and root certificates when diagnosing trust-chain problems, and sslRaw=true only when you need the raw OpenSSL output, which is long. For DNS records use dnsLookup; for domain ownership use liveWhoisLookup; for an overall risk verdict on the domain use domainReputation. Costs 1 credit, plus 1 credit per 2 certificates with chain=true. Returns each certificate's subject (common name, organisation), issuer, validity dates, serial number, signature algorithm, key algorithm and size, and extensions: covered hostnames (SANs), key usages, issuer and OCSP URLs, and certificate policies. A domain with no certificate returns a "no data found" (HTTP 404) message. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).
Inputs: domainName (required), chain, format, sslRaw.
subdomainLookupSubdomain lookupARead-onlyIdempotentInspect
List the known subdomains of a domain (for example api.example.com or mail.example.com) from the WhoisFreaks subdomain database. Use this for attack-surface mapping, finding exposed services, or auditing a company's hosts. It looks up subdomains already discovered by WhoisFreaks rather than scanning the target, so it only knows subdomains that have been observed. To get a subdomain's DNS records use dnsLookup. To find look-alike domains of a brand use domainDiscovery, and look-alike subdomains on other domains use subdomainTyposquatting. status=active keeps only subdomains that currently resolve; after and before (YYYY-MM-DD) filter by when a subdomain was discovered. Costs 2 credits per page. Results are paginated, so large domains may need several pages. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).
Inputs: domain (required), page, after, before, +2 more.
subdomainTyposquattingSubdomain typosquatting searchARead-onlyIdempotentInspect
Find subdomains, on any domain, that contain a typo variant of a brand name or match a wildcard pattern as one of their labels, for example login.paypa1.example.com. Phishing pages often hide a brand inside a subdomain of an unrelated domain, so these hosts never show up in domainDiscovery. Use this for brand protection and phishing hunting. Provide exactly one of keyword or pattern. For the subdomains of one domain use subdomainLookup. To judge how risky a result's domain is use domainReputation. Costs 5 credits per page (100 subdomains by default). Returns each subdomain with its registrable domain, whether it is active, and its first-seen, last-seen and inactive-from dates, plus the total count. When there are more, the result has a nextPageToken: pass it as pageToken, with the same keyword or pattern, to get the next page. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).
Inputs: keyword, pattern, fetchSize, pageToken.
whoisHistoryWHOIS historyARead-onlyIdempotentInspect
Get the historical WHOIS records of a domain: deduplicated snapshots ordered from newest to oldest, going back as far as 1986. Use this to see previous owners, registrar transfers, past contacts, name server changes, or when a domain expired and was re-registered. For only the current record use liveWhoisLookup. For DNS changes over time use dnsHistory. Costs 2 credits. Every record comes back in one response; there are no pages. Returns a list of snapshots, each with the registrar, dates, contacts and name servers recorded at that time. A domain with no recorded history returns a "no data found" message. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).
Inputs: domainName (required), format.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
TDQS
Scored across 22 tools
Most tools have clearly distinct targets (DNS vs WHOIS vs IP vs SSL vs availability), and the descriptions explicitly cross-reference sibling tools to steer selection. A few subtle boundaries remain—domainDiscovery vs subdomainTyposquatting vs reverseWhoisLookup with a keyword—that require careful reading, but they are documented distinctions.
All names are camelCase and largely follow a resource+action pattern (dnsLookup, liveWhoisLookup, ipGeolocation, sslLookup) with a consistent 'bulk' prefix for batch variants. Minor deviations like domainDiscovery, domainReputation, and subdomainTyposquatting lack the trailing action verb but remain predictable.
22 tools is on the heavy side, but the surface covers genuinely separate domains (WHOIS, DNS, IP geo/security, SSL, subdomains, typosquatting, availability, usage). The bulk variants are justified by real payload-size constraints rather than redundancy, so each tool earns its place.
Comprehensive coverage: current/historical/bulk/reverse for both WHOIS and DNS, IP WHOIS, ASN WHOIS, geolocation and security with bulk forms, SSL inspection, availability, subdomain enumeration, typosquat detection, reputation, and API key usage. No obvious lifecycle gaps remain for a domain/IP intelligence service.
Maintenance
Related MCP Connectors
A comprehensive Model Context Protocol (MCP) server that enables AI assistants to interact with yo…
Free MCP server of security & dev API tools -- supply-chain, CVE, DNS, WHOIS, OFAC, Cosmos SDK.
Model Context Protocol server for the Apideck Unified API. Connect any MCP-compatible agent framework to 100+ accounting systems, HRIS platforms, file storage providers, and more through one integration. More information https://www.apideck.com/mcp-server
Talk to your public-facing AI from any MCP client — Claude, ChatGPT, Cursor, Cline, Windsurf.
Related MCP Servers
- AlicenseAqualityDmaintenanceA Model Context Protocol server that allows AI agents to perform WHOIS lookups, enabling users to directly ask the AI about domain availability, ownership, registration details, and other domain information.4184 npm60MIT
- AlicenseAqualityBmaintenanceA Model Context Protocol (MCP) server that enables Claude Desktop to check domain availability across 50+ TLDs. Features DNS/WHOIS verification, bulk checking, and smart suggestions. Zero-clone installation via uvx.261Mozilla Public 2.0

mcp-ip2whoisofficial
AlicenseAqualityBmaintenanceA Model Context Protocol (MCP) server that provides comprehensive WHOIS lookup capabilities using the IP2WHOIS API. This server allows AI agents to query domain registration details, including expiry dates, registrar information, and registrant data.21MIT- AlicenseNot gradedqualityDmaintenanceA comprehensive MCP server that exposes multiple OSINT tools to AI assistants like Claude, enabling sophisticated reconnaissance and information gathering tasks using industry-standard OSINT tools.249MIT