How do I use WhoisXML API MCP Server?

1. Click on "Install Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@WhoisXML API MCP Server WHOIS for example.com" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

WhoisXML API MCP Server

The official WhoisXML API MCP server: 32 first-party tools for WHOIS, DNS, IP geolocation, threat intelligence, typosquatting, email verification, and native bulk lookups — in Claude, Cursor, VS Code, LobeChat, or any MCP client.

Documentation: https://mcp.whoisxmlapi.com
npm package: @whoisxmlapidotcom/mcp-whoisxmlapi
Docker image: whoisxmlapidotcom/mcp-whoisxmlapi
MCP Registry: io.github.whois-api-llc/mcp-whoisxmlapi

This repository is the public listing home for the server. Distribution is via the hosted endpoint, npm, and Docker Hub; the implementation source is maintained privately by Whois API, Inc.

Hosted endpoint (no install)

Connect any remote-capable MCP client to the hosted server — authentication is via OAuth with your WhoisXML API key:

https://mcp-hosted.whoisxmlapi.com/mcp

{
  "mcpServers": {
    "whoisxmlapi": {
      "url": "https://mcp-hosted.whoisxmlapi.com/mcp"
    }
  }
}

Related MCP server: domain-mcp

Run locally

Requires a WhoisXML API key — get one at https://whoisxmlapi.com.

npm:

{
  "mcpServers": {
    "whoisxmlapi": {
      "command": "npx",
      "args": ["-y", "@whoisxmlapidotcom/mcp-whoisxmlapi"],
      "env": { "WHOISXMLAPI_TOKEN": "at_YOUR_KEY" }
    }
  }
}

Docker:

docker run -i --rm -e WHOISXMLAPI_TOKEN=at_YOUR_KEY whoisxmlapidotcom/mcp-whoisxmlapi

Tools (32)

Domain intelligence

Tool	What it does
`whois`	Current WHOIS/RDAP registration data for a domain — registrar, dates, nameservers, status, contacts.
`whois_history`	Full timeline of WHOIS changes — ownership transfers, registrar moves, nameserver swaps.
`domain_info`	Enriched WHOIS profile combining current + historical records to fill redacted fields.
`reverse_whois`	Every domain whose WHOIS record contains a free-text term (name, email, org, address).
`reverse_whois_advanced`	Field-specific WHOIS searches (e.g. `RegistrantContact.Organization`), up to 4 terms.
`domain_reputation`	0–100 trust score from live infrastructure and configuration checks.
`typosquatting`	Check whether a domain belongs to a typosquatting group, or expand the full group.
`categorization`	Classify a domain into IAB Content Taxonomy v3.1 categories.

DNS & infrastructure

Tool	What it does
`dns_lookup`	Current DNS records — A, AAAA, MX, NS, SOA, TXT, CNAME, PTR, SRV, CAA, DS, DNSKEY, or all.
`dns_history`	Historical DNS records (forward) or domains historically on an IP (reverse).
`reverse_dns`	Search DNS records by pattern and return matching domains.
`reverse_ip`	Every domain currently pointing at an IP, with first-/last-seen dates.
`reverse_mx`	Every domain using a specific MX server.
`reverse_ns`	Every domain delegated to a specific nameserver.
`subdomain_lookup`	Enumerate up to 10,000 known subdomains of a domain with seen timestamps.
`domain_and_subdomain_discovery`	Newly-registered domains/subdomains containing search terms (wildcards supported).
`ssl_certificates`	TLS certificate details — issuer, validity, SANs, chain trust.

IP intelligence

Tool	What it does
`ipgeolocation`	Country, region, city, ISP, ASN for an IP, domain, or email.
`ip_netblocks`	CIDR ranges, ASN, organisation, and registration dates for IP/ASN/org.

Threat & brand protection

Tool	What it does
`threat_intelligence`	Check a domain, URL, IP, CIDR, or file hash against malware/phishing/spam/botnet feeds.
`brand_alert`	Newly added/dropped/updated domains containing brand terms — typosquat & lookalike monitoring.
`registrant_alert`	New/changed domains whose WHOIS registrant fields match search terms.

Email

Tool	What it does
`email_verification`	Syntax, MX, and SMTP deliverability checks; flags disposable/role/free/catch-all.
`disposable_email_check`	Boolean verdict on disposable/temporary email providers.

Screenshots

Tool	What it does
`website_screenshot`	Capture a web page screenshot, returned as a native image content block.

Native bulk

Tool	What it does
`bulk_whois`	WHOIS for up to 10,000 domains in one call (native bulk, async `job_id` if long-running).
`bulk_email_verification`	Email verification for up to 10,000 addresses (native bulk, async if long-running).
`bulk_dns_lookup`	DNS lookups for up to 200 domains, fanned out concurrently.
`bulk_ip_geolocation`	IP geolocation for up to 200 IPs, fanned out concurrently.
`bulk_subdomain_lookup`	Subdomain discovery for up to 200 apex domains.
`bulk_job_status`	Progress of an in-flight bulk job.
`bulk_job_results`	Full per-input results of a completed bulk job.

Example prompts

"Look up the WHOIS for suspicious-domain.com and tell me if it's suspicious."
"Find all subdomains of example.com and check their DNS history."
"Check the threat intelligence reputation of 203.0.113.7 and what's hosted there."

This server cannot be installed

A

license - permissive license

-

quality - not tested

C

maintenance

How are these scores calculated?

Maintenance

–Maintainers

–Response time

–Release cycle

–Releases (12mo)

Commit activity

Resources

Need Help?

Related Servers

WhoisXML API MCP Server

WhoisXML API MCP Server

Hosted endpoint (no install)

Run locally

Tools (32)

Domain intelligence

DNS & infrastructure

IP intelligence

Threat & brand protection

Email

Screenshots

Native bulk

Example prompts

Maintenance

Resources

Latest Blog Posts

MCP directory API