Whoisxml Api
About
MCP server for Whoisxml Api.
Details
- Author
- whois-api-llc
- Downloads
- 310
- Categories
- Developer Tools, Security
Jump to
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
Whoisxml ApiCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
{
"mcpServers": {
"whoisxmlapi": {
"command": "npx",
"args": [
"@whoisxmlapidotcom/mcp-whoisxmlapi"
],
"env": {
"WHOISXMLAPI_TOKEN": "your-api-key"
}
}
}
}
brand_alert
Find newly added, dropped, or updated domains whose names contain specified brand terms. Use this for typosquat detection, lookalike-domain monitoring, and brand-protection workflows. Do NOT use this for matching against WHOIS contact fields (use `registrant_alert`) or for general WHOIS-text matching (use `reverse_whois`). Set with_typos=true to automatically expand brand terms with common typo variants.
bulk_dns_lookup
Run DNS lookups for up to 200 domains in a single call. Emulated bulk (no native upstream endpoint): the server fans out single lookups concurrently and returns a unified envelope, 1 credit per input. Use this whenever you have ≥2 domains and want concurrent execution under one rate-limit budget. For >200 inputs, split client-side. Do NOT use this for historical DNS records (use `dns_history`) or for a single domain (use `dns_lookup` directly).
bulk_email_verification
Run email verification for up to 10,000 addresses in a single call. Native bulk via WhoisXML's Bulk Email Verification API; 1 credit per email. Returns inline if it completes within 20s, otherwise returns a `job_id` to poll via `bulk_job_status` / `bulk_job_results`. Use this for lead-list hygiene at any scale ≥2 emails. Do NOT use this for live polling of an in-flight job (use `bulk_job_status` for status, `bulk_job_results` to fetch completed rows) or for a single email (use `email_verification`).
bulk_ip_geolocation
Run IP geolocation for up to 200 IP addresses in a single call. Emulated bulk (no native upstream endpoint exists; WhoisXML's bulk IP-geo product is CSV-only via web UI). Server fans out single lookups concurrently, 1 credit per input. Use this whenever you have ≥2 IPs to enrich. For >200 IPs, split client-side. Do NOT use this for ASN/CIDR ownership lookups (use `ip_netblocks`) or for a single IP (use `ipgeolocation` directly).
bulk_job_results
Fetch full per-input results for a completed native bulk job (created by `bulk_whois` or `bulk_email_verification`). If the job is still in flight, returns `status=running` with progress; the caller should retry. Per-input order may differ from the original input order. Do NOT use this for emulated bulk tools (`bulk_dns_lookup`, `bulk_subdomain_lookup`, `bulk_ip_geolocation`); they always return inline.
bulk_job_status
Check progress of an in-flight bulk job created by `bulk_whois` or `bulk_email_verification`. Returns `running` or `completed` plus progress counters. Use this when a bulk call returned a `job_id` instead of inline results — poll until completed, then call `bulk_job_results`. Do NOT use this for emulated bulk tools (`bulk_dns_lookup`, `bulk_subdomain_lookup`, `bulk_ip_geolocation`); they always return inline.
bulk_subdomain_lookup
Discover subdomains for up to 200 apex domains in a single call. Emulated bulk: fans out single subdomain lookups concurrently. Reuses the in-memory cache of `subdomain_lookup`, so re-querying recently-fetched domains is free; otherwise 1 credit per input. Use this for attack-surface mapping across an organisation's full apex-domain portfolio in one shot. Do NOT use this for newly-registered domains containing a search term (use `domain_and_subdomain_discovery`) or when you have a single apex (use `subdomain_lookup`).
bulk_whois
Run WHOIS lookups for up to 10,000 domains in a single call. Native bulk via WhoisXML's Bulk WHOIS API; 1 credit per domain. Returns inline if it completes within 20s, otherwise returns a `job_id` to poll via `bulk_job_status` / `bulk_job_results`. Use this whenever you have ≥2 domains to look up — looping `whois` is strictly worse on rate-limit budget. Do NOT use this for live polling of an in-flight job (use `bulk_job_status` for status, `bulk_job_results` to fetch completed rows).
categorization
Classify a domain into IAB Content Taxonomy v3.1 content categories (Website Categorization v4). Returns 1-3 ranked categories plus a primary_category shortcut, each with a string ID (e.g. "IAB-596"), a human-readable hierarchical path ("Shopping > Online Marketplace") with tier1..tier4 levels, and a confidence score; response metadata includes taxonomy_version, credits_charged, latency_ms, model, an abstain object (flags parked/dead/thin sites with no real business purpose), a source object (is_historical_fallback marks results served from historical data when the live crawl was blocked), and error. Use this for content filtering, brand-safety gating, or to understand what a flagged domain claims to be. Do NOT use this for malware/phishing reputation (use `threat_intelligence` or `domain_reputation`) or for WHOIS/DNS facts (use `whois` / `dns_lookup`); unlike the legacy v3 API the response carries no ASN or domain-age data (use `ip_netblocks` / `whois` for those).
disposable_email_check
Check whether an email address belongs to a disposable or temporary provider (e.g., mailinator, 10minutemail, guerrillamail). Returns a boolean verdict and the domain extracted from the address. Use this for lead-gen hygiene, signup-fraud filtering, or free-trial abuse detection when you only need the disposable verdict. Do NOT use this for full deliverability or mailbox-reachability checks — use `email_verification` instead.
dns_history
Look up historical DNS records for a domain (forward) or domains historically associated with an IP (reverse). Use this when investigating infrastructure pivots, domain takeovers, or when a current `dns_lookup` returns sparse/expired data. Do NOT use this for current resolution (use `dns_lookup`) or for the live set of domains on an IP right now (use `reverse_ip`).
dns_lookup
Resolve current DNS records for a domain — A, AAAA, MX, NS, SOA, TXT, CNAME, PTR, SRV, CAA, DS, DNSKEY, or `all`. Use this whenever you need today's authoritative answer for any record type. Do NOT use this for historical resolution data (use `dns_history`), to enumerate domains pointing at an IP (use `reverse_ip`), or to search records by pattern across the zone (use `reverse_dns`).
domain_and_subdomain_discovery
Find newly-registered domains and subdomains containing one or more search terms, with registration dates. Wildcards (`*`) supported; multiple terms combine with AND. Use this when sweeping for typosquats or brand-impersonation domains being registered fresh against your brand. Do NOT use this to enumerate the existing subdomain tree of a known domain (use `subdomain_lookup`) or for typosquat verification on an already-known domain (use `typosquatting`).
domain_info
Get an enriched WHOIS profile for a domain by combining the current record with historical records to fill redacted or missing fields. Use this when a plain `whois` call returns redacted contacts or sparse data and you still need registrant/admin details. Do NOT use this for the historical timeline itself (use `whois_history`) or for a quick first-pass lookup where the current record is sufficient (use `whois`).
domain_reputation
Score a single domain's trustworthiness on a 0–100 scale by running live infrastructure and configuration checks (certificate validity, mail and name-server setup, malware-database and blackhole lookups, domain age, and more) and return the contributing test results with human-readable warnings. Use this to triage whether a flagged or unfamiliar domain is actually dangerous — for example after `typosquatting` or `brand_alert` surfaces a lookalike. Do NOT use it to look up a known-bad verdict from curated threat feeds (use `threat_intelligence`), to learn what a site claims to be (use `categorization`), or to fetch raw registration or zone records (those have their own dedicated lookup tools).
email_verification
Verify an email address via syntax check, MX lookup, and SMTP deliverability probe. Also flags disposable, role-based (e.g. `info@`, `noreply@`), free-provider, and catch-all addresses. Use this for lead-list hygiene or to gate signup forms. Do NOT use this to look up the registrant email of a domain (use `whois`) or when you have a list of >1 email (use `bulk_email_verification`).
ip_netblocks
Look up CIDR ranges, ASN number/name, organisation, and registration dates for an IP address, ASN, or organisation name. Use this when investigating who owns a chunk of address space or what netblocks an organisation controls. Do NOT use this for point-in-time geolocation of a single IP (use `ipgeolocation`) or to enumerate domains on the IP (use `reverse_ip`).
ipgeolocation
Get geolocation data (country, region, city, ISP, ASN) for an IP address, domain, or email. Falls back to the caller's IP if no input is provided. Use this when assessing whether a connection or registration originates from an unexpected geography. Do NOT use this for IP netblock / ASN ownership queries (use `ip_netblocks`) or when you have many IPs to enrich (use `bulk_ip_geolocation`).
registrant_alert
Find newly added, dropped, or updated domains whose WHOIS records match search terms in registrant contact fields (email, name, organisation, etc.). Use this for brand-impersonation monitoring and threat-actor infrastructure tracking. Do NOT use this for general WHOIS-text matching (use `reverse_whois`) or for domain-name string matching.
reverse_dns
Search across DNS records by pattern and return matching domains plus the record values. Multiple search terms combine with AND — use separate calls for OR. Wildcards (`*`) are required for partial matches; otherwise the search is exact. Use this when sweeping the zone for SPF strings, TXT verification tokens, or arbitrary RDATA patterns. Do NOT use this when you already know the domain (use `dns_lookup`) or when the input is an IP (use `reverse_ip`).
reverse_ip
Find every domain currently pointing at a given IP address, with first-/last-seen dates per domain. Use this when investigating shared hosting, malicious infrastructure pivots, or to enumerate co-tenants of a flagged IP. Do NOT use this to resolve a domain's IP (use `dns_lookup`) or to search DNS records by pattern (use `reverse_dns`).
reverse_mx
Find every domain that uses a specific MX server, with first-/last-seen dates. Use this when sweeping for domains that share a phishing-friendly mail provider, or to map an organisation's mail-handling fleet. Do NOT use this for nameservers (use `reverse_ns`) or for hosting IPs (use `reverse_ip`).
reverse_ns
Find every domain delegated to a specific authoritative nameserver, with first-/last-seen dates. Use this when an attacker uses a private NS infrastructure and you want to enumerate the rest of their fleet. Do NOT use this for MX servers (use `reverse_mx`) or hosting IPs (use `reverse_ip`).
reverse_whois
Find every domain whose WHOIS record contains a given free-text search term (registrant name, email, organisation, address, etc.). Wildcards (`*`) and partial matches supported; multiple terms combine with AND. Use this when pivoting from a known registrant identity to other domains they own. Do NOT use this when you need a field-targeted query (use `reverse_whois_advanced`) or when you only have the domain (use `whois` / `whois_history`).
reverse_whois_advanced
Find domains using field-specific WHOIS searches — e.g. `RegistrantContact.Organization`, `DomainName`, `NameServers`. Up to 4 search terms with optional exact-match and exclude flags, combined with AND. Use this when you need precision (search only the registrant org, not the full record). Do NOT use this for free-text searches (use `reverse_whois`) or when you have only the domain (use `whois`).
ssl_certificates
Retrieve TLS certificate details for a domain — issuer, validity period, subject alternative names (SANs), chain trust status. Optionally returns the full chain. Use this when investigating SAN-based pivots (other domains on the same cert), expired/self-signed cert posture, or CT-log evidence of recent issuance. Do NOT use this to enumerate subdomains directly (use `subdomain_lookup`); SANs are a side effect, not the primary signal.
subdomain_lookup
Enumerate up to 10000 known subdomains of a single domain (the upstream API's hard cap; check the "truncated_at_upstream_cap" response field for whether more may exist), with first-/last-seen timestamps per subdomain. Use this for attack-surface mapping on a target organisation's apex domain. Can return thousands of rows — paginate. Do NOT use this for searching newly-registered domains by pattern (use `domain_and_subdomain_discovery`) or for processing many apex domains at once (use `bulk_subdomain_lookup`).
threat_intelligence
Check whether an indicator (domain, URL, IP, CIDR, or file hash) appears in known malware, phishing, spam, or botnet feeds. Returns threat classification, severity, and source feed details. Use this on every suspicious indicator before deeper enrichment — it's the cheapest gate. Do NOT use this for content-category labels like "gambling" or "adult" (use `categorization`) or for typosquat detection (use `typosquatting`).
typosquatting
Check whether a domain belongs to a typosquatting group, or expand every domain across all groups containing it. Use `mode=probe` for a fast inGroup boolean + groupId triage. Use `mode=group` to enumerate the full lookalike infrastructure once a probe hits. Do NOT use this to find newly-registered impersonation domains by pattern (use `domain_and_subdomain_discovery`) or for malware/phishing reputation (use `threat_intelligence`).
website_screenshot
Capture a screenshot of a web page for a URL and return it as a native image content block plus a base64-encoded JSON payload (JSON's base64 field is deprecated as of 2026-10-04; prefer the native image block). Choose the output format with the type parameter: "png" (default) or "jpg" for raster images, or "pdf" to render the page as a PDF. Optionally set the viewport width and height in pixels, and enable full-page capture to grab the entire scrollable page instead of just the visible viewport. Use this to obtain visual evidence of how a site actually looks — for example to document a suspicious, phishing, or typosquatting page surfaced by another tool. Do NOT use it to read a page's text, fetch DNS or WHOIS records, or classify the site, since those have their own tools.
whois
Look up current WHOIS / RDAP registration data for a single domain — registrar, creation/expiry/updated dates, nameservers, status codes, and contact info when not redacted. Use this as the first move when triaging an unknown or suspicious domain. Do NOT use this when you need historical ownership changes (use `whois_history`) or when you have many domains in a list (use `bulk_whois`).
whois_history
Retrieve the full timeline of WHOIS changes for a domain — ownership transfers, registrar moves, nameserver swaps, and contact edits over time. Use this when investigating attribution, domain age, or whether a domain recently changed hands (a common phishing precursor). Do NOT use this for current registration only (use `whois`) or for enriched-but-current data (use `domain_info`).
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"whoisxml api": {
"whoisxmlapi": {
"command": "npx",
"args": [
"@whoisxmlapidotcom/mcp-whoisxmlapi"
],
"env": {
"WHOISXMLAPI_TOKEN": "your-api-key"
}
}
}
}
}McpServers
{
"whoisxmlapi": {
"command": "npx",
"args": [
"@whoisxmlapidotcom/mcp-whoisxmlapi"
],
"env": {
"WHOISXMLAPI_TOKEN": "your-api-key"
}
}
}Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
