WhoisXML API MCP Server

27 WHOIS, DNS, IP, threat intelligence, and bulk tools for AI agents — backed by 28.7B+ historic WHOIS records, 50B+ domains, and 116B+ DNS records.

CommunityOnlineNo sign-inGlobalFreeRead-only

What it can do

  • Bulk Dns Lookup: Run DNS lookups for up to 200 domain names per call. Emulated bulk (no native upstream bulk endpoint): the server fans out single DNS lookups concurrently and returns a unified envelo
  • Bulk Email Verification: Run email verification for up to 10,000 emails per call. Native bulk (uses WhoisXML's Bulk Email Verification API). Each email consumes 1 credit. Returns inline if completes w
  • Bulk Ip Geolocation: Run IP geolocation lookups for up to 200 IP addresses per call. Emulated bulk (no native upstream bulk endpoint exists; the WhoisXML bulk-IP-geo product is CSV-only via web UI). T

What data it sees

Do you need an account

No: the server works without sign-in

27 WHOIS, DNS, IP, threat intelligence, and bulk tools for AI agents — backed by 28.7B+ historic WHOIS records, 50B+ domains, and 116B+ DNS records.

Capabilities

  • WHOIS / Domain: whois, whois_history, reverse_whois, reverse_whois_advanced, bulk_whois, domain_info
  • DNS: dns_lookup, dns_history, reverse_dns, reverse_ns, reverse_mx, bulk_dns_lookup
  • IP / Network: ipgeolocation, ip_netblocks, reverse_ip, bulk_ip_geolocation
  • Subdomain / Discovery: subdomain_lookup, domain_and_subdomain_discovery, bulk_subdomain_lookup
  • Threat / Brand intel: threat_intelligence, typosquatting, categorization, ssl_certificates
  • Email: email_verification, bulk_email_verification
  • Bulk-job admin: bulk_job_status, bulk_job_results
  • Meta: tool_search (deferred-loading helper for context-constrained agents)

Auth: OAuth 2.0 (PKCE/S256, dynamic client registration). Sign in once with your WhoisXML API account at the OAuth prompt — no API-key management on the client side.

Pricing: Tools consume WhoisXML API credits per call. Free trial available at https://whoisxmlapi.com.

License: Apache 2.0

How to connect

How to connect WhoisXML API MCP Server to Claude

The server address to paste into Claude settings:

https://whoisxmlapi--dev-gbg4.run.tools

  1. Open Claude (claude.ai or the desktop app).
  2. Go to Settings → Connectors.
  3. Click Add custom connector.
  4. Paste the server address copied below into Remote MCP server URL and click Add.
  5. In a chat, click + → Connectors and switch the new connector on.

Custom connectors are available on Free, Pro, Max, Team and Enterprise plans (Free is limited to one). On Team and Enterprise an organization Owner adds the connector first under Organization settings → Connectors.

Authorization

After you click Add, a sign-in window for the service opens. Sign in with your own account and approve access. Claude never sees your password.

How to connect WhoisXML API MCP Server to ChatGPT

The server address to paste into ChatGPT settings:

https://whoisxmlapi--dev-gbg4.run.tools

  1. Open ChatGPT in a browser (chatgpt.com). A Plus, Pro, Business, Enterprise or Edu plan is required.
  2. Turn on developer mode once: Settings → Apps → Advanced settings → Developer mode.
  3. Open Settings → Connectors and click Create.
  4. Fill in the form: Name (anything), Description (one line about what the service does), MCP server URL (copy it below).
  5. Under Authentication choose OAuth if the service requires sign-in, otherwise None. Click Create.
  6. In a new chat open + → Apps/Connectors and enable the connector.

OpenAI has renamed this section before (Connectors → Apps/Plugins). If the label differs, search settings for "developer mode". On Business/Enterprise workspaces an admin must allow custom connectors first.

Authorization

On first use ChatGPT opens the service's sign-in window. Sign in and approve access.

How to connect WhoisXML API MCP Server to Cursor

The server address to paste into Cursor settings:

https://whoisxmlapi--dev-gbg4.run.tools

Fastest: click Open in Cursor below and confirm the prompt.

Manually:

  1. In Cursor open Settings → Cursor Settings → MCP and click Add new global MCP server.
  2. Paste the JSON copied below into ~/.cursor/mcp.json (per project: .cursor/mcp.json in the repo root).
  3. Save the file. The server appears in the MCP list; authorize it there if asked.

Authorization

If the service needs sign-in, an authorize button appears next to the server in the MCP list.

Server tool list (27)

Raw names from tools/list. Only developers need these.

bulk_dns_lookupRun DNS lookups for up to 200 domain names per call. Emulated bulk (no native upstream bulk endpoint): the server fans out single DNS lookups concurrently and returns a unified envelope. Each input consumes 1 credit. For larger jobs, split client-side.
bulk_email_verificationRun email verification for up to 10,000 emails per call. Native bulk (uses WhoisXML's Bulk Email Verification API). Each email consumes 1 credit. Returns inline if completes within 20s, otherwise returns a job_id to poll via bulk_job_status / bulk_job_results.
bulk_ip_geolocationRun IP geolocation lookups for up to 200 IP addresses per call. Emulated bulk (no native upstream bulk endpoint exists; the WhoisXML bulk-IP-geo product is CSV-only via web UI). The server fans out single IP geolocation lookups concurrently and returns a unified envelope. Each input consumes 1 credit. For larger jobs, split client-side.
bulk_job_resultsFetch full per-input results for a completed native bulk job (created by bulk_whois or bulk_email_verification). If the job is still in-flight, returns status=running with progress; caller should retry later. Note: per-input order may differ from the original input order — the polling helper uses upstream's order.
bulk_job_statusCheck progress of an in-flight bulk job created by bulk_whois or bulk_email_verification. Returns status (running|completed) and progress counters. Use bulk_job_results once status=completed.
bulk_subdomain_lookupDiscover subdomains for up to 200 domains per call. Emulated bulk (no native upstream bulk endpoint): the server fans out single subdomain lookups concurrently and returns a unified envelope. Reuses the in-memory cache of subdomain_lookup, so re-querying recently-fetched domains is free. Each input consumes 1 credit when uncached.
bulk_whoisRun WHOIS lookups for up to 10,000 domains per call. Native bulk (uses WhoisXML's Bulk WHOIS API). Each domain consumes 1 credit. Returns inline if completes within 20s, otherwise returns a job_id to poll via bulk_job_status / bulk_job_results.
categorizationClassify a URL or domain into IAB content categories, website groups, and content classifications. Returns category labels with confidence scores for content filtering and brand safety.
dns_historyGet historical DNS records for a domain (forward) or find domains associated with an IP (reverse).
dns_lookupPerform DNS record lookups for a domain. Supports A, AAAA, MX, NS, SOA, TXT, CNAME, PTR, SRV, CAA, DS, and DNSKEY record types, or "all" to retrieve every record type at once.
domain_and_subdomain_discoveryFind newly registered domains and subdomains containing search terms, returning registration dates. Supports wildcard (*) patterns for partial matching — without wildcards the search is exact. Multiple terms use AND logic; use separate API calls for OR logic.
domain_infoGet enriched WHOIS registration information for a domain. Combines current WHOIS data with historical records to fill missing or redacted fields. Works for active and expired domains.
email_verificationVerify an email address via syntax check, DNS MX lookup, and SMTP deliverability test. Also detects disposable/temporary addresses, role-based addresses (e.g. info@, noreply@), free email providers, and catch-all domains.
ip_netblocksLook up IP netblocks by IP address, ASN, or organization name. Returns CIDR ranges, ASN number and name, organization info, and registration/update dates for each matching netblock.
ipgeolocationGet location data for IP addresses, domains, or email addresses. Uses caller's IP if no address provided.
reverse_dnsFind DNS records matching search criteria. Returns domains and DNS record values. Multiple search terms are combined with AND logic - results must match ALL terms. Use separate API calls for OR logic. Must use wildcards in the "term" field for partial matches otherwise the search will be exact.
reverse_ipFind all domains sharing the same IP address and connection dates.
reverse_mxFind all services sharing the same MX server and connection dates.
reverse_nsFind all services sharing the same NS nameserver and connection dates.
reverse_whoisFind domains whose WHOIS records contain specific search terms. Supports wildcard searches with * and partial string matching. Multiple terms use AND logic — domains must match ALL terms. Use separate API calls for OR logic.
reverse_whois_advancedFind domains using advanced field-specific search on WHOIS records. Each search term targets a specific WHOIS field (e.g., RegistrantContact.Organization, DomainName, NameServers) with optional exact match and exclude flags. Up to 4 search terms combined with AND logic.
ssl_certificatesRetrieve TLS certificate details for a domain, including issuer, validity period (not-before/not-after), subject alternative names (SANs), and chain trust status. Optionally returns the full certificate chain.
subdomain_lookupDiscover all known subdomains of a domain, including first-seen and last-seen timestamps for each. Can return thousands of subdomains; use pagination to retrieve large result sets.
threat_intelligenceCheck if an IoC (domain, URL, IP, CIDR, or file hash) appears in known malware, phishing, spam, or botnet databases. Returns threat classification, severity, and source feed details.
typosquattingCheck whether a domain is part of a known typosquatting group, or expand all domains across all groups the queried domain belongs to. Use mode="probe" for a fast triage check (returns inGroup boolean + groupId). Use mode="group" for the heavy follow-up that returns every domain across all groups containing this domain — useful for understanding the full lookalike infrastructure.
whoisGet WHOIS data for a domain, returning registrar name, creation/expiry/updated dates, nameservers, domain status codes, and registrant/admin/tech contact info (when not redacted). Supports both WHOIS and RDAP protocols.
whois_historyGet the full timeline of WHOIS changes for a domain, showing ownership transfers, registrar changes, nameserver updates, and contact modifications over time. Supports pagination for domains with many historical records.