WhoisXML API MCP Server

Show how many credits this WhoisXML API account has left on each product, and which tools spend each product's credits. This call spends no credits. Use it before a large or bulk job to check that the account can cover it, or after a call fails for lack of credits. A product the account holds without a credit limit is marked unlimited instead of showing a number. Do NOT use this to look up domains, IP addresses or emails: it reads only the account's own balances.

Takes no parameters.

Find newly added, dropped, or updated domains whose names contain specified brand terms. Use this for typosquat detection, lookalike-domain detection, and brand-protection workflows. Do NOT use this for matching against WHOIS contact fields (use `registrant_alert`) or for general WHOIS-text matching (use `reverse_whois`). Set with_typos=true to automatically expand brand terms with common typo variants.

Run DNS lookups for up to 200 domains in a single call. Emulated bulk (no native upstream endpoint): the server fans out single lookups concurrently and returns a unified envelope, 1 credit per input. Use this whenever you have ≥2 domains and want concurrent execution under one rate-limit budget. For >200 inputs, split client-side. Do NOT use this for historical DNS records (use `dns_history`) or for a single domain (use `dns_lookup` directly).

Run email verification for up to 10,000 addresses in a single call. Native bulk via WhoisXML's Bulk Email Verification API; 1 credit per email. Returns inline if it completes within 20s, otherwise returns a `job_id` to poll via `bulk_job_status` / `bulk_job_results`. Use this for lead-list hygiene at any scale ≥2 emails. Do NOT use this for live polling of an in-flight job (use `bulk_job_status` for status, `bulk_job_results` to fetch completed rows) or for a single email (use `email_verification`).

Run IP geolocation for up to 200 IP addresses in a single call. Emulated bulk: the server fans out single lookups concurrently, 1 credit per input. Use this whenever you have ≥2 IPs to enrich. For >200 IPs, split client-side; WhoisXML's Bulk IP Geolocation API (not a tool on this server) runs asynchronous JSON jobs of up to 100,000 IPs. Do NOT use this for ASN/CIDR ownership lookups (use `ip_netblocks`) or for a single IP (use `ipgeolocation` directly).

Fetch full per-input results for a completed native bulk job (created by `bulk_whois` or `bulk_email_verification`). If the job is still in flight, returns `status=running` with progress; the caller should retry. Per-input order may differ from the original input order. Do NOT use this for emulated bulk tools (`bulk_dns_lookup`, `bulk_subdomain_lookup`, `bulk_ip_geolocation`); they always return inline.

Check progress of an in-flight bulk job created by `bulk_whois` or `bulk_email_verification`. Returns `running` or `completed` plus progress counters. Use this when a bulk call returned a `job_id` instead of inline results — poll until completed, then call `bulk_job_results`. Do NOT use this for emulated bulk tools (`bulk_dns_lookup`, `bulk_subdomain_lookup`, `bulk_ip_geolocation`); they always return inline.

Discover subdomains for up to 200 apex domains in a single call. Emulated bulk: fans out single subdomain lookups concurrently. Reuses the in-memory cache of `subdomain_lookup`, so re-querying recently-fetched domains is free; otherwise 10 Domain Research Suite credits per input. Use this for attack-surface mapping across an organisation's full apex-domain portfolio in one shot. Do NOT use this for domains or subdomains containing a search term (use `domain_and_subdomain_discovery`) or when you have a single apex (use `subdomain_lookup`).

Check up to 100 IP addresses in one call for VPN, proxy, Tor exit, relay, hosting or CDN membership, using the VPN & Proxy Detection API's native batch endpoint. Requires a Starter or higher VPN & Proxy Detection plan. Rows carry the same fields as `vpn_proxy_detection` under the same plan rules: confidence, seen times and residential-proxy network names need Pro or higher, null below, and a residential-proxy network is named only where its exit is attributed. Rejected inputs, such as reserved addresses, come back as ok=false rows with an error code. Data is IPv4-first; IPv6 mostly returns unknown. Duplicates are looked up once. Costs 1 VPN & Proxy Detection API credit per IP successfully looked up; rejected rows are not charged. Use this whenever you have 2 or more IPs; split lists longer than 100 client-side.

Run WHOIS lookups for up to 10,000 domains in a single call. Native bulk via WhoisXML's Bulk WHOIS API; 1 credit per domain. Returns inline if it completes within 20s, otherwise returns a `job_id` to poll via `bulk_job_status` / `bulk_job_results`. Use this whenever you have ≥2 domains to look up — looping `whois` is strictly worse on rate-limit budget. Do NOT use this for live polling of an in-flight job (use `bulk_job_status` for status, `bulk_job_results` to fetch completed rows).

Classify a domain into IAB Content Taxonomy v3.1 content categories (Website Categorization v4). Returns 1-3 ranked categories plus a primary_category shortcut, each with a string ID (e.g. "IAB-596"), a human-readable hierarchical path ("Shopping > Online Marketplace") with tier1..tier4 levels, and a confidence score; response metadata includes taxonomy_version, credits_charged, latency_ms, model, an abstain object (flags parked/dead/thin sites with no real business purpose), a source object (is_historical_fallback marks results served from historical data when the live crawl was blocked), and error. Use this for content filtering, brand-safety gating, or to understand what a flagged domain claims to be. Do NOT use this for malware/phishing reputation (use `threat_intelligence` or `domain_reputation`) or for WHOIS/DNS facts (use `whois` / `dns_lookup`); unlike the legacy v3 API the response carries no ASN or domain-age data (use `ip_netblocks` / `whois` for those).

Check whether an email address belongs to a disposable or temporary provider (e.g., mailinator, 10minutemail, guerrillamail). Returns a boolean verdict and the domain extracted from the address. Use this for lead-gen hygiene, signup-fraud filtering, or free-trial abuse detection when you only need the disposable verdict. Do NOT use this for full deliverability or mailbox-reachability checks — use `email_verification` instead.

Look up historical DNS records for a domain (forward) or domains historically associated with an IP (reverse). Use this when investigating infrastructure pivots, domain takeovers, or when a current `dns_lookup` returns sparse/expired data. Do NOT use this for current resolution (use `dns_lookup`) or for the live set of domains on an IP right now (use `reverse_ip`).

Resolve current DNS records for a domain — A, AAAA, MX, NS, SOA, TXT, CNAME, PTR, SRV, CAA, DS, DNSKEY, or `all`. Use this whenever you need today's authoritative answer for any record type. Do NOT use this for historical resolution data (use `dns_history`), to enumerate domains pointing at an IP (use `reverse_ip`), or to search records by pattern across the zone (use `reverse_dns`).

Search WhoisXMLAPI's domain and subdomain index for names containing one or more search terms. Returns matching names whatever their age, not only recent registrations; pass `since` to narrow to names first seen after a date. Wildcards (`*`) supported; multiple terms combine with AND, so one call covers one apex-plus-term pair. Use this to sweep for typosquats and brand-impersonation hosts, including lookalikes on shared platforms that are subdomains carrying no registration of their own. Returns one page of at most 10000 names: while "truncated_at_upstream_cap" is true, call again with the response's "next_page_token"; if no token is present, stop and narrow the terms, as the result may be incomplete and cannot be continued. "domainsCount" is this page's size, NOT a total. Do NOT use this to enumerate the existing subdomain tree of a known domain (use `subdomain_lookup`) or for typosquat verification on an already-known domain (use `typosquatting`).

Get an enriched WHOIS profile for a domain by combining the current record with historical records to fill redacted or missing fields. Use this when a plain `whois` call returns redacted contacts or sparse data and you still need registrant/admin details. Do NOT use this for the historical timeline itself (use `whois_history`) or for a quick first-pass lookup where the current record is sufficient (use `whois`).

Score a single domain's trustworthiness on a 0–100 scale by running live infrastructure and configuration checks (certificate validity, mail and name-server setup, malware-database and blackhole lookups, domain age, and more) and return the contributing test results with human-readable warnings. Use this to triage whether a flagged or unfamiliar domain is actually dangerous — for example after `typosquatting` or `brand_alert` surfaces a lookalike. Do NOT use it to look up a known-bad verdict from curated threat feeds (use `threat_intelligence`), to learn what a site claims to be (use `categorization`), or to fetch raw registration or zone records (those have their own dedicated lookup tools).

Verify an email address via syntax check, MX lookup, and SMTP deliverability probe. Also flags disposable, free-provider, and catch-all addresses. Use this for lead-list hygiene or to gate signup forms. Do NOT use this to look up the registrant email of a domain (use `whois`) or when you have a list of >1 email (use `bulk_email_verification`).

Look up CIDR ranges, ASN number/name, organisation, and each block's last-modified date for an IP address, ASN, or organisation name. Use this when investigating who owns a chunk of address space or what netblocks an organisation controls. Do NOT use this for point-in-time geolocation of a single IP (use `ipgeolocation`) or to enumerate domains on the IP (use `reverse_ip`).

Get geolocation data (country, region, city, ISP, ASN) for an IP address, domain, or email. Falls back to the caller's IP if no input is provided. Use this when assessing whether a connection or registration originates from an unexpected geography. Do NOT use this for IP netblock / ASN ownership queries (use `ip_netblocks`) or when you have many IPs to enrich (use `bulk_ip_geolocation`).

Find newly added, dropped, or updated domains whose WHOIS records match search terms in registrant contact fields (email, name, organisation, etc.). Use this for brand-impersonation monitoring and threat-actor infrastructure tracking. Do NOT use this for general WHOIS-text matching (use `reverse_whois`) or for domain-name string matching.

Search across DNS records by pattern and return matching domains plus the record values. Multiple search terms combine with AND — use separate calls for OR. Wildcards (`*`) are required for partial matches; otherwise the search is exact. Use this when sweeping the zone for SPF strings, TXT verification tokens, or arbitrary RDATA patterns. Do NOT use this when you already know the domain (use `dns_lookup`) or when the input is an IP (use `reverse_ip`).

Find every domain currently pointing at a given IP address, with first-/last-seen dates per domain. Use this when investigating shared hosting, malicious infrastructure pivots, or to enumerate co-tenants of a flagged IP. Do NOT use this to resolve a domain's IP (use `dns_lookup`) or to search DNS records by pattern (use `reverse_dns`).

Find every domain that uses a specific MX server, with first-/last-seen dates. Use this when sweeping for domains that share a phishing-friendly mail provider, or to map an organisation's mail-handling fleet. Do NOT use this for nameservers (use `reverse_ns`) or for hosting IPs (use `reverse_ip`).

Find every domain delegated to a specific authoritative nameserver, with first-/last-seen dates. Use this when an attacker uses a private NS infrastructure and you want to enumerate the rest of their fleet. Do NOT use this for MX servers (use `reverse_mx`) or hosting IPs (use `reverse_ip`).

Find every domain whose WHOIS record contains a given free-text search term (registrant name, email, organisation, address, etc.). Wildcards (`*`) and partial matches supported; multiple terms combine with AND. Use this when pivoting from a known registrant identity to other domains they own. Do NOT use this when you need a field-targeted query (use `reverse_whois_advanced`) or when you only have the domain (use `whois` / `whois_history`).

Find domains using field-specific WHOIS searches — e.g. `RegistrantContact.Organization`, `DomainName`, `NameServers`. Up to 4 search terms with optional exact-match and exclude flags, combined with AND. Use this when you need precision (search only the registrant org, not the full record). Do NOT use this for free-text searches (use `reverse_whois`) or when you have only the domain (use `whois`).

Retrieve TLS certificate details for a domain — issuer, validity period, subject alternative names (SANs), chain trust status. Optionally returns the full chain. Use this when investigating SAN-based pivots (other domains on the same cert), expired/self-signed cert posture, or CT-log evidence of recent issuance. Do NOT use this to enumerate subdomains directly (use `subdomain_lookup`); SANs are a side effect, not the primary signal.

Enumerate the known subdomains of a single domain, with first-/last-seen timestamps per subdomain. Use this for attack-surface mapping on a target organisation's apex domain. Can return tens of thousands of rows, so it is paginated: keep calling with "next_page_token" copied from the previous response for as long as "has_more" is true, and you will walk the whole set — including past the upstream's 10000-per-request cap. "total_count" counts the rows currently fetched, NOT the size of the whole result set: the upstream offers no total, so the only way to know it is to page to the end. Do NOT use this for searching domains or subdomains by name pattern (use `domain_and_subdomain_discovery`) or for processing many apex domains at once (use `bulk_subdomain_lookup`).

Check whether an indicator (domain, URL, IP, CIDR, or file hash) appears in known malware, phishing, spam, or botnet feeds. Returns `total` (all matching records, not capped by `limit`) and `results`, one record per match: `value` (the matched indicator), `iocType` (IPv4, IPv6, URL, domain, hash, or CIDR), `threatType` (attack, botnet, C&C, malware, phishing, spam, suspicious, tor, or generic), and `firstSeen`/`lastSeen` dates. An empty `results` list means no feed record matched, not that the indicator is safe. Use this on every suspicious indicator before deeper enrichment — it's the cheapest gate. Do NOT use this for content-category labels like "gambling" or "adult" (use `categorization`) or for typosquat detection (use `typosquatting`).

Check whether a domain belongs to a typosquatting group, or expand every domain across all groups containing it. It calls WhoisXML API's Bulk Registration Risk API, formerly the Typosquatting API, and checks one domain per call. Use `mode=probe` for a fast inGroup boolean + groupId triage. Use `mode=group` to enumerate the full lookalike infrastructure once a probe hits. Do NOT use this to find impersonation domains or subdomains by name pattern (use `domain_and_subdomain_discovery`) or for malware/phishing reputation (use `threat_intelligence`).

Check whether one IP address belongs to a known VPN, proxy (including residential and open proxies), Tor exit, relay, hosting or CDN network. Every plan returns classification (for example vpn, proxy, tor, hosting, cdn or unknown), risk_score (0-100), is_vpn / is_proxy / is_tor and related flags, ASN and reason codes. provider and netblock owner need Starter or higher; confidence, seen times and residential-proxy network names need Pro or higher, null below. A residential-proxy network is named only where its exit is attributed. Data is IPv4-first; IPv6 mostly returns unknown. Reserved and private addresses are rejected. Costs 1 VPN & Proxy Detection API credit per successful lookup. Use this to vet the IP behind a login, signup or API call. Do NOT use this for location data (use `ipgeolocation`) or for 2 or more IPs (use `bulk_vpn_proxy_detection`).

Capture a screenshot of a web page for a URL and return it as a native image content block, plus a small JSON summary with its MIME type, decoded byte size and chosen type. Choose the output format with the type parameter: "png" (default) or "jpg" for raster images, or "pdf" to render the page as a PDF. Optionally set the viewport width and height in pixels, and enable full-page capture to grab the entire scrollable page instead of just the visible viewport. Use this to obtain visual evidence of how a site actually looks — for example to document a suspicious, phishing, or typosquatting page surfaced by another tool. Do NOT use it to read a page's text, fetch DNS or WHOIS records, or classify the site, since those have their own tools.

Look up current WHOIS / RDAP registration data for a single domain — registrar, creation/expiry/updated dates, nameservers, status codes, and contact info when not redacted. Use this as the first move when triaging an unknown or suspicious domain. Do NOT use this when you need historical ownership changes (use `whois_history`) or when you have many domains in a list (use `bulk_whois`).

Retrieve the full timeline of WHOIS changes for a domain — ownership transfers, registrar moves, nameserver swaps, and contact edits over time. By default it returns only the number of records, for 1 credit instead of 50; pass `preview_mode: false` to return the records. Use this when investigating attribution, domain age, or whether a domain recently changed hands (a common phishing precursor). Do NOT use this for current registration only (use `whois`) or for enriched-but-current data (use `domain_info`).