{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-04", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "tool": { "slug": "whoisxml-api", "name": "WhoisXML API", "vendor": "Whois API, Inc.", "vendorUrl": "https://www.whoisxmlapi.com", "kind": "http-api", "category": "security-intelligence", "summary": "WhoisXML API is a set of domain, DNS, IP and threat intelligence APIs from Whois API, Inc. Its WHOIS API returns parsed registration records for a domain or address, and a hosted MCP server bundles 35 tools on one balance.", "url": "https://www.anchorterminal.com/tools/whoisxml-api", "markdownUrl": "https://www.anchorterminal.com/tools/whoisxml-api.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/whoisxml-api.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/whoisxml-api.json", "dns": "whoisxml-api.grade.anchorterminal.com", "transports": [ "streamable-http", "stdio" ], "remoteUrl": "https://mcp-hosted.whoisxmlapi.com/mcp", "packages": [ { "registry": "npm", "name": "@whoisxmlapidotcom/mcp-whoisxmlapi" } ], "auth": "mixed", "authNotes": "API key from the account after a browser signup, sent as an `apiKey` query parameter (which takes priority) or as `Authorization: Bearer`, which also accepts a server-to-server OAuth token. An IP allowlist can be set (403 AUTHENTICATE_10). The hosted MCP server uses OAuth, taking the API key once in the connect flow; local installs take the key as an environment variable.", "pricing": "freemium", "pricingNotes": "500 free WHOIS API credits on signup with no card. A WHOIS lookup costs 1 credit, 5 with a forced real-time refresh. WXA.ONE universal credit pools, one balance across the APIs and the MCP server, start from $129 a month, monthly or yearly; per-credit rates sit behind a calculator and were not read. Enterprise packages and premium support by sales. Credits expire after 12 months and orders are non-refundable under the terms.", "priceSummary": "$129 / mo", "where": "both", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the WHOIS API docs, the pricing pages, the terms or the MCP server docs (checked 2026-11-03). An exhausted balance answers 401 AUTHENTICATE_05.", "endpoints": [] }, "toolCount": 35, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-03" }, "docsUrl": "https://whois.whoisxmlapi.com/documentation/making-requests", "llmsTxt": "https://www.whoisxmlapi.com/llms.txt", "registryName": "io.github.whois-api-llc/mcp-whoisxmlapi", "capabilities": [ "secintel.dns", "secintel.reputation", "secintel.ip-enrichment", "secintel.indicators" ], "tags": [ "hosted", "freemium", "no-card", "free-tier", "api-key", "oauth", "mcp", "remote-mcp", "official", "mcp-registry", "llms-txt", "status-page", "prepaid", "typescript", "python", "go", "docker", "closed-source" ], "lastRelease": "2026-11-03", "graded": true, "anchor": { "graded": true, "score": 56.8, "grade": "C", "agentReady": false, "rank": 771, "ranked": true, "rankOf": 1349, "categoryRank": 5, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 65, "maintenance": 76, "payments": 25, "reliability": 65, "schema": 70, "security": 39, "transparency": 60 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 65, "points": 13, "reason": "Read with the hosted lines. The vendor's own Service Status and Data Releases page is linked from the docs and describes a per-API JSON status file with four levels (20). It shows no incident history and the status file's live values could not be read, so no 90-day record (5). The docs give 200 requests a second with rejection until the next second; the terms give 50 a second, 20 concurrent and 5 concurrent bulk requests, so numbers are published even though they disagree (15). A 429 AUTHENTICATE_06 carries Retry-After and every response X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, with guidance to slow before zero; all calls are reads (15). No SLA; the terms guarantee no minimum uptime and cite a historical 99.9 per cent, with enterprise SLAs by separate agreement (0). The API is generally available (10). 20 + 5 + 15 + 15 + 0 + 10 = 65.", "checked": "2026-11-03" }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 70, "points": 11.38, "reason": "The surface graded is the WHOIS API, with the hosted MCP server noted. No OpenAPI document. JSON Schema draft-07 and XSD files define the WHOIS record, the DomainInfo response and the error body, and a Postman collection is published (15 of 25). llms.txt on www.whoisxmlapi.com lists the APIs, databases and feeds (10). The making-requests page states each parameter's purpose, default and credit cost, lists deprecated parameters that are still accepted, and says when RDAP applies, with little on when not to call (15 of 20). rdap, outputFormat and the cache flags have enumerated values and the record schema is typed, but unknown parameters are ignored silently and the output page gives no types in prose (11 of 15). Request examples, example records and an error table with HTTP status, errorCode and message (12 of 15). No API version and no changelog for the API; press releases summarise product updates yearly, the newest dated 9 May 2025, and the MCP server's versions are dated in the registry (7 of 15). 15 + 10 + 15 + 11 + 12 + 7 = 70.", "checked": "2026-11-03" }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 65, "points": 10.56, "reason": "ignoreRawTexts drops the raw text fields, cmd=GET_DN_AVAILABILITY returns a two-field record, and the MCP server's reverse_whois defaults to a count-only mode; the MCP server lists 35 tools, more than 30, with a tool_search for deferred loading over stdio only (17 of 25). The WHOIS API returns one record per call with no pagination; bulk variants take up to 10,000 domains as jobs with status and results tools (8 of 20). Errors carry a code and a message an agent can branch on, though WHOIS_01 names both a validation error on HTTP 200 and an internal error on 500 (14 of 20). Every call is a read, and the cache flags make a repeat cheap, but a retry with _hardRefresh costs 5 credits each time and no annotations were found on the MCP tools (14 of 20). One required parameter, sensible defaults, and official Python and Go client libraries in the vendor's GitHub organisation, last pushed in 2023 (12 of 15). 17 + 8 + 14 + 14 + 12 = 65.", "checked": "2026-11-03" }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 39, "points": 6.83, "reason": "An API key with no scopes found, accepted as an apiKey query parameter that overrides the Authorization header, or as a Bearer token including a server-to-server OAuth token; an IP allowlist can be set on the account (20 less 10 for the query string, plus 4 for OAuth and the allowlist, so 14). Every call is a read and the MCP server has no write tools, but there is no read-only or restricted key (12 of 20). Records include raw registrar text from third parties with no guidance on treating it as untrusted (5 of 15). The MCP server's account_balance tool reports credits per product and the account page shows usage, with no per-call log documented (5 of 15). security.txt returns 404, no disclosure policy, bug bounty or certification was found, and the payment page names only a PCI-compliant card processor (3 of 20). 14 + 12 + 5 + 5 + 3 = 39.", "checked": "2026-11-03" }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 25, "points": 3.13, "reason": "No x402, MPP or L402 (0). The only public price is from $129 a month for a universal credit pool; per-credit rates are behind a calculator whose output was not read and enterprise packages are by sales (5 of 20). 500 free WHOIS credits on signup with no card (20). The key comes from the account after a browser signup and no key API was found (0). 0 + 5 + 20 + 0 = 25.", "checked": "2026-11-03" }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 76, "points": 6.65, "reason": "Read as a closed service with an official MCP server. MCP server 1.13.0 was published in the official registry on 3 November 2026 and the ProfessionalServices and ipgeo-community repositories were pushed the same day (30). 1.8.6 on 8 September through 1.13.0 on 3 November 2026 is nine registry versions in 90 days (20). Product updates are summarised in yearly press releases, the newest 9 May 2025, support is a contact form with tiered response times sold separately, and the client library repositories were last pushed in 2023 (8 of 15). The MCP server is in the official registry under io.github.whois-api-llc, and official Python and Go clients exist (15). The MCP server's source was not found on GitHub, and the SDK repositories show no activity since 2023 (3 of 10). 30 + 20 + 8 + 15 + 3 = 76.", "checked": "2026-11-03" }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 60, "points": 5.25, "note": "editorial 31, provenance 89", "reason": "A closed service with clear terms naming Whois API, Inc. and California law, though they confine data to one site, bar sharing it and forbid AI training on it (15 of 30). The privacy policy was last modified on 6 April 2020, cites the Privacy Shield frameworks, keeps data as long as there is a reasonable basis, and names no DPA (6 of 30). Deprecated parameters are listed and still accepted, with no notice periods or policy (8 of 20). No subprocessors or data locations are named (2 of 20). 15 + 6 + 8 + 2 = 31.", "checked": "2026-11-03" } ], "assessment": { "date": "2026-11-03", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "ignoreRawTexts drops the raw text fields, cmd=GET_DN_AVAILABILITY returns a two-field record, and the MCP server's reverse_whois defaults to a count-only mode; the MCP server lists 35 tools, more than 30, with a tool_search for deferred loading over stdio only (17 of 25). The WHOIS API returns one record per call with no pagination; bulk variants take up to 10,000 domains as jobs with status and results tools (8 of 20). Errors carry a code and a message an agent can branch on, though WHOIS_01 names both a validation error on HTTP 200 and an internal error on 500 (14 of 20). Every call is a read, and the cache flags make a repeat cheap, but a retry with _hardRefresh costs 5 credits each time and no annotations were found on the MCP tools (14 of 20). One required parameter, sensible defaults, and official Python and Go client libraries in the vendor's GitHub organisation, last pushed in 2023 (12 of 15). 17 + 8 + 14 + 14 + 12 = 65.", "maintenance": "Read as a closed service with an official MCP server. MCP server 1.13.0 was published in the official registry on 3 November 2026 and the ProfessionalServices and ipgeo-community repositories were pushed the same day (30). 1.8.6 on 8 September through 1.13.0 on 3 November 2026 is nine registry versions in 90 days (20). Product updates are summarised in yearly press releases, the newest 9 May 2025, support is a contact form with tiered response times sold separately, and the client library repositories were last pushed in 2023 (8 of 15). The MCP server is in the official registry under io.github.whois-api-llc, and official Python and Go clients exist (15). The MCP server's source was not found on GitHub, and the SDK repositories show no activity since 2023 (3 of 10). 30 + 20 + 8 + 15 + 3 = 76.", "payments": "No x402, MPP or L402 (0). The only public price is from $129 a month for a universal credit pool; per-credit rates are behind a calculator whose output was not read and enterprise packages are by sales (5 of 20). 500 free WHOIS credits on signup with no card (20). The key comes from the account after a browser signup and no key API was found (0). 0 + 5 + 20 + 0 = 25.", "reliability": "Read with the hosted lines. The vendor's own Service Status and Data Releases page is linked from the docs and describes a per-API JSON status file with four levels (20). It shows no incident history and the status file's live values could not be read, so no 90-day record (5). The docs give 200 requests a second with rejection until the next second; the terms give 50 a second, 20 concurrent and 5 concurrent bulk requests, so numbers are published even though they disagree (15). A 429 AUTHENTICATE_06 carries Retry-After and every response X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, with guidance to slow before zero; all calls are reads (15). No SLA; the terms guarantee no minimum uptime and cite a historical 99.9 per cent, with enterprise SLAs by separate agreement (0). The API is generally available (10). 20 + 5 + 15 + 15 + 0 + 10 = 65.", "schema": "The surface graded is the WHOIS API, with the hosted MCP server noted. No OpenAPI document. JSON Schema draft-07 and XSD files define the WHOIS record, the DomainInfo response and the error body, and a Postman collection is published (15 of 25). llms.txt on www.whoisxmlapi.com lists the APIs, databases and feeds (10). The making-requests page states each parameter's purpose, default and credit cost, lists deprecated parameters that are still accepted, and says when RDAP applies, with little on when not to call (15 of 20). rdap, outputFormat and the cache flags have enumerated values and the record schema is typed, but unknown parameters are ignored silently and the output page gives no types in prose (11 of 15). Request examples, example records and an error table with HTTP status, errorCode and message (12 of 15). No API version and no changelog for the API; press releases summarise product updates yearly, the newest dated 9 May 2025, and the MCP server's versions are dated in the registry (7 of 15). 15 + 10 + 15 + 11 + 12 + 7 = 70.", "security": "An API key with no scopes found, accepted as an apiKey query parameter that overrides the Authorization header, or as a Bearer token including a server-to-server OAuth token; an IP allowlist can be set on the account (20 less 10 for the query string, plus 4 for OAuth and the allowlist, so 14). Every call is a read and the MCP server has no write tools, but there is no read-only or restricted key (12 of 20). Records include raw registrar text from third parties with no guidance on treating it as untrusted (5 of 15). The MCP server's account_balance tool reports credits per product and the account page shows usage, with no per-call log documented (5 of 15). security.txt returns 404, no disclosure policy, bug bounty or certification was found, and the payment page names only a PCI-compliant card processor (3 of 20). 14 + 12 + 5 + 5 + 3 = 39.", "transparency": "A closed service with clear terms naming Whois API, Inc. and California law, though they confine data to one site, bar sharing it and forbid AI training on it (15 of 30). The privacy policy was last modified on 6 April 2020, cites the Privacy Shield frameworks, keeps data as long as there is a reasonable basis, and names no DPA (6 of 30). Deprecated parameters are listed and still accepted, with no notice periods or policy (8 of 20). No subprocessors or data locations are named (2 of 20). 15 + 6 + 8 + 2 = 31." }, "sources": [ { "what": "WHOIS API making requests (parameters, credits, auth)", "url": "https://whois.whoisxmlapi.com/api/documentation/making-requests", "seen": "2026-11-03" }, { "what": "usage limits and throttling", "url": "https://whois.whoisxmlapi.com/documentation/limits", "seen": "2026-11-03" }, { "what": "error handling", "url": "https://whois.whoisxmlapi.com/documentation/error-handling", "seen": "2026-11-03" }, { "what": "output schema, JSON Schema and XSD links", "url": "https://whois.whoisxmlapi.com/documentation/output", "seen": "2026-11-03" }, { "what": "WHOIS API product page (free credits, links)", "url": "https://whois.whoisxmlapi.com/", "seen": "2026-11-03" }, { "what": "pricing page (JS-rendered, only the $129 figure readable)", "url": "https://whois.whoisxmlapi.com/pricing", "seen": "2026-11-03" }, { "what": "WXA.ONE universal credits pricing", "url": "https://main.whoisxmlapi.com/wxa-one/pricing", "seen": "2026-11-03" }, { "what": "terms of service", "url": "https://main.whoisxmlapi.com/terms-of-service", "seen": "2026-11-03" }, { "what": "privacy policy", "url": "https://main.whoisxmlapi.com/privacy-policy", "seen": "2026-11-03" }, { "what": "payment security and policy", "url": "https://main.whoisxmlapi.com/payment-security-and-policy", "seen": "2026-11-03" }, { "what": "service status and data releases", "url": "https://main.whoisxmlapi.com/api-status", "seen": "2026-11-03" }, { "what": "company page", "url": "https://main.whoisxmlapi.com/company", "seen": "2026-11-03" }, { "what": "press releases", "url": "https://main.whoisxmlapi.com/press-release", "seen": "2026-11-03" }, { "what": "support services", "url": "https://main.whoisxmlapi.com/support-services", "seen": "2026-11-03" }, { "what": "MCP server page", "url": "https://main.whoisxmlapi.com/ai/mcp-server", "seen": "2026-11-03" }, { "what": "MCP server docs", "url": "https://mcp.whoisxmlapi.com/", "seen": "2026-11-03" }, { "what": "MCP tools reference", "url": "https://mcp.whoisxmlapi.com/tools.html", "seen": "2026-11-03" }, { "what": "MCP registry search", "url": "https://registry.modelcontextprotocol.io/v0/servers?search=whoisxmlapi", "seen": "2026-11-03" }, { "what": "GitHub organisation repositories", "url": "https://api.github.com/orgs/whois-api-llc/repos", "seen": "2026-11-03" }, { "what": "llms.txt", "url": "https://www.whoisxmlapi.com/llms.txt", "seen": "2026-11-03" }, { "what": "security.txt (404)", "url": "https://main.whoisxmlapi.com/.well-known/security.txt", "seen": "2026-11-03" }, { "what": "robots.txt", "url": "https://whois.whoisxmlapi.com/robots.txt", "seen": "2026-11-03" }, { "what": "RDAP for whoisxmlapi.com", "url": "https://rdap.verisign.com/com/v1/domain/whoisxmlapi.com", "seen": "2026-11-03" } ], "openQuestions": [ "unchecked: the per-credit rates and plan sizes on whois.whoisxmlapi.com/pricing and the WXA.ONE calculator, which render by script; payments scores the $129 starting price as plan-only pricing", "unchecked: the live values of the status JSON file and the data release feeds, whose URLs the status page describes but does not expose in its text", "unchecked: the MCP server's tool annotations, licence and source; GitHub answered 403 for the repository named in the registry and no source repository was found in the whois-api-llc organisation", "Which rate limit applies, 200 requests a second per the docs or 50 per the terms of 3 March 2025", "Who runs the company; no first-hand page names an officer. The company page names Whois API, Inc. and the Inc. 5000 listing since 2016", "firstReleased is the domain registration date, 20 March 2009; the company page says 15 years of data crawling and its copyright runs from 2010", "The terms forbid unauthorised data mining and obtaining materials by means not intentionally made available; public pages were read for this listing and the clause is recorded as a fact" ] }, "negative": 0, "verdict": "500 free credits with no card, JSON Schema and XSD for every response, 429s with Retry-After, cache controls that set the price per lookup, and a 35-tool hosted MCP server with OAuth. Per-credit prices sit behind a calculator, the terms confine data to one site and forbid AI training on it, and the key is accepted in the query string.", "bestFor": "An agent investigating a domain's registration, history, DNS, certificates or related domains at scale, on a prepaid credit pool.", "strengths": [ "500 free WHOIS credits on signup with no card, and 1 credit a lookup from cache or 5 for a forced refresh", "JSON Schema and XSD documents for the record, availability and error responses, with an error code table and Retry-After on 429", "Each record carries audit.createdDate and audit.updatedDate, so an agent can tell when the copy was collected", "Official MCP server with 35 tools, hosted with OAuth, in the official MCP registry with 21 versions since May 2026", "llms.txt on whoisxmlapi.com lists the APIs, feeds and databases" ], "weaknesses": [ "Per-credit prices are not published outside a calculator; the only public figure is from $129 a month, and orders are non-refundable", "The terms license data for one site, bar sharing it with third parties and forbid AI model training on it without written authorisation", "The docs say 200 requests a second while the terms say 50, 20 concurrent and 5 concurrent bulk", "The key is accepted as a query parameter that overrides the header, no scopes were found, and security.txt returns 404", "The privacy policy was last modified on 6 April 2020, cites Privacy Shield, and names no processors, locations or retention periods", "No OpenAPI document, no API version, and the MCP server's source was not found" ], "agentNotes": [ "Send the key as `Authorization: Bearer` and `outputFormat=JSON`; the default output is XML and an `apiKey` query parameter overrides the header", "Leave the cache flags alone for 1 credit a lookup; `_hardRefresh=1` costs 5 credits, and `_dbOnly=1` returns WHOIS_03 when nothing is cached", "Read `audit.updatedDate` before trusting a record, and check `dataError` for MASKED_WHOIS_DATA or PARTIAL_DATA", "Watch `X-RateLimit-Remaining` and on 429 AUTHENTICATE_06 wait for `Retry-After`; a 401 AUTHENTICATE_05 means the balance is spent, so stop", "Keep results inside the customer's own systems; the terms forbid passing data to third parties or using it to train models" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 56.8 } ], "editorialScores": { "ergonomics": 65, "maintenance": 76, "payments": 25, "reliability": 65, "schema": 70, "security": 39, "transparency": 31 }, "provenanceScore": 89, "checked": { "categories": { "ergonomics": "2026-11-03", "maintenance": "2026-11-03", "payments": "2026-11-03", "reliability": "2026-11-03", "schema": "2026-11-03", "security": "2026-11-03", "transparency": "2026-11-03" }, "last": "2026-11-03", "oldest": "2026-11-03", "stale": false, "staleAfterDays": 90 }, "scoreHistory": [ { "date": "2026-11-03", "grade": "C", "kind": "listed", "method": "0.7", "score": 56.8 } ] }, "connect": { "install": "npx @whoisxmlapidotcom/mcp-whoisxmlapi --help", "http": "curl -H \"Authorization: Bearer $WHOISXML_API_KEY\" \"https://www.whoisxmlapi.com/whoisserver/WhoisService?domainName=example.com\u0026outputFormat=JSON\"", "claudeCode": "claude mcp add --transport http whoisxmlapi https://mcp-hosted.whoisxmlapi.com/mcp", "config": { "mcpServers": { "whoisxmlapi": { "url": "https://mcp-hosted.whoisxmlapi.com/mcp" } } } }, "letme": { "capability": "https://letme.dev/secintel.dns", "tool": "https://letme.dev/whoisxml-api" }, "notable": [ "The WHOIS API is one GET or POST endpoint at whoisxmlapi.com/whoisserver/WhoisService with JSON or XML output, cache controls (maxCacheAgeHours, preferFresh, _hardRefresh, _dbOnly), RDAP fallback and a compact availability mode; responses carry audit.createdDate and audit.updatedDate for when the record was collected (https://whois.whoisxmlapi.com/api/documentation/making-requests)", "JSON Schema (draft-07) and XSD files define the WHOIS record, the DomainInfo response and the error body; errors use errorCode and msg, with 429 AUTHENTICATE_06 carrying Retry-After and X-RateLimit headers (https://whois.whoisxmlapi.com/documentation/output)", "The docs set the rate at 200 requests a second, while the terms of 3 March 2025 set 50 requests a second, 20 concurrent requests and 5 concurrent bulk requests across all of a customer's applications (https://whois.whoisxmlapi.com/documentation/limits)", "The terms license data for internal use at one site, bar distributing data or derivatives to third parties, require deletion on termination, and forbid using the data to train, test or develop AI models without written authorisation (https://main.whoisxmlapi.com/terms-of-service)", "The official MCP server io.github.whois-api-llc/mcp-whoisxmlapi reached 1.13.0 on 3 November 2026 with 35 tools, hosted with OAuth at mcp-hosted.whoisxmlapi.com and installable from npm or Docker; its source was not found on GitHub (https://mcp.whoisxmlapi.com/)", "A Service Status and Data Releases page describes a JSON status file with four status levels and announce.json and announce.rss feeds, but shows no incident history (https://main.whoisxmlapi.com/api-status)", "The privacy policy was last modified on 6 April 2020 and still cites the EU-US and Swiss-US Privacy Shield frameworks (https://main.whoisxmlapi.com/privacy-policy)" ], "area": "developer", "details": [ { "label": "Surface listed", "value": "The WHOIS API at whoisxmlapi.com/whoisserver/WhoisService, read from whois.whoisxmlapi.com (docs, limits, errors, output), main.whoisxmlapi.com (terms, privacy, company, status, pricing, MCP page, press releases, support), mcp.whoisxmlapi.com, the MCP registry and the whois-api-llc GitHub organisation on 3 November 2026. The hosted MCP server is noted. No account was made and no call was sent" }, { "label": "Other APIs", "value": "WHOIS History, Domain Info, DNS Lookup, DNS Chronicle, Reverse DNS, Reverse WHOIS, SSL Certificates, IP Geolocation, IP Netblocks, Threat Intelligence, Domain Reputation, Email Verification, Website Categorization, Subdomains, Brand and Registrant Alert, Typosquatting, plus bulk variants and data feeds. Each has its own docs and credit price" }, { "label": "Credits", "value": "WHOIS 1 credit from cache (48 hours or older by default), 5 for a refresh. Per the MCP tools page, domain reputation 1 or 3, typosquatting 1 or 5, subdomains 10, threat intelligence 1 per 100 records, bulk tools 1 per item. Credits expire after 12 months" }, { "label": "Rate limits", "value": "200 requests a second per the docs, with X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset and Retry-After on 429. The terms set 50 a second, 20 concurrent and 5 concurrent bulk requests. A dedicated endpoint is sold for more" }, { "label": "Errors", "value": "ErrorMessage with errorCode and msg. WHOIS_01 validation error (HTTP 200) and internal error (500 or 503), WHOIS_02 unknown user (401), WHOIS_03 no record (200), AUTHENTICATE_04 missing key, AUTHENTICATE_05 no credits, AUTHENTICATE_06 rate limit (429), AUTHENTICATE_10 IP not allowed (403). Unknown parameters are ignored" }, { "label": "MCP server", "value": "35 tools in 1.13.0, covering WHOIS, history, reverse lookups, DNS, IP geolocation, netblocks, email verification, categorisation, SSL, threat intelligence, domain reputation, VPN detection, screenshots, account balance, a tool_search for deferred loading over stdio and native bulk jobs. Streamable HTTP hosted with OAuth, or stdio from npm, Docker or a binary. No annotations, licence or source found" }, { "label": "Service status", "value": "api-status page with a JSON status file (0 passed, 1 partial outage, 2 data issues, 3 major outage) and data release feeds. No incident history shown. The terms guarantee no minimum uptime and cite a historical 99.9 per cent" }, { "label": "Support", "value": "Contact form on all plans. Bronze, Silver, Gold and Platinum support tiers with severity-1 responses from 12 hours to 6 hours, priced on request. English only" } ], "unitPrices": [ { "item": "WXA.ONE universal credit pool, smallest plan", "unit": "month", "usd": 129, "note": "from $129 a month; credits included and per-credit rates were not read" } ], "provenance": { "legalEntity": "Whois API, Inc.", "domain": "whoisxmlapi.com", "domainRegistered": "2009-03-20", "endpointOnVendorDomain": true, "terms": "https://main.whoisxmlapi.com/terms-of-service", "privacy": "https://main.whoisxmlapi.com/privacy-policy", "statusPage": "https://main.whoisxmlapi.com/api-status", "changelog": "https://main.whoisxmlapi.com/press-release", "securityTxt": "none", "checked": "2026-11-03", "notes": [ "The terms of service, last updated 3 March 2025 and effective 3 May 2025, name Whois API, Inc. under California law with AAA arbitration. The company page's copyright line reads 2010 to 2026 Whois API, Inc. No postal address was found on the terms, privacy policy or company page.", "The terms forbid unauthorised data mining and obtaining materials through means not intentionally made available, and set a rate limit of 50 requests a second. Public pages were read for this listing and the clauses are recorded as facts.", "whois.whoisxmlapi.com/robots.txt allows all paths for general crawlers and blocks five named bots. www.whoisxmlapi.com/robots.txt disallows blog admin paths and /BulkWhoisLookup/, none fetched. www.whoisxmlapi.com/terms-of-service redirects to a 404; the terms live at main.whoisxmlapi.com.", "The status page is the vendor's own Service Status and Data Releases page, which describes a JSON status file and feeds but lists no incidents.", "The changelog link is the press release page, whose newest product update is dated 9 May 2025. MCP server versions are dated in the official MCP registry.", "main.whoisxmlapi.com/.well-known/security.txt returns 404. RDAP at Verisign gives a registration date of 20 March 2009." ], "score": 89, "checks": [ { "check": "Legal entity named", "value": "Whois API, Inc.", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "whoisxmlapi.com, registered 2009-03-20 (17 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "mcp-hosted.whoisxmlapi.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 6 of the 7 things a reader expects", "points": 9.1, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 7 of the 8 things a reader expects", "points": 9.3, "max": 10, "state": "part" }, { "check": "Status page", "value": "main.whoisxmlapi.com/api-status", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "People named", "value": "not researched yet", "points": 0, "max": 0, "state": "na" }, { "check": "Support route", "value": "help pages", "points": 5, "max": 5, "state": "ok" } ], "policies": [ { "kind": "terms", "url": "https://main.whoisxmlapi.com/terms-of-service", "state": "read", "readAt": "2026-11-03", "statedDate": "2025-03-03", "words": 7383, "points": 9.1, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last updated on March 3, 2025, with any changes taking effect on May 3, 2025.", "says": "Last updated 2025-03-03" }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "This Agreement shall be governed by the laws of the State of California, without reference to its conflict of laws provisions.", "says": "The law of the State of California" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "Notwithstanding the foregoing, Whois API’s total cumulative liability to Customer for all claims arising under or related to this Agreement or the Services shall not exceed the amount paid by Customer to Whois API for the Services in the three (3) months immediately preceding the event giving rise to the claim..", "says": "Capped at the fees paid in the 3 months before the claim" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "Whois API may suspend any pending Purchase Order Forms or services if the Customer fails to meet payment obligations or other reasonable credit requirements." }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": false }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "The Customer shall not use the Data, Services, or any Whois API Properties in any manner not expressly allowed." }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": true, "quote": "The Service uptime has historically been 99.9% year over year, and the uptime target continues to be to exceed 99.9%.", "says": "Names 99.9% availability" } ], "toKnow": [ { "key": "terms.cutoff", "label": "Says access can be ended without notice or for any reason", "found": true, "quote": "…any License and Use Exhibit or Purchase Order Form to the contrary, Whois API reserves the right to terminate this Agreement (and/or Customer’s account) or discontinue the Services or any portion or feature thereof at any time and for any reason at its sole discretion with a pro-rata refund of any prepaid fees for Ser…" }, { "key": "terms.arbitration", "label": "Requires arbitration or waives class actions", "found": true, "quote": "Any dispute or controversy arising under or in connection with this Agreement shall be settled by binding arbitration, conducted in accordance with the commercial rules of the American Arbitration Association then in effect." } ], "notes": [ { "date": "2026-11-03", "text": "The customer may not use the Data or Parsed Data for AI model training, testing or development without written authorisation from Whois API.", "quote": "Customer and its affiliates shall not use, or permit any third party to use, the Data or Parsed Data (including derivatives) for the purpose of AI model training, testing, or development without receiving express, written authorization from Whois API." }, { "date": "2026-11-03", "text": "Data obtained through the Services is for the customer's internal use only and may not be distributed to any third party, including portions or derivatives, without a separate licence exhibit.", "quote": "the data obtained via the Services are provided solely for Customer’s internal use, and Customer shall not distribute or otherwise make available the Data to any third party, including but not limited to portions and/or derivatives thereof." }, { "date": "2026-11-03", "text": "Where Whois API processes personal data on the customer's behalf, the customer grants it an irrevocable, perpetual, worldwide, transferable and sublicensable licence to that personal data.", "quote": "Customer hereby grants to Whois API during the term of the Agreement, an irrevocable, perpetual, nonexclusive, royalty-free, and fully paid, worldwide, transferable, sublicensable license to the personal data." } ] }, { "kind": "privacy", "url": "https://main.whoisxmlapi.com/privacy-policy", "state": "read", "readAt": "2026-11-03", "statedDate": "2020-04-06", "words": 2918, "points": 9.3, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "This policy was last modified on Apr. 6, 2020.", "says": "Last updated 2020-04-06" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "This privacy policy (“Privacy Policy”) explains what personal data we collect from you and how we use it." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "We will keep personal information you provide as long as there is a reasonable basis to do so, whether to enforce any relevant law, the provisions of any agreement, to resolve any past, current, or future dispute, or any other business, tax, or legal purpose." }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "We may share personal information with third-parties when necessary to provide the Services (such as to our vendors or to other users to enable transactions between users), when we have a good faith belief it is necessary by law or to respond to legal process, to protect the safety and lives of people, to protect the…" }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "We will never sell personal information to third-parties for advertising or marketing purposes.", "says": "Says it does not sell personal data" }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "This Privacy Policy is subject to GDPR compliance requirements that may apply to you to the extent that you have customers that reside in the EU, or otherwise handle or otherwise have access to Personal Data (as that term is defined in Regulation (EU) 2016/679, generally known as the General Data Protection Regulation…" }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "You may request correction of any personal information that is incorrect by contacting us at [email protected].", "says": "Gives an email address, hidden from our reader by the page" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": false } ], "toKnow": [ { "key": "old", "label": "Has not been updated for three years or more", "found": true, "quote": "This policy was last modified on Apr. 6, 2020." } ], "notes": [ { "date": "2026-11-03", "text": "Requesting deletion of personal information releases WHOIS API from any liability, obligation or claim relating to that information.", "quote": "However, you acknowledge and agree that doing so shall relieve and release WHOIS API from any liability, obligation, claim, or other damages related to or arising from said personal information." } ] } ] }, "humans": { "slug": "whoisxml-api", "checked": "2026-11-03", "company": "Whois API, Inc.", "peopleNote": "No person is named on any first-hand page read. The company page describes the team as seasoned big data and infosec professionals, the terms name Whois API, Inc. under California law, and the press release page lists product updates with no bylines. The about-us link in the site navigation points to a placeholder and main.whoisxmlapi.com/about-us returns 404. Outside pages (a conference speaker profile and a trade press author page) call Jonathan Zhang founder and CEO, but no vendor page confirms it, so he is not listed. Investors were looked for on the company page, the press release page (eight releases from 2021 to 2025, none about funding), the terms and privacy policy and one outside search; nothing names a round or an investor.", "companySocial": { "linkedin": "https://www.linkedin.com/company/whois-api-llc/", "x": "https://x.com/whoisxmlapi", "github": "https://github.com/whois-api-llc" }, "support": { "urls": [ "https://main.whoisxmlapi.com/support-services", "https://main.whoisxmlapi.com/contact-us", "https://main.whoisxmlapi.com/knowledge-base" ], "contactUrls": [ "https://main.whoisxmlapi.com/contact-us" ] }, "sources": [ "https://main.whoisxmlapi.com/company", "https://main.whoisxmlapi.com/terms-of-service", "https://main.whoisxmlapi.com/privacy-policy", "https://main.whoisxmlapi.com/press-release", "https://main.whoisxmlapi.com/support-services", "https://main.whoisxmlapi.com/", "https://api.github.com/orgs/whois-api-llc/repos" ], "ownership": { "status": "private", "checked": "2026-11-03", "sources": [ "https://main.whoisxmlapi.com/terms-of-service", "https://main.whoisxmlapi.com/company" ] } }, "pageJsonUrl": "https://www.anchorterminal.com/tools/whoisxml-api.json", "live": { "slug": "whoisxml-api", "probe": { "target": "https://mcp-hosted.whoisxmlapi.com/mcp", "method": "get", "lastAt": "2026-11-04T19:35:20.133308456Z", "lastOk": true, "lastStatus": 401, "lastMs": 425, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 412, "p95ms24h": 503, "samples24h": 43, "samples30d": 43, "days": [ { "date": "2026-11-04", "probes": 43, "ok": 43 } ] }, "vendorStatus": { "page": "https://main.whoisxmlapi.com/api-status", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-04T15:32:43.472322439Z" }, "versions": [ { "registry": "mcp-registry", "name": "io.github.whois-api-llc/mcp-whoisxmlapi", "version": "1.15.0", "seenAt": "2026-11-04T17:11:44.552009456Z" } ], "securityTxt": { "url": "https://whoisxmlapi.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-04T15:53:49.350283946Z" }, "updatedAt": "2026-11-04T19:35:20.133308456Z" } } }