# AbuseIPDB vs WhoisXML API (slim)

> WhoisXML scores 56.8 (C) to AbuseIPDB's 55.7 (C) for secintel reputation. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/abuseipdb-vs-whoisxml-api.md (~4,350 tokens) · this version ~2,730 tokens · JSON https://www.anchorterminal.com/compare/abuseipdb-vs-whoisxml-api.json · canonical https://www.anchorterminal.com/compare/abuseipdb-vs-whoisxml-api
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-04
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

WhoisXML API scores 56.8 (C) on agent readiness against AbuseIPDB's 55.7 (C), and leads in 3 of 7 scored categories. AbuseIPDB leads on reliability, agent ergonomics and payments & pricing. Both do secintel reputation.

- AbuseIPDB: C 55.7, rank #765 of 1349 · https://www.anchorterminal.com/tools/abuseipdb.min.md
- WhoisXML API: C 56.8, rank #731 of 1349 · https://www.anchorterminal.com/tools/whoisxml-api.min.md
- AbuseIPDB, good for An agent that needs a quick reputation verdict on an IP or subnet, or wants to report abuse from its own logs, with a free daily quota large enough for one incident. Ahead on Reliability, 75 against 65; Agent ergonomics, 74 against 65; Payments & pricing, 30 against 25.
- WhoisXML API, good for An agent investigating a domain's registration, history, DNS, certificates or related domains at scale, on a prepaid credit pool. Ahead on Schema & documentation, 70 against 59; Maintenance & community, 76 against 38. Also A hosted endpoint, with nothing to install.

| Category | AbuseIPDB | WhoisXML API |
| --- | --- | --- |
| Reliability (16%) | 75 | 65 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 59 | 70 |
| Agent ergonomics (13%) | 74 | 65 |
| Security & auth (14%) | 37 | 39 |
| Payments & pricing (10%) | 30 | 25 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 38 | 76 |
| Transparency & trust (7%) | 63 | 60 |

| Fact (where they differ) | AbuseIPDB | WhoisXML API |
| --- | --- | --- |
| Vendor | AbuseIPDB LLC | Whois API, Inc. |
| Hosted endpoint | no (local only) | `https://mcp-hosted.whoisxmlapi.com/mcp` |
| Transports | stdio | Streamable HTTP, stdio |
| Auth | API key | OAuth or key |
| Tools exposed | 2 | 35 |
| Read-only variant documented | yes | no |
| MCP registry | `io.github.abuseipdb/abuseipdb-mcp` | `io.github.whois-api-llc/mcp-whoisxmlapi` |
| Last release | 2026-08-02 | 2026-11-03 |
| Terms last updated | no date given | 2025-03-03 |
| Privacy policy last updated | no date given | 2020-04-06 |
| Terms restrict automated access | yes | not found in the text |
| Terms or service can change without notice | yes | not found in the text |
| Popularity | 6 stars | none |

Why the edge:
- Maintenance & community, WhoisXML API +38: AbuseIPDB 38 (Read as a closed service with an official MCP server. The newest dated change to the surface is the MCP server's v0.1.1 on 2 August 2026, 93 days before the check; the API docs and blog carry no later date (10 of 30). One release in the last 90 days, v0.1.1 fell just outside it (0 of 20). Support is a contact form with no guaranteed response on the free plan, there is no public changelog for the API, and the MCP repository shows a pull request merged on 2 August but GitHub's issue pages could not be read (5 of 15). The MCP server sits in the official registry under io.github.abuseipdb (15). The MCP package has CI on Python 3.11 to 3.14 with ruff, pytest and a packaging check, and a locked dependency set (8 of 10). 10 + 0 + 5 + 15 + 8 = 38.); WhoisXML API 76 (Read as a closed service with an official MCP server. MCP server 1.13.0 was published in the official registry on 3 November 2026 and the ProfessionalServices and ipgeo-community repositories were pushed the same day (30). 1.8.6 on 8 September through 1.13.0 on 3 November 2026 is nine registry versions in 90 days (20). Product updates are summarised in yearly press releases, the newest 9 May 2025, support is a contact form with tiered response times sold separately, and the client library repositories were last pushed in 2023 (8 of 15). The MCP server is in the official registry under io.github.whois-api-llc, and official Python and Go clients exist (15). The MCP server's source was not found on GitHub, and the SDK repositories show no activity since 2023 (3 of 10). 30 + 20 + 8 + 15 + 3 = 76.)
- Schema & documentation, WhoisXML API +11: AbuseIPDB 59 (The surface graded is the REST API v2, with the official MCP server noted. No OpenAPI document was found. The MCP server's two tools carry JSON Schema inputs with range constraints from pydantic Field (8 of 25). llms.txt on abuseipdb.com describes the API, endpoints, categories and reporting rules (10). Each endpoint has a purpose statement and a parameter table, the FAQ explains scoring and decay, and the docs say to act on abuseConfidenceScore rather than isWhitelisted, with little on when not to call (14 of 20). Parameters give defaults and ranges (maxAgeInDays 1 to 365, perPage 1 to 100), usageType has a listed set of values and categories are numbered, but types are not stated and the categories default is ambiguous (10 of 15). Examples in cURL, Python, PHP, C# and VBScript for every endpoint, and errors follow the JSON API shape with 422, 429 and 402 examples (12 of 15). v2 is in the path, there is no API changelog, the blog's last post is from December 2018, and the reports endpoint may change without notice (5 of 15). 8 + 10 + 14 + 10 + 12 + 5 = 59.); WhoisXML API 70 (The surface graded is the WHOIS API, with the hosted MCP server noted. No OpenAPI document. JSON Schema draft-07 and XSD files define the WHOIS record, the DomainInfo response and the error body, and a Postman collection is published (15 of 25). llms.txt on www.whoisxmlapi.com lists the APIs, databases and feeds (10). The making-requests page states each parameter's purpose, default and credit cost, lists deprecated parameters that are still accepted, and says when RDAP applies, with little on when not to call (15 of 20). rdap, outputFormat and the cache flags have enumerated values and the record schema is typed, but unknown parameters are ignored silently and the output page gives no types in prose (11 of 15). Request examples, example records and an error table with HTTP status, errorCode and message (12 of 15). No API version and no changelog for the API; press releases summarise product updates yearly, the newest dated 9 May 2025, and the MCP server's versions are dated in the registry (7 of 15). 15 + 10 + 15 + 11 + 12 + 7 = 70.)
- Reliability, AbuseIPDB +10: AbuseIPDB 75 (Read with the hosted lines. A status page on UptimeRobot is linked from every page's footer (20). Its monitors and 90-day history load by script and answered with an error on 3 November 2026, so no incident record could be read (5). Daily limits are published per endpoint and per plan, 1,000 checks a day on the free plan up to 50,000 on Premium (15). A 429 carries Retry-After, X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, and a repeated report of the same address with the same comment within 24 hours updates the earlier report instead of adding one (15). The terms carry a service level agreement with a 99 per cent monthly availability target and a refund as the sole remedy (10). API v2 is generally available, with only the reports endpoint in open beta (10). 20 + 5 + 15 + 15 + 10 + 10 = 75.); WhoisXML API 65 (Read with the hosted lines. The vendor's own Service Status and Data Releases page is linked from the docs and describes a per-API JSON status file with four levels (20). It shows no incident history and the status file's live values could not be read, so no 90-day record (5). The docs give 200 requests a second with rejection until the next second; the terms give 50 a second, 20 concurrent and 5 concurrent bulk requests, so numbers are published even though they disagree (15). A 429 AUTHENTICATE_06 carries Retry-After and every response X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, with guidance to slow before zero; all calls are reads (15). No SLA; the terms guarantee no minimum uptime and cite a historical 99.9 per cent, with enterprise SLAs by separate agreement (0). The API is generally available (10). 20 + 5 + 15 + 15 + 0 + 10 = 65.)
- Agent ergonomics, AbuseIPDB +9: AbuseIPDB 74 (check returns a compact record unless verbose is set, which adds the reports array, maxAgeInDays bounds the window, and blacklist takes a limit and a plaintext form (18 of 25). reports is paginated with page and perPage up to 100 and next and previous links, and blacklist filters by confidence, country and IP version, though check has no field selection (16 of 20). Errors carry a status and a detail an agent can act on, 429 names the daily limit and the headers say when it resets, and a 402 marks a plan limit on check-block (16 of 20). Every lookup is a GET, duplicate reports within 24 hours collapse, and both MCP tools are annotated readOnlyHint and idempotentHint (16 of 20). One required parameter per endpoint with sensible defaults. No official SDK beyond a Laravel package in the vendor's GitHub organisation and the Python MCP server (8 of 15). 18 + 16 + 16 + 16 + 8 = 74.); WhoisXML API 65 (ignoreRawTexts drops the raw text fields, cmd=GET_DN_AVAILABILITY returns a two-field record, and the MCP server's reverse_whois defaults to a count-only mode; the MCP server lists 35 tools, more than 30, with a tool_search for deferred loading over stdio only (17 of 25). The WHOIS API returns one record per call with no pagination; bulk variants take up to 10,000 domains as jobs with status and results tools (8 of 20). Errors carry a code and a message an agent can branch on, though WHOIS_01 names both a validation error on HTTP 200 and an internal error on 500 (14 of 20). Every call is a read, and the cache flags make a repeat cheap, but a retry with _hardRefresh costs 5 credits each time and no annotations were found on the MCP tools (14 of 20). One required parameter, sensible defaults, and official Python and Go client libraries in the vendor's GitHub organisation, last pushed in 2023 (12 of 15). 17 + 8 + 14 + 14 + 12 = 65.)
- Payments & pricing, AbuseIPDB +5: AbuseIPDB 30 (No x402, MPP or L402 (0). Plan prices are public, $25 and $99 a month, sold by daily quota rather than per call (10). The Individual plan allows 1,000 checks a day with no card, and paid plans carry a 30-day trial (20). The key comes from the account page after a browser signup, and the terms forbid multiple accounts to raise quota, so no autonomous route (0). 0 + 10 + 20 + 0 = 30.); WhoisXML API 25 (No x402, MPP or L402 (0). The only public price is from $129 a month for a universal credit pool; per-credit rates are behind a calculator whose output was not read and enterprise packages are by sales (5 of 20). 500 free WHOIS credits on signup with no card (20). The key comes from the account after a browser signup and no key API was found (0). 0 + 5 + 20 + 0 = 25.)