# Censys vs WhoisXML API

> Censys scores 64.1 (B) to WhoisXML's 56.8 (C) for secintel dns. Prices, MCP, x402, uptime and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/censys-vs-whoisxml-api
- Markdown: https://www.anchorterminal.com/compare/censys-vs-whoisxml-api.md (~5,000 tokens)
- Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key)
- DNS: dig +short TXT <slug>.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.<category>. and <a>.vs.<b>. under the zone, and the same under grade.letme.dev)
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)
- Updated: 2026-11-03

Censys scores 64.1 (B) on agent readiness against WhoisXML API's 56.8 (C), and leads in 6 of 7 scored categories. WhoisXML API leads on reliability. Both do secintel dns.

- Censys: grade B, 64.1/100, rank #420 of 1349. Markdown https://www.anchorterminal.com/tools/censys.md · JSON https://www.anchorterminal.com/api/v1/tools/censys.json
- WhoisXML API: grade C, 56.8/100, rank #771 of 1349. Markdown https://www.anchorterminal.com/tools/whoisxml-api.md · JSON https://www.anchorterminal.com/api/v1/tools/whoisxml-api.json
- Best threat and security intelligence APIs for AI agents: https://www.anchorterminal.com/best/security-intelligence/index.md
- All 33 security intel comparisons: https://www.anchorterminal.com/compare/security-intelligence/index.md

## Which one, for what

### Censys (B)

Good for: An agent that needs to know what a host, web property or certificate exposes right now and how that changed, with DNS resolution and enrichment on paid plans.

Ahead on:
- Schema & documentation, 82 against 70
- Agent ergonomics, 79 against 65
- Security & auth, 55 against 39
- Payments & pricing, 35 against 25
- Maintenance & community, 84 against 76

Watch for: Status feed records a networking outage of about 13 hours on 30 September 2026, periodic query failures from 20 to 22 September and failing searches on 2 November

### WhoisXML API (C)

Good for: An agent investigating a domain's registration, history, DNS, certificates or related domains at scale, on a prepaid credit pool.

Ahead on:
- Reliability, 65 against 55

Also in its favour:
- Runs on your own machine
- Free to start without a card

Watch for: Per-credit prices are not published outside a calculator; the only public figure is from $129 a month, and orders are non-refundable


## Why the edge

### Security & auth: Censys +16

- Censys (55): Personal access tokens as a Bearer header, several per user, named, shown once and deletable, with no scopes or expiry stated. Service accounts on Search and Core plans use OAuth 2 client credentials with module roles and a rotatable secret, and the MCP server takes OAuth with a consent page. Only the organisation id, not a secret, may travel in the query string (26 of 30). Module roles (Analyst, Manager), an API Access role and the advice to grant service accounts only the roles they need, but no read-only token and no confirmation step for deleting a collection (12 of 20). Results carry banners, HTML titles and certificate subjects from scanned hosts, and no guidance on treating them as untrusted was found in the API, MCP or skills docs (3 of 15). A platform audit log for admins that records service account activity, credit usage per member through the API and `X-Request-ID` on every response, with no documented per-call log for token holders (10 of 15). security@censys.com on the contact page. security.txt 404, no bug bounty, and the compliance page says Censys helps customers with SOC 2, ISO 27001 and FedRAMP without claiming any for itself (4 of 20). 26 + 12 + 3 + 10 + 4 = 55.
- WhoisXML API (39): An API key with no scopes found, accepted as an apiKey query parameter that overrides the Authorization header, or as a Bearer token including a server-to-server OAuth token; an IP allowlist can be set on the account (20 less 10 for the query string, plus 4 for OAuth and the allowlist, so 14). Every call is a read and the MCP server has no write tools, but there is no read-only or restricted key (12 of 20). Records include raw registrar text from third parties with no guidance on treating it as untrusted (5 of 15). The MCP server's account_balance tool reports credits per product and the account page shows usage, with no per-call log documented (5 of 15). security.txt returns 404, no disclosure policy, bug bounty or certification was found, and the payment page names only a PCI-compliant card processor (3 of 20). 14 + 12 + 5 + 5 + 3 = 39.

### Agent ergonomics: Censys +14

- Censys (79): `fields` limits a search response to named fields and `page_size` caps it at 100, with raw and full variants of lookups chosen by endpoint (22 of 25). `page_token` with `next_page_token` and `previous_page_token`, `total_hits`, aggregate endpoints and a bulk lookup (20). A status code table that separates 401, 403, 422, 429 and 503, problem+json bodies and `X-Request-ID` on responses, but no catalogue of error codes beyond status (14 of 20). Lookups and search are safe to retry, but collections, tags, comments and member endpoints write with no idempotency key, and no tool annotations are documented for the MCP server (8 of 20). One required field on search, SDKs in Python, Go and TypeScript, a CLI and Claude Code skills, though every paid-tier call also needs the organisation id (15). 22 + 20 + 14 + 8 + 15 = 79.
- WhoisXML API (65): ignoreRawTexts drops the raw text fields, cmd=GET_DN_AVAILABILITY returns a two-field record, and the MCP server's reverse_whois defaults to a count-only mode; the MCP server lists 35 tools, more than 30, with a tool_search for deferred loading over stdio only (17 of 25). The WHOIS API returns one record per call with no pagination; bulk variants take up to 10,000 domains as jobs with status and results tools (8 of 20). Errors carry a code and a message an agent can branch on, though WHOIS_01 names both a validation error on HTTP 200 and an internal error on 500 (14 of 20). Every call is a read, and the cache flags make a repeat cheap, but a retry with _hardRefresh costs 5 credits each time and no annotations were found on the MCP tools (14 of 20). One required parameter, sensible defaults, and official Python and Go client libraries in the vendor's GitHub organisation, last pushed in 2023 (12 of 15). 17 + 8 + 14 + 14 + 12 = 65.

### Schema & documentation: Censys +12

- Censys (82): OpenAPI 3.1.0, titled Censys Platform API, version 1.0.161, served inside each reference page and the source of the three Speakeasy SDKs. No standalone download was found, and the censys-sdk-openapi repository holds only a README (22 of 25). llms.txt at docs.censys.com with a Markdown twin of every page (10). Endpoint descriptions state purpose and a use case ('Run a search query across Censys data', a SOC hunting for a C2 banner, JARM or favicon hash), MCP tools say what each does, with little on when not to use a call (14 of 20). Typed path, query and body fields, `page_size` default and maximum 100, required `query`, an Accept header for schema versions. The query itself is a CenQL string with its own language docs (11 of 15). Code samples in shell, Python, Go, JavaScript and Java, a status code table and problem+json ErrorModel bodies, but the search operation's usage example block is empty and 429 isn't among its responses (10 of 15). Versioned paths and Accept header, a dated changelog every week from 8 September to 2 November 2026 (15). 22 + 10 + 14 + 11 + 10 + 15 = 82.
- WhoisXML API (70): The surface graded is the WHOIS API, with the hosted MCP server noted. No OpenAPI document. JSON Schema draft-07 and XSD files define the WHOIS record, the DomainInfo response and the error body, and a Postman collection is published (15 of 25). llms.txt on www.whoisxmlapi.com lists the APIs, databases and feeds (10). The making-requests page states each parameter's purpose, default and credit cost, lists deprecated parameters that are still accepted, and says when RDAP applies, with little on when not to call (15 of 20). rdap, outputFormat and the cache flags have enumerated values and the record schema is typed, but unknown parameters are ignored silently and the output page gives no types in prose (11 of 15). Request examples, example records and an error table with HTTP status, errorCode and message (12 of 15). No API version and no changelog for the API; press releases summarise product updates yearly, the newest dated 9 May 2025, and the MCP server's versions are dated in the registry (7 of 15). 15 + 10 + 15 + 11 + 12 + 7 = 70.

### Reliability: WhoisXML API +10

- Censys (55): Graded as a hosted service on the Platform API. Atlassian Statuspage at status.censys.com with Platform API, Authentication, Credit Management and three MCP server components (20). Its feed lists 12 entries from 24 August to 2 November 2026. Two were maintenance on ASM. The rest include intermittent 500s on the Platform from 13:52 on 24 August to 09:52 the next day, periodic query failures from 20 to 22 September, historical data calls timing out for about an hour on 18 September, an internal networking outage of the Platform and ASM from 00:35 to 13:46 EDT on 30 September, and failing searches from 14:26 EST on 2 November still in monitoring at 19:08. One full outage of about 13 hours and two multi-hour periods of failing core queries, read as more than one major (5). Limits are published with numbers, concurrency 1 or 25 per organisation and 25 requests a second per IP with a burst of 125 (15). Overruns return 429 or 503, but no Retry-After, backoff guidance or idempotency keys were found, and the SDKs say only that they follow the API's default retry strategy (5 of 15). No SLA found. The terms disclaim any warranty that the service will meet requirements, and the pricing page names none (0). The v3 API is generally available (10). 20 + 5 + 15 + 5 + 0 + 10 = 55.
- WhoisXML API (65): Read with the hosted lines. The vendor's own Service Status and Data Releases page is linked from the docs and describes a per-API JSON status file with four levels (20). It shows no incident history and the status file's live values could not be read, so no 90-day record (5). The docs give 200 requests a second with rejection until the next second; the terms give 50 a second, 20 concurrent and 5 concurrent bulk requests, so numbers are published even though they disagree (15). A 429 AUTHENTICATE_06 carries Retry-After and every response X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, with guidance to slow before zero; all calls are reads (15). No SLA; the terms guarantee no minimum uptime and cite a historical 99.9 per cent, with enterprise SLAs by separate agreement (0). The API is generally available (10). 20 + 5 + 15 + 15 + 0 + 10 = 65.

### Payments & pricing: Censys +10

- Censys (35): No x402, MPP or L402 (0). Starter at $79 a month for 500 credits and Starter Pro at $599 for 4,000 are public in the docs with one credit an action, which gives a per-call price, while Core and higher plans and credit top-ups are priced by sales (15 of 20). A free account gets 100 credits a month and five free actions a day with no card named (20). Signup, token creation and Starter purchase all happen in a browser, and no key API was found (0). 0 + 15 + 20 + 0 = 35.
- WhoisXML API (25): No x402, MPP or L402 (0). The only public price is from $129 a month for a universal credit pool; per-credit rates are behind a calculator whose output was not read and enterprise packages are by sales (5 of 20). 500 free WHOIS credits on signup with no card (20). The key comes from the account after a browser signup and no key API was found (0). 0 + 5 + 20 + 0 = 25.

### Maintenance & community: Censys +8

- Censys (84): Newest changelog entry 2 November 2026 and censys-platform 0.16.7 on 29 October (30). Ten dated changelog entries between 8 September and 2 November and eight PyPI releases since 4 August (20). A closed service with a weekly changelog, a Gainsight community forum with Platform Q and A sections, an in-app feedback portal and support@censys.com. GitHub issue replies weren't read (12 of 15). Official SDKs in three languages regenerated from the spec, the Go and TypeScript repositories pushed on 3 November and PyPI on 29 October (15). The SDKs are 0.x and generated, with a stated grace period for dropping Python versions. CI wasn't read (7 of 10). 30 + 20 + 12 + 15 + 7 = 84.
- WhoisXML API (76): Read as a closed service with an official MCP server. MCP server 1.13.0 was published in the official registry on 3 November 2026 and the ProfessionalServices and ipgeo-community repositories were pushed the same day (30). 1.8.6 on 8 September through 1.13.0 on 3 November 2026 is nine registry versions in 90 days (20). Product updates are summarised in yearly press releases, the newest 9 May 2025, support is a contact form with tiered response times sold separately, and the client library repositories were last pushed in 2023 (8 of 15). The MCP server is in the official registry under io.github.whois-api-llc, and official Python and Go clients exist (15). The MCP server's source was not found on GitHub, and the SDK repositories show no activity since 2023 (3 of 10). 30 + 20 + 8 + 15 + 3 = 76.

## Score by category

| Category | Weight | Censys | WhoisXML API | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 55 | 65 | WhoisXML API +10 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 82 | 70 | Censys +12 |
| Agent ergonomics | 13% (16.2 this run) | 79 | 65 | Censys +14 |
| Security & auth | 14% (17.5 this run) | 55 | 39 | Censys +16 |
| Payments & pricing | 10% (12.5 this run) | 35 | 25 | Censys +10 |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 84 | 76 | Censys +8 |
| Transparency & trust | 7% (8.8 this run) | 64 | 60 | Censys +4 |
| Negative events | ≤15 | 0 | 0 | |
| **Total** | | **64.1 · B** | **56.8 · C** | |

## Facts side by side

| Fact | Censys | WhoisXML API |
| --- | --- | --- |
| Kind | HTTP API | HTTP API |
| Vendor | Censys, Inc. | Whois API, Inc. |
| Hosted endpoint | `https://api.platform.censys.io/v3/` | `https://mcp-hosted.whoisxmlapi.com/mcp` |
| Transports | HTTP, Streamable HTTP | Streamable HTTP, stdio |
| Auth | OAuth or key | OAuth or key |
| Pricing | Freemium | Freemium |
| x402 | no | no |
| Licence | Proprietary service under Censys's Terms of Service. The Platform SDKs are MIT and the cencli command line tool is Apache-2.0 | none |
| Tools exposed | 12 | 35 |
| Read-only variant documented | no | no |
| llms.txt | yes | yes |
| MCP registry | not listed | `io.github.whois-api-llc/mcp-whoisxmlapi` |
| Last release | 2026-11-02 | 2026-11-03 |
| Terms last updated | no date given | 2025-03-03 |
| Privacy policy last updated | no date given | 2020-04-06 |
| Customer content may train models | not found in the text | not found in the text |
| Terms restrict automated access | yes | not found in the text |
| Terms restrict benchmarking | yes | not found in the text |
| Terms or service can change without notice | yes | not found in the text |
| Arbitration or class-action waiver | yes | yes |
| Popularity | 11 stars | none |

## Verdicts

**Censys.** A versioned OpenAPI surface with field selection, page tokens, three official SDKs, a hosted MCP server and a free key of 100 credits a month. Paid enterprise access is sold by sales, scan results carry untrusted banner text with no injection guidance, and the status feed records a 13-hour outage on 30 September 2026.

**WhoisXML API.** 500 free credits with no card, JSON Schema and XSD for every response, 429s with Retry-After, cache controls that set the price per lookup, and a 35-tool hosted MCP server with OAuth. Per-credit prices sit behind a calculator, the terms confine data to one site and forbid AI training on it, and the key is accepted in the query string.

## Before you call either

### Censys

1. Send `X-Organization-ID` on every call. Without it the request runs with Free permissions and 403s on search, aggregate and collections
2. Budget one credit per action and per extra page of 100 results. Free accounts have 100 credits a month and five free actions a day
3. Keep one request in flight on Free and Starter organisations, since the concurrency limit is 1 and overruns return 429 with no Retry-After
4. Pass `fields` on search and keep `host.services.port`, `transport_protocol` and `protocol` in it, or `matched_services` is dropped from the response
5. Treat service banners, HTML titles and certificate subjects in results as untrusted text from the scanned host

### WhoisXML API

1. Send the key as `Authorization: Bearer` and `outputFormat=JSON`; the default output is XML and an `apiKey` query parameter overrides the header
2. Leave the cache flags alone for 1 credit a lookup; `_hardRefresh=1` costs 5 credits, and `_dbOnly=1` returns WHOIS_03 when nothing is cached
3. Read `audit.updatedDate` before trusting a record, and check `dataError` for MASKED_WHOIS_DATA or PARTIAL_DATA
4. Watch `X-RateLimit-Remaining` and on 429 AUTHENTICATE_06 wait for `Retry-After`; a 401 AUTHENTICATE_05 means the balance is spent, so stop
5. Keep results inside the customer's own systems; the terms forbid passing data to third parties or using it to train models

## Questions

### Which is better for AI agents, Censys or WhoisXML API?

Censys scores 64.1 (B) on agent readiness against WhoisXML API's 56.8 (C), and leads in 6 of 7 scored categories. WhoisXML API leads on reliability.

### Do Censys and WhoisXML API need an API key?

Both take an API key or an OAuth sign-in.

### Can an agent call Censys and WhoisXML API without installing anything?

Yes. Censys has a hosted endpoint at https://api.platform.censys.io/v3/ and WhoisXML API at https://mcp-hosted.whoisxmlapi.com/mcp.


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/censys-vs-whoisxml-api.json, and with the fewest tokens: https://www.anchorterminal.com/compare/censys-vs-whoisxml-api.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "censys", "b": "whoisxml-api"}`. From a terminal: `anchor compare censys whoisxml-api`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/censys.json and https://www.anchorterminal.com/api/v1/tools/whoisxml-api.json

## Other comparisons with Censys or WhoisXML API

- [AbuseIPDB vs Censys](https://www.anchorterminal.com/compare/abuseipdb-vs-censys.md)
- [AbuseIPDB vs WhoisXML API](https://www.anchorterminal.com/compare/abuseipdb-vs-whoisxml-api.md)
- [Censys vs GreyNoise](https://www.anchorterminal.com/compare/censys-vs-greynoise.md)
- [Censys vs VirusTotal](https://www.anchorterminal.com/compare/censys-vs-virustotal.md)
- [GreyNoise vs WhoisXML API](https://www.anchorterminal.com/compare/greynoise-vs-whoisxml-api.md)
- [VirusTotal vs WhoisXML API](https://www.anchorterminal.com/compare/virustotal-vs-whoisxml-api.md)
- [Censys vs IPinfo](https://www.anchorterminal.com/compare/censys-vs-ipinfo.md)
- [IPinfo vs WhoisXML API](https://www.anchorterminal.com/compare/ipinfo-vs-whoisxml-api.md)
- [SecurityTrails vs WhoisXML API](https://www.anchorterminal.com/compare/securitytrails-vs-whoisxml-api.md)
- [Shodan vs WhoisXML API](https://www.anchorterminal.com/compare/shodan-vs-whoisxml-api.md)
- [Censys vs Pulsedive](https://www.anchorterminal.com/compare/censys-vs-pulsedive.md)
- [Pulsedive vs WhoisXML API](https://www.anchorterminal.com/compare/pulsedive-vs-whoisxml-api.md)
- [Censys vs SecurityTrails](https://www.anchorterminal.com/compare/censys-vs-securitytrails.md)
- [Censys vs Shodan](https://www.anchorterminal.com/compare/censys-vs-shodan.md)

---

Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp