# GreyNoise vs WhoisXML API (slim)

> GreyNoise scores 66 (B) to WhoisXML's 56.8 (C) for secintel reputation. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/greynoise-vs-whoisxml-api.md (~4,550 tokens) · this version ~2,880 tokens · JSON https://www.anchorterminal.com/compare/greynoise-vs-whoisxml-api.json · canonical https://www.anchorterminal.com/compare/greynoise-vs-whoisxml-api
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-03
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

GreyNoise scores 66 (B) on agent readiness against WhoisXML API's 56.8 (C), and leads in 6 of 7 scored categories. Both do secintel reputation.

- GreyNoise: B 66, rank #350 of 1349 · https://www.anchorterminal.com/tools/greynoise.min.md
- WhoisXML API: C 56.8, rank #771 of 1349 · https://www.anchorterminal.com/tools/whoisxml-api.min.md
- GreyNoise, good for A triage or investigation agent that needs to know whether an IP is mass-scanning background noise, a known business service or something targeted, with tags and exploited CVEs to explain the verdict. Ahead on Reliability, 78 against 65; Schema & documentation, 83 against 70; Agent ergonomics, 76 against 65; Payments & pricing, 35 against 25; Transparency & trust, 76 against 60.
- WhoisXML API, good for An agent investigating a domain's registration, history, DNS, certificates or related domains at scale, on a prepaid credit pool. Also Free to start without a card.

| Category | GreyNoise | WhoisXML API |
| --- | --- | --- |
| Reliability (16%) | 78 | 65 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 83 | 70 |
| Agent ergonomics (13%) | 76 | 65 |
| Security & auth (14%) | 40 | 39 |
| Payments & pricing (10%) | 35 | 25 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 75 | 76 |
| Transparency & trust (7%) | 76 | 60 |

| Fact (where they differ) | GreyNoise | WhoisXML API |
| --- | --- | --- |
| Vendor | GreyNoise Intelligence, Inc. | Whois API, Inc. |
| Hosted endpoint | `https://api.greynoise.io/v3` | `https://mcp-hosted.whoisxmlapi.com/mcp` |
| Transports | HTTP, stdio | Streamable HTTP, stdio |
| Auth | API key | OAuth or key |
| Licence | Proprietary service under the GreyNoise End User License Agreement. The MCP server (greynoise-mcp-server) and the Python SDK (pygreynoise) are MIT | none |
| Tools exposed | 48 | 35 |
| MCP registry | not listed | `io.github.whois-api-llc/mcp-whoisxmlapi` |
| Last release | 2026-10-09 | 2026-11-03 |
| Terms last updated | 2025-05-07 | 2025-03-03 |
| Privacy policy last updated | 2026-09-03 | 2020-04-06 |
| Arbitration or class-action waiver | not found in the text | yes |
| Popularity | 99 npm/wk | none |

Why the edge:
- Transparency & trust, GreyNoise +16: GreyNoise 76 (Closed service under an EULA last modified 7 May 2025 that is clear on scope, with the MCP server and SDK under MIT (15 of 30). Privacy policy of 3 September 2026 with retention periods (threat data indefinitely, backups 14 days, logs about 30 days, account data until deletion is requested), named subprocessors and standard contractual clauses for transfers; no DPA named, and the page as served repeats its sections twice with small differences, such as whether Cloudflare is a subprocessor (20 of 30). The migration matrix dates v2's deprecation (28 July 2025), end of life (1 January 2026) and decommission (30 April 2026) and marks five v3 endpoints deprecated, while the EULA lets GreyNoise discontinue any product at any time with 10 days' notice of EULA changes (15 of 20). Amazon Web Services, Snowflake, Auth0, Stripe, Stigg, Datadog, Webflow, Google, HubSpot and Cloudflare named, with hosting in the United States (15 of 20). 15 + 20 + 15 + 15 = 65.); WhoisXML API 60 (A closed service with clear terms naming Whois API, Inc. and California law, though they confine data to one site, bar sharing it and forbid AI training on it (15 of 30). The privacy policy was last modified on 6 April 2020, cites the Privacy Shield frameworks, keeps data as long as there is a reasonable basis, and names no DPA (6 of 30). Deprecated parameters are listed and still accepted, with no notice periods or policy (8 of 20). No subprocessors or data locations are named (2 of 20). 15 + 6 + 8 + 2 = 31.)
- Reliability, GreyNoise +13: GreyNoise 78 (Read with the hosted lines for the v3 REST API. Status page at status.greynoise.io on incident.io with 16 components, ten of them GreyNoise's own, including API and API Data Freshness (20). No incident is listed for the 90 days to 3 November 2026. The API component shows 99.94 per cent uptime for August to November and the group 99.83 per cent, downtime the page gives no incident for, so read as clean or trivial with that caveat (25 of 30). Limits with numbers exist only for the free side, 10 lookups a day unauthenticated and 50 searches a week on a free account; paid plans are 'Unlimited' on the plans page and no per-minute figure was found (8 of 15). 429 responses are defined on 29 of 70 operations and a 503 at query engine capacity carries a documented Retry-After header, which the official SDK and MCP client honour with backoff. No idempotency keys for the blocklist, alert and feed writes (10 of 15). The plans page publishes an SLA of 1 business day, 8 hours or 4 hours on paid tiers beside support hours, which reads as a response time, and no availability SLA was found (5 of 10). The v3 API is generally available and v2 was decommissioned on 30 April 2026 (10). 20 + 25 + 8 + 10 + 5 + 10 = 78.); WhoisXML API 65 (Read with the hosted lines. The vendor's own Service Status and Data Releases page is linked from the docs and describes a per-API JSON status file with four levels (20). It shows no incident history and the status file's live values could not be read, so no 90-day record (5). The docs give 200 requests a second with rejection until the next second; the terms give 50 a second, 20 concurrent and 5 concurrent bulk requests, so numbers are published even though they disagree (15). A 429 AUTHENTICATE_06 carries Retry-After and every response X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, with guidance to slow before zero; all calls are reads (15). No SLA; the terms guarantee no minimum uptime and cite a historical 99.9 per cent, with enterprise SLAs by separate agreement (0). The API is generally available (10). 20 + 5 + 15 + 15 + 0 + 10 = 65.)
- Schema & documentation, GreyNoise +13: GreyNoise 83 (OpenAPI 3.0.0 at api.greynoise.io/v3/openapi.yaml, 65 paths and 70 operations, every one with a description, 32 enums, a `key` header security scheme, and 400, 401, 403, 429 and 500 responses on nearly every operation (25). llms.txt at docs.greynoise.io/llms.txt, and every docs page is served as Markdown with a .md suffix (10). Operation descriptions say what each call returns and when to use `quick`, with little on when not to use a call; the MCP tool descriptions in the source are fuller (14 of 20). Typed path and query parameters with enums and required flags, and bulk bodies typed as `{"ips": [...]}` with a 10,000 limit in prose (12 of 15). The guides carry curl and Python examples and the spec defines error bodies with example messages, but the v3 IP reference page itself has no code sample (11 of 15). Versioned paths and a migration matrix with dated deprecation, end-of-life and decommission for v2, plus dated product-update posts naming new endpoints, but no API changelog as such and an empty roadmap page (11 of 15). 25 + 10 + 14 + 12 + 11 + 11 = 83.); WhoisXML API 70 (The surface graded is the WHOIS API, with the hosted MCP server noted. No OpenAPI document. JSON Schema draft-07 and XSD files define the WHOIS record, the DomainInfo response and the error body, and a Postman collection is published (15 of 25). llms.txt on www.whoisxmlapi.com lists the APIs, databases and feeds (10). The making-requests page states each parameter's purpose, default and credit cost, lists deprecated parameters that are still accepted, and says when RDAP applies, with little on when not to call (15 of 20). rdap, outputFormat and the cache flags have enumerated values and the record schema is typed, but unknown parameters are ignored silently and the output page gives no types in prose (11 of 15). Request examples, example records and an error table with HTTP status, errorCode and message (12 of 15). No API version and no changelog for the API; press releases summarise product updates yearly, the newest dated 9 May 2025, and the MCP server's versions are dated in the registry (7 of 15). 15 + 10 + 15 + 11 + 12 + 7 = 70.)
- Agent ergonomics, GreyNoise +11: GreyNoise 76 (`quick=true` cuts an IP lookup to `found` and the classification or trust level, `/v3/gnql/metadata` drops raw scan data, and `request_metadata.restricted_fields` names what a plan withholds; no arbitrary field selection (18 of 25). GNQL pages default to 1,000 results with `size` up to 10,000 and a `scroll` token, plus stats, count and export variants and CSV output in the SDK (18 of 20). Error bodies carry a message, 206 marks partial content from plan limits, and the 503 at capacity documents Retry-After, though the 429 example says only that the limit was hit (15 of 20). Nearly every call is a GET or a read POST; the blocklist, alert and feed-consumer writes have no idempotency key. The MCP server sets readOnlyHint true by default, marks 8 write tools and sets destructiveHint on the delete tools (15 of 20). One required parameter on most calls and sensible defaults, but the only official SDK is Python; the TypeScript MCP server is not a client library (10 of 15). 18 + 18 + 15 + 15 + 10 = 76.); WhoisXML API 65 (ignoreRawTexts drops the raw text fields, cmd=GET_DN_AVAILABILITY returns a two-field record, and the MCP server's reverse_whois defaults to a count-only mode; the MCP server lists 35 tools, more than 30, with a tool_search for deferred loading over stdio only (17 of 25). The WHOIS API returns one record per call with no pagination; bulk variants take up to 10,000 domains as jobs with status and results tools (8 of 20). Errors carry a code and a message an agent can branch on, though WHOIS_01 names both a validation error on HTTP 200 and an internal error on 500 (14 of 20). Every call is a read, and the cache flags make a repeat cheap, but a retry with _hardRefresh costs 5 credits each time and no annotations were found on the MCP tools (14 of 20). One required parameter, sensible defaults, and official Python and Go client libraries in the vendor's GitHub organisation, last pushed in 2023 (12 of 15). 17 + 8 + 14 + 14 + 12 = 65.)
- Payments & pricing, GreyNoise +10: GreyNoise 35 (No x402, MPP or L402 (0). Standard, Advanced and Elite are contact sales with no figure on the plans page, and no per-lookup price exists (0). A free Community account at 50 searches a week needs a business email and no card is mentioned; `/v3/community/{ip}` answers 10 lookups a day with no account at all (20). An agent can call the community endpoint with no key, but a key and the v3 API need a browser signup and a sales contract (15 of 20). 0 + 0 + 20 + 15 = 35.); WhoisXML API 25 (No x402, MPP or L402 (0). The only public price is from $129 a month for a universal credit pool; per-credit rates are behind a calculator whose output was not read and enterprise packages are by sales (5 of 20). 500 free WHOIS credits on signup with no card (20). The key comes from the account after a browser signup and no key API was found (0). 0 + 5 + 20 + 0 = 25.)