Shodan vs WhoisXML API

Shodan 16

No dated API change found. The blog's newest post is 7 August 2024, and the official Python library shodan 1.31.0 was published on 17 December 2023 with the repository's last push on 5 August 2024 (0 of 30). No releases or dated changelog entries in the last 90 days (0 of 20). 63 open issues on the Python repository with no push since August 2024; a support email and a help centre exist (5 of 25). The official Python SDK still installs but is two years old, and the other clients are community work (8 of 15). The repository has no CI configuration and no CHANGELOG entry since 1.28.0 of July 2022 (3 of 10). 0 + 0 + 5 + 8 + 3 = 16.

WhoisXML API 76

Read as a closed service with an official MCP server. MCP server 1.13.0 was published in the official registry on 3 November 2026 and the ProfessionalServices and ipgeo-community repositories were pushed the same day (30). 1.8.6 on 8 September through 1.13.0 on 3 November 2026 is nine registry versions in 90 days (20). Product updates are summarised in yearly press releases, the newest 9 May 2025, support is a contact form with tiered response times sold separately, and the client library repositories were last pushed in 2023 (8 of 15). The MCP server is in the official registry under io.github.whois-api-llc, and official Python and Go clients exist (15). The MCP server's source was not found on GitHub, and the SDK repositories show no activity since 2023 (3 of 10). 30 + 20 + 8 + 15 + 3 = 76.

Shodan 40

Read with the hosted lines. A public status page exists at status.shodan.io (UptimeRobot), but on 3 November 2026 its component list failed to load and it showed only that there were no updates in the last 7 days, so no component history was readable (10 of 20). No readable incident record for the 90 days (5). The billing page states that all API plans are limited to 1 request a second, and credits per plan are published with numbers (15). No 429, Retry-After or backoff guidance was found in the reference or the OpenAPI document; the only error statement is that a non-200 status carries an error message, and no idempotency keys exist for alert, notifier or scan writes. The official Python client throttles itself to 1 request a second and retries a timed-out search cursor, which is client behaviour, not an API contract (0). No SLA found on the billing, enterprise or developer pages (0). The REST API is generally available (10). 10 + 5 + 15 + 0 + 0 + 10 = 40.

WhoisXML API 65

Read with the hosted lines. The vendor's own Service Status and Data Releases page is linked from the docs and describes a per-API JSON status file with four levels (20). It shows no incident history and the status file's live values could not be read, so no 90-day record (5). The docs give 200 requests a second with rejection until the next second; the terms give 50 a second, 20 concurrent and 5 concurrent bulk requests, so numbers are published even though they disagree (15). A 429 AUTHENTICATE_06 carries Retry-After and every response X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, with guidance to slow before zero; all calls are reads (15). No SLA; the terms guarantee no minimum uptime and cite a historical 99.9 per cent, with enterprise SLAs by separate agreement (0). The API is generally available (10). 20 + 5 + 15 + 15 + 0 + 10 = 65.

Shodan 46

The surface graded is the REST API at api.shodan.io. An OpenAPI 3.0.0 document at developer.shodan.io/api/openapi.json covers 37 paths and 44 operations, but declares no securitySchemes, no enums and a non-200 response on one operation only (15 of 25). No llms.txt on developer.shodan.io or www.shodan.io, both 404, and no Markdown docs served for agents (0 of 10). Every operation carries a description, and the reference says which calls cost credits and which plans can scan, with little on when not to use a call (12 of 20). Required flags on the key and path parameters, with facets, query and fields as free strings and no enums or constraints (7 of 15). Example requests and responses for every endpoint in the reference, and errors documented only as a non-200 status with an error field (9 of 15). No version in the path, the OpenAPI document says 1.0.0, and the only dated record of changes is the blog, whose newest post is 7 August 2024 (3 of 15). 15 + 0 + 12 + 7 + 9 + 3 = 46.

WhoisXML API 70

The surface graded is the WHOIS API, with the hosted MCP server noted. No OpenAPI document. JSON Schema draft-07 and XSD files define the WHOIS record, the DomainInfo response and the error body, and a Postman collection is published (15 of 25). llms.txt on www.whoisxmlapi.com lists the APIs, databases and feeds (10). The making-requests page states each parameter's purpose, default and credit cost, lists deprecated parameters that are still accepted, and says when RDAP applies, with little on when not to call (15 of 20). rdap, outputFormat and the cache flags have enumerated values and the record schema is typed, but unknown parameters are ignored silently and the output page gives no types in prose (11 of 15). Request examples, example records and an error table with HTTP status, errorCode and message (12 of 15). No API version and no changelog for the API; press releases summarise product updates yearly, the newest dated 9 May 2025, and the MCP server's versions are dated in the registry (7 of 15). 15 + 10 + 15 + 11 + 12 + 7 = 70.

Shodan 19

One key per account with no scopes, sent as key= in the query string on every documented call and in the OpenAPI document, with no header option. Read as a plain key, the way the Alpha Vantage listing was read, less 10 for the query string (10 of 30). No read-only key or least-privilege mode; the free plan's limits are quotas, not scopes, and alerts, notifiers and org members can be deleted with the same key and no confirmation (3 of 20). Results carry banners, HTTP titles and page bodies collected from arbitrary hosts, and no guidance on treating them as untrusted was found (3 of 15). /api-info reports the plan and credits, and no call log for the key holder was found (3 of 15). security.txt returns 404 on www.shodan.io, and no bug bounty, disclosure policy, SOC 2 or ISO 27001 was found on the pages read (0 of 20). 10 + 3 + 3 + 3 + 0 = 19.

WhoisXML API 39

An API key with no scopes found, accepted as an apiKey query parameter that overrides the Authorization header, or as a Bearer token including a server-to-server OAuth token; an IP allowlist can be set on the account (20 less 10 for the query string, plus 4 for OAuth and the allowlist, so 14). Every call is a read and the MCP server has no write tools, but there is no read-only or restricted key (12 of 20). Records include raw registrar text from third parties with no guidance on treating it as untrusted (5 of 15). The MCP server's account_balance tool reports credits per product and the account page shows usage, with no per-call log documented (5 of 15). security.txt returns 404, no disclosure policy, bug bounty or certification was found, and the payment page names only a PCI-compliant card processor (3 of 20). 14 + 12 + 5 + 5 + 3 = 39.

Shodan 44

Editorial half. A closed service whose terms at static.shodan.io/legal/terms.html were not read, because that host answers 403 to robots.txt, so their clarity can't be assessed; the Python library is MIT (5 of 30). The privacy policy at account.shodan.io/privacy carries no date, names no legal entity, retention period, data location or subprocessor, and says Shodan may share information with advertisers, business partners, sponsors and other third parties (5 of 30). The help centre says export credits are deprecated and no longer sold, with no date; no deprecation policy found (3 of 20). No subprocessors or data locations disclosed (0 of 20). 5 + 5 + 3 + 0 = 13.

WhoisXML API 60

A closed service with clear terms naming Whois API, Inc. and California law, though they confine data to one site, bar sharing it and forbid AI training on it (15 of 30). The privacy policy was last modified on 6 April 2020, cites the Privacy Shield frameworks, keeps data as long as there is a reasonable basis, and names no DPA (6 of 30). Deprecated parameters are listed and still accepted, with no notice periods or policy (8 of 20). No subprocessors or data locations are named (2 of 20). 15 + 6 + 8 + 2 = 31.

Shodan 40

No x402, MPP or L402 (0). Plan prices and credit quotas are public on the billing page without a login, from a $49 one-time Membership to $1,099 a month, sold by monthly credit quota rather than per call (10). A free account with a free API plan, and the billing page does not ask for a card (20). The REST API key comes from a browser signup. InternetDB and CVEDB answer with no account or key at all, for non-commercial use, which is keyless use of part of the surface (10 of 20). 0 + 10 + 20 + 10 = 40.

WhoisXML API 25

No x402, MPP or L402 (0). The only public price is from $129 a month for a universal credit pool; per-credit rates are behind a calculator whose output was not read and enterprise packages are by sales (5 of 20). 500 free WHOIS credits on signup with no card (20). The key comes from the account after a browser signup and no key API was found (0). 0 + 5 + 20 + 0 = 25.