{ "data": { "a": { "slug": "shodan", "name": "Shodan", "vendor": "Shodan", "vendorUrl": "https://www.shodan.io", "kind": "http-api", "category": "security-intelligence", "summary": "Shodan is a search engine for internet-connected devices. Its REST API returns the open ports, banners, certificates and known vulnerabilities of an IP address, searches the index by filter, scans ranges on demand and monitors networks for change.", "url": "https://www.anchorterminal.com/tools/shodan", "markdownUrl": "https://www.anchorterminal.com/tools/shodan.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/shodan.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/shodan.json", "dns": "shodan.grade.anchorterminal.com", "repo": "https://github.com/achillean/shodan-python", "license": "Proprietary service. The official Python library and CLI in achillean/shodan-python are MIT", "transports": [ "http" ], "remoteUrl": "https://api.shodan.io", "packages": [ { "registry": "pypi", "name": "shodan" } ], "auth": "api-key", "authNotes": "One API key per account, shown after a browser signup for a free account. Every documented call sends it as `key=` in the query string, the only method the API reference and the OpenAPI document show. No scopes, no read-only keys and no header option were found. The free API plan allows unfiltered searches and counts; host lookups need at least a one-time Membership, and scanning needs a plan with scan credits (checked 2026-11-03).", "pricing": "freemium", "pricingNotes": "Free account with a free API plan. Membership $49 one time (100 query and 100 scan credits a month, 16 monitored IPs). Freelancer $69 a month (10,000 query credits, 5,120 scan credits), Small Business $359 (200,000 and 65,536), Corporate $1,099 (unlimited query credits, 327,680 scan credits), Enterprise by contact. One query credit is 100 results of a filtered or paged search, one scan credit is one IP. All API plans are limited to 1 request a second (https://account.shodan.io/billing). InternetDB and CVEDB are keyless and free for non-commercial use.", "priceSummary": "$49 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the API reference, the OpenAPI document, the billing page or the help centre (checked 2026-11-03). Plans are bought in a browser at account.shodan.io.", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 3463, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-03" }, "docsUrl": "https://developer.shodan.io/api", "openapi": "https://developer.shodan.io/api/openapi.json", "capabilities": [ "secintel.exposure", "secintel.ip-enrichment", "secintel.dns", "secintel.indicators" ], "tags": [ "hosted", "freemium", "api-key", "free-tier", "openapi", "python", "cli", "security" ], "lastRelease": "2023-12-17", "graded": true, "anchor": { "graded": true, "score": 39.5, "grade": "E", "agentReady": false, "rank": 1218, "ranked": true, "rankOf": 1349, "categoryRank": 8, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 64, "maintenance": 16, "payments": 40, "reliability": 40, "schema": 46, "security": 19, "transparency": 44 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-03" }, "negative": 0, "verdict": "One GET endpoint per job returns ports, banners and vulnerabilities for an IP, with `minify` and `fields` to trim responses and public plan prices from a $49 one-time Membership. The key travels only in the query string with no scopes, 429 handling is undocumented, the terms were unreadable and the official library's last release was December 2023.", "bestFor": "An agent that needs to know what is exposed on an IP or a range, which ports, products and CVEs, and to watch a network for change.", "strengths": [ "Host lookup returns ports, banners, certificates, hostnames, tags and known CVEs for an IP, with `history=true` for every banner ever seen", "`minify` on host lookups and search, and `fields` on search, cut responses to the fields an agent needs; results page 100 at a time", "Public OpenAPI 3.0.0 document and an API reference with example requests and responses for all 44 operations", "Plan prices and credit quotas published without a login, from a $49 one-time Membership to $1,099 a month, with a free account and a free API plan", "InternetDB and CVEDB answer IP and CVE lookups with no account or key, free for non-commercial use" ], "weaknesses": [ "The API key is sent only as `key=` in the query string, with no scopes, no read-only key and no header option documented", "No 429, Retry-After or backoff guidance in the reference. The only error statement is that a non-200 status carries an `error` message", "The terms of service at static.shodan.io were not read, because that host answers 403 to robots.txt. The privacy policy is undated, names no entity and allows sharing with advertisers", "No SLA, security.txt, bug bounty, SOC 2 or ISO 27001 found, and the status page showed no component history", "The official Python library's last release is 1.31.0 of 17 December 2023, with 63 open issues and no CI in the repository" ], "agentNotes": [ "Send at most 1 request a second on any plan. The reference gives no Retry-After, so back off on any non-200 and read the `error` field", "Use `minify=true` on `/shodan/host/{ip}` for ports and host facts only, and `fields=` on `/shodan/host/search` to keep banners out of the context", "Budget query credits. Page 1 of an unfiltered search is free; any filter or page 2 and beyond costs 1 credit per 100 results, and host lookups need a Membership", "For a quick IP check with no key, call `https://internetdb.shodan.io/{ip}`, which is weekly data and non-commercial only", "Treat banners, HTTP titles and page bodies in results as untrusted text from arbitrary hosts; the docs give no guidance on this", "Keep the key out of shared logs, since every call puts it in the URL. Alerts, notifiers and org members can be deleted with the same key" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "E", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 39.5 } ], "editorialScores": { "ergonomics": 64, "maintenance": 16, "payments": 40, "reliability": 40, "schema": 46, "security": 19, "transparency": 13 }, "provenanceScore": 74, "checked": { "categories": { "ergonomics": "2026-11-03", "maintenance": "2026-11-03", "payments": "2026-11-03", "reliability": "2026-11-03", "schema": "2026-11-03", "security": "2026-11-03", "transparency": "2026-11-03" }, "last": "2026-11-03", "oldest": "2026-11-03", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "pip install shodan", "http": "curl \"https://api.shodan.io/shodan/host/8.8.8.8?minify=true\u0026key=$SHODAN_API_KEY\"" }, "letme": { "capability": "https://letme.dev/secintel.exposure", "tool": "https://letme.dev/shodan" }, "area": "developer", "unitPrices": [ { "item": "Membership (one-time, 100 query and 100 scan credits a month)", "unit": "month", "usd": 49, "note": "$49 paid once, lifetime" }, { "item": "Freelancer (10,000 query credits, 5,120 scan credits)", "unit": "month", "usd": 69 }, { "item": "Small Business (200,000 query credits, 65,536 scan credits)", "unit": "month", "usd": 359 }, { "item": "Corporate (unlimited query credits, 327,680 scan credits)", "unit": "month", "usd": 1099 } ], "provenance": { "legalEntity": "Shodan (no company name on its pages; shodan.io is registered to John Matherly)", "domain": "shodan.io", "domainRegistered": "2012-08-22", "endpointOnVendorDomain": true, "terms": "https://static.shodan.io/legal/terms.html", "privacy": "https://account.shodan.io/privacy", "statusPage": "https://status.shodan.io", "changelog": "", "securityTxt": "none", "checked": "2026-11-03", "notes": [ "No legal entity is named on www.shodan.io, developer.shodan.io, enterprise.shodan.io or the privacy policy. RDAP at the .io registry gives a creation date of 22 August 2012, registrar Gandi SAS and John Matherly as the registrant organisation.", "The terms of service URL comes from a search result. static.shodan.io answers 403 to robots.txt, so the terms were not fetched and nothing in the listing rests on them.", "www.shodan.io/robots.txt disallows /domain/ for all crawlers with a crawl delay of 10 seconds. developer.shodan.io, account.shodan.io and help.shodan.io have no robots.txt (404). blog.shodan.io disallows only /ghost/.", "The privacy policy is undated, names no entity, retention period, data location or subprocessor, and says Shodan may share information with advertisers, business partners, sponsors and other third parties.", "/.well-known/security.txt returns 404 on www.shodan.io. No bug bounty, SOC 2 or ISO 27001 found on the pages read.", "No API changelog found. blog.shodan.io is the only dated record of changes, and its newest post is 7 August 2024." ], "score": 74 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/shodan.json", "live": { "slug": "shodan", "probe": { "target": "https://api.shodan.io", "method": "get", "lastAt": "2026-11-04T21:28:12.712911599Z", "lastOk": true, "lastStatus": 404, "lastMs": 245, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 231, "p95ms24h": 355, "samples24h": 62, "samples30d": 62, "days": [ { "date": "2026-11-04", "probes": 62, "ok": 62 } ] }, "vendorStatus": { "page": "https://status.shodan.io", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-04T21:26:45.492889572Z" }, "versions": [ { "registry": "github", "name": "achillean/shodan-python", "version": "1.28.0", "released": "2022-07-09", "seenAt": "2026-11-04T20:54:46.879651275Z" }, { "registry": "pypi", "name": "shodan", "version": "1.31.0", "released": "2023-12-17", "seenAt": "2026-11-04T20:54:46.658127963Z" } ], "githubStars": 3466, "pypiWeekly": 132377, "securityTxt": { "url": "https://shodan.io/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-04T15:54:49.622046628Z" }, "updatedAt": "2026-11-04T21:28:12.712911599Z" } }, "answer": "WhoisXML API scores 56.8 (C) on agent readiness against Shodan's 39.5 (E), and leads in 6 of 7 scored categories. Shodan leads on payments \u0026 pricing.", "b": { "slug": "whoisxml-api", "name": "WhoisXML API", "vendor": "Whois API, Inc.", "vendorUrl": "https://www.whoisxmlapi.com", "kind": "http-api", "category": "security-intelligence", "summary": "WhoisXML API is a set of domain, DNS, IP and threat intelligence APIs from Whois API, Inc. Its WHOIS API returns parsed registration records for a domain or address, and a hosted MCP server bundles 35 tools on one balance.", "url": "https://www.anchorterminal.com/tools/whoisxml-api", "markdownUrl": "https://www.anchorterminal.com/tools/whoisxml-api.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/whoisxml-api.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/whoisxml-api.json", "dns": "whoisxml-api.grade.anchorterminal.com", "transports": [ "streamable-http", "stdio" ], "remoteUrl": "https://mcp-hosted.whoisxmlapi.com/mcp", "packages": [ { "registry": "npm", "name": "@whoisxmlapidotcom/mcp-whoisxmlapi" } ], "auth": "mixed", "authNotes": "API key from the account after a browser signup, sent as an `apiKey` query parameter (which takes priority) or as `Authorization: Bearer`, which also accepts a server-to-server OAuth token. An IP allowlist can be set (403 AUTHENTICATE_10). The hosted MCP server uses OAuth, taking the API key once in the connect flow; local installs take the key as an environment variable.", "pricing": "freemium", "pricingNotes": "500 free WHOIS API credits on signup with no card. A WHOIS lookup costs 1 credit, 5 with a forced real-time refresh. WXA.ONE universal credit pools, one balance across the APIs and the MCP server, start from $129 a month, monthly or yearly; per-credit rates sit behind a calculator and were not read. Enterprise packages and premium support by sales. Credits expire after 12 months and orders are non-refundable under the terms.", "priceSummary": "$129 / mo", "where": "both", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the WHOIS API docs, the pricing pages, the terms or the MCP server docs (checked 2026-11-03). An exhausted balance answers 401 AUTHENTICATE_05.", "endpoints": [] }, "toolCount": 35, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-03" }, "docsUrl": "https://whois.whoisxmlapi.com/documentation/making-requests", "llmsTxt": "https://www.whoisxmlapi.com/llms.txt", "registryName": "io.github.whois-api-llc/mcp-whoisxmlapi", "capabilities": [ "secintel.dns", "secintel.reputation", "secintel.ip-enrichment", "secintel.indicators" ], "tags": [ "hosted", "freemium", "no-card", "free-tier", "api-key", "oauth", "mcp", "remote-mcp", "official", "mcp-registry", "llms-txt", "status-page", "prepaid", "typescript", "python", "go", "docker", "closed-source" ], "lastRelease": "2026-11-03", "graded": true, "anchor": { "graded": true, "score": 56.8, "grade": "C", "agentReady": false, "rank": 731, "ranked": true, "rankOf": 1349, "categoryRank": 5, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 65, "maintenance": 76, "payments": 25, "reliability": 65, "schema": 70, "security": 39, "transparency": 60 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-03" }, "negative": 0, "verdict": "500 free credits with no card, JSON Schema and XSD for every response, 429s with Retry-After, cache controls that set the price per lookup, and a 35-tool hosted MCP server with OAuth. Per-credit prices sit behind a calculator, the terms confine data to one site and forbid AI training on it, and the key is accepted in the query string.", "bestFor": "An agent investigating a domain's registration, history, DNS, certificates or related domains at scale, on a prepaid credit pool.", "strengths": [ "500 free WHOIS credits on signup with no card, and 1 credit a lookup from cache or 5 for a forced refresh", "JSON Schema and XSD documents for the record, availability and error responses, with an error code table and Retry-After on 429", "Each record carries audit.createdDate and audit.updatedDate, so an agent can tell when the copy was collected", "Official MCP server with 35 tools, hosted with OAuth, in the official MCP registry with 21 versions since May 2026", "llms.txt on whoisxmlapi.com lists the APIs, feeds and databases" ], "weaknesses": [ "Per-credit prices are not published outside a calculator; the only public figure is from $129 a month, and orders are non-refundable", "The terms license data for one site, bar sharing it with third parties and forbid AI model training on it without written authorisation", "The docs say 200 requests a second while the terms say 50, 20 concurrent and 5 concurrent bulk", "The key is accepted as a query parameter that overrides the header, no scopes were found, and security.txt returns 404", "The privacy policy was last modified on 6 April 2020, cites Privacy Shield, and names no processors, locations or retention periods", "No OpenAPI document, no API version, and the MCP server's source was not found" ], "agentNotes": [ "Send the key as `Authorization: Bearer` and `outputFormat=JSON`; the default output is XML and an `apiKey` query parameter overrides the header", "Leave the cache flags alone for 1 credit a lookup; `_hardRefresh=1` costs 5 credits, and `_dbOnly=1` returns WHOIS_03 when nothing is cached", "Read `audit.updatedDate` before trusting a record, and check `dataError` for MASKED_WHOIS_DATA or PARTIAL_DATA", "Watch `X-RateLimit-Remaining` and on 429 AUTHENTICATE_06 wait for `Retry-After`; a 401 AUTHENTICATE_05 means the balance is spent, so stop", "Keep results inside the customer's own systems; the terms forbid passing data to third parties or using it to train models" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 56.8 } ], "editorialScores": { "ergonomics": 65, "maintenance": 76, "payments": 25, "reliability": 65, "schema": 70, "security": 39, "transparency": 31 }, "provenanceScore": 89, "checked": { "categories": { "ergonomics": "2026-11-03", "maintenance": "2026-11-03", "payments": "2026-11-03", "reliability": "2026-11-03", "schema": "2026-11-03", "security": "2026-11-03", "transparency": "2026-11-03" }, "last": "2026-11-03", "oldest": "2026-11-03", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npx @whoisxmlapidotcom/mcp-whoisxmlapi --help", "http": "curl -H \"Authorization: Bearer $WHOISXML_API_KEY\" \"https://www.whoisxmlapi.com/whoisserver/WhoisService?domainName=example.com\u0026outputFormat=JSON\"", "claudeCode": "claude mcp add --transport http whoisxmlapi https://mcp-hosted.whoisxmlapi.com/mcp", "config": { "mcpServers": { "whoisxmlapi": { "url": "https://mcp-hosted.whoisxmlapi.com/mcp" } } } }, "letme": { "capability": "https://letme.dev/secintel.dns", "tool": "https://letme.dev/whoisxml-api" }, "area": "developer", "unitPrices": [ { "item": "WXA.ONE universal credit pool, smallest plan", "unit": "month", "usd": 129, "note": "from $129 a month; credits included and per-credit rates were not read" } ], "provenance": { "legalEntity": "Whois API, Inc.", "domain": "whoisxmlapi.com", "domainRegistered": "2009-03-20", "endpointOnVendorDomain": true, "terms": "https://main.whoisxmlapi.com/terms-of-service", "privacy": "https://main.whoisxmlapi.com/privacy-policy", "statusPage": "https://main.whoisxmlapi.com/api-status", "changelog": "https://main.whoisxmlapi.com/press-release", "securityTxt": "none", "checked": "2026-11-03", "notes": [ "The terms of service, last updated 3 March 2025 and effective 3 May 2025, name Whois API, Inc. under California law with AAA arbitration. The company page's copyright line reads 2010 to 2026 Whois API, Inc. No postal address was found on the terms, privacy policy or company page.", "The terms forbid unauthorised data mining and obtaining materials through means not intentionally made available, and set a rate limit of 50 requests a second. Public pages were read for this listing and the clauses are recorded as facts.", "whois.whoisxmlapi.com/robots.txt allows all paths for general crawlers and blocks five named bots. www.whoisxmlapi.com/robots.txt disallows blog admin paths and /BulkWhoisLookup/, none fetched. www.whoisxmlapi.com/terms-of-service redirects to a 404; the terms live at main.whoisxmlapi.com.", "The status page is the vendor's own Service Status and Data Releases page, which describes a JSON status file and feeds but lists no incidents.", "The changelog link is the press release page, whose newest product update is dated 9 May 2025. MCP server versions are dated in the official MCP registry.", "main.whoisxmlapi.com/.well-known/security.txt returns 404. RDAP at Verisign gives a registration date of 20 March 2009." ], "score": 89 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/whoisxml-api.json", "live": { "slug": "whoisxml-api", "probe": { "target": "https://mcp-hosted.whoisxmlapi.com/mcp", "method": "get", "lastAt": "2026-11-04T21:28:20.437933986Z", "lastOk": true, "lastStatus": 401, "lastMs": 391, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 413, "p95ms24h": 537, "samples24h": 62, "samples30d": 62, "days": [ { "date": "2026-11-04", "probes": 62, "ok": 62 } ] }, "vendorStatus": { "page": "https://main.whoisxmlapi.com/api-status", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-04T21:26:59.259669881Z" }, "versions": [ { "registry": "mcp-registry", "name": "io.github.whois-api-llc/mcp-whoisxmlapi", "version": "1.15.0", "seenAt": "2026-11-04T17:11:44.552009456Z" }, { "registry": "npm", "name": "@whoisxmlapidotcom/mcp-whoisxmlapi", "version": "1.15.0", "seenAt": "2026-11-04T21:06:02.286471255Z" } ], "npmWeekly": 1559, "securityTxt": { "url": "https://whoisxmlapi.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-04T15:53:49.350283946Z" }, "updatedAt": "2026-11-04T21:28:20.437933986Z" } }, "edges": [ { "by": 60, "category": "maintenance", "leads": "whoisxml-api", "name": "Maintenance \u0026 community", "reasons": { "a": "No dated API change found. The blog's newest post is 7 August 2024, and the official Python library `shodan` 1.31.0 was published on 17 December 2023 with the repository's last push on 5 August 2024 (0 of 30). No releases or dated changelog entries in the last 90 days (0 of 20). 63 open issues on the Python repository with no push since August 2024; a support email and a help centre exist (5 of 25). The official Python SDK still installs but is two years old, and the other clients are community work (8 of 15). The repository has no CI configuration and no CHANGELOG entry since 1.28.0 of July 2022 (3 of 10). 0 + 0 + 5 + 8 + 3 = 16.", "b": "Read as a closed service with an official MCP server. MCP server 1.13.0 was published in the official registry on 3 November 2026 and the ProfessionalServices and ipgeo-community repositories were pushed the same day (30). 1.8.6 on 8 September through 1.13.0 on 3 November 2026 is nine registry versions in 90 days (20). Product updates are summarised in yearly press releases, the newest 9 May 2025, support is a contact form with tiered response times sold separately, and the client library repositories were last pushed in 2023 (8 of 15). The MCP server is in the official registry under io.github.whois-api-llc, and official Python and Go clients exist (15). The MCP server's source was not found on GitHub, and the SDK repositories show no activity since 2023 (3 of 10). 30 + 20 + 8 + 15 + 3 = 76." }, "scores": { "a": 16, "b": 76 } }, { "by": 25, "category": "reliability", "leads": "whoisxml-api", "name": "Reliability", "reasons": { "a": "Read with the hosted lines. A public status page exists at status.shodan.io (UptimeRobot), but on 3 November 2026 its component list failed to load and it showed only that there were no updates in the last 7 days, so no component history was readable (10 of 20). No readable incident record for the 90 days (5). The billing page states that all API plans are limited to 1 request a second, and credits per plan are published with numbers (15). No 429, Retry-After or backoff guidance was found in the reference or the OpenAPI document; the only error statement is that a non-200 status carries an error message, and no idempotency keys exist for alert, notifier or scan writes. The official Python client throttles itself to 1 request a second and retries a timed-out search cursor, which is client behaviour, not an API contract (0). No SLA found on the billing, enterprise or developer pages (0). The REST API is generally available (10). 10 + 5 + 15 + 0 + 0 + 10 = 40.", "b": "Read with the hosted lines. The vendor's own Service Status and Data Releases page is linked from the docs and describes a per-API JSON status file with four levels (20). It shows no incident history and the status file's live values could not be read, so no 90-day record (5). The docs give 200 requests a second with rejection until the next second; the terms give 50 a second, 20 concurrent and 5 concurrent bulk requests, so numbers are published even though they disagree (15). A 429 AUTHENTICATE_06 carries Retry-After and every response X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, with guidance to slow before zero; all calls are reads (15). No SLA; the terms guarantee no minimum uptime and cite a historical 99.9 per cent, with enterprise SLAs by separate agreement (0). The API is generally available (10). 20 + 5 + 15 + 15 + 0 + 10 = 65." }, "scores": { "a": 40, "b": 65 } }, { "by": 24, "category": "schema", "leads": "whoisxml-api", "name": "Schema \u0026 documentation", "reasons": { "a": "The surface graded is the REST API at api.shodan.io. An OpenAPI 3.0.0 document at developer.shodan.io/api/openapi.json covers 37 paths and 44 operations, but declares no securitySchemes, no enums and a non-200 response on one operation only (15 of 25). No llms.txt on developer.shodan.io or www.shodan.io, both 404, and no Markdown docs served for agents (0 of 10). Every operation carries a description, and the reference says which calls cost credits and which plans can scan, with little on when not to use a call (12 of 20). Required flags on the key and path parameters, with `facets`, `query` and `fields` as free strings and no enums or constraints (7 of 15). Example requests and responses for every endpoint in the reference, and errors documented only as a non-200 status with an `error` field (9 of 15). No version in the path, the OpenAPI document says 1.0.0, and the only dated record of changes is the blog, whose newest post is 7 August 2024 (3 of 15). 15 + 0 + 12 + 7 + 9 + 3 = 46.", "b": "The surface graded is the WHOIS API, with the hosted MCP server noted. No OpenAPI document. JSON Schema draft-07 and XSD files define the WHOIS record, the DomainInfo response and the error body, and a Postman collection is published (15 of 25). llms.txt on www.whoisxmlapi.com lists the APIs, databases and feeds (10). The making-requests page states each parameter's purpose, default and credit cost, lists deprecated parameters that are still accepted, and says when RDAP applies, with little on when not to call (15 of 20). rdap, outputFormat and the cache flags have enumerated values and the record schema is typed, but unknown parameters are ignored silently and the output page gives no types in prose (11 of 15). Request examples, example records and an error table with HTTP status, errorCode and message (12 of 15). No API version and no changelog for the API; press releases summarise product updates yearly, the newest dated 9 May 2025, and the MCP server's versions are dated in the registry (7 of 15). 15 + 10 + 15 + 11 + 12 + 7 = 70." }, "scores": { "a": 46, "b": 70 } }, { "by": 20, "category": "security", "leads": "whoisxml-api", "name": "Security \u0026 auth", "reasons": { "a": "One key per account with no scopes, sent as `key=` in the query string on every documented call and in the OpenAPI document, with no header option. Read as a plain key, the way the Alpha Vantage listing was read, less 10 for the query string (10 of 30). No read-only key or least-privilege mode; the free plan's limits are quotas, not scopes, and alerts, notifiers and org members can be deleted with the same key and no confirmation (3 of 20). Results carry banners, HTTP titles and page bodies collected from arbitrary hosts, and no guidance on treating them as untrusted was found (3 of 15). `/api-info` reports the plan and credits, and no call log for the key holder was found (3 of 15). security.txt returns 404 on www.shodan.io, and no bug bounty, disclosure policy, SOC 2 or ISO 27001 was found on the pages read (0 of 20). 10 + 3 + 3 + 3 + 0 = 19.", "b": "An API key with no scopes found, accepted as an apiKey query parameter that overrides the Authorization header, or as a Bearer token including a server-to-server OAuth token; an IP allowlist can be set on the account (20 less 10 for the query string, plus 4 for OAuth and the allowlist, so 14). Every call is a read and the MCP server has no write tools, but there is no read-only or restricted key (12 of 20). Records include raw registrar text from third parties with no guidance on treating it as untrusted (5 of 15). The MCP server's account_balance tool reports credits per product and the account page shows usage, with no per-call log documented (5 of 15). security.txt returns 404, no disclosure policy, bug bounty or certification was found, and the payment page names only a PCI-compliant card processor (3 of 20). 14 + 12 + 5 + 5 + 3 = 39." }, "scores": { "a": 19, "b": 39 } }, { "by": 16, "category": "transparency", "leads": "whoisxml-api", "name": "Transparency \u0026 trust", "reasons": { "a": "Editorial half. A closed service whose terms at static.shodan.io/legal/terms.html were not read, because that host answers 403 to robots.txt, so their clarity can't be assessed; the Python library is MIT (5 of 30). The privacy policy at account.shodan.io/privacy carries no date, names no legal entity, retention period, data location or subprocessor, and says Shodan may share information with advertisers, business partners, sponsors and other third parties (5 of 30). The help centre says export credits are deprecated and no longer sold, with no date; no deprecation policy found (3 of 20). No subprocessors or data locations disclosed (0 of 20). 5 + 5 + 3 + 0 = 13.", "b": "A closed service with clear terms naming Whois API, Inc. and California law, though they confine data to one site, bar sharing it and forbid AI training on it (15 of 30). The privacy policy was last modified on 6 April 2020, cites the Privacy Shield frameworks, keeps data as long as there is a reasonable basis, and names no DPA (6 of 30). Deprecated parameters are listed and still accepted, with no notice periods or policy (8 of 20). No subprocessors or data locations are named (2 of 20). 15 + 6 + 8 + 2 = 31." }, "scores": { "a": 44, "b": 60 } }, { "by": 15, "category": "payments", "leads": "shodan", "name": "Payments \u0026 pricing", "reasons": { "a": "No x402, MPP or L402 (0). Plan prices and credit quotas are public on the billing page without a login, from a $49 one-time Membership to $1,099 a month, sold by monthly credit quota rather than per call (10). A free account with a free API plan, and the billing page does not ask for a card (20). The REST API key comes from a browser signup. InternetDB and CVEDB answer with no account or key at all, for non-commercial use, which is keyless use of part of the surface (10 of 20). 0 + 10 + 20 + 10 = 40.", "b": "No x402, MPP or L402 (0). The only public price is from $129 a month for a universal credit pool; per-credit rates are behind a calculator whose output was not read and enterprise packages are by sales (5 of 20). 500 free WHOIS credits on signup with no card (20). The key comes from the account after a browser signup and no key API was found (0). 0 + 5 + 20 + 0 = 25." }, "scores": { "a": 40, "b": 25 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Shodan", "b": "Whois API, Inc.", "name": "Vendor" }, { "a": "https://api.shodan.io", "b": "https://mcp-hosted.whoisxmlapi.com/mcp", "name": "Hosted endpoint" }, { "a": "HTTP", "b": "Streamable HTTP, stdio", "name": "Transports" }, { "a": "API key", "b": "OAuth or key", "name": "Auth" }, { "a": "Freemium", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Proprietary service. The official Python library and CLI in achillean/shodan-python are MIT", "b": "none", "name": "Licence" }, { "a": "none", "b": "35", "name": "Tools exposed" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "no", "b": "yes", "name": "llms.txt" }, { "a": "not listed", "b": "io.github.whois-api-llc/mcp-whoisxmlapi", "name": "MCP registry" }, { "a": "2023-12-17", "b": "2026-11-03", "name": "Last release" }, { "a": "no date given", "b": "2025-03-03", "name": "Terms last updated" }, { "a": "no date given", "b": "2020-04-06", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "yes", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "yes", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "3.5k stars", "b": "none", "name": "Popularity" } ], "faq": [ { "answer": "WhoisXML API scores 56.8 (C) on agent readiness against Shodan's 39.5 (E), and leads in 6 of 7 scored categories. Shodan leads on payments \u0026 pricing.", "question": "Which is better for AI agents, Shodan or WhoisXML API?" }, { "answer": "Shodan needs an API key. WhoisXML API takes an API key or an OAuth sign-in.", "question": "Do Shodan and WhoisXML API need an API key?" }, { "answer": "Yes. Shodan has a hosted endpoint at https://api.shodan.io and WhoisXML API at https://mcp-hosted.whoisxmlapi.com/mcp.", "question": "Can an agent call Shodan and WhoisXML API without installing anything?" } ], "goodFor": [ { "aheadOn": [ "Payments \u0026 pricing, 40 against 25" ], "also": null, "goodFor": "An agent that needs to know what is exposed on an IP or a range, which ports, products and CVEs, and to watch a network for change.", "slug": "shodan", "watchFor": "The API key is sent only as `key=` in the query string, with no scopes, no read-only key and no header option documented" }, { "aheadOn": [ "Reliability, 65 against 40", "Schema \u0026 documentation, 70 against 46", "Security \u0026 auth, 39 against 19", "Maintenance \u0026 community, 76 against 16", "Transparency \u0026 trust, 60 against 44" ], "also": [ "Runs on your own machine", "Free to start without a card" ], "goodFor": "An agent investigating a domain's registration, history, DNS, certificates or related domains at scale, on a prepaid credit pool.", "slug": "whoisxml-api", "watchFor": "Per-credit prices are not published outside a calculator; the only public figure is from $129 a month, and orders are non-refundable" } ], "history": null, "job": { "capability": "secintel.dns", "name": "Secintel dns" }, "others": [ { "json": "https://www.anchorterminal.com/compare/abuseipdb-vs-whoisxml-api.json", "title": "AbuseIPDB vs WhoisXML API", "url": "https://www.anchorterminal.com/compare/abuseipdb-vs-whoisxml-api" }, { "json": "https://www.anchorterminal.com/compare/greynoise-vs-whoisxml-api.json", "title": "GreyNoise vs WhoisXML API", "url": "https://www.anchorterminal.com/compare/greynoise-vs-whoisxml-api" }, { "json": "https://www.anchorterminal.com/compare/virustotal-vs-whoisxml-api.json", "title": "VirusTotal vs WhoisXML API", "url": "https://www.anchorterminal.com/compare/virustotal-vs-whoisxml-api" }, { "json": "https://www.anchorterminal.com/compare/greynoise-vs-shodan.json", "title": "GreyNoise vs Shodan", "url": "https://www.anchorterminal.com/compare/greynoise-vs-shodan" }, { "json": "https://www.anchorterminal.com/compare/ipinfo-vs-shodan.json", "title": "IPinfo vs Shodan", "url": "https://www.anchorterminal.com/compare/ipinfo-vs-shodan" }, { "json": "https://www.anchorterminal.com/compare/ipinfo-vs-whoisxml-api.json", "title": "IPinfo vs WhoisXML API", "url": "https://www.anchorterminal.com/compare/ipinfo-vs-whoisxml-api" }, { "json": "https://www.anchorterminal.com/compare/censys-vs-whoisxml-api.json", "title": "Censys vs WhoisXML API", "url": "https://www.anchorterminal.com/compare/censys-vs-whoisxml-api" }, { "json": "https://www.anchorterminal.com/compare/securitytrails-vs-shodan.json", "title": "SecurityTrails vs Shodan", "url": "https://www.anchorterminal.com/compare/securitytrails-vs-shodan" }, { "json": "https://www.anchorterminal.com/compare/securitytrails-vs-whoisxml-api.json", "title": "SecurityTrails vs WhoisXML API", "url": "https://www.anchorterminal.com/compare/securitytrails-vs-whoisxml-api" }, { "json": "https://www.anchorterminal.com/compare/abuseipdb-vs-shodan.json", "title": "AbuseIPDB vs Shodan", "url": "https://www.anchorterminal.com/compare/abuseipdb-vs-shodan" }, { "json": "https://www.anchorterminal.com/compare/pulsedive-vs-shodan.json", "title": "Pulsedive vs Shodan", "url": "https://www.anchorterminal.com/compare/pulsedive-vs-shodan" }, { "json": "https://www.anchorterminal.com/compare/pulsedive-vs-whoisxml-api.json", "title": "Pulsedive vs WhoisXML API", "url": "https://www.anchorterminal.com/compare/pulsedive-vs-whoisxml-api" }, { "json": "https://www.anchorterminal.com/compare/censys-vs-shodan.json", "title": "Censys vs Shodan", "url": "https://www.anchorterminal.com/compare/censys-vs-shodan" } ], "panel": null, "scores": [ { "by": 25, "edge": "whoisxml-api", "key": "reliability", "name": "Reliability", "shodan": 40, "weight": 16, "whoisxml-api": 65 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 24, "edge": "whoisxml-api", "key": "schema", "name": "Schema \u0026 documentation", "shodan": 46, "weight": 13, "whoisxml-api": 70 }, { "by": 1, "edge": "whoisxml-api", "key": "ergonomics", "name": "Agent ergonomics", "shodan": 64, "weight": 13, "whoisxml-api": 65 }, { "by": 20, "edge": "whoisxml-api", "key": "security", "name": "Security \u0026 auth", "shodan": 19, "weight": 14, "whoisxml-api": 39 }, { "by": 15, "edge": "shodan", "key": "payments", "name": "Payments \u0026 pricing", "shodan": 40, "weight": 10, "whoisxml-api": 25 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 60, "edge": "whoisxml-api", "key": "maintenance", "name": "Maintenance \u0026 community", "shodan": 16, "weight": 7, "whoisxml-api": 76 }, { "by": 16, "edge": "whoisxml-api", "key": "transparency", "name": "Transparency \u0026 trust", "shodan": 44, "weight": 7, "whoisxml-api": 60 } ], "summary": "WhoisXML API scores 56.8 (C) on agent readiness against Shodan's 39.5 (E), and leads in 6 of 7 scored categories. Shodan leads on payments \u0026 pricing. Both do secintel dns.", "tasks": null, "tutorials": [], "verdicts": { "shodan": "One GET endpoint per job returns ports, banners and vulnerabilities for an IP, with `minify` and `fields` to trim responses and public plan prices from a $49 one-time Membership. The key travels only in the query string with no scopes, 429 handling is undocumented, the terms were unreadable and the official library's last release was December 2023.", "whoisxml-api": "500 free credits with no card, JSON Schema and XSD for every response, 429s with Retry-After, cache controls that set the price per lookup, and a 35-tool hosted MCP server with OAuth. Per-credit prices sit behind a calculator, the terms confine data to one site and forbid AI training on it, and the key is accepted in the query string." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/shodan-vs-whoisxml-api", "json": "https://www.anchorterminal.com/compare/shodan-vs-whoisxml-api.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/shodan-vs-whoisxml-api.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/shodan-vs-whoisxml-api.min.md" }, "markdown": "WhoisXML API scores 56.8 (C) on agent readiness against Shodan's 39.5 (E), and leads in 6 of 7 scored categories. Shodan leads on payments \u0026 pricing. Both do secintel dns.\n\n- Shodan: grade E, 39.5/100, rank #1218 of 1349. Markdown https://www.anchorterminal.com/tools/shodan.md · JSON https://www.anchorterminal.com/api/v1/tools/shodan.json\n- WhoisXML API: grade C, 56.8/100, rank #731 of 1349. Markdown https://www.anchorterminal.com/tools/whoisxml-api.md · JSON https://www.anchorterminal.com/api/v1/tools/whoisxml-api.json\n- Best threat and security intelligence APIs for AI agents: https://www.anchorterminal.com/best/security-intelligence/index.md\n- All 33 security intel comparisons: https://www.anchorterminal.com/compare/security-intelligence/index.md\n\n## Which one, for what\n\n### Shodan (E)\n\nGood for: An agent that needs to know what is exposed on an IP or a range, which ports, products and CVEs, and to watch a network for change.\n\nAhead on:\n- Payments \u0026 pricing, 40 against 25\n\nWatch for: The API key is sent only as `key=` in the query string, with no scopes, no read-only key and no header option documented\n\n### WhoisXML API (C)\n\nGood for: An agent investigating a domain's registration, history, DNS, certificates or related domains at scale, on a prepaid credit pool.\n\nAhead on:\n- Reliability, 65 against 40\n- Schema \u0026 documentation, 70 against 46\n- Security \u0026 auth, 39 against 19\n- Maintenance \u0026 community, 76 against 16\n- Transparency \u0026 trust, 60 against 44\n\nAlso in its favour:\n- Runs on your own machine\n- Free to start without a card\n\nWatch for: Per-credit prices are not published outside a calculator; the only public figure is from $129 a month, and orders are non-refundable\n\n\n## Why the edge\n\n### Maintenance \u0026 community: WhoisXML API +60\n\n- Shodan (16): No dated API change found. The blog's newest post is 7 August 2024, and the official Python library `shodan` 1.31.0 was published on 17 December 2023 with the repository's last push on 5 August 2024 (0 of 30). No releases or dated changelog entries in the last 90 days (0 of 20). 63 open issues on the Python repository with no push since August 2024; a support email and a help centre exist (5 of 25). The official Python SDK still installs but is two years old, and the other clients are community work (8 of 15). The repository has no CI configuration and no CHANGELOG entry since 1.28.0 of July 2022 (3 of 10). 0 + 0 + 5 + 8 + 3 = 16.\n- WhoisXML API (76): Read as a closed service with an official MCP server. MCP server 1.13.0 was published in the official registry on 3 November 2026 and the ProfessionalServices and ipgeo-community repositories were pushed the same day (30). 1.8.6 on 8 September through 1.13.0 on 3 November 2026 is nine registry versions in 90 days (20). Product updates are summarised in yearly press releases, the newest 9 May 2025, support is a contact form with tiered response times sold separately, and the client library repositories were last pushed in 2023 (8 of 15). The MCP server is in the official registry under io.github.whois-api-llc, and official Python and Go clients exist (15). The MCP server's source was not found on GitHub, and the SDK repositories show no activity since 2023 (3 of 10). 30 + 20 + 8 + 15 + 3 = 76.\n\n### Reliability: WhoisXML API +25\n\n- Shodan (40): Read with the hosted lines. A public status page exists at status.shodan.io (UptimeRobot), but on 3 November 2026 its component list failed to load and it showed only that there were no updates in the last 7 days, so no component history was readable (10 of 20). No readable incident record for the 90 days (5). The billing page states that all API plans are limited to 1 request a second, and credits per plan are published with numbers (15). No 429, Retry-After or backoff guidance was found in the reference or the OpenAPI document; the only error statement is that a non-200 status carries an error message, and no idempotency keys exist for alert, notifier or scan writes. The official Python client throttles itself to 1 request a second and retries a timed-out search cursor, which is client behaviour, not an API contract (0). No SLA found on the billing, enterprise or developer pages (0). The REST API is generally available (10). 10 + 5 + 15 + 0 + 0 + 10 = 40.\n- WhoisXML API (65): Read with the hosted lines. The vendor's own Service Status and Data Releases page is linked from the docs and describes a per-API JSON status file with four levels (20). It shows no incident history and the status file's live values could not be read, so no 90-day record (5). The docs give 200 requests a second with rejection until the next second; the terms give 50 a second, 20 concurrent and 5 concurrent bulk requests, so numbers are published even though they disagree (15). A 429 AUTHENTICATE_06 carries Retry-After and every response X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, with guidance to slow before zero; all calls are reads (15). No SLA; the terms guarantee no minimum uptime and cite a historical 99.9 per cent, with enterprise SLAs by separate agreement (0). The API is generally available (10). 20 + 5 + 15 + 15 + 0 + 10 = 65.\n\n### Schema \u0026 documentation: WhoisXML API +24\n\n- Shodan (46): The surface graded is the REST API at api.shodan.io. An OpenAPI 3.0.0 document at developer.shodan.io/api/openapi.json covers 37 paths and 44 operations, but declares no securitySchemes, no enums and a non-200 response on one operation only (15 of 25). No llms.txt on developer.shodan.io or www.shodan.io, both 404, and no Markdown docs served for agents (0 of 10). Every operation carries a description, and the reference says which calls cost credits and which plans can scan, with little on when not to use a call (12 of 20). Required flags on the key and path parameters, with `facets`, `query` and `fields` as free strings and no enums or constraints (7 of 15). Example requests and responses for every endpoint in the reference, and errors documented only as a non-200 status with an `error` field (9 of 15). No version in the path, the OpenAPI document says 1.0.0, and the only dated record of changes is the blog, whose newest post is 7 August 2024 (3 of 15). 15 + 0 + 12 + 7 + 9 + 3 = 46.\n- WhoisXML API (70): The surface graded is the WHOIS API, with the hosted MCP server noted. No OpenAPI document. JSON Schema draft-07 and XSD files define the WHOIS record, the DomainInfo response and the error body, and a Postman collection is published (15 of 25). llms.txt on www.whoisxmlapi.com lists the APIs, databases and feeds (10). The making-requests page states each parameter's purpose, default and credit cost, lists deprecated parameters that are still accepted, and says when RDAP applies, with little on when not to call (15 of 20). rdap, outputFormat and the cache flags have enumerated values and the record schema is typed, but unknown parameters are ignored silently and the output page gives no types in prose (11 of 15). Request examples, example records and an error table with HTTP status, errorCode and message (12 of 15). No API version and no changelog for the API; press releases summarise product updates yearly, the newest dated 9 May 2025, and the MCP server's versions are dated in the registry (7 of 15). 15 + 10 + 15 + 11 + 12 + 7 = 70.\n\n### Security \u0026 auth: WhoisXML API +20\n\n- Shodan (19): One key per account with no scopes, sent as `key=` in the query string on every documented call and in the OpenAPI document, with no header option. Read as a plain key, the way the Alpha Vantage listing was read, less 10 for the query string (10 of 30). No read-only key or least-privilege mode; the free plan's limits are quotas, not scopes, and alerts, notifiers and org members can be deleted with the same key and no confirmation (3 of 20). Results carry banners, HTTP titles and page bodies collected from arbitrary hosts, and no guidance on treating them as untrusted was found (3 of 15). `/api-info` reports the plan and credits, and no call log for the key holder was found (3 of 15). security.txt returns 404 on www.shodan.io, and no bug bounty, disclosure policy, SOC 2 or ISO 27001 was found on the pages read (0 of 20). 10 + 3 + 3 + 3 + 0 = 19.\n- WhoisXML API (39): An API key with no scopes found, accepted as an apiKey query parameter that overrides the Authorization header, or as a Bearer token including a server-to-server OAuth token; an IP allowlist can be set on the account (20 less 10 for the query string, plus 4 for OAuth and the allowlist, so 14). Every call is a read and the MCP server has no write tools, but there is no read-only or restricted key (12 of 20). Records include raw registrar text from third parties with no guidance on treating it as untrusted (5 of 15). The MCP server's account_balance tool reports credits per product and the account page shows usage, with no per-call log documented (5 of 15). security.txt returns 404, no disclosure policy, bug bounty or certification was found, and the payment page names only a PCI-compliant card processor (3 of 20). 14 + 12 + 5 + 5 + 3 = 39.\n\n### Transparency \u0026 trust: WhoisXML API +16\n\n- Shodan (44): Editorial half. A closed service whose terms at static.shodan.io/legal/terms.html were not read, because that host answers 403 to robots.txt, so their clarity can't be assessed; the Python library is MIT (5 of 30). The privacy policy at account.shodan.io/privacy carries no date, names no legal entity, retention period, data location or subprocessor, and says Shodan may share information with advertisers, business partners, sponsors and other third parties (5 of 30). The help centre says export credits are deprecated and no longer sold, with no date; no deprecation policy found (3 of 20). No subprocessors or data locations disclosed (0 of 20). 5 + 5 + 3 + 0 = 13.\n- WhoisXML API (60): A closed service with clear terms naming Whois API, Inc. and California law, though they confine data to one site, bar sharing it and forbid AI training on it (15 of 30). The privacy policy was last modified on 6 April 2020, cites the Privacy Shield frameworks, keeps data as long as there is a reasonable basis, and names no DPA (6 of 30). Deprecated parameters are listed and still accepted, with no notice periods or policy (8 of 20). No subprocessors or data locations are named (2 of 20). 15 + 6 + 8 + 2 = 31.\n\n### Payments \u0026 pricing: Shodan +15\n\n- Shodan (40): No x402, MPP or L402 (0). Plan prices and credit quotas are public on the billing page without a login, from a $49 one-time Membership to $1,099 a month, sold by monthly credit quota rather than per call (10). A free account with a free API plan, and the billing page does not ask for a card (20). The REST API key comes from a browser signup. InternetDB and CVEDB answer with no account or key at all, for non-commercial use, which is keyless use of part of the surface (10 of 20). 0 + 10 + 20 + 10 = 40.\n- WhoisXML API (25): No x402, MPP or L402 (0). The only public price is from $129 a month for a universal credit pool; per-credit rates are behind a calculator whose output was not read and enterprise packages are by sales (5 of 20). 500 free WHOIS credits on signup with no card (20). The key comes from the account after a browser signup and no key API was found (0). 0 + 5 + 20 + 0 = 25.\n\n## Score by category\n\n| Category | Weight | Shodan | WhoisXML API | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 40 | 65 | WhoisXML API +25 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 46 | 70 | WhoisXML API +24 |\n| Agent ergonomics | 13% (16.2 this run) | 64 | 65 | WhoisXML API +1 |\n| Security \u0026 auth | 14% (17.5 this run) | 19 | 39 | WhoisXML API +20 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 40 | 25 | Shodan +15 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 16 | 76 | WhoisXML API +60 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 44 | 60 | WhoisXML API +16 |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **39.5 · E** | **56.8 · C** | |\n\n## Facts side by side\n\n| Fact | Shodan | WhoisXML API |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Shodan | Whois API, Inc. |\n| Hosted endpoint | `https://api.shodan.io` | `https://mcp-hosted.whoisxmlapi.com/mcp` |\n| Transports | HTTP | Streamable HTTP, stdio |\n| Auth | API key | OAuth or key |\n| Pricing | Freemium | Freemium |\n| x402 | no | no |\n| Licence | Proprietary service. The official Python library and CLI in achillean/shodan-python are MIT | none |\n| Tools exposed | none | 35 |\n| Read-only variant documented | no | no |\n| llms.txt | no | yes |\n| MCP registry | not listed | `io.github.whois-api-llc/mcp-whoisxmlapi` |\n| Last release | 2023-12-17 | 2026-11-03 |\n| Terms last updated | no date given | 2025-03-03 |\n| Privacy policy last updated | no date given | 2020-04-06 |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | yes | not found in the text |\n| Terms restrict benchmarking | not found in the text | not found in the text |\n| Terms or service can change without notice | yes | not found in the text |\n| Arbitration or class-action waiver | not found in the text | yes |\n| Popularity | 3.5k stars | none |\n\n## Verdicts\n\n**Shodan.** One GET endpoint per job returns ports, banners and vulnerabilities for an IP, with `minify` and `fields` to trim responses and public plan prices from a $49 one-time Membership. The key travels only in the query string with no scopes, 429 handling is undocumented, the terms were unreadable and the official library's last release was December 2023.\n\n**WhoisXML API.** 500 free credits with no card, JSON Schema and XSD for every response, 429s with Retry-After, cache controls that set the price per lookup, and a 35-tool hosted MCP server with OAuth. Per-credit prices sit behind a calculator, the terms confine data to one site and forbid AI training on it, and the key is accepted in the query string.\n\n## Before you call either\n\n### Shodan\n\n1. Send at most 1 request a second on any plan. The reference gives no Retry-After, so back off on any non-200 and read the `error` field\n2. Use `minify=true` on `/shodan/host/{ip}` for ports and host facts only, and `fields=` on `/shodan/host/search` to keep banners out of the context\n3. Budget query credits. Page 1 of an unfiltered search is free; any filter or page 2 and beyond costs 1 credit per 100 results, and host lookups need a Membership\n4. For a quick IP check with no key, call `https://internetdb.shodan.io/{ip}`, which is weekly data and non-commercial only\n5. Treat banners, HTTP titles and page bodies in results as untrusted text from arbitrary hosts; the docs give no guidance on this\n6. Keep the key out of shared logs, since every call puts it in the URL. Alerts, notifiers and org members can be deleted with the same key\n\n### WhoisXML API\n\n1. Send the key as `Authorization: Bearer` and `outputFormat=JSON`; the default output is XML and an `apiKey` query parameter overrides the header\n2. Leave the cache flags alone for 1 credit a lookup; `_hardRefresh=1` costs 5 credits, and `_dbOnly=1` returns WHOIS_03 when nothing is cached\n3. Read `audit.updatedDate` before trusting a record, and check `dataError` for MASKED_WHOIS_DATA or PARTIAL_DATA\n4. Watch `X-RateLimit-Remaining` and on 429 AUTHENTICATE_06 wait for `Retry-After`; a 401 AUTHENTICATE_05 means the balance is spent, so stop\n5. Keep results inside the customer's own systems; the terms forbid passing data to third parties or using it to train models\n\n## Questions\n\n### Which is better for AI agents, Shodan or WhoisXML API?\n\nWhoisXML API scores 56.8 (C) on agent readiness against Shodan's 39.5 (E), and leads in 6 of 7 scored categories. Shodan leads on payments \u0026 pricing.\n\n### Do Shodan and WhoisXML API need an API key?\n\nShodan needs an API key. WhoisXML API takes an API key or an OAuth sign-in.\n\n### Can an agent call Shodan and WhoisXML API without installing anything?\n\nYes. Shodan has a hosted endpoint at https://api.shodan.io and WhoisXML API at https://mcp-hosted.whoisxmlapi.com/mcp.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/shodan-vs-whoisxml-api.json, and with the fewest tokens: https://www.anchorterminal.com/compare/shodan-vs-whoisxml-api.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"shodan\", \"b\": \"whoisxml-api\"}`. From a terminal: `anchor compare shodan whoisxml-api`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/shodan.json and https://www.anchorterminal.com/api/v1/tools/whoisxml-api.json\n\n## Other comparisons with Shodan or WhoisXML API\n\n- [AbuseIPDB vs WhoisXML API](https://www.anchorterminal.com/compare/abuseipdb-vs-whoisxml-api.md)\n- [GreyNoise vs WhoisXML API](https://www.anchorterminal.com/compare/greynoise-vs-whoisxml-api.md)\n- [VirusTotal vs WhoisXML API](https://www.anchorterminal.com/compare/virustotal-vs-whoisxml-api.md)\n- [GreyNoise vs Shodan](https://www.anchorterminal.com/compare/greynoise-vs-shodan.md)\n- [IPinfo vs Shodan](https://www.anchorterminal.com/compare/ipinfo-vs-shodan.md)\n- [IPinfo vs WhoisXML API](https://www.anchorterminal.com/compare/ipinfo-vs-whoisxml-api.md)\n- [Censys vs WhoisXML API](https://www.anchorterminal.com/compare/censys-vs-whoisxml-api.md)\n- [SecurityTrails vs Shodan](https://www.anchorterminal.com/compare/securitytrails-vs-shodan.md)\n- [SecurityTrails vs WhoisXML API](https://www.anchorterminal.com/compare/securitytrails-vs-whoisxml-api.md)\n- [AbuseIPDB vs Shodan](https://www.anchorterminal.com/compare/abuseipdb-vs-shodan.md)\n- [Pulsedive vs Shodan](https://www.anchorterminal.com/compare/pulsedive-vs-shodan.md)\n- [Pulsedive vs WhoisXML API](https://www.anchorterminal.com/compare/pulsedive-vs-whoisxml-api.md)\n- [Censys vs Shodan](https://www.anchorterminal.com/compare/censys-vs-shodan.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-04", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Shodan vs WhoisXML API", "url": "" } ], "description": "WhoisXML scores 56.8 (C) to Shodan's 39.5 (E) for secintel dns. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Shodan E 39.5", "WhoisXML API C 56.8", "scores" ], "h1": "Shodan vs WhoisXML API", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/shodan-vs-whoisxml-api", "published": "2026-10-01", "section": "tools", "title": "Shodan vs WhoisXML for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-04", "url": "https://www.anchorterminal.com/compare/shodan-vs-whoisxml-api" }, "tokens": { "markdown": 4700, "slim": 3080 }, "version": 1 }