# VirusTotal vs WhoisXML API (slim)

> VirusTotal scores 67.5 (B) to WhoisXML's 56.8 (C) for secintel reputation. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/virustotal-vs-whoisxml-api.md (~5,000 tokens) · this version ~3,380 tokens · JSON https://www.anchorterminal.com/compare/virustotal-vs-whoisxml-api.json · canonical https://www.anchorterminal.com/compare/virustotal-vs-whoisxml-api
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-03
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

VirusTotal scores 67.5 (B) on agent readiness against WhoisXML API's 56.8 (C), and leads in 6 of 7 scored categories. WhoisXML API leads on reliability. Both do secintel reputation.

- VirusTotal: B 67.5, rank #288 of 1349 · https://www.anchorterminal.com/tools/virustotal.min.md
- WhoisXML API: C 56.8, rank #771 of 1349 · https://www.anchorterminal.com/tools/whoisxml-api.min.md
- VirusTotal, good for File, URL, domain and IP reputation with multi-engine evidence, and the one listing here an agent can onboard to by a single POST. Ahead on Schema & documentation, 77 against 70; Agent ergonomics, 83 against 65; Security & auth, 69 against 39; Payments & pricing, 40 against 25; Maintenance & community, 88 against 76; Transparency & trust, 65 against 60.
- WhoisXML API, good for An agent investigating a domain's registration, history, DNS, certificates or related domains at scale, on a prepaid credit pool. Ahead on Reliability, 65 against 55.

| Category | VirusTotal | WhoisXML API |
| --- | --- | --- |
| Reliability (16%) | 55 | 65 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 77 | 70 |
| Agent ergonomics (13%) | 83 | 65 |
| Security & auth (14%) | 69 | 39 |
| Payments & pricing (10%) | 40 | 25 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 88 | 76 |
| Transparency & trust (7%) | 65 | 60 |

| Fact (where they differ) | VirusTotal | WhoisXML API |
| --- | --- | --- |
| Vendor | Google LLC | Whois API, Inc. |
| Hosted endpoint | `https://ai.virustotal.com/mcp` | `https://mcp-hosted.whoisxmlapi.com/mcp` |
| Transports | HTTP, Streamable HTTP, stdio | Streamable HTTP, stdio |
| Licence | Proprietary service under the Google Cloud Terms of Service (SecOps). The official MCP server vt-mcp, vt-py and vt-go are Apache-2.0 | none |
| Tools exposed | 11 | 35 |
| MCP registry | `io.github.VirusTotal/virustotal-mcp` | `io.github.whois-api-llc/mcp-whoisxmlapi` |
| Last release | 2026-10-11 | 2026-11-03 |
| Terms last updated | no date given | 2025-03-03 |
| Privacy policy last updated | 2025-02-06 | 2020-04-06 |
| Arbitration or class-action waiver | not found in the text | yes |
| Popularity | 26 stars, 53 PyPI/wk | none |

Why the edge:
- Security & auth, VirusTotal +30: VirusTotal 69 (A personal v3 key carries every privilege of the account, with no scopes, sent only in an `x-apikey` header. Licensed groups get service accounts with six roles and a daily cap each. VTAI MCP uses OAuth with three scopes, vt:reports:read, vt:submissions:write and vt:network-analysis:write, and REST agent tokens are revocable with one DELETE. No documented query-string option (24 of 30). The read scope and readOnlyHint tools give a read-only mode; submission tools have no per-call confirmation of their own, so consent rests on the client and the `X-VTAI-Consent` header (15 of 20). Reports carry third-party text and `ai_insights`, and the VTAI pages say to treat report text as data, not instructions, and never to read a missing report as safety (12 of 15). Group administrators see consumption by endpoint and by user, VTAI shows OAuth connections at /oauth/connections, and no per-call log for a personal key was found (8 of 15). SECURITY.md in the MCP repository points to the Google Bug Hunters form, and the SecOps SLA and privacy notice are Google Cloud documents, but www.virustotal.com has no security.txt and whether VirusTotal is in scope of Google Cloud's SOC 2 and ISO 27001 reports could not be read (10 of 20). 24 + 15 + 12 + 8 + 10 = 69.); WhoisXML API 39 (An API key with no scopes found, accepted as an apiKey query parameter that overrides the Authorization header, or as a Bearer token including a server-to-server OAuth token; an IP allowlist can be set on the account (20 less 10 for the query string, plus 4 for OAuth and the allowlist, so 14). Every call is a read and the MCP server has no write tools, but there is no read-only or restricted key (12 of 20). Records include raw registrar text from third parties with no guidance on treating it as untrusted (5 of 15). The MCP server's account_balance tool reports credits per product and the account page shows usage, with no per-call log documented (5 of 15). security.txt returns 404, no disclosure policy, bug bounty or certification was found, and the payment page names only a PCI-compliant card processor (3 of 20). 14 + 12 + 5 + 5 + 3 = 39.)
- Agent ergonomics, VirusTotal +18: VirusTotal 83 (The hosted MCP server lists 11 compact tools, one over the ten-tool line (15), and the vt:reports:read OAuth scope gives a read-only subset (5 added back, so 20). VTAI reports are fixed in shape with `detections` as labels, category counts and `coverage` sized for a model. Pagination and field selection on v3 list endpoints were not read in this run (10 of 20). Error codes an agent can branch on, QuotaExceededError, NotFoundError, `receipt_conflict` on 409, enumerated rejection codes, and Retry-After on VTAI 429s (18 of 20). File submissions are keyed by SHA-256 with recoverable receipts, network submissions by a persisted request_id, `can_resubmit` is set on every result, and all 11 tools carry readOnlyHint and destructiveHint in the source (20). Few required parameters, official clients vt-py and vt-go, and the submit_local_file stdio tool (15). 20 + 10 + 18 + 20 + 15 = 83.); WhoisXML API 65 (ignoreRawTexts drops the raw text fields, cmd=GET_DN_AVAILABILITY returns a two-field record, and the MCP server's reverse_whois defaults to a count-only mode; the MCP server lists 35 tools, more than 30, with a tool_search for deferred loading over stdio only (17 of 25). The WHOIS API returns one record per call with no pagination; bulk variants take up to 10,000 domains as jobs with status and results tools (8 of 20). Errors carry a code and a message an agent can branch on, though WHOIS_01 names both a validation error on HTTP 200 and an internal error on 500 (14 of 20). Every call is a read, and the cache flags make a repeat cheap, but a retry with _hardRefresh costs 5 credits each time and no annotations were found on the MCP tools (14 of 20). One required parameter, sensible defaults, and official Python and Go client libraries in the vendor's GitHub organisation, last pushed in 2023 (12 of 15). 17 + 8 + 14 + 14 + 12 = 65.)
- Payments & pricing, VirusTotal +15: VirusTotal 40 (No x402, MPP or L402 (0). Premium quotas and Google Threat Intelligence are sold by contacting sales, and no price was found on any page read (0). A public key gives 500 requests a day and VTAI 1,000 a day, with no card (20). An agent registers itself with `POST /api/v3/agents/register` and receives a token in the response, no browser or person involved (20). 0 + 0 + 20 + 20 = 40.); WhoisXML API 25 (No x402, MPP or L402 (0). The only public price is from $129 a month for a universal credit pool; per-credit rates are behind a calculator whose output was not read and enterprise packages are by sales (5 of 20). 500 free WHOIS credits on signup with no card (20). The key comes from the account after a browser signup and no key API was found (0). 0 + 5 + 20 + 0 = 25.)
- Maintenance & community, VirusTotal +12: VirusTotal 88 (Read as a closed service with open agent tooling. vt-mcp 0.9.9 on PyPI on 11 October 2026 and the repository's newest tag, antigravity-plugin-v0.1.1, on 2 November 2026 (30). Nine vt-mcp releases between 20 September and 11 October 2026 and 146 commits in 90 days (20). Pull requests merged within a day by the maintainer in October, weekly blog posts, dated release notes per version, but issue replies could not be read because github.com refuses our reader (15 of 25). io.github.VirusTotal/virustotal-mcp in the official registry, latest 0.9.9, and vt-py and vt-go as official clients (15). CI, PyPI, release and registry workflows in the MCP repository and a pinned `mcp==2.1.1`, while vt-py's last release is 28 October 2025 and Google's gti-mcp still requires mcp below 2.0 (8 of 10). 30 + 20 + 15 + 15 + 8 = 88.); WhoisXML API 76 (Read as a closed service with an official MCP server. MCP server 1.13.0 was published in the official registry on 3 November 2026 and the ProfessionalServices and ipgeo-community repositories were pushed the same day (30). 1.8.6 on 8 September through 1.13.0 on 3 November 2026 is nine registry versions in 90 days (20). Product updates are summarised in yearly press releases, the newest 9 May 2025, support is a contact form with tiered response times sold separately, and the client library repositories were last pushed in 2023 (8 of 15). The MCP server is in the official registry under io.github.whois-api-llc, and official Python and Go clients exist (15). The MCP server's source was not found on GitHub, and the SDK repositories show no activity since 2023 (3 of 10). 30 + 20 + 8 + 15 + 3 = 76.)
- Reliability, WhoisXML API +10: VirusTotal 55 (Read with the hosted lines, on the v3 API and VirusTotal AI together. No status page found. status.virustotal.com does not resolve and neither docs.virustotal.com nor ai.virustotal.com links one (0). No readable incident history (5). Rate limits documented with numbers, 4 requests a minute and 500 a day on a public key, and 60 queries per 60-second window and 1,000 a UTC day plus 20 uploads a minute and 500 a day on VTAI (15). 429 answers QuotaExceededError or TooManyRequestsError on v3, the quota FAQ says wait 30 to 60 seconds, VTAI says honour Retry-After, and VTAI submissions are idempotent by SHA-256 receipt or a caller-chosen request_id (15). The Google Cloud SecOps SLA page lists service level agreements for Google Threat Intelligence and VirusTotal, which cover paid licences (10). The v3 API is generally available; VTAI's OpenAPI document is version 0.10.39 and vt-mcp 0.9.9, neither marked beta, with Codex support marked staging (10). 0 + 5 + 15 + 15 + 10 + 10 = 55.); WhoisXML API 65 (Read with the hosted lines. The vendor's own Service Status and Data Releases page is linked from the docs and describes a per-API JSON status file with four levels (20). It shows no incident history and the status file's live values could not be read, so no 90-day record (5). The docs give 200 requests a second with rejection until the next second; the terms give 50 a second, 20 concurrent and 5 concurrent bulk requests, so numbers are published even though they disagree (15). A 429 AUTHENTICATE_06 carries Retry-After and every response X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, with guidance to slow before zero; all calls are reads (15). No SLA; the terms guarantee no minimum uptime and cite a historical 99.9 per cent, with enterprise SLAs by separate agreement (0). The API is generally available (10). 20 + 5 + 15 + 15 + 0 + 10 = 65.)
- Schema & documentation, VirusTotal +7: VirusTotal 77 (VTAI publishes an OpenAPI 3.1 document at ai.virustotal.com/openapi.json with 17 operations, and the MCP tools take typed JSON Schema inputs with annotations. No OpenAPI document was found for the v3 API, whose reference lists typed parameters page by page (20 of 25). llms.txt on both hosts, 650 links on virustotal.readme.io and an agent manifest plus a Markdown quickstart at /skills/BASIC.md on ai.virustotal.com (10). VTAI descriptions and skills say when to look up, when not to submit, and what a missing report does not prove. v3 endpoint descriptions are one line, such as "Retrieve information about a file" (15 of 20). Enums for indicator_type, analysis status, pending_reason and rejection codes, a consent header fixed to `standard-v1`, required path parameters. The v3 pages read carry no constraints beyond the hash formats (11 of 15). 16 documented v3 error codes with HTTP statuses and a JSON envelope, and VTAI documents 401, 404 and 429 per operation, but the v3 file report page read shows no example request or response body (11 of 15). Version in the path (v3, with v2 still served) and dated release notes for vt-mcp, but no changelog for the API itself (10 of 15). 20 + 10 + 15 + 11 + 11 + 10 = 77.); WhoisXML API 70 (The surface graded is the WHOIS API, with the hosted MCP server noted. No OpenAPI document. JSON Schema draft-07 and XSD files define the WHOIS record, the DomainInfo response and the error body, and a Postman collection is published (15 of 25). llms.txt on www.whoisxmlapi.com lists the APIs, databases and feeds (10). The making-requests page states each parameter's purpose, default and credit cost, lists deprecated parameters that are still accepted, and says when RDAP applies, with little on when not to call (15 of 20). rdap, outputFormat and the cache flags have enumerated values and the record schema is typed, but unknown parameters are ignored silently and the output page gives no types in prose (11 of 15). Request examples, example records and an error table with HTTP status, errorCode and message (12 of 15). No API version and no changelog for the API; press releases summarise product updates yearly, the newest dated 9 May 2025, and the MCP server's versions are dated in the registry (7 of 15). 15 + 10 + 15 + 11 + 12 + 7 = 70.)