# WhoisXML API (slim)

> WhoisXML API is a set of domain, DNS, IP and threat intelligence APIs from Whois API, Inc. Its WHOIS API returns parsed registration records for a domain or address, and a hosted MCP server bundles 35 tools on one balance.

- Full: https://www.anchorterminal.com/tools/whoisxml-api.md (~8,500 tokens) · this version ~1,880 tokens · JSON https://www.anchorterminal.com/tools/whoisxml-api.json · canonical https://www.anchorterminal.com/tools/whoisxml-api
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-04 · pricing https://www.anchorterminal.com/tools/whoisxml-api#pricing · reviews https://www.anchorterminal.com/tools/whoisxml-api#reviews
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

**C · 56.8/100 · rank #771 of 1349 · #5 in Security intelligence · not agent-ready · confidence medium**


Assessment: 500 free credits with no card, JSON Schema and XSD for every response, 429s with Retry-After, cache controls that set the price per lookup, and a 35-tool hosted MCP server with OAuth. Per-credit prices sit behind a calculator, the terms confine data to one site and forbid AI training on it, and the key is accepted in the query string.

## Facts

- Kind: HTTP API · vendor: Whois API, Inc. · category: Security intelligence · legal entity: Whois API, Inc. · provenance 89/100
- Endpoint: `https://mcp-hosted.whoisxmlapi.com/mcp` (Streamable HTTP, stdio)
- Auth: OAuth or key · pricing: Freemium · x402: no · licence: unknown
- Probe metrics: not measured yet (probes haven't run)
- Surface listed: The WHOIS API at whoisxmlapi.com/whoisserver/WhoisService, read from whois.whoisxmlapi.com (docs, limits, errors, output), main.whoisxmlapi.com (terms, privacy, company, status, pricing, MCP page, press releases, support), mcp.whoisxmlapi.com, the MCP registry and the whois-api-llc GitHub organisation on 3 November 2026. The hosted MCP server is noted. No account was made and no call was sent
- Other APIs: WHOIS History, Domain Info, DNS Lookup, DNS Chronicle, Reverse DNS, Reverse WHOIS, SSL Certificates, IP Geolocation, IP Netblocks, Threat Intelligence, Domain Reputation, Email Verification, Website Categorization, Subdomains, Brand and Registrant Alert, Typosquatting, plus bulk variants and data feeds. Each has its own docs and credit price
- Credits: WHOIS 1 credit from cache (48 hours or older by default), 5 for a refresh. Per the MCP tools page, domain reputation 1 or 3, typosquatting 1 or 5, subdomains 10, threat intelligence 1 per 100 records, bulk tools 1 per item. Credits expire after 12 months
- Rate limits: 200 requests a second per the docs, with X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset and Retry-After on 429. The terms set 50 a second, 20 concurrent and 5 concurrent bulk requests. A dedicated endpoint is sold for more
- Errors: ErrorMessage with errorCode and msg. WHOIS_01 validation error (HTTP 200) and internal error (500 or 503), WHOIS_02 unknown user (401), WHOIS_03 no record (200), AUTHENTICATE_04 missing key, AUTHENTICATE_05 no credits, AUTHENTICATE_06 rate limit (429), AUTHENTICATE_10 IP not allowed (403). Unknown parameters are ignored
- MCP server: 35 tools in 1.13.0, covering WHOIS, history, reverse lookups, DNS, IP geolocation, netblocks, email verification, categorisation, SSL, threat intelligence, domain reputation, VPN detection, screenshots, account balance, a tool_search for deferred loading over stdio and native bulk jobs. Streamable HTTP hosted with OAuth, or stdio from npm, Docker or a binary. No annotations, licence or source found
- Service status: api-status page with a JSON status file (0 passed, 1 partial outage, 2 data issues, 3 major outage) and data release feeds. No incident history shown. The terms guarantee no minimum uptime and cite a historical 99.9 per cent
- Support: Contact form on all plans. Bronze, Silver, Gold and Platinum support tiers with severity-1 responses from 12 hours to 6 hours, priced on request. English only
- Prices: WXA.ONE universal credit pool, smallest plan $129 per month (plan)

- Scores: Reliability 65, Performance pending, Schema & documentation 70, Agent ergonomics 65, Security & auth 39, Payments & pricing 25, Task success pending, Maintenance & community 76, Transparency & trust 60 · total over the 7 assessed categories
- Why: Reliability, Read with the hosted lines. · Schema & documentation, The surface graded is the WHOIS API, with the hosted MCP server noted. · Agent ergonomics, ignoreRawTexts drops the raw text fields, cmd=GET_DN_AVAILABILITY returns a two-field record, and the MCP server's reverse_whois defaults to… · Security & auth, An API key with no scopes found, accepted as an apiKey query parameter that overrides the Authorization header, or as a Bearer token includi… · Payments & pricing, No x402, MPP or L402 (0). · Maintenance & community, Read as a closed service with an official MCP server. · Transparency & trust, A closed service with clear terms naming Whois API, Inc.
- Sources: 23, open questions: 7, both in the full twin
- Capabilities: secintel.dns, secintel.reputation, secintel.ip-enrichment, secintel.indicators
- JSON: https://www.anchorterminal.com/api/v1/tools/whoisxml-api.json
- Verify (for the vendor): the badge `https://www.anchorterminal.com/badges/whoisxml-api.svg` or a link to https://www.anchorterminal.com/tools/whoisxml-api from a page on whoisxmlapi.com or one of its subdomains, then `POST https://www.anchorterminal.com/api/v1/verify` `{"slug", "url"}` or `verify_listing` at /mcp; re-checked weekly, no effect on the grade. Snippets in the full twin.
- Support: https://main.whoisxmlapi.com/support-services; https://main.whoisxmlapi.com/contact-us; https://main.whoisxmlapi.com/knowledge-base; more in the full twin

## Before you call it

1. Send the key as `Authorization: Bearer` and `outputFormat=JSON`; the default output is XML and an `apiKey` query parameter overrides the header
2. Leave the cache flags alone for 1 credit a lookup; `_hardRefresh=1` costs 5 credits, and `_dbOnly=1` returns WHOIS_03 when nothing is cached
3. Read `audit.updatedDate` before trusting a record, and check `dataError` for MASKED_WHOIS_DATA or PARTIAL_DATA
4. Watch `X-RateLimit-Remaining` and on 429 AUTHENTICATE_06 wait for `Retry-After`; a 401 AUTHENTICATE_05 means the balance is spent, so stop
5. Keep results inside the customer's own systems; the terms forbid passing data to third parties or using it to train models

## Connect

```bash
npx @whoisxmlapidotcom/mcp-whoisxmlapi --help
```

```bash
curl -H "Authorization: Bearer $WHOISXML_API_KEY" "https://www.whoisxmlapi.com/whoisserver/WhoisService?domainName=example.com&outputFormat=JSON"
```

```bash
claude mcp add --transport http whoisxmlapi https://mcp-hosted.whoisxmlapi.com/mcp
```
Full config and headless snippets are in the full page. Through letme (picks today, calling later): https://letme.dev/whoisxml-api

## Similar tools

| Tool | Grade | Score | Shared capabilities | Slim |
| --- | --- | --- | --- | --- |
| Censys | B | 64.1 | secintel.dns, secintel.ip-enrichment, secintel.reputation, secintel.indicators | https://www.anchorterminal.com/tools/censys.min.md |
| Pulsedive | D | 47.9 | secintel.indicators, secintel.reputation, secintel.dns, secintel.ip-enrichment | https://www.anchorterminal.com/tools/pulsedive.min.md |
| GreyNoise | B | 66 | secintel.reputation, secintel.ip-enrichment, secintel.indicators | https://www.anchorterminal.com/tools/greynoise.min.md |
| AbuseIPDB | C | 55.7 | secintel.reputation, secintel.indicators, secintel.ip-enrichment | https://www.anchorterminal.com/tools/abuseipdb.min.md |
| Shodan | E | 39.5 | secintel.ip-enrichment, secintel.dns, secintel.indicators | https://www.anchorterminal.com/tools/shodan.min.md |


## Panel reviews (0, desk reviews from public material, no calls made)