# io.github.cyanheads/whois-mcp-server (npm · @cyanheads/whois-mcp-server)

Domain registration, availability, DNS records, and IP/ASN resolution via RDAP and DNS-over-HTTPS.

- Trust score: 65/100 (medium)
- Change this week: +50
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-07

## Components

- npm · `@cyanheads/whois-mcp-server`: 65/100 (this document), [markdown](https://verifymcp.io/servers/cyanheads-whois-mcp-server/cyanheads-whois-mcp-server.md), [page](https://verifymcp.io/servers/cyanheads-whois-mcp-server/cyanheads-whois-mcp-server)

## Channel facts

- Registry: `npm`
- Package: `@cyanheads/whois-mcp-server`
- Version: `0.1.3`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-07.

- **Supply Chain Security**: 88/100
  - No malware found by supply-chain analysis.
  - Known CVEs were checked across the 125 of 132 dependencies we could resolve, so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Dependency health was assessed across the 125 of 132 dependencies we could resolve, so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (Apache-2.0).
  - Actively maintained (last published 55 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 72/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 1110 tokens (~185/item across 6 items; 6 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add cyanheads-whois-mcp-server -- npx -y @cyanheads/whois-mcp-server
```

### Codex

```bash
codex mcp add cyanheads-whois-mcp-server -- npx -y @cyanheads/whois-mcp-server
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "cyanheads-whois-mcp-server": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@cyanheads/whois-mcp-server"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add cyanheads-whois-mcp-server --command npx --arg -y --arg @cyanheads/whois-mcp-server
```

### Hermes

```yaml
mcp_servers:
  cyanheads-whois-mcp-server:
    command: "npx"
    args: ["-y", "@cyanheads/whois-mcp-server"]
```

### Other

```json
{
  "mcpServers": {
    "cyanheads-whois-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@cyanheads/whois-mcp-server"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-06 (score 65, +30)

- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Tool coverage: unverified → 100
- [functional] First check of Tool coverage: 100
- [functional] First check of Tool coverage: 100
- [functional] First check of Schema quality: fail
- [functional] First check of Schema quality: excellent
- [functional] First check of Schema quality: fail

### 2026-08-02 (score 35, +30)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional] Capabilities: Protocol version not yet verified: we do not have a sandbox capture of the MCP handshake this version of the package performs yet.
- [functional] Tool coverage: Tool coverage not yet verified: we do not have a sandbox capture of the tool definitions this version of the package serves yet.
- [functional] Schema quality: Schema quality not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- [functional] Licence: Apache-2.0

### 2026-08-01 (score 5, −10)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-31 (score 15, −9)

- [security regression] Provenance: unverified → fail
- [security regression] Malware scan: pass → unverified
- [security improvement] Install scripts: unverified → pass
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] License: unverified → pass
- [functional] Tool coverage: Tool coverage not yet verified: our sandbox run of this package did not complete, so we have no tool definitions to assess.
- [functional] Schema quality: Schema quality not yet verified: our sandbox run of this package did not complete, so we have no schema to assess.
- [functional] Licence: Apache-2.0

### 2026-07-29 (score 24, −1)

- [functional regression] Dependency health: partial → unverified

### 2026-07-28 (score 25, +1)

- [functional improvement] Dependency health: unverified → partial
- [functional] Tool coverage: Tool coverage not yet verified: we do not have a sandbox capture of the tool definitions this version of the package serves yet.
- [functional] Schema quality: Schema quality not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.

### 2026-07-27 (score 24)

First indexed and scored.

## MCP tools (6)

### `whois_lookup_domain` (~166 tokens)

Domain Registration Lookup

Look up a domain's registration record — registrar, created/expiry dates, nameservers, EPP status codes, DNSSEC flag, and registrant org (where not privacy-redacted). Uses RDAP via IANA bootstrap to auto-select the correct per-TLD RDAP server, returning one normalized shape regardless of TLD. When the TLD has no RDAP coverage, returns rdap_coverage: false. If the domain is not registered, throws domain_not_found — use whois_check_availability to test availability without triggering an error.

Input parameters:

- `domain` (string, required): Fully qualified domain name to look up (e.g., "example.com", "github.com"). Must be a valid FQDN — labels separated by dots, each label up to 63 chars.

Output parameters:

- `created_date` (string): ISO 8601 domain registration date.
- `dnssec_signed` (boolean): True when the domain has DNSSEC delegation signed.
- `domain` (string): Normalized domain name (lowercased).
- `expiry_date` (string): ISO 8601 registration expiry date.
- `handle` (string): Registry handle / object identifier assigned by the registry.
- `nameservers` (array): Authoritative nameservers for this domain.
- `rdap_coverage` (boolean): True when a RDAP server was found for this TLD; false when RDAP coverage is absent.
- `rdap_last_updated` (string): ISO 8601 timestamp of last RDAP database update.
- `registrant_org` (string): Registrant organization name. Omitted when privacy-redacted.
- `registrant_redacted` (boolean): True when registrant contact data is privacy-redacted (common post-GDPR).
- `registrar` (string): Name of the sponsoring registrar.
- `registrar_iana_id` (string): IANA registrar ID number.
- `status` (array): EPP status codes (e.g., clientTransferProhibited, serverDeleteProhibited).
- `updated_date` (string): ISO 8601 date of last registration record change.

### `whois_check_availability` (~129 tokens)

Domain Availability Check

Check whether a domain name is registered or available for registration. Returns available: true when the domain is not registered, available: false with registrar and expiry_date when it is registered, and available: null with rdap_coverage: false when the TLD has no RDAP coverage. Designed for "can I register X" and bulk name sweeps. For the full registration record use whois_lookup_domain.

Input parameters:

- `domain` (string, required): Fully qualified domain name to check (e.g., "myfuturename.com"). Must be a valid FQDN — labels separated by dots.

Output parameters:

- `available`: True = available for registration. False = registered. Null = rdap_coverage is false — cannot determine availability for this TLD.
- `domain` (string): Normalized domain name checked.
- `expiry_date` (string): Expiry date when available: false.
- `rdap_coverage` (boolean): True when a RDAP server was found for this TLD.
- `registrar` (string): Registrar name when available: false.

### `whois_get_dns` (~153 tokens)

DNS Record Lookup

Fetch DNS records for a domain via DNS-over-HTTPS. Supports A, AAAA, MX, TXT, NS, CNAME, SOA, CAA, PTR. Multiple types are fetched in parallel. NXDOMAIN is returned as nxdomain: true in the result, not as an error — it means the domain does not exist in DNS.

Input parameters:

- `domain` (string, required): Fully qualified domain name or hostname to query (e.g., "github.com", "mail.example.com").
- `types` (array): DNS record types to fetch. Defaults to [A, AAAA, MX, TXT, NS]. Specify more types to expand coverage (e.g., add CAA to check certificate authority authorization).

Output parameters:

- `domain` (string): Domain queried.
- `nxdomain` (boolean): True when the domain does not exist in DNS (NXDOMAIN / Status 3). Records will be empty. This is a valid data signal, not an error.
- `records` (array): DNS records returned for the requested types.
- `source` (string): The DoH resolver that provided results (cloudflare = primary used for most types, nextdns = fallback or CAA).

### `whois_lookup_ip` (~189 tokens)

IP Address / Network Lookup

Look up an IP address or CIDR block via RIR RDAP (ARIN, RIPE, APNIC, LACNIC, AFRINIC — auto-routed via IANA bootstrap). Returns netblock, org, country, CIDR, abuse contact email, and reverse DNS (PTR) via DoH. PTR is best-effort — failure returns ptr: null. Private/reserved ranges (RFC 1918, loopback, link-local) return a validation error — no RIR RDAP record exists for them.

Input parameters:

- `ip` (string, required): IPv4 address (e.g., "8.8.8.8"), IPv6 address (e.g., "2001:4860:4860::8888"), or CIDR notation (e.g., "192.0.2.0/24"). Private/reserved ranges will return a validation error.

Output parameters:

- `abuse_email` (string): Abuse contact email address.
- `cidr` (string): CIDR notation of the netblock (e.g., "8.8.8.0/24").
- `country` (string): Country code (ISO 3166-1 alpha-2). Omitted when not in RDAP data.
- `end_address` (string): End address of the IP netblock.
- `handle` (string): RIR handle / object identifier.
- `ip` (string): The IP or CIDR queried.
- `ip_version` (string): IP version: "v4" or "v6".
- `name` (string): Network name assigned by the RIR.
- `org_name` (string): Organization name holding the netblock.
- `ptr`: Reverse DNS hostname (PTR record). Null when PTR lookup fails, returns no answer, or domain is NXDOMAIN.
- `rdap_source` (string): RIR that provided the RDAP data (ARIN, RIPE, APNIC, LACNIC, AFRINIC).
- `start_address` (string): Start address of the IP netblock.
- `type` (string): Network type (e.g., "DIRECT ALLOCATION").

### `whois_lookup_asn` (~123 tokens)

ASN Lookup

Resolve an Autonomous System Number (ASN) to its org name, country, and RIR source via RIR RDAP. Accepts AS-prefixed format (e.g., "AS15169") or bare integer (e.g., "15169"). Distinct from IP lookup — the entry point is the ASN itself, not an IP within its block.

Input parameters:

- `asn` (string, required): Autonomous System Number to look up. Accepts AS-prefixed format (e.g., "AS15169") or bare integer (e.g., "15169").

Output parameters:

- `asn` (string): Normalized ASN identifier (AS-prefixed, e.g., "AS15169").
- `country` (string): Country code (ISO 3166-1 alpha-2). Omitted when not in RDAP data.
- `end_autnum` (number): End ASN of the registered range.
- `handle` (string): RIR handle / object identifier.
- `name` (string): ASN network name.
- `org_name` (string): Organization name registered for this ASN.
- `rir` (string): Regional Internet Registry that manages this ASN (ARIN, RIPE, APNIC, LACNIC, AFRINIC).
- `start_autnum` (number): Start ASN of the registered range.
- `type` (string): ASN type (e.g., "DIRECT ALLOCATION").

### `whois_get_dossier` (~185 tokens)

Domain Dossier

One-call domain triage: fetches registration record (RDAP) and DNS records (A, MX, NS, TXT) in parallel, returning a single normalized record with factual signals — domain age in days, privacy-redacted flag, registrar, NS provider inferred from NS records, mail provider inferred from MX records. No synthesized scores — factual signals only. Partial results are surfaced when one leg fails (registration or DNS marked with source_error); only when both legs fail does the tool throw both_legs_failed. For the full registration record use whois_lookup_domain. For DNS types beyond A/MX/NS/TXT (e.g., CNAME, CAA, SOA) use whois_get_dns.

Input parameters:

- `domain` (string, required): Fully qualified domain name for the triage (e.g., "github.com"). Must be a valid FQDN.

Output parameters:

- `a_records` (array): IPv4 addresses (A records). Empty when DNS leg failed or NXDOMAIN.
- `age_days`: Domain age in days since creation_date. Null when created_date is unavailable.
- `created_date` (string): ISO 8601 registration creation date.
- `dns_nxdomain`: True when DNS says domain does not exist (NXDOMAIN). Null when DNS leg failed.
- `dns_source_error` (string): Error message from the DNS leg when it failed. Omitted on success.
- `dnssec_signed`: True when delegation-signed. Null when RDAP leg unavailable.
- `domain` (string): Normalized domain name.
- `expiry_date` (string): ISO 8601 registration expiry date.
- `mx_provider`: Mail provider inferred from MX record (e.g., "Google Workspace", "Microsoft 365"). Null when no MX or DNS leg failed.
- `mx_records` (array): Mail exchange hostnames (MX data). Empty when DNS leg failed or NXDOMAIN.
- `nameservers` (array): Authoritative nameservers. Empty when RDAP leg failed.
- `ns_provider`: DNS provider inferred from NS record (e.g., "Cloudflare", "AWS Route 53"). Null when unknown or DNS leg failed.
- `ns_records` (array): DNS nameservers from live DNS (NS data). Empty when DNS leg failed or NXDOMAIN.
- `privacy_redacted`: True when registrant contact info is privacy-redacted. Null when RDAP leg unavailable.
- `rdap_coverage`: True = RDAP server found. False = no RDAP coverage. Null = RDAP leg failed (source_error set).
- `rdap_source_error` (string): Error message from the RDAP leg when it failed. Omitted on success.
- `registered`: True when the domain has a registration record. False = RDAP 404 (not registered). Null when RDAP leg failed.
- `registrar` (string): Registrar name from registration record.
- `status` (array): EPP status codes. Empty when RDAP leg failed.
- `txt_records` (array): TXT record values (SPF, DKIM hints, etc.). Empty when DNS leg failed or NXDOMAIN.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/cyanheads-whois-mcp-server/cyanheads-whois-mcp-server#diagnostics

## Score history

- 2026-08-07: 65
- 2026-08-06: 65
- 2026-08-05: 35
- 2026-08-04: 35
- 2026-08-03: 35
- 2026-08-02: 35
- 2026-08-01: 5
- 2026-07-31: 15
- 2026-07-29: 24
- 2026-07-28: 25
- 2026-07-27: 24

## Links

- npm package: https://www.npmjs.com/package/@cyanheads/whois-mcp-server
- Socket report: https://socket.dev/npm/package/@cyanheads/whois-mcp-server
- Repository: https://github.com/cyanheads/whois-mcp-server
- Changelog RSS feed: https://verifymcp.io/servers/cyanheads-whois-mcp-server/cyanheads-whois-mcp-server.xml
- Changelog JSON feed: https://verifymcp.io/servers/cyanheads-whois-mcp-server/cyanheads-whois-mcp-server.json
- HTML version of this page: https://verifymcp.io/servers/cyanheads-whois-mcp-server/cyanheads-whois-mcp-server