DC5 WHOIS
REMOTE · WHOIS.DC5.TECH
WHOIS, RDAP, DNS, IP / ASN / CIDR and Web3 name (ENS, Unstoppable, Handshake) lookups. No API key.
Available components
Last scanned (1 hour ago)
Scores higher than 66% of remote servers
Reachable. Last reached 24 Oct 2026.
Category Security
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security80
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one. See how to fix → View diagnostics → Partial
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability67
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1104 tokens (~276/item across 4 items; 4 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management17
- Stability observed for 5 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 4 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 5 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 24 Oct 26 0
- Server version: 2026.10.23 → 2026.10.23.1 functional
- 23 Oct 26 +3
- HSTS header: fail → pass ▲ security
- Server version: 2026.10.18-cdf49eb → 2026.10.23 functional
- 21 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.
- 20 Oct 26 0
- Stability: unverified → 0.03 ▲ functional
- 19 Oct 26 70
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 24 Oct 2026 · Probed https://whois.dc5.tech/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=whois.dc5.tech | CN=YE2,O=Let's Encrypt,C=US | 15 Oct 2026 | 13 Jan 2027 | ECDSA 256 | ECDSA-SHA384 | 5ca7aa5b861a57d25069bb66f1827f3c571 |
| SANs: whois.dc5.tech | ||||||
| CN=YE2,O=Let's Encrypt,C=US (CA) | CN=Root YE,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | ECDSA 384 | ECDSA-SHA384 | 4df3b15dd6c0784c507cd37b58e6f115 |
| CN=Root YE,O=ISRG,C=US (CA) | CN=ISRG Root X2,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | ECDSA-SHA384 | 872165fc34b6e5fba8add5b3705fb53a |
| CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | SHA256-RSA | 6c8f1dc727c7117f7baf853ac980f9cd |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of whois.dc5.tech. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| tech. | present | 2185 | 13 | Verified |
| dc5.tech. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=31536000 |
| content-security-policy | frame-ancestors 'none' |
| x-content-type-options | nosniff |
| x-frame-options | DENY |
| referrer-policy | strict-origin-when-cross-origin |
| permissions-policy | camera=(), microphone=(), geolocation=() |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://whois.dc5.tech/mcp | Verified | 200 | |
| http (plaintext) | http://whois.dc5.tech/mcp | HTTPS enforced | 308 | https://whois.dc5.tech/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
check_lookalike Look-alike (homograph) check ~195
Check whether one domain or Web3 name is a visual look-alike (homograph): letters from different scripts mixed in one label, or every non-ASCII letter having a Latin twin, so раураl.com reads as paypal.com. Returns the scripts used and the Latin name it imitates. Use it to screen candidate or incoming names quickly (phishing triage, brand monitoring). lookup_target already includes this warning for the name it looks up, so there is no need to call both for one name. Behavior: offline and instant; no DNS, registry or network call. It catches script tricks only, not typos or digit swaps such as paypa1.com, so a clean result does not mean the domain is safe.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | one domain or Web3 name, Unicode (раураl.com) or punycode (xn--...); a full URL is not accepted |
| Name | Type | Req | Description |
|---|---|---|---|
| look_alike | boolean | yes | – |
| looks_like | string | – | the Latin name it imitates |
| mixed_script | boolean | – | one label mixes scripts |
| name | string | yes | name in Unicode form |
| scripts | null|array | – | scripts the letters come from |
No examples provided.
check_mail_security Mail security grade ~220
Grade one domain's email authentication and list every check: SPF (single record, the 10 DNS-lookup limit across includes, the all qualifier), DMARC (policy, inheritance from the organizational domain, pct, report addresses), MTA-STS, TLS-RPT, BIMI, DANE and null MX. The level is strong, fair, weak, no_mail (domain declares it sends no mail) or none (no MX, SPF or DMARC at all). Use it for questions about spoofing, deliverability or a DMARC rollout. lookup_target gives only the overall grade; this tool gives the status and a one-line finding for each check. Behavior: reads public DNS only and never connects to the domain's mail servers, so it cannot test SMTP TLS, certificates or whether a mailbox exists. Usually under 2 s.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | registered domain or subdomain whose mail setup to grade, e.g. example.com; Unicode or punycode. Not an email address and not a mail server host name |
| Name | Type | Req | Description |
|---|---|---|---|
| checks | null|array | yes | – |
| details_url | string | – | – |
| domain | string | yes | – |
| level | string | yes | strong, fair, weak, no_mail, or none when the domain has no mail setup |
No examples provided.
list_data_sources Data sources and freshness ~127
List the local datasets and feeds behind lookup_target (RIR delegations, IANA, Public Suffix List, cloud / CDN ranges, Tor and Private Relay, reputation lists, GeoLite2) with state, record count, generation date and a stale flag. Use it to judge how current a reputation, RIR, cloud or geolocation answer is, or to explain why such a section is missing from a lookup (dataset not loaded or stale). Registry, DNS and Web3 data are fetched live and are not listed here. Behavior: takes no arguments and makes no external calls.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| datasets | null|array | yes | – |
No examples provided.
lookup_target WHOIS / RDAP / DNS / network / Web3 lookup ~439
Look up one domain, IP address, CIDR block, ASN (AS15169) or Web3 name (ENS .eth, Unstoppable, SPACE ID .bnb, Handshake hns:) and get a compact fact sheet. Domains: registrar, dates, status, nameservers, DNS records, overall mail-security grade, third-party services seen in DNS, possibly dangling records. IPs, CIDRs and ASNs: network owner, origin AS, RIR, cloud / CDN provider, Tor or iCloud Private Relay tag, geolocation, abuse contact, local reputation. Web3 names: registration status, addresses, records. A look-alike warning is added when the name uses deceptive letters. Use it first for any question about who owns, runs, hosts or registered something. Prefer check_mail_security when you need each email check rather than the grade, and check_lookalike to screen many names without network calls. Behavior: queries registries, DNS and (for Web3) blockchain RPC live, usually in 1-5 s, at most about 12 s. If one source fails, the rest is still returned and the failure is listed under errors. Reputation covers local blocklists only: no match is not a clean bill of health. Queries are not logged or stored. The result ends with details_url, the full page with every record and its provenance.
| Name | Type | Req | Description |
|---|---|---|---|
| namespace | string | – | optional; force a Web3 namespace (ens, unstoppable, spaceid, sns or hns) when a name could belong to several, e.g. a TLD that is both an ICANN TLD and a Web3 namespace. Leave empty and the namespace… |
| query | string | yes | what to look up: a domain (example.com, münchen.de), IPv4 / IPv6 address, CIDR (8.8.8.0/24), ASN written as AS15169 (a bare number is not an ASN), or a Web3 name (vitalik.eth, brad.crypto, spaceid.bn… |
| Name | Type | Req | Description |
|---|---|---|---|
| addresses | null|array | – | Web3 addresses as network:address |
| anonymizer | string | – | tor_exit or private_relay |
| availability | string | – | registered, available or unknown (domains and Web3 names) |
| cloud | string | – | cloud / CDN provider |
| country | string | – | – |
| created_at | string | – | – |
| details_url | string | – | full result page |
| errors | null|array | – | provider failures; the rest of the result is still valid |
| expires_at | string | – | – |
| mail_security | string | – | strong, fair, weak or no_mail |
| nameservers | null|array | – | – |
| network | string | – | covering CIDR or network range |
| organization | string | – | – |
| origin_as | integer | – | origin AS number for an IP |
| query | string | yes | normalized query |
| registrar | string | – | – |
| reputation | string | – | verdict from local lists; absent when no list is loaded |
| summary | string | yes | the full human-readable fact sheet, the same text as the text content |
| type | string | yes | target type: domain, ipv4, ipv6, cidr, asn or web3_name |
| warnings | null|array | – | look-alike, special-purpose and namespace-collision warnings |
| web3_status | string | – | – |
No examples provided.
How do I install the DC5 WHOIS MCP server?
DC5 WHOIS is a hosted endpoint at https://whois.dc5.tech/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · whois.dc5.tech
claude mcp add --transport http tech-dc5-whois-dc5-whois 'https://whois.dc5.tech/mcp'
What is the DC5 WHOIS MCP server?
DC5 WHOIS is an MCP server listed in the public MCP registry as tech.dc5.whois/dc5-whois. WHOIS, RDAP, DNS, IP / ASN / CIDR and Web3 name (ENS, Unstoppable, Handshake) lookups. No API key. This page covers its hosted endpoint (https://whois.dc5.tech/mcp).
Is the DC5 WHOIS MCP server safe to use?
DC5 WHOIS scores 74 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the DC5 WHOIS MCP server expose?
DC5 WHOIS exposes 4 tools: check_lookalike, check_mail_security, list_data_sources, lookup_target. Their descriptions and schemas cost roughly 981 tokens of context every time the server is loaded.
Does the DC5 WHOIS MCP server require authentication?
No. We connected to DC5 WHOIS without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the DC5 WHOIS MCP server still maintained?
DC5 WHOIS is still listed as active in the MCP registry. We last reached this channel on 24 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.