# DC5 WHOIS (remote · whois.dc5.tech)

WHOIS, RDAP, DNS, IP / ASN / CIDR and Web3 name (ENS, Unstoppable, Handshake) lookups. No API key.

- Trust score: 74/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-10-24

## Components

- remote · `whois.dc5.tech`: 74/100 (this document), [markdown](https://verifymcp.io/servers/tech-dc5-whois-dc5-whois/whois.md), [page](https://verifymcp.io/servers/tech-dc5-whois-dc5-whois/whois)

## Channel facts

- Endpoint: `https://whois.dc5.tech/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `2026.10.23`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-10-24.

- **Endpoint Security**: 80/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one.
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 67/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 1104 tokens (~276/item across 4 items; 4 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 17/100
  - Stability observed for 5 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 4 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 5 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).

## Install

### How do I install the DC5 WHOIS MCP server?

DC5 WHOIS is a hosted endpoint at https://whois.dc5.tech/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http tech-dc5-whois-dc5-whois 'https://whois.dc5.tech/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "tech-dc5-whois-dc5-whois": {
      "url": "https://whois.dc5.tech/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "tech-dc5-whois-dc5-whois": {
      "type": "http",
      "url": "https://whois.dc5.tech/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.tech-dc5-whois-dc5-whois]
url = "https://whois.dc5.tech/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "tech-dc5-whois-dc5-whois": {
      "type": "remote",
      "url": "https://whois.dc5.tech/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add tech-dc5-whois-dc5-whois --url 'https://whois.dc5.tech/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  tech-dc5-whois-dc5-whois:
    url: "https://whois.dc5.tech/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "tech-dc5-whois-dc5-whois": {
      "Transport": "http",
      "Url": "https://whois.dc5.tech/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add tech-dc5-whois-dc5-whois -t streamable-http -u 'https://whois.dc5.tech/mcp'
```

### Other

```json
{
  "mcpServers": {
    "tech-dc5-whois-dc5-whois": {
      "type": "http",
      "url": "https://whois.dc5.tech/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-10-24 (score 74, 0)

- [functional] Server version: 2026.10.23 → 2026.10.23.1

### 2026-10-23 (score 74, +3)

- [security improvement] HSTS header: fail → pass
- [functional] Server version: 2026.10.18-cdf49eb → 2026.10.23

### 2026-10-21 (score 71, +1)

No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-20 (score 70, 0)

- [functional improvement] Stability: unverified → 0.03

### 2026-10-19 (score 70)

First indexed and scored.

## MCP tools (4)

### `check_lookalike` (~195 tokens)

Look-alike (homograph) check

Check whether one domain or Web3 name is a visual look-alike (homograph): letters from different scripts mixed in one label, or every non-ASCII letter having a Latin twin, so раураl.com reads as paypal.com. Returns the scripts used and the Latin name it imitates.

Use it to screen candidate or incoming names quickly (phishing triage, brand monitoring). lookup_target already includes this warning for the name it looks up, so there is no need to call both for one name.

Behavior: offline and instant; no DNS, registry or network call. It catches script tricks only, not typos or digit swaps such as paypa1.com, so a clean result does not mean the domain is safe.

Input parameters:

- `name` (string, required): one domain or Web3 name, Unicode (раураl.com) or punycode (xn--...); a full URL is not accepted

Output parameters:

- `look_alike` (boolean)
- `looks_like` (string): the Latin name it imitates
- `mixed_script` (boolean): one label mixes scripts
- `name` (string): name in Unicode form
- `scripts` (null|array): scripts the letters come from

### `check_mail_security` (~220 tokens)

Mail security grade

Grade one domain's email authentication and list every check: SPF (single record, the 10 DNS-lookup limit across includes, the all qualifier), DMARC (policy, inheritance from the organizational domain, pct, report addresses), MTA-STS, TLS-RPT, BIMI, DANE and null MX. The level is strong, fair, weak, no_mail (domain declares it sends no mail) or none (no MX, SPF or DMARC at all).

Use it for questions about spoofing, deliverability or a DMARC rollout. lookup_target gives only the overall grade; this tool gives the status and a one-line finding for each check.

Behavior: reads public DNS only and never connects to the domain's mail servers, so it cannot test SMTP TLS, certificates or whether a mailbox exists. Usually under 2 s.

Input parameters:

- `domain` (string, required): registered domain or subdomain whose mail setup to grade, e.g. example.com; Unicode or punycode. Not an email address and not a mail server host name

Output parameters:

- `checks` (null|array)
- `details_url` (string)
- `domain` (string)
- `level` (string): strong, fair, weak, no_mail, or none when the domain has no mail setup

### `list_data_sources` (~127 tokens)

Data sources and freshness

List the local datasets and feeds behind lookup_target (RIR delegations, IANA, Public Suffix List, cloud / CDN ranges, Tor and Private Relay, reputation lists, GeoLite2) with state, record count, generation date and a stale flag.

Use it to judge how current a reputation, RIR, cloud or geolocation answer is, or to explain why such a section is missing from a lookup (dataset not loaded or stale). Registry, DNS and Web3 data are fetched live and are not listed here.

Behavior: takes no arguments and makes no external calls.

Output parameters:

- `datasets` (null|array)

### `lookup_target` (~439 tokens)

WHOIS / RDAP / DNS / network / Web3 lookup

Look up one domain, IP address, CIDR block, ASN (AS15169) or Web3 name (ENS .eth, Unstoppable, SPACE ID .bnb, Handshake hns:) and get a compact fact sheet. Domains: registrar, dates, status, nameservers, DNS records, overall mail-security grade, third-party services seen in DNS, possibly dangling records. IPs, CIDRs and ASNs: network owner, origin AS, RIR, cloud / CDN provider, Tor or iCloud Private Relay tag, geolocation, abuse contact, local reputation. Web3 names: registration status, addresses, records. A look-alike warning is added when the name uses deceptive letters.

Use it first for any question about who owns, runs, hosts or registered something. Prefer check_mail_security when you need each email check rather than the grade, and check_lookalike to screen many names without network calls.

Behavior: queries registries, DNS and (for Web3) blockchain RPC live, usually in 1-5 s, at most about 12 s. If one source fails, the rest is still returned and the failure is listed under errors. Reputation covers local blocklists only: no match is not a clean bill of health. Queries are not logged or stored. The result ends with details_url, the full page with every record and its provenance.

Input parameters:

- `namespace` (string): optional; force a Web3 namespace (ens, unstoppable, spaceid, sns or hns) when a name could belong to several, e.g. a TLD that is both an ICANN TLD and a Web3 namespace. Leave empty and the namespace…
- `query` (string, required): what to look up: a domain (example.com, münchen.de), IPv4 / IPv6 address, CIDR (8.8.8.0/24), ASN written as AS15169 (a bare number is not an ASN), or a Web3 name (vitalik.eth, brad.crypto, spaceid.bn…

Output parameters:

- `addresses` (null|array): Web3 addresses as network:address
- `anonymizer` (string): tor_exit or private_relay
- `availability` (string): registered, available or unknown (domains and Web3 names)
- `cloud` (string): cloud / CDN provider
- `country` (string)
- `created_at` (string)
- `details_url` (string): full result page
- `errors` (null|array): provider failures; the rest of the result is still valid
- `expires_at` (string)
- `mail_security` (string): strong, fair, weak or no_mail
- `nameservers` (null|array)
- `network` (string): covering CIDR or network range
- `organization` (string)
- `origin_as` (integer): origin AS number for an IP
- `query` (string): normalized query
- `registrar` (string)
- `reputation` (string): verdict from local lists; absent when no list is loaded
- `summary` (string): the full human-readable fact sheet, the same text as the text content
- `type` (string): target type: domain, ipv4, ipv6, cidr, asn or web3_name
- `warnings` (null|array): look-alike, special-purpose and namespace-collision warnings
- `web3_status` (string)

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/tech-dc5-whois-dc5-whois/whois#diagnostics

## Score history

- 2026-10-24: 74
- 2026-10-23: 74
- 2026-10-22: 71
- 2026-10-21: 71
- 2026-10-20: 70
- 2026-10-19: 70

## Common questions

### What is the DC5 WHOIS MCP server?

DC5 WHOIS is an MCP server listed in the public MCP registry as tech.dc5.whois/dc5-whois. WHOIS, RDAP, DNS, IP / ASN / CIDR and Web3 name (ENS, Unstoppable, Handshake) lookups. No API key. This page covers its hosted endpoint (https://whois.dc5.tech/mcp).

### Is the DC5 WHOIS MCP server safe to use?

DC5 WHOIS scores 74 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the DC5 WHOIS MCP server expose?

DC5 WHOIS exposes 4 tools: check_lookalike, check_mail_security, list_data_sources, lookup_target. Their descriptions and schemas cost roughly 981 tokens of context every time the server is loaded.

### Does the DC5 WHOIS MCP server require authentication?

No. We connected to DC5 WHOIS without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

### Is the DC5 WHOIS MCP server still maintained?

DC5 WHOIS is still listed as active in the MCP registry. We last reached this channel on 24 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://whois.dc5.tech/mcp
- Website: https://whois.dc5.tech/
- Changelog RSS feed: https://verifymcp.io/servers/tech-dc5-whois-dc5-whois/whois.xml
- Changelog JSON feed: https://verifymcp.io/servers/tech-dc5-whois-dc5-whois/whois.json
- HTML version of this page: https://verifymcp.io/servers/tech-dc5-whois-dc5-whois/whois