DC5 WHOIS

WHOIS, RDAP, DNS, IP, CIDR, ASN and Web3 name (ENS, Unstoppable, SPACE ID, Handshake, Solana) lookups in one call: registration, DNS, routing, cloud/CDN, reputation, mail security and look-alike screening from local datasets. No API key needed.

View on dc5.tech

Hosted MCP Server

npx add-mcp 'https://whois.dc5.tech/mcp'

Installs into Claude Code, Codex, Cursor and more

Documentation

Lookups for AI agents.

The same WHOIS, RDAP, DNS, network and Web3 data as this console, as a Model Context Protocol server. No sign-up, no API key. Four read-only tools; answers are compact text plus structured JSON.

Endpoint

https://whois.dc5.tech/mcp

Streamable HTTP, stateless. Opening this URL in a browser shows this page.

Connect

# Claude Code
claude mcp add --transport http dc5-whois https://whois.dc5.tech/mcp

# Claude (web / desktop): Settings → Connectors → Add custom connector → https://whois.dc5.tech/mcp

# Cursor: ~/.cursor/mcp.json
{ "mcpServers": { "dc5-whois": { "url": "https://whois.dc5.tech/mcp" } } }

# VS Code: .vscode/mcp.json
{ "servers": { "dc5-whois": { "type": "http", "url": "https://whois.dc5.tech/mcp" } } }

# Any other client (JSON config)
{ "mcpServers": { "dc5-whois": { "type": "http", "url": "https://whois.dc5.tech/mcp" } } }

Also listed on Smithery and Glama. Server card: /.well-known/mcp/server-card.json.

Tools

lookup_target (query, namespace?)

One domain, IP, CIDR, ASN (AS15169) or Web3 name → a compact fact sheet: registrar and dates, DNS, mail-security grade, network owner, origin AS, RIR, cloud / CDN, geolocation, abuse contact, local reputation, Web3 records. Ends with a link to the full page.

Try: “Who hosts example.com and when does it expire?”

check_mail_security (domain)

Every email-authentication check with a one-line finding: SPF (incl. the 10-lookup limit), DMARC, MTA-STS, TLS-RPT, BIMI, DANE, null MX. Public DNS only.

Try: “Why do mails from our domain fail DMARC?”

check_lookalike (name)

Homograph check: mixed scripts or letters with Latin twins, so раураl.com (Cyrillic) reads as paypal.com. Offline and instant; does not catch typos like paypa1.com.

Try: “Are any of these sender domains look-alikes?”

list_data_sources (—)

The local datasets behind the answers (RIR, IANA, PSL, cloud ranges, Tor, reputation lists, GeoLite2) with record counts, dates and a stale flag.

Try: “How fresh is the reputation data?”

Behavior

  • Registry, DNS and Web3 data are fetched live: usually 1–5 s, at most about 12 s per lookup.
  • If one source fails, the rest is still returned and the failure is listed under errors.
  • Reputation and geolocation come from local copies of public datasets; no third party sees what is looked up. No match is not a clean bill of health.
  • About 60 requests per minute per IP, shared with the HTTP API.
  • Tool arguments are not stored; calls are counted by target type only. See the privacy notice.