liveWhoisLookupLABSCO SUMMARY
A domain investigation runs as one conversation instead of six browser tabs.
Registration, DNS, subdomains and IP reputation all come from the same connection, and both WHOIS and DNS carry history — so "who owns this and what changed" is answerable without stitching together separate lookup sites.
What it is
The WhoisFreaks API exposed as fourteen tools covering four areas: domain and IP registration records, DNS both current and historical, IP intelligence, and domain discovery. It runs as a container or from a Java build.
What you get
- Live WHOIS for any domain — registrar, registrant, key dates and nameservers — plus the full ownership history as a timeline
- Reverse WHOIS: every domain registered under an email address, keyword, owner name or company
- WHOIS for an IPv4 or IPv6 address, and for an Autonomous System Number
- DNS records live (A, AAAA, MX, NS, CNAME, SOA, TXT, SPF, or all at once), historically with a change timeline, and in reverse from an IP or nameserver
- IP intelligence: country, city, region, ISP and coordinates, alongside VPN, proxy, Tor-exit, bot and threat signals
- Domain availability with suggestions, subdomain enumeration, domain discovery and SSL certificate lookup
Requirements
A WhoisFreaks API key. Then either Docker, which is the route the authors recommend and which needs nothing else installed, or a Java toolchain and Maven to build from source. It connects over stdio locally, or over HTTP and SSE when it runs on a remote machine.
Setup effort
One command plus a key — docker run -d -p 3100:3100 -e WHOISFREAKS_API_KEY=<YOUR_WHOISFREAKS_API_KEY> whoisfreaks/mcp-server:latest
USE CASES
01
Finding out who is behind a domain
Start with the live registration record — registrar, registrant, dates, nameservers — then read the ownership timeline to see whether it recently changed hands.
02
Mapping everything one organization owns
Search backwards from a company name, an owner or a registration email to the full set of domains registered under it, then enumerate the subdomains that hang off them.
03
Judging whether an IP address should be trusted
Read its geolocation and ISP alongside the threat signals — VPN, proxy, Tor exit node, known bot — and check the registration record and ASN behind it.
04
Working out when a domain's DNS changed
Pull the current records, then the historical timeline, so a mail failure or a redirect that started last Tuesday can be tied to the change that caused it.
05
Finding what else lives on an address
Go the other way from an IP or a nameserver to every domain pointing at it — the fastest way to see what shares infrastructure with the thing you are looking at.
06
Checking a name before you buy it
Ask whether the domain is registrable, take the suggestions when it is not, and inspect the certificate on the one that is already live.
14 tools
Listed in project docs. Your client may show a different list.
whoisHistoryreverseWhoisLookupipWhoisLookupasnWhoisLookupdnsLookupdnsHistoryreverseDnsLookupipGeolocationipSecuritydomainAvailabilitysubdomainLookupdomainDiscoverysslLookupBEFORE YOU INSTALL
What to know first
Tools you get
14 tools named in the project's documentation.
Requires
- docker on PATH
- WHOISFREAKS_API_KEY in your environment
INSTALLATION
Connect your client
Server setup
TERMINAL
docker run -d -p 3100:3100 -e WHOISFREAKS_API_KEY=<YOUR_WHOISFREAKS_API_KEY> whoisfreaks/mcp-server:latestMCP Clients
Claude Desktop, Windsurf
JSON
{
"mcpServers": {
"whoisfreaks": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"-e",
"WHOISFREAKS_API_KEY=<YOUR_WHOISFREAKS_API_KEY>",
"--entrypoint",
"java",
"whoisfreaks/mcp-server:latest",
"-jar",
"app.jar"
]
}
}
}Cursor
CURSOR · JSON
{
"mcpServers": {
"whoisfreaks": {
"url": "http://localhost:3100/sse"
}
}
}VS Code
VS CODE · JSON
{
"servers": {
"whoisfreaks": {
"type": "sse",
"url": "http://localhost:3100/sse"
}
}
}Continue
CONTINUE · YAML
mcpServers:
- name: whoisfreaks
url: http://localhost:3100/sse
type: sse
