how.is domain & IP intelligence

by how.is · remote · no sign-in to list tools · v1.1.0 · published by is.how

Pay-per-call DNS, WHOIS, domain age, TLS, email auth, blocklists, IP intel. Free samples.

Changes · 13

Compare Registry entry

16 tools: 13 change things and 3 only read.

Scanned Oct 21, 2026

Deletes or cancels0Claude Code: deny
Can't be undone0Claude Code: ask
Changes things13Claude Code: ask: see these tools
Only reads3Claude Code: allow: see these tools

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http domain-intel https://how.is/mcp

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

16 tools

Changes things 13Creates or changes something that can be changed back.Claude Code: ask

bot_observatoryPartner tier of the dns.pizza bot observatory: every network (ASN), named crawler, TLS (JA4) fingerprint and firewall rule seen in the last 7 days, refreshed hourly.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Partner tier of the dns.pizza bot observatory: every network (ASN), named crawler, TLS (JA4) fingerprint and firewall rule seen in the last 7 days, refreshed hourly. The public tier is free at https://dns.pizza/bots. Price $0.050 per call. Returns: data.data: generated_at, networks, bots, fingerprints (the free tier at dns.pizza/bots shows the same shape without fingerprints).
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
- idempotentHint: true
- destructiveHint: false
domain_ageHow old a domain is: registration date, age in days and years, and whether it was registered in the last 30 days (a common phishing signal).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
How old a domain is: registration date, age in days and years, and whether it was registered in the last 30 days (a common phishing signal). Price $0.005 per call. Free sample: {"domain": "example.com"}. Returns: data: created, age_days, age_years, newly_registered, expires, registrar, source.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
- idempotentHint: true
- destructiveHint: false
domain_availableIs this domain name registered?No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Is this domain name registered? Asked of the registry over RDAP, with the standard first-year and renewal price when it is free to register. Price $0.005 per call. Free sample: {"domain": "example.com"}. Returns: data: available (true/false; null when only DNS could be checked, then likely_available), registered_on, suffix, source (rdap/dns), confidence, price{registration_usd, renewal_usd, registrar, note}, caveat.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
- idempotentHint: true
- destructiveHint: false
domain_blacklistWhether the addresses behind a domain appear on spam and abuse blocklists.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Whether the addresses behind a domain appear on spam and abuse blocklists. Price $0.005 per call. Free sample: {"domain": "example.com"}. Returns: data.data.ipResults[]: target, isListed, listingCount, totalChecked.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
- idempotentHint: true
- destructiveHint: false
domain_dnsA, AAAA, MX, NS, TXT and other records for a domain, with resolve timing.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
A, AAAA, MX, NS, TXT and other records for a domain, with resolve timing. Price $0.005 per call. Free sample: {"domain": "example.com"}. Returns: data.data.records keyed by record type (A, AAAA, MX, NS, TXT, ...); data.data.responseTime.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
- idempotentHint: true
- destructiveHint: false
domain_dnssecWhether DNSSEC is signed and validates for a domain.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Whether DNSSEC is signed and validates for a domain. Price $0.005 per call. Free sample: {"domain": "example.com"}. Returns: data.data: isSigned, isValid, validationStatus, chainOfTrust, dsRecords, dnskeyRecords, errors, warnings, recommendations.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
- idempotentHint: true
- destructiveHint: false
domain_email_authSPF, DKIM and DMARC records and posture for a domain.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
SPF, DKIM and DMARC records and posture for a domain. Price $0.005 per call. Free sample: {"domain": "example.com"}. Returns: data.data: spf, dkim, dmarc, mx, overallScore, overallStatus, recommendations.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
- idempotentHint: true
- destructiveHint: false
domain_profileEverything about a domain in one call: DNS, WHOIS, TLS, DNSSEC, email auth, security score, blacklist status, plus IP intelligence for its A record.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Everything about a domain in one call: DNS, WHOIS, TLS, DNSSEC, email auth, security score, blacklist status, plus IP intelligence for its A record. Price $0.025 per call. Free sample: {"domain": "example.com"}. Returns: data.sections.{dns,whois,tls,dnssec,email-auth,security-score,blacklist,ip}; data.errors names any section that failed; data.billing says what was delivered.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
- idempotentHint: true
- destructiveHint: false
domain_security_scoreA letter grade and point score for a domain security posture, with the scored items behind it.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
A letter grade and point score for a domain security posture, with the scored items behind it. Price $0.005 per call. Free sample: {"domain": "example.com"}. Returns: data.data: grade, overallScore, maxPossibleScore, categories[] of scored items.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
- idempotentHint: true
- destructiveHint: false
domain_tlsCertificate validity, issuer, protocol and days until expiry for a domain.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Certificate validity, issuer, protocol and days until expiry for a domain. Price $0.005 per call. Free sample: {"domain": "example.com"}. Returns: data.data: valid, issuer, subject, subjectAltNames, validFrom, validTo, daysUntilExpiry, protocol, cipher, selfSigned.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
- idempotentHint: true
- destructiveHint: false
domain_trustShould an agent click, sign in to, or pay this domain?No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Should an agent click, sign in to, or pay this domain? A risk score and verdict (likely_safe / caution / high_risk, or inconclusive when a check could not run) with plain-English reasons, from domain age, spam/abuse blocklists and the HTTPS certificate. Price $0.020 per call. Free sample: {"domain": "example.com"}. Returns: data: verdict, risk_score (0-100), reasons[{risk, why}], age_days, blocklist_listings, blocklists_unanswered[], https_valid, not_checked[].
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
- idempotentHint: true
- destructiveHint: false
domain_whoisRegistrar, creation and expiry dates, nameservers and status codes for a domain.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Registrar, creation and expiry dates, nameservers and status codes for a domain. Price $0.005 per call. Free sample: {"domain": "example.com"}. Returns: data.data.data: the parsed WHOIS/RDAP record (registrar, dates, nameservers, status).
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
- idempotentHint: true
- destructiveHint: false
page_watchHas this page changed since your last call, and how much?No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Has this page changed since your last call, and how much? The first call stores a baseline; later calls return a text diff (2% threshold). Price $0.005 per call. Free sample: {"url": "https://example.com"}. Returns: data with baseline, changed, change_pct, added, removed, last_change_ts.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: true
- idempotentHint: false
- destructiveHint: false

Only reads 3Looks things up and changes nothing.Claude Code: allow

ip_lookupNetwork owner (ASN), company, geolocation, privacy flags and abuse contact for an IP address.No findings
Why it is in this group
- The name "ip_lookup" says "lookup": a word for reading.
Description, as the server wrote it
Network owner (ASN), company, geolocation, privacy flags and abuse contact for an IP address. Price $0.005 per call. Free sample: {"ip": "1.1.1.1"}. Returns: data.data: ip, hostname, city, region, country, asn, company, privacy, carrier, abuse.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
- idempotentHint: true
- destructiveHint: false
site_screenshotSee a web page: a 1280-wide JPEG of any public URL, viewport or full page (capped at 6000 px), with its final URL, HTTP status and title.No findings
Why it is in this group
- The name "site_screenshot" says "screenshot": a word for reading.
Description, as the server wrote it
See a web page: a 1280-wide JPEG of any public URL, viewport or full page (capped at 6000 px), with its final URL, HTTP status and title. Price $0.020 per call. Free sample: {"url": "https://example.com"}. Returns: data: image_base64 (JPEG), mime, width, height, final_url, http_status, title, note.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
- idempotentHint: true
- destructiveHint: false
site_statusLive check of one or more URLs: HTTP status, latency, DNS resolve time, resolved IP, TTL, nameservers, TLS days remaining.No findings
Why it is in this group
- The name "site_status" says "status": a word for reading.
Description, as the server wrote it
Live check of one or more URLs: HTTP status, latency, DNS resolve time, resolved IP, TTL, nameservers, TLS days remaining. Price $0.005 per call. Free sample: {"sites": ["https://example.com"]}. Returns: data keyed by URL; each entry has ok, code, ms, dns_ms, ip, ttl, ns, cert_days, server, ts.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
- idempotentHint: true
- destructiveHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.1.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http domain-intel https://how.is/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__domain-intel__ip_lookup",
      "mcp__domain-intel__site_status",
      "mcp__domain-intel__site_screenshot"
    ],
    "ask": [
      "mcp__domain-intel__domain_profile",
      "mcp__domain-intel__domain_trust",
      "mcp__domain-intel__domain_dns",
      "mcp__domain-intel__domain_whois",
      "mcp__domain-intel__domain_age",
      "mcp__domain-intel__domain_available",
      "mcp__domain-intel__domain_tls",
      "mcp__domain-intel__domain_dnssec",
      "mcp__domain-intel__domain_email_auth",
      "mcp__domain-intel__domain_security_score",
      "mcp__domain-intel__domain_blacklist",
      "mcp__domain-intel__page_watch",
      "mcp__domain-intel__bot_observatory"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as domain-intel. Review it before you use it.

Keep track

Get told when this server's tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/is.how/domain-intel/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Anlyon alternative

13 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Compare with other servers for the same product.

Source: MCP Registry. Synced Oct 21, 2026, 18:53 UTC.

For agents: Markdown · JSON · report this listing