how.is

Endpoints (36 live)

• POST /v1/domain/email-auth — SPF, DKIM and DMARC records and posture for a domain. (0.005 USDC on Base)
• POST /v1/domain/security-score — A letter grade and point score for a domain security posture, with the scored items behind it. (0.005 USDC on Base)
• POST /v1/domain/blacklist — Whether the addresses behind a domain appear on spam and abuse blocklists. (0.005 USDC on Base)
• POST /v1/check/site — Live check of one or more URLs: HTTP status, latency, DNS resolve time, resolved IP, TTL, nameservers, TLS days remaining. (0.005 USDC on Base)
• POST /v1/watch/page — Has this page changed since your last call, and how much? The first call stores a baseline; later calls return a text diff (2% threshold). (0.005 USDC on Base)
• POST /v1/site/screenshot — See a web page: a 1280-wide JPEG of any public URL, viewport or full page (capped at 6000 px), with its final URL, HTTP status and title. (0.02 USDC on Base)
• POST /v1/domain/dnssec — Whether DNSSEC is signed and validates for a domain. (0.005 USDC on Base)
• POST /v1/domain/dns — A, AAAA, MX, NS, TXT and other records for a domain, with resolve timing. (0.005 USDC on Base)
• POST /v1/domain/tls — Certificate validity, issuer, protocol and days until expiry for a domain. (0.005 USDC on Base)
• POST /v1/domain/age — How old a domain is: registration date, age in days and years, and whether it was registered in the last 30 days (a common phishing signal). (0.005 USDC on Base)
• POST /v1/ip — Network owner (ASN), company, geolocation, privacy flags and abuse contact for an IP address. (0.005 USDC on Base)
• POST /v1/domain/profile — Everything about a domain in one call: DNS, WHOIS, TLS, DNSSEC, email auth, security score, blacklist status, plus IP intelligence for its A record. (0.025 USDC on Base)
• POST /v1/domain/whois — Registrar, creation and expiry dates, nameservers and status codes for a domain. (0.005 USDC on Base)
• POST /v1/domain/available — Is this domain name registered? Asked of the registry over RDAP, with the standard first-year and renewal price when it is free to register. (0.005 USDC on Base)
• POST /v1/domain/trust — Should an agent click, sign in to, or pay this domain? A risk score and verdict (likely_safe / caution / high_risk, or inconclusive when a check could not run) with plain-English reasons, from domain age, spam/abuse blocklists and the HTTPS certificate. (0.02 USDC on Base)
• POST /v1/bots — Partner tier of the dns.pizza bot observatory: every network (ASN), named crawler, TLS (JA4) fingerprint and firewall rule seen in the last 7 days, refreshed hourly. The public tier is free at https://dns.pizza/bots. (0.05 USDC on Base)
• POST /v1/bot/verify/batch — Verify many crawler visitors (IP + user-agent) in one call: real Googlebot, GPTBot, ClaudeBot or impostor, billed per item. (0.01 USDC on Base)
• POST /v1/url/preflight — Check whether a URL is safe to fetch, read, sign in to or pay before you do: domain age, look-alike, blocklists, HTTPS, robots.txt for your agent and the site's own x402 price. (0.005 USDC on Base)
• POST /v1/read — Read a web page as clean markdown, with a safety verdict attached: robots.txt honored for your agent, risky sites flagged as untrusted, optional screenshot. (0.005 USDC on Base)
• POST /v1/brand/lookalikes — Find newly registered look-alikes of a brand: typos, look-alike characters, the same name on another TLD, or the brand beside a lure word, new in the zone files in the last 14 days, each with a risk tier and reasons. (0.02 USDC on Base)

+16 more endpoints.

MCP tools (24)

how.is domain intelligence https://how.is/mcp

• add_credit — Free. Returns a link your user opens to add card credit (from $5) to the key on this connection. If the connection has no key, it creates one: tell your user to add it to this server's settings as the header 'Authorization: Bearer <key>'. The link only adds credit; it never reveals the key.
• bot_observatory — Partner tier of the dns.pizza bot observatory: every network (ASN), named crawler, TLS (JA4) fingerprint and firewall rule seen in the last 7 days, refreshed hourly. The public tier is free at https://dns.pizza/bots; unlimited pulls come with a monthly plan at https://how.is/bots. Price $0.050 per call. Returns: data.data: generated_at, networks, bots, fingerprints (the free tier at dns.pizza/bots shows the same shape without fingerprints).
• bot_verify — Verify a crawler's identity: is this visitor (IP + user-agent) really Googlebot, Bingbot, GPTBot, ClaudeBot, Applebot, PerplexityBot..., an impostor using the name, another bot, or likely a person? Checked against each operator's published IP lists and forward-confirmed reverse DNS, plus 7 days of bot-observatory firewall data on the network and TLS (JA4) fingerprint. Price $0.005 per call. Free sample: {"ip": "66.249.66.1", "ua": "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"}. Returns: data: verdict (verified / impostor / unknown_bot / likely_human_or_unclassified), confidence, automation_likely, claimed, identified_as{operator, method, evidence}, reasons[], how_to_act, checks{published_ranges, reverse_dns, asn}, observatory{network, fingerprint, claimed_family, impostors_seen}.
• bot_verify_batch — Verify up to 100 visitors (IP + user-agent, optional JA4) in one call and one payment, billed per item: the same verdicts as bot_verify, for a log excerpt or a firewall review. Price $0.005 per call. Free sample: {"items": [{"ip": "66.249.66.1", "ua": "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"}]}. Returns: data: results[] (one bot_verify verdict per item, or {ip, error}), counts by verdict, billing{items, unit_price_usd}.
• brand_lookalikes — Newly registered look-alikes of a brand: names that entered the gTLD and .com/.net zones in the last 14 days and are a typo, a look-alike-character spelling (paypa1), the same name on another TLD, or the brand beside a lure word (paypal-login). Each with a risk tier and the reasons. Derived matches only, at most 50 — never a raw list of new domains. Price $0.020 per call. Free sample: {"brand": "example"}. Returns: data: brand, window{from,to,days}, matches[{domain, day, kind, matched, lures, tier, score, signals, ns{provider,hint}, census{state,registrar}, risk{tier,verdict,target}}], window_totals{total, by_tier, by_kind, listed_cap}, variants_searched, saturated, note.
• company_lookup — Who runs this site? Company name and legal name, what they do, category, location and social links when known, mail/DNS/hosting providers, registration facts, and whether it is the same outfit as before, with a source and a confidence for every field. Unknown domains answer 404 and are not charged. Price $0.010 per call. Free sample: {"domain": "stripe.com"}. Returns: data: name, legal_name, description, categories, kind, audience, business_model, location{locality,region,country}, social{x,linkedin,...}, providers{dns,mail,hosting}, registration{registrar,created,expires,age_years,registrant_org}, ownership, confidence{overall,fields}, sources, not_checked[].
• domain_age — How old a domain is: registration date, age in days and years, and whether it was registered in the last 30 days (a common phishing signal). Price $0.005 per call. Free sample: {"domain": "example.com"}. Returns: data: created, age_days, age_years, newly_registered, expires, registrar, source.
• domain_available — Is this domain name registered? Asked of the registry over RDAP, with the standard first-year and renewal price when it is free to register. Price $0.005 per call. Free sample: {"domain": "example.com"}. Returns: data: available (true/false; null when only DNS could be checked, then likely_available), registered_on, suffix, source (rdap/dns), confidence, price{registration_usd, renewal_usd, registrar, note}, caveat.
• domain_blacklist — Whether the addresses behind a domain appear on spam and abuse blocklists. Price $0.005 per call. Free sample: {"domain": "example.com"}. Returns: data.data.ipResults[]: target, isListed, listingCount, totalChecked.
• domain_changes — When did this domain appear in the registry zone file, leave it, come back, or change nameservers? From the daily gTLD + .com/.net zone files we capture (daily since 2026-08-05; monthly 2013-2018). A sudden nameserver move is a hijack or sale signal; a brand-new name is a phishing signal. Price $0.010 per call. Free sample: {"domain": "example.com"}. Returns: data: in_zone_now, first_seen, first_seen_is_coverage_start, last_seen, current_ns, events[{type: appeared|disappeared|reappeared|ns_changed, dates, from, to, message}], changed_last_30_days, coverage{daily_since, first_zone_file, runs}, ns_runs, note.
• domain_dns — A, AAAA, MX, NS, TXT and other records for a domain, with resolve timing. Price $0.005 per call. Free sample: {"domain": "example.com"}. Returns: data.data.records keyed by record type (A, AAAA, MX, NS, TXT, ...); data.data.responseTime.
• domain_dnssec — Whether DNSSEC is signed and validates for a domain. Price $0.005 per call. Free sample: {"domain": "example.com"}. Returns: data.data: isSigned, isValid, validationStatus, chainOfTrust, dsRecords, dnskeyRecords, errors, warnings, recommendations.
• domain_email_auth — SPF, DKIM and DMARC records and posture for a domain. Price $0.005 per call. Free sample: {"domain": "example.com"}. Returns: data.data: spf, dkim, dmarc, mx, overallScore, overallStatus, recommendations.
• domain_profile — Everything about a domain in one call: DNS, WHOIS, TLS, DNSSEC, email auth, security score, blacklist status, plus IP intelligence for its A record. Price $0.025 per call. Free sample: {"domain": "example.com"}. Returns: data.sections.{dns,whois,tls,dnssec,email-auth,security-score,blacklist,ip}; data.errors names any section that failed; data.billing says what was delivered.
• domain_security_score — A letter grade and point score for a domain security posture, with the scored items behind it. Price $0.005 per call. Free sample: {"domain": "example.com"}. Returns: data.data: grade, overallScore, maxPossibleScore, categories[] of scored items.
• domain_tls — Certificate validity, issuer, protocol and days until expiry for a domain. Price $0.005 per call. Free sample: {"domain": "example.com"}. Returns: data.data: valid, issuer, subject, subjectAltNames, validFrom, validTo, daysUntilExpiry, protocol, cipher, selfSigned.
• domain_trust — Should an agent click, sign in to, or pay this domain? A risk score and verdict (likely_safe / caution / high_risk, or inconclusive when a check could not run) with plain-English reasons, from domain age, spam/abuse blocklists and the HTTPS certificate. Price $0.020 per call. Free sample: {"domain": "example.com"}. Returns: data: verdict, risk_score (0-100), reasons[{risk, why}], age_days, blocklist_listings, blocklists_unanswered[], https_valid, not_checked[].
• domain_whois — Registrar, creation and expiry dates, nameservers and status codes for a domain. Price $0.005 per call. Free sample: {"domain": "example.com"}. Returns: data.data.data: the parsed WHOIS/RDAP record (registrar, dates, nameservers, status).
• ip_lookup — Network owner (ASN), company, geolocation, privacy flags and abuse contact for an IP address. Price $0.005 per call. Free sample: {"ip": "1.1.1.1"}. Returns: data.data: ip, hostname, city, region, country, asn, company, privacy, carrier, abuse.
• page_watch — Has this page changed since your last call, and how much? The first call stores a baseline; later calls return a text diff (2% threshold). Price $0.005 per call. Free sample: {"url": "https://example.com"}. Returns: data with baseline, changed, change_pct, added, removed, last_change_ts.
• read_url — Read a web page as clean markdown, with the URL pre-flight verdict attached (and a viewport screenshot on request). Honors robots.txt for your user agent; flags text from risky sites as untrusted. Refunded if nothing can be read. Price $0.005 per call. Free sample: {"url": "https://example.com"}. Returns: data: markdown, title, description, lang, canonical, final_url, http_status, content_type, words, truncated, untrusted_content, preflight{verdict, safe_to, reasons, ...}, screenshot{image_base64, ...} when asked.
• site_screenshot — See a web page: a 1280-wide JPEG of any public URL, viewport or full page (capped at 6000 px), with its final URL, HTTP status and title. Price $0.020 per call. Free sample: {"url": "https://example.com"}. Returns: data: image_base64 (JPEG), mime, width, height, final_url, http_status, title, note.
• site_status — Live check of one or more URLs: HTTP status, latency, DNS resolve time, resolved IP, TTL, nameservers, TLS days remaining. Price $0.005 per call. Free sample: {"sites": ["https://example.com"]}. Returns: data keyed by URL; each entry has ok, code, ms, dns_ms, ip, ttl, ns, cert_days, server, ts.
• url_preflight — Check whether a URL is safe to fetch, read, sign in to, or pay — before you do. One verdict with plain reasons: domain age and newborn flag, lookalike of a top site, spam/abuse blocklists, HTTPS, robots.txt for your user agent, how our bot observatory sees your user agent, and the site's own x402 price if it answers 402. Fails closed: 'unknown' means do not proceed. Price $0.005 per call. Free sample: {"url": "https://example.com"}. Returns: data: verdict (likely_safe/caution/high_risk/inconclusive), risk_score, safe_to{fetch,read,sign_in,pay} each yes/caution/no/unknown, actions{...: {answer, why}}, reasons[{risk, why}], domain_age_days, newborn, lookalike, https_valid, robots{allowed, token, status}, http{status, content_type, redirects}, x402{offers[{price_usd, network, pay_to}]}, bot_policy, not_checked[].