
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@devlime/domain-radar-mcp
Advanced tools
MCP server for domain name intelligence - availability, expiring and expired domains tracking
A Model Context Protocol (MCP) server that provides domain name information, availability checking, and trend analysis for Claude and other MCP clients.
# Install the package globally
npm install -g @devlimelabs/domain-radar-mcp
# Start the server
domain-radar-mcp
# Clone the repository
git clone https://github.com/devlimelabs/domain-radar-mcp.git
cd domain-radar-mcp
# Install dependencies
npm install
# Set up development environment
npm run setup:dev
# Start the development server
npm run dev
# Build and run with Docker Compose
docker-compose up -d
# Or build and run the Docker image directly
docker build -t domain-radar-mcp .
docker run -p 3000:3000 domain-radar-mcp
The Domain Radar MCP uses WhoisXML API for domain availability checking. Follow these steps to set it up:
# Create a configuration file
cp .env.example .env
Edit the .env file with your WhoisXML API key:
# Required: Your WhoisXML API key
DOMAIN_API_KEY=YOUR_WHOISXML_API_KEY
# WhoisXML API Endpoint (default is already configured)
AVAILABILITY_API_URL=https://domain-availability.whoisxmlapi.com/api/v1
# NOTE: Expired/Expiring domains currently use mock data
# WhoisXML requires data feed subscription for these features
EXPIRATION_API_URL=https://api.example.com/domains/expiring
EXPIRED_API_URL=https://api.example.com/domains/expired
# Top-level domains to check (comma-separated)
TOP_LEVEL_DOMAINS=.com,.net,.org,.io,.co,.dev,.app,.ai
# Cache time-to-live in milliseconds (default: 15 minutes)
CACHE_TTL=900000
For production use with expired/expiring domains, consider:
Add this MCP server to your Claude Desktop configuration file:
# Run the Claude Desktop setup script
npm run setup:claude
Follow the instructions to update your Claude Desktop configuration file. The script will generate a configuration similar to:
{
"mcpServers": {
"domain-radar": {
"command": "domain-radar-mcp",
"env": {
"DOMAIN_API_KEY": "your_domain_api_key"
}
}
}
}
Add this MCP server to your Cursor configuration file:
Cursor → Settings or Cmd+, on Mac){
"mcpServers": {
"domain-radar": {
"command": "node",
"args": ["/path/to/global/domain-radar-mcp/dist/index.js"],
"env": {
"DOMAIN_API_KEY": "your_domain_api_key"
}
}
}
}
Or if installed globally:
{
"mcpServers": {
"domain-radar": {
"command": "domain-radar-mcp",
"env": {
"DOMAIN_API_KEY": "your_domain_api_key"
}
}
}
}
Add this MCP server to your Windsurf configuration:
.windsurf/config.json file in your project directory{
"mcpServers": {
"domain-radar": {
"command": "domain-radar-mcp",
"env": {
"DOMAIN_API_KEY": "your_domain_api_key"
}
}
}
}
For development setup with Windsurf:
{
"mcpServers": {
"domain-radar": {
"command": "tsx",
"args": ["src/index.ts"],
"cwd": "/path/to/domain-radar",
"env": {
"DOMAIN_API_KEY": "your_domain_api_key"
}
}
}
}
Check if domains are available for registration:
check-domain-availability
domain: "example.com"
If you provide a domain name without a TLD (e.g., "example" instead of "example.com"), the tool will check availability across common TLDs (.com, .net, .org, etc.).
Search for domains expiring within 24 hours:
search-expiring-domains
keyword: "tech" # Optional filter
Search for recently expired domains:
search-expired-domains
keyword: "business" # Optional filter
View a markdown table of domains expiring within 24 hours:
Resource: expiring-domains://list
View a markdown table of recently expired domains:
Resource: expired-domains://list
User: I'm looking for a technology blog domain name with "tech" in it. What's available?
Claude: Let me check domain availability for names containing "tech".
[Uses check-domain-availability tool with domain "tech"]
Here are the available domains with "tech":
- techblog.io is available
- mytechworld.com is available
- techtips.dev is available
Would you like me to check any specific domains?
User: Check if devlime.ai is available.
Claude: Let me check the availability of devlime.ai for you.
[Uses check-domain-availability tool with domain "devlime.ai"]
✅ devlime.ai is available! Price: $45 USD
Would you like me to check any other domains?
User: Are there any good AI-related domains expiring soon?
Claude: Let me search for AI-related domains that are expiring within the next 24 hours.
[Uses search-expiring-domains tool with keyword "ai"]
Domains expiring within 24 hours matching "ai":
• aistudios.net - Expires: 5/18/2023, 3:45:00 PM
Estimated Value: $2,800
Est. Monthly Traffic: 1,200
Categories: artificial intelligence, technology, education
• fairdata.org - Expires: 5/18/2023, 11:30:00 PM
Estimated Value: $5,500
Est. Monthly Traffic: 3,100
Categories: artificial intelligence, data science, ethics
Would you like details on any of these domains?
For details on known limitations, issues, and planned improvements, see the ISSUES.md file.
For manual testing details, see the Testing Guide.
Contributions are welcome! Please feel free to submit a Pull Request.
MIT
FAQs
MCP server for domain name intelligence - availability, expiring and expired domains tracking
We found that @devlime/domain-radar-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.