# dechonet-mcp Domain security reconnaissance MCP server — 19 tools for AI agents. DNS, SSL, HTTP headers, email auth, port scan, ASN, RDAP, subdomains, lookalikes, OWASP, impersonation exposure, domain change history. Every result interpreted. Free, no API key. - **Type:** MCP server - **Trust:** 85/100 (A), scored on the package rubric - **Verification:** verified (build provenance) - **Version:** 1.2.2 - **Author:** DechoNet - **License:** MIT - **npm:** dechonet-mcp - **Endpoints:** streamable-http https://dechonet.com/mcp - **Source:** https://github.com/node-man/dechonet-mcp - **Endpoint health:** reachable (last checked 2026-09-16T11:27:07.962Z, 1 sample) — uptime is not a security property and is not part of the trust score - **Compatible clients:** claude-code, cursor, copilot, chatgpt, gemini (basis: transport) ## Trust 85/100 (A), scored on the package rubric - Publisher verified: no - Build provenance: verified attestation - npm trusted publishing (OIDC): yes - Install scripts: nothing suspicious found - Prompt-injection scan: not run - Obfuscation scan: not run - Evidence age: 1 day ## Security scan - **Status:** clean - **Scanned:** 2026-09-16T11:26:51.785Z - **Version scanned:** 1.2.2 - **CVEs:** none found by OSV at scan time ## Tools 20 declared. Statically extracted from the shipped source — a floor on the surface, not a census. - `dns_lookup` — Query DNS records (A, AAAA, MX, TXT, NS, SOA, CAA) for a domain and validate email-related records, including DNSSEC presence and SPF/DMARC syntax, returning se - `ssl_check` — Inspect a host's served TLS/SSL certificate and connection: expiry date, issuer, SAN list, chain integrity, TLS version, and HSTS, returning an A+ to F grade we - `http_security` — Follow a URL's HTTP redirect chain and audit response security headers (CSP, HSTS, X-Frame-Options, COOP, CORP, COEP, Permissions-Policy), grading A+ to F and f - `email_auth` — Assess a domain's email authentication and deliverability posture: MX records, SPF, DMARC, DKIM (probes 15 common selectors), BIMI, MTA-STS, TLS-RPT, and DANE, - `port_scan` — Probe a host for a fixed set of common TCP ports (HTTP, HTTPS, SSH, FTP, SMTP, DNS, and common databases) and report which are open, the service name, and the r - `dns_propagation` — Query one DNS record across 8+ global public resolvers (Google, Cloudflare, Quad9, OpenDNS, and more) simultaneously and report which resolvers return stale ver - `reverse_dns` — Resolve the PTR (reverse DNS) record for an IPv4 or IPv6 address and verify forward-confirmed reverse DNS (FCrDNS) by checking that the PTR hostname resolves ba - `asn_lookup` — Look up Autonomous System (ASN) / BGP information for an IP address or AS number: the network operator, announced prefixes, abuse contact, and a classification - `whois_lookup` — Retrieve domain registration data via RDAP (with WHOIS fallback): registrar, creation/expiry/update dates, nameservers, and EPP status flags, highlighting risk - `subdomain_discovery` — Enumerate the subdomains of a domain from Certificate Transparency logs — fully passive (no packets are sent to the target; CT logs are public records of every - `lookalike_domains` — Generate the typosquat/lookalike variants of a domain that phishers actually register — homoglyph swaps (l→1, o→0, rn→m), TLD swaps (.com→.co), character omissi - `ip_info` — Report information about the caller's own public IP as seen by the server: IPv4/IPv6 address, ISP, ASN, approximate geolocation, and proxy/VPN heuristics. - `email_header_analysis` — Parse raw email headers to reconstruct the delivery path (each Received hop in order), extract SPF/DKIM/DMARC authentication results, measure per-hop delays, an - `subnet_calc` — Compute IPv4 subnet details from CIDR notation entirely locally — no network call: network and broadcast addresses, usable host range, total usable hosts, subne - `security_scan` — One-shot comprehensive audit of a domain: runs DNS, SSL, HTTP headers, email auth, port scan, DNS propagation, reverse DNS, and ASN/RDAP checks in parallel, the - `owasp_check` — Assess a domain's OWASP posture from EXTERNAL OBSERVATION only: the OWASP Secure Headers Project plus the externally observable Top 10 subset — A02 Cryptographi - `impersonation_exposure` — Assess how exposed a domain is to brand impersonation and phishing, PASSIVELY: live typosquat/lookalike domains (homoglyph, omission, transposition, TLD swap) t - `domain_changes` — Report what has CHANGED for a domain over time — the security regressions and drift that DechoNet's daily monitoring has recorded across every watch on the doma - `watch_domain` — Start (or reuse) a daily DechoNet watch on a domain so that changes are recorded over time — SSL grade/issuer/expiry, DNS records, HTTP security headers, domain - `golive_check` — Check whether a domain is ready to launch or migrate — a go/no-go verdict over five essentials: DNS resolves to an IP, has propagated consistently across global ## Install **Verdict: install** — No blocking findings and no open coverage gaps — safe to install as configured. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"dechonet\": {\n \"command\": \"npx\",\n \"args\": [\n \"-y\",\n \"dechonet-mcp\"\n ]\n }\n }\n}" ``` ## Blast radius Contained to extensive — no credential declaration found, from the publisher, the upstream registry, or the README. Known so far: runs locally and hosted; read-only tool surface. - Floor 17, ceiling 35 (tier: unknown) - `unknown` means the floor and ceiling land in different bands — not measured enough to name one. It does not mean low. - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/dechonet-mcp - Install plan: https://forgeregistry.com/api/v1/packages/dechonet-mcp/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/dechonet-mcp - HTML page: https://forgeregistry.com/registry/dechonet-mcp - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.