Signed internet telemetry, read-only: DNS, TLS, WHOIS, reachability. Every record Ed25519-signed.
Inferred from the transports this listing declares (streamable-http). A client not listed here hasn’t been ruled out — it just isn’t something Forge can confirm.
Verification confirms publisher identity (repo ownership), not code safety. The security scan covers known CVEs and suspicious install scripts.
Read from a real MCP initialize → tools/list handshake against the declared endpoint. No tool was ever invoked — tools/list is the read-only introspection call the protocol defines for this. It reflects what the server advertised at that moment; a hosted endpoint is not pinned to any version and can change without notice.
https://domaindrift.io/mcp5 tools · 159mslookup_domainThe latest signed observation of one domain: who runs its nameservers, mail, and CDN; certificate issuer and expiry; HTTPS reachability; per-record-type counts; and the Ed25519 receipt pointer. Keyless calls get this reduced preview, throttled to 1 request per 15 seconds per IP under a shared daily…The latest signed observation of one domain: who runs its nameservers, mail, and CDN; certificate issuer and expiry; HTTPS reachability; per-record-type counts; and the Ed25519 receipt pointer. Keyless calls get this reduced preview, throttled to 1 request per 15 seconds per IP under a shared daily…
| Parameter | Type | Description |
|---|---|---|
| domain* | string | Registrable domain name, e.g. "example.com" |
whats_changed_todayThe daily "what changed on the internet" digest: a ranked top-20 of the most significant DNS, TLS, WHOIS, and infrastructure changes observed across the tracked catalog in the last 24 hours. Public and keyless. The complete change wire with sync cursors is the keyed /v1/changes endpoint.The daily "what changed on the internet" digest: a ranked top-20 of the most significant DNS, TLS, WHOIS, and infrastructure changes observed across the tracked catalog in the last 24 hours. Public and keyless. The complete change wire with sync cursors is the keyed /v1/changes endpoint.
No input schema was published for this tool.
resolve_receiptResolve any DomainDrift provenance receipt by id: the public Ed25519 commitment (output hash, signing key, timestamp, chain link) for one observation. Public and keyless. Verify the signing key against /.well-known/domaindrift-keys.json.Resolve any DomainDrift provenance receipt by id: the public Ed25519 commitment (output hash, signing key, timestamp, chain link) for one observation. Public and keyless. Verify the signing key against /.well-known/domaindrift-keys.json.
| Parameter | Type | Description |
|---|---|---|
| id* | string | Receipt id, as returned in any signed record or preview |
internet_tapeThe rolling 24-hour aggregate rollup: how many domains changed DNS provider, switched certificate authority, moved mail, went unreachable, and the other tape legs, each with a live count. Public and keyless.The rolling 24-hour aggregate rollup: how many domains changed DNS provider, switched certificate authority, moved mail, went unreachable, and the other tape legs, each with a live count. Public and keyless.
No input schema was published for this tool.
signing_keysThe Ed25519 public keys that sign every DomainDrift observation, with derivation paths and validity windows. Public and keyless. Use these to verify receipts and signed records offline.The Ed25519 public keys that sign every DomainDrift observation, with derivation paths and validity windows. Public and keyless. Use these to verify receipts and signed records offline.
No input schema was published for this tool.
5 of 5 tools published a description.
Tool names and descriptions are written by the publisher and shown verbatim as inert text. They are the strings an MCP client passes to a model, so Forge scans them for prompt-injection patterns — any finding appears with the security scan above. “Privileged” is a keyword match on the tool name, not an audit of what the tool does: a benign-sounding name can still do anything.
Signed internet telemetry, read-only: DNS, TLS, WHOIS, reachability. Every record Ed25519-signed.
Linked names open Forge’s index of every entry observed exposing that tool. Browse all indexed tools.
This entry publishes no npm package, so Forge has no dependency tree for it. That is a gap in coverage — not a statement that it has no dependencies.