# io.uptimeify/mcp-server Free anonymous website, DNS, email and TLS checks, plus monitor read and opt-in write access. - **Type:** MCP server - **Trust:** 60/100 (B), scored on the content rubric - **Verification:** community-indexed — nobody has claimed this listing - **Version:** 1.6.0 - **Author:** io.uptimeify - **License:** Unknown - **Endpoints:** streamable-http https://uptimeify.io/mcp - **Source:** https://uptimeify.io/mcp-server - **Endpoint health:** reachable (last checked 2026-09-23T12:12:42.254Z, 5 samples) — uptime is not a security property and is not part of the trust score - **Compatible clients:** claude-code, cursor, copilot, chatgpt, gemini (basis: transport) ## Trust 60/100 (B), scored on the content rubric - Publisher verified: no - Install scripts: nothing suspicious found - Prompt-injection scan: clean - Obfuscation scan: clean - Evidence age: 0 days ## Security scan - **Status:** clean - **Scanned:** 2026-09-23T12:12:42.254Z - **Version scanned:** live - **CVEs:** no coverage — this entry has no package coordinates to query OSV against, so "no known CVEs" is NOT asserted for it. **Findings** - injection-shaped content (note) in the `http_headers` tool: Links to undeclared domain: deinkunde.com - injection-shaped content (note) in the `redirect_check` tool: Links to undeclared domain: deinkunde.com - injection-shaped content (note) in the `website_status` tool: Links to undeclared domain: deinkunde.com - injection-shaped content (note) in the `response_time` tool: Links to undeclared domain: deinkunde.com ## Tools 20 declared. Observed from a live `tools/list` probe. - `check_ssl` — Fetch and evaluate a host's TLS/SSL certificate over a live handshake: subject and issuer, validity window, days until expiry, hostname match, chain trust, self - `check_dns` — Resolve a domain's DNS records in one call (A, AAAA, CNAME, MX, TXT, NS, SOA and more), returning each record type with its values and a per-type error where a - `dns_propagation` — Query the same domain against several public resolvers and compare the answers, so a recent record change can be told apart from a stale cache. Returns each res - `mx_lookup` — Look up a domain's MX records and resolve each mail exchanger to its IPv4 and IPv6 addresses, ordered by priority and flagged when a host resolves into private - `spf_check` — Fetch a domain's SPF record and evaluate the policy: the raw record, every parsed term with its qualifier, the number of DNS lookups it costs against the RFC 72 - `dkim_check` — Fetch and validate the DKIM public key published at a given selector (._domainkey.) and report the parsed tags, key type, key size in bits, an - `dmarc_check` — Fetch a domain's DMARC record from _dmarc. and evaluate it: the raw record, every parsed tag, the policy and subdomain policy, the percentage the policy - `dnsbl_check` — Query a public IP address against common DNS blacklists and return, per list, whether it is listed, the reason code the list gave and its delisting URL, plus to - `whois` — Retrieve WHOIS registration data for a domain: registrar, creation, update and expiry dates, EPP status codes, nameservers and the contact roles the registry st - `domain_expiry` — Report a domain's registration expiry from WHOIS together with daysUntilExpiry, plus registrar, creation and update dates and the EPP status codes that reveal a - `http_headers` — Fetch a URL and return its HTTP response headers verbatim as a name/value map, with the status line and every redirect hop taken to get there. Use it to inspect - `hsts_check` — Check a domain's HTTP Strict Transport Security configuration: whether the header is present, its raw value, max-age in seconds, the includeSubDomains and prelo - `redirect_check` — Follow a URL's HTTP redirect chain hop by hop and return every step with its status code, source and target, the final URL and status, the hop count, and warnin - `port_check` — Open a TCP connection to one or more ports on a host and report each as open, closed or filtered with the time the attempt took. Pass a single port or a list of - `ping_test` — Measure reachability and round-trip time by opening repeated TCP connections to a host, reporting every attempt plus the count sent and received, packet loss pe - `website_status` — Is a website up right now? Start here for any is-the-site-down question: up/down verdict, HTTP status and status text, response time in milliseconds, the server - `response_time` — Measure how fast a URL answers by taking several samples and returning each one plus min, average and max milliseconds, the HTTP status and an up flag. partial= - `ip_geolocation` — Locate a public IP address, or a domain resolved to one, at network level: country code, allocating registry, announced prefix, PTR hostname and the autonomous - `asn_lookup` — Resolve a public IP address, or a domain, to the autonomous system that announces it: AS number and name, the announced prefix, country code, registry and alloc - `reverse_dns` — Resolve a public IP address to the PTR hostnames published for it, returning every name the pointer record carries, or the resolver's error where there is none. ## Install **Verdict: review** — Installable, but 2 things to check first: No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it. **Cautions** (coverage gaps and advisories — never blocking) - No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it. - No publisher has proved control of this listing; it is indexed, not vouched for. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"mcp-server\": {\n \"type\": \"http\",\n \"url\": \"https://uptimeify.io/mcp\"\n }\n }\n}" ``` ## Blast radius Contained to moderate — no credential declaration found, from the publisher, the upstream registry, or the README. Known so far: runs on someone else's infrastructure; read-only tool surface. - Floor 9, ceiling 27 (tier: unknown) - `unknown` means the floor and ceiling land in different bands — not measured enough to name one. It does not mean low. - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/io.uptimeify%2Fmcp-server - Install plan: https://forgeregistry.com/api/v1/packages/io.uptimeify%2Fmcp-server/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/io.uptimeify%2Fmcp-server - HTML page: https://forgeregistry.com/registry/io.uptimeify%2Fmcp-server - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.