# DechoNet MCP Server

**[dechonet.com](https://dechonet.com)** · [Remote MCP (no install)](https://dechonet.com/mcp) · [Phishing link check](https://dechonet.com/util/phishing) · [Free web tools](https://dechonet.com/util) · [HTTP API](https://dechonet.com/developers) · [Detection benchmark](https://dechonet.com/benchmark) · [Status](https://dechonet.com/status)

[![Smithery](https://img.shields.io/badge/Smithery-nodeman%2Fdechonet-orange)](https://smithery.ai/servers/nodeman/dechonet) [![Glama MCP connector](https://glama.ai/mcp/connectors/com.dechonet/mcp/badges/score.svg)](https://glama.ai/mcp/connectors/com.dechonet/mcp) [![npm](https://img.shields.io/npm/v/dechonet-mcp)](https://www.npmjs.com/package/dechonet-mcp)

Domain security reconnaissance for AI agents via the [Model Context Protocol](https://modelcontextprotocol.io).

**30 tools. No API key needed for non-commercial use.** Phishing/smishing link checks, exposed admin page checks (admin screens, test servers, dev tools left open), DNS, SSL/TLS, post-quantum TLS readiness, HTTP security headers, email authentication, port scan, DNS propagation, reverse DNS, ASN/BGP, RDAP/WHOIS, subdomain discovery (CT logs), lookalike/typosquat detection, OWASP-mapped observable checks, brand-impersonation exposure, go-live readiness, **MCP server checks** before you connect one, **domain change history** — what changed since the last check — **infrastructure history and pivots** (past nameservers/IPs/issuers, and other domains seen on the same rare infrastructure), and a daily **watch** you can set from the agent.

Every result comes back interpreted, not just as raw JSON: a status, the key numbers, each issue with severity and confidence, and the concrete action to take. That is what an agent needs to tell a human what to do next.

**Part of [DechoNet](https://dechonet.com).** Every tool here is also a free web tool at **[dechonet.com](https://dechonet.com)** — no sign-up — backed by error-fix [guides](https://dechonet.com/guides). This package brings the same checks to AI agents.

## Zero-install: remote endpoint

No npx, no install. Point any MCP client that speaks Streamable HTTP at:

```
https://dechonet.com/mcp
```

| Client | How to connect |
|---|---|
| Claude Code | `claude mcp add --transport http dechonet https://dechonet.com/mcp` |
| Claude app / Desktop | Listed in the [Claude connectors directory](https://claude.ai/directory/connectors/dechonet): Customize → Connectors, search DechoNet → Connect. Or + Add → Add custom connector with the URL (Free plan: one custom connector) |
| ChatGPT | [chatgpt.com/plugins](https://chatgpt.com/plugins) → + → Add custom MCP server → URL under Connection, no authentication → Create as a plugin (work/school accounts need an admin to allow custom MCP servers) |
| Cursor | `~/.cursor/mcp.json`: `{"mcpServers":{"dechonet":{"url":"https://dechonet.com/mcp"}}}` |
| VS Code (Copilot agent mode) | `.mcp.json` at the workspace root: `{"mcpServers":{"dechonet":{"type":"http","url":"https://dechonet.com/mcp"}}}` (in `.vscode/mcp.json` the root key is `servers`) |
| Gemini CLI | `gemini mcp add --transport http dechonet https://dechonet.com/mcp` (in `settings.json` use `httpUrl`, not `url`) |
| Codex | `codex mcp add dechonet --url https://dechonet.com/mcp` |
| Windsurf | `~/.codeium/windsurf/mcp_config.json`: `{"mcpServers":{"dechonet":{"serverUrl":"https://dechonet.com/mcp"}}}` |
| Any stdio-only client | npm package — see Quick Start below |

Step-by-step for each client: [dechonet.com/mcp](https://dechonet.com/mcp). The remote endpoint also serves 3 curated prompts (`audit_domain`, `monitor_setup`, `investigate_changes`) and 2 reference resources.

## Quick Start (stdio, Claude Desktop)

Add to your `claude_desktop_config.json`:

```json
{
  "mcpServers": {
    "dechonet": {
      "command": "npx",
      "args": ["-y", "dechonet-mcp"]
    }
  }
}
```

Config file location:
- **macOS**: `~/Library/Application Support/Claude/claude_desktop_config.json`
- **Windows**: `%APPDATA%\Claude\claude_desktop_config.json`

Restart Claude Desktop; DechoNet shows up in the chat input's tools menu. (Claude Desktop can also skip the install and add `https://dechonet.com/mcp` as a custom connector — see the table above.)

## Install

```bash
# Via npx (no install needed)
npx dechonet-mcp

# Or install globally
npm install -g dechonet-mcp
```

## Command line

The same checks work from a terminal or a CI step — no MCP client needed:

```bash
npx dechonet-mcp ssl example.com
npx dechonet-mcp email example.com --json
npx dechonet-mcp scan example.com --fail-on bad   # exit 2 when the overall grade is D or F
```

Checks: `dns`, `ssl`, `http`, `email`, `port`, `propagation`, `rdns`, `asn`, `whois`, `subdomains`, `lookalike`, `scan`, `owasp`, `golive`, `pqc`, `mcp`, `phishing`, `exposure`, `changes`, `history`, `impersonation`, `ip`, `subnet` (or any tool name below). `--json` prints the structured result, `--raw` keeps the raw data, `--port` sets the TLS port. Exit codes: 0 done, 1 the lookup failed, 2 the result reached `--fail-on` (`bad` or `warn`). With no arguments the package runs as the MCP server.

## Available Tools

| Tool | Description |
|------|-------------|
| `phishing_link_check` | **Is this link a scam?** — paste a text message or URL; follows shorteners, checks domain age, Korean brand impersonation, APK downloads, phishing feeds |
| `exposure_map` | **Admin pages open to the internet?** — subdomains from CT, each opened once: admin screens, staging, dev tools, VPN logins, default pages, directory listings (counts; per-host detail for the verified owner on the web report) |
| `security_scan` | **Comprehensive scan** — 9 checks in parallel, 0-100 Health Score, A-F grade |
| `dns_lookup` | DNS records + DNSSEC + SPF/DMARC validation |
| `ssl_check` | SSL/TLS certificate, chain, expiry, HSTS, CT history, A-F grade |
| `http_security` | HTTP redirect trace + 10 security headers audit, A-F grade |
| `email_auth` | SPF, DMARC, DKIM, BIMI, MTA-STS, DANE + blacklist check |
| `port_scan` | Open TCP ports with service identification |
| `dns_propagation` | DNS propagation across 6 public resolvers |
| `reverse_dns` | PTR record + FCrDNS verification |
| `asn_lookup` | ASN/BGP network identification + abuse contact |
| `whois_lookup` | RDAP/WHOIS domain registration data |
| `subdomain_discovery` | Passive subdomain enumeration from CT logs, operational-name flags (dev/staging/admin), wildcard detection |
| `lookalike_domains` | Typosquat variants that are actually registered — homoglyph, affix (brand-login), TLD swap, keyboard slips — with the domain's own defensive registrations separated out |
| `owasp_check` | OWASP-mapped checks that can be observed passively (headers, TLS, exposed files), honest about what is out of scope |
| `impersonation_exposure` | Brand impersonation exposure grade: third-party lookalikes + exposed operational subdomains + wildcard certs |
| `golive_check` | Go-live readiness — DNS, propagation, SSL, HTTP, registration in one READY / CAUTION / NOT READY verdict |
| `domain_history` | Past nameservers, A/AAAA, MX, certificate issuer, registrar (and an IP's ASN/PTR) with first and last seen — from DechoNet's own observations, not passive DNS |
| `infrastructure_pivot` | Other domains DechoNet saw with the same nameserver, IP, MX, issuer or registrar. **Needs a free API key** (`DECHONET_API_KEY`); shared infrastructure returns a count only |
| `domain_changes` | What changed since the last check — status, grade, issuer, DNS, issues. Works from lookup history even without a watch |
| `pqc_readiness` | Post-quantum TLS readiness: hybrid X25519MLKEM768 key exchange, whether the origin server or a CDN edge provides it, certificate signature algorithms. External indicator, not a full PQC audit |
| `mcp_server_check` | Before you connect a remote MCP server: authentication and OAuth metadata, tools that act (commands, files, messages, payments, secrets), agent-steering text in tool descriptions, CORS/Origin, HTTPS. Initialize and tools/list only — no tool is called |
| `watch_domain` | Register a domain for daily re-checks (SSL, DNS, HTTP, RDAP) so `domain_changes` accumulates a timeline. Writes a watch; idempotent |
| `set_expectations` | State what a domain should show from outside (a header present, DMARC enforcing, an issue gone, a grade, certificate days, DNS records, HTTPS answering), check it now with fresh reads and every day after. Each result comes with a signed observation receipt; with an API key, a set that stops holding is reported in your account's daily mail |
| `check_before_action` | Before logging in, paying, downloading or submitting: whether the page impersonates a brand, how new the domain is, whether it was flagged before, and — when the caller reports the page structure as host names — whether the card fields sit with a known payment provider. Answers danger / suspicious / unreachable / official / no_signals, with what was not checked; never 'safe' |
| `report_page` | Report a page (phishing, fake payment window, hidden instructions for AI agents, malicious download, or a verdict that looks wrong), an MCP server whose tool descriptions steer agents, or a network anomaly (the certificate or addresses you saw differ). Only the host and kind are kept; a report changes no verdict by itself — DechoNet checks the page itself, independent reports first |
| `verify_expectations` | Check a stored set (by id) or a one-off list from outside now — after a change, to see whether it is visible yet |
| `ip_info` | Public IP, ISP, ASN, proxy detection |
| `email_header_analysis` | Email delivery route tracing + auth results |
| `subnet_calc` | CIDR subnet calculator (offline) |

Every tool response ends with a link to the full interactive report on dechonet.com for the human behind the agent.

## Example Prompts

Once connected, try asking Claude:

- "Audit the security posture of example.com"
- "Is the SSL certificate for mysite.com about to expire?"
- "Which subdomains of example.com are exposed in CT logs?"
- "Are there registered lookalike domains of mybrand.com?"
- "How exposed is mybrand.com to impersonation?"
- "Is example.com ready to go live?"
- "What changed on example.com since the last check?"
- "Analyze these email headers: [paste headers]"
- "What's the ASN for 8.8.8.8?"

## Local SSE Transport

For a self-hosted HTTP/SSE bridge (the hosted remote endpoint above is usually simpler):

```bash
npm run start:sse
# Server runs on http://localhost:3100
# SSE endpoint: http://localhost:3100/sse
```

## Development

```bash
npm install
npm run build    # TypeScript → build/
npm run dev      # Run with tsx (stdio)
npm run start:sse # Run SSE server
```

## How It Works

The MCP server calls DechoNet's public API (`https://dechonet.com/api/util/*`) — the same backend as the [dechonet.com](https://dechonet.com) web tools — and returns structured results with:
- **Status** (ok/warn/bad)
- **KPIs** (key numbers per tool)
- **Issues** with severity (critical/warning/info) and confidence levels
- **Actionable remediation steps**
- **Raw data** (full JSON)

All data comes from public sources (DNS, HTTP headers, SSL certificates, CT logs, RDAP). Passive by design: no active exploitation, and a registered lookalike is reported as a fact to verify, never as an accusation.

## Environment Variables

| Variable | Default | Description |
|----------|---------|-------------|
| `DECHONET_URL` | `https://dechonet.com` | API base URL |
| `DECHONET_LOCALE` | `en` | Response language (`en` or `ko`) |
| `DECHONET_API_KEY` | — | Optional free API key from your [DechoNet account](https://dechonet.com/monitoring): your own rate-limit bucket, and required for `infrastructure_pivot` |
| `DECHONET_SESSION_COOKIE` | — | Your own DechoNet login cookie, only for the [signed-in tools](#signed-in-tools). Keep it secret |
| `PORT` | `3100` | SSE server port |

## Terms of use

Free use (with or without a key) is for **non-commercial purposes** from **November 8, 2026** — personal learning and research, checking your own domains, non-profit work. Using DechoNet inside a paid product, for clients, or regularly for company work needs **MCP·API Pro** ([dechonet.com/pro](https://dechonet.com/pro)); until payments open, ask at support@dechonet.com. Full terms: [dechonet.com/terms](https://dechonet.com/terms) §4.

## About DechoNet

[DechoNet](https://dechonet.com) is a domain security reconnaissance platform — distributed observation, cross-verification. The same diagnostics ship three ways: free web tools, error-fix guides, and this MCP server.

- 🌐 **Web tools** (free, no sign-up): https://dechonet.com
- 📘 **Guides** (fix common DNS/SSL/HTTP/email errors): https://dechonet.com/guides
- 🎣 **Phishing / smishing link check** (opens the link like a Korean phone): https://dechonet.com/util/phishing
- 🩺 **Full domain check** (DNS, SSL, headers, email auth, ports, PQC in one score): https://dechonet.com/util/all
- 🔔 **Monitoring** (daily re-checks, change history): https://dechonet.com/pro
- 🛠 **HTTP API** (same tools, OpenAPI): https://dechonet.com/developers · https://dechonet.com/openapi.json
- 📏 **How results are judged** / **monthly detection benchmark**: https://dechonet.com/methodology · https://dechonet.com/benchmark
- 🟢 **Service status**: https://dechonet.com/status
- 🐦 **X**: https://x.com/Dechonetwork

MIT licensed. Issues and PRs welcome.

## Signed-in tools

These tools appear only when the server has your DechoNet login: set `DECHONET_SESSION_COOKIE` to your own current cookie as it is sent, e.g. `dn_acct=…` (or `dn_acct=…; dn_ws=…` when you work in an agency workspace). Treat it like a password. It is sent only to the exact private endpoints below, never to the public diagnostics, and a public API key does not stand in for it. Without it the server lists the 30 public tools.

**Business plan — active checks on domains you own** ([plans](https://dechonet.com/pro))

| Tool | Description |
|------|-------------|
| `asm_nuclei_start` | Start a limited active check (Nuclei) on a verified asset from your attack-surface report. Needs current DNS TXT ownership, the exact root URL from that report and `confirm: "asm-nuclei-v1"` |
| `asm_nuclei_status` | Progress, coverage and sanitized findings. Partial or failed is not a clean result; technology detection is not proof of a vulnerability. Never starts requests |
| `asm_nuclei_cancel` | Stop new requests and end the job. Requests already sent cannot be recalled |

**Investigator case spaces** — `case_kit_search` and `case_kit_observe` work only with a case owner session or an existing case access cookie. Search reads stored, case-scoped page fingerprints; observe re-opens a case target under the same render rules and daily cap. Similar screens and kit candidates never confirm a person or a phishing verdict.