com.dechonet/mcp

up checked 2026-11-11T05:38:26.569Z

Unclaimed · Unverified

Agent searches it appeared in, last 30 days: 0. Run this server? Claim the listing: verified label, uptime alerts and analytics.

Publisher-provided description

30 security tools for AI agents: phishing links, exposure maps, DNS, SSL, PQC, history, pivots.

Summary by lookupd

Runs phishing checks, DNS, SSL, email auth and domain monitoring so an agent can audit a domain's security posture and flag lookalikes.

Install

Claude Code, remote (streamable-http)

claude mcp add --transport http mcp https://dechonet.com/mcp

Claude Code, npm package (stdio)

claude mcp add mcp -- npx -y dechonet-mcp

Codex, remote (streamable-http)

codex mcp add mcp --url https://dechonet.com/mcp

Codex, npm package (stdio)

codex mcp add mcp -- npx -y dechonet-mcp

Cursor, remote (streamable-http) → .cursor/mcp.json

{
  "mcpServers": {
    "mcp": {
      "url": "https://dechonet.com/mcp"
    }
  }
}

Cursor, npm package (stdio) → .cursor/mcp.json

{
  "mcpServers": {
    "mcp": {
      "command": "npx",
      "args": [
        "-y",
        "dechonet-mcp"
      ]
    }
  }
}

Other clients: docs. Or tell your agent: Set up lookupd for me: read https://lookupd.com/agent.md and follow it.

Tools (showing 30 of 34)

Publisher-provided text

• dns_lookup Query DNS records (A, AAAA, MX, TXT, NS, SOA, CAA) for a domain and validate email-related records, including DNSSEC presence and SPF/DMARC syntax, returning se
• ssl_check Inspect a host's served TLS/SSL certificate and connection: expiry date, issuer, SAN list, chain integrity, revocation (OCSP, then CRL; unknown when neither ans
• http_security Follow a URL's HTTP redirect chain and audit response security headers (CSP, HSTS, X-Frame-Options, COOP, CORP, COEP, Permissions-Policy), grading A+ to F on th
• email_auth Assess a domain's email authentication and deliverability posture: MX records, SPF, DMARC, DKIM (probes 15 common selectors), BIMI, MTA-STS, TLS-RPT, and DANE,
• port_scan Probe a host for a fixed set of common TCP ports (HTTP, HTTPS, SSH, FTP, SMTP, DNS, and common databases) and report which are open, the service name, and the r
• dns_propagation Query one DNS record across 8+ global public resolvers (Google, Cloudflare, Quad9, OpenDNS, and more) simultaneously and report which resolvers return stale ver
• reverse_dns Resolve the PTR (reverse DNS) record for an IPv4 or IPv6 address and verify forward-confirmed reverse DNS (FCrDNS) by checking that the PTR hostname resolves ba
• asn_lookup Look up Autonomous System (ASN) / BGP information for an IP address or AS number: the network operator, announced prefixes, abuse contact, and a classification
• whois_lookup Retrieve domain registration data via RDAP (with WHOIS fallback): registrar, creation/expiry/update dates, nameservers, and EPP status flags, highlighting risk
• subdomain_discovery Enumerate the subdomains of a domain from Certificate Transparency logs — fully passive (no packets are sent to the target; CT logs are public records of every
• lookalike_domains Generate the typosquat/lookalike variants of a domain that phishers actually register — homoglyph swaps (l→1, o→0, rn→m), TLD swaps (.com→.co), character omissi
• ip_info Report information about the caller's own public IP as seen by the server: IPv4/IPv6 address, ISP, ASN, approximate geolocation, and proxy/VPN heuristics. Takes
• email_header_analysis Parse raw email headers to reconstruct the delivery path (each Received hop in order), extract SPF/DKIM/DMARC authentication results, measure per-hop delays, an
• subnet_calc Compute IPv4 subnet details from CIDR notation entirely locally — no network call: network and broadcast addresses, usable host range, total usable hosts, subne
• security_scan One-shot comprehensive audit of a domain, scored 0-100 with an A+ to F grade and a prioritized action list. Five scored areas: the web connection (TLS certifica
• owasp_check Assess a domain's OWASP posture from EXTERNAL OBSERVATION only: the OWASP Secure Headers Project plus the externally observable OWASP Top 10:2025 subset — A04 C
• impersonation_exposure Assess how exposed a domain is to brand impersonation and phishing, PASSIVELY: live typosquat/lookalike domains (homoglyph, omission, transposition, TLD swap) t
• domain_changes Report what has changed for a domain over time — the security regressions and drift that DechoNet's daily monitoring has recorded across every watch on the doma
• domain_history Show how a domain's (or IPv4 address's) infrastructure has changed over time from DechoNet's stored observations: nameservers, A/AAAA, MX, CNAME, certificate is
• infrastructure_pivot Find other domains DechoNet has seen with the same infrastructure value — a nameserver, IP address, MX host, certificate issuer or registrar — with first and la
• watch_domain Start (or reuse) a daily DechoNet watch on a domain so that changes are recorded over time — SSL grade/issuer/expiry, DNS records, HTTP security headers, domain
• set_expectations Record what a domain should show from outside and check it now — HSTS or another header present, DMARC enforcing, an issue key no longer reported, an HTTP or TL
• verify_expectations Check expectations from outside now, with fresh reads: either a stored set by id (from set_expectations — its state is updated and an anonymous set is kept anot
• check_before_action Check the page an agent is about to log in, pay, download from or submit to: whether the address impersonates a brand, how new the domain is, whether DechoNet o
• crypto_check_before_sign Before an agent signs or sends from a crypto wallet: send the destination address (to), the page that asked (url) and/or the wallet request it is about to appro
• wallet_address_check Check one crypto wallet address: which chain it belongs to (EVM, TRON, Bitcoin, Solana — from the format alone), whether its checksum is valid (EIP-55, Base58Ch
• crypto_dapp_check Open a crypto page — a dApp, airdrop, claim or mint link — and report what it asks a wallet to do. DechoNet opens it in an isolated Chromium (Seoul) with a test
• crypto_exchange_check Check whether a domain or link is the official address of a crypto exchange, wallet or dApp — Korean exchanges (Upbit, Bithumb, Coinone, GOPAX, DigitalX/Korbit)
• report_page Report a page to DechoNet: phishing or brand impersonation, a fake payment window (card fields where a payment provider should be), hidden instructions aimed at
• golive_check Check whether a domain is ready to launch or migrate — a go/no-go verdict over five essentials: DNS resolves to an IP, has propagated consistently across global

Details

• Version: 1.8.0
• Transports: streamable-http, stdio
• Uptime (7 days): 100%
• Median latency: 1820 ms
• First indexed: 2026-11-01T08:53:39.002Z
• Last seen in registry: 2026-11-06T04:17:12.249Z
• Repository: https://github.com/node-man/dechonet-mcp
• Website: https://dechonet.com/mcp

Badge for your README

Shows this live status and links here; updates hourly.

[![lookupd status](https://lookupd.com/badge/com.dechonet/mcp.svg)](https://lookupd.com/servers/com.dechonet/mcp)

• 62033 servers
• Last crawl: 2026-11-11T15:38:39.561Z
• API base: https://api.lookupd.com
• MCP URL: https://api.lookupd.com/mcp