io.github.bck-stack/sitecheck-web-intel

up checked 2026-11-11T06:39:32.939Z

Unclaimed · Unverified

Agent searches it appeared in, last 30 days: 0. Run this server? Claim the listing: verified label, uptime alerts and analytics.

Publisher-provided title

SiteCheck Web Intel

Publisher-provided description

129 pay-per-call agent tools: security, threat intelligence, web search and SEO data tools. x402

Summary by lookupd

Runs security and threat intel lookups on IPs, domains, CVEs and URLs: reputation, DNS, TLS, headers, breaches and exposure data.

Install

Claude Code, remote (streamable-http)

claude mcp add --transport http sitecheck-web-intel 'https://api.webintel-api.workers.dev/mcp?ref=registry'

Codex, remote (streamable-http)

codex mcp add sitecheck-web-intel --url 'https://api.webintel-api.workers.dev/mcp?ref=registry'

Cursor, remote (streamable-http) → .cursor/mcp.json

{
  "mcpServers": {
    "sitecheck-web-intel": {
      "url": "https://api.webintel-api.workers.dev/mcp?ref=registry"
    }
  }
}

Other clients: docs. Or tell your agent: Set up lookupd for me: read https://lookupd.com/agent.md and follow it.

Tools (showing 30 of 129)

Publisher-provided text

• security_dns_records DNS records of a domain (A, AAAA, MX, NS, TXT, CNAME, CAA, SOA) resolved live through the public AdGuard DNS JSON resolver (NextDNS as backup). Shows answers as
• security_whois_rdap Domain registration facts via RDAP (IANA bootstrap, then the registry's own server): registration, last change and expiry dates, days left, registrar name, stat
• security_ssl_cert_chain HTTPS certificate chain and cipher audit for a host (port 443) from Qualys SSL Labs' cached report: grade, number of certificates in the chain, trust store, TLS
• security_crtsh_transparency Subdomain names found in public Certificate Transparency logs for a domain (via CertSpotter): unique host names and wildcard names, issuers, latest issue date a
• security_ip_geolocation_asn IPv4 or IPv6 address → covering BGP prefix, origin AS number and holder name, whether the prefix is announced, and a coarse country and map point, all from RIPE
• security_security_headers Checks the live HTTP response headers of a site's home page (one GET, https) for Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, X-F
• security_dmarc_spf_dkim Email authentication DNS records for a domain: DMARC policy (p, sp, pct, rua), SPF record and its all-mechanism, and DKIM public keys for a selector you give or
• security_urlhaus_malware Checks whether a host (domain or IP) is known to abuse.ch URLhaus as a malware distribution host: first seen, number of malware URLs, Spamhaus DBL / SURBL statu
• security_phishtank_check Looks one http or https URL up in the PhishTank phishing database (live checkurl lookup, no key). Returns whether PhishTank has the URL and, if so, its phish id
• security_cve_nvd_lookup One CVE record from the NIST National Vulnerability Database: description, published and last-modified dates, NVD status, primary CVSS score and severity (v4.0,
• security_tor_exit_nodes Checks an IPv4 address against the Tor Project's bulk exit list (about 1,200 active exit IPs). If it is an exit, adds the relays for that address from Onionoo:
• security_vpn_proxy_detector Checks an IPv4 address against the public X4BNet list of commercial VPN provider address ranges (about 11,000 CIDR blocks, refreshed by the list's maintainer).
• security_shodan_host_summary Shodan InternetDB summary for an IPv4 address (free, no key): open TCP ports, host names seen, CPE software identifiers, tags and CVE IDs Shodan associates with
• security_censys_exposure Censys host view for an IPv4 address: the services, ports and protocols Censys has observed on it with their last scan time and detected software, plus autonomo
• security_abuseipdb_check AbuseIPDB reputation for an IPv4 address over the last 90 days: abuse confidence score (0-100), number of abuse reports, last report date, ISP, usage type and c
• security_grey_noise_noise GreyNoise Community lookup for an IPv4 address: whether it was seen mass-scanning the internet recently (noise), whether it is a known benign service (riot), it
• security_hibp_breach_check Lists the data breaches HaveIBeenPwned has recorded for a domain (breach name, breach date, accounts affected, data types exposed, verified flag). It is the pub
• security_cisa_known_exploits CISA's Known Exploited Vulnerabilities catalog (public JSON). With cveId: whether that CVE is on the list, with vendor, product, date added, federal due date, r
• security_open_port_scanner Lists the TCP ports Shodan has seen open on an IPv4 address, from its pre-collected passive scan data (not a live scan: nothing connects to the address now). Th
• security_dns_propagation Asks two independent public DNS resolvers (AdGuard DNS and NextDNS) for the same name and record type right now and reports whether they agree, with each answer
• security_reverse_dns_ptr Reverse DNS (PTR) names for an IPv4 address, and forward-confirmed reverse DNS: whether each PTR name resolves back (A record) to the same address. Up to 3 PTR
• security_bgp_prefix_origin For an IPv4 prefix (e.g. 8.8.8.0/24): the origin AS seen announcing it now across RIPE RIS peers, its RPKI status for that origin (valid, invalid or unknown), r
• security_dnssec_validator DNSSEC check for a domain: whether a DS record exists at the parent zone (the domain is signed), and whether two public validating resolvers (AdGuard DNS, NextD
• security_cors_misconfig Checks how a site's home page answers a cross-origin request from a made-up origin: whether it echoes that origin back, sends a wildcard (*), and whether creden
• security_cookie_security Lists the cookies a site sets on its public home page (one anonymous GET, no login) with their Secure, HttpOnly and SameSite flags, and flags the ones missing a
• security_subdomain_takeover For a subdomain: finds its CNAME, matches the target against the public can-i-take-over-xyz fingerprint list (services such as GitHub Pages, S3, Azure, WordPres
• security_robots_security_txt Reads a site's public robots.txt (crawl rules, sitemaps, AI-crawler rules) and security.txt (RFC 9116: contact, expiry, policy), and says whether security.txt i
• security_email_disposable Checks whether an email address's domain (or a domain you give) is on the community disposable and temporary email blocklist (about 9,900 domains). Only the dom
• security_domain_typosquatting For a brand domain, generates up to 24 lookalike names (letter omission, doubling and swapping, plus .co/.net/.org/.io swaps) and checks which ones have name se
• security_asn_peers_upstream For an autonomous system (e.g. AS13335): how many upstream (transit) and downstream neighbours RIPEstat sees in BGP, the top upstreams ranked by 'power' with th

Details

• Version: 1.0.0
• Transports: streamable-http
• Uptime (7 days): 100%
• Median latency: 487 ms
• First indexed: 2026-11-01T09:21:33.880Z
• Last seen in registry: 2026-11-01T09:21:33.880Z
• Website: https://api.webintel-api.workers.dev

Badge for your README

Shows this live status and links here; updates hourly.

[![lookupd status](https://lookupd.com/badge/io.github.bck-stack/sitecheck-web-intel.svg)](https://lookupd.com/servers/io.github.bck-stack/sitecheck-web-intel)

• 62071 servers
• Last crawl: 2026-11-11T16:39:06.253Z
• API base: https://api.lookupd.com
• MCP URL: https://api.lookupd.com/mcp