net.fmelo/cognita

up checked 2026-11-11T10:38:23.043Z

Unclaimed · Unverified

Agent searches it appeared in, last 30 days: 0. Run this server? Claim the listing: verified label, uptime alerts and analytics.

Publisher-provided title

Cognita

Publisher-provided description

Passive OSINT and security recon: DNS, TLS, email posture, IP reputation, CVE/KEV, CT logs.

Summary by lookupd

Runs passive recon on domains and IPs: DNS, TLS, email policy, CVE and exploit status, reputation and abuse contacts, without active…

Install

Claude Code, remote (streamable-http)

claude mcp add --transport http cognita https://cognita.fmelo.net/mcp

Codex, remote (streamable-http)

codex mcp add cognita --url https://cognita.fmelo.net/mcp

Cursor, remote (streamable-http) → .cursor/mcp.json

{
  "mcpServers": {
    "cognita": {
      "url": "https://cognita.fmelo.net/mcp"
    }
  }
}

Other clients: docs. Or tell your agent: Set up lookupd for me: read https://lookupd.com/agent.md and follow it.

Tools (showing 30 of 51)

Publisher-provided text

• asn_prefixes List the IP prefixes an autonomous system announces (via RIPEstat), with the network holder — the routed footprint of an ASN. Read-only.
• cve_triage Prioritise a host's internet-exposed CVEs: takes the CVEs from host_exposure (Shodan InternetDB) and enriches each with CISA KEV (confirmed exploited in the wil
• typosquat_scan Generate lookalike variants of a domain (omission, transposition, homoglyph, adjacent-key, hyphenation and TLD-swap typos) and report which ones actually resolv
• email_header_analyzer Parse pasted raw email headers: the Received: delivery path with per-hop delays, the SPF/DKIM/DMARC verdicts, the originating IP, and spoofing warnings. Pure pa
• dns_propagation Ask several independent public resolvers (Google, Cloudflare, DNS.SB, NextDNS) the same record over DNS-over-HTTPS and compare their answers. Returns each resol
• email_posture Report a domain's modern email-security records beyond SPF/DMARC/DKIM: MTA-STS (DNS record + fetched policy: enforce/testing mode, max_age, MX), TLS-RPT (report
• ct_org_search Find the certificates that name an ORGANISATION in Certificate Transparency (via crt.sh) and the distinct registrable domains on them — a link from a company na
• geo_route Show the network path from the caller to a target host on a world map: origin (the caller's IP — the user when the agent runs client-side), destination (the tar
• tls_posture Grade a host's transport security A–F in one call, correlating tls_certificate (validity, chain trust, protocol, key/signature), cert_revocation (OCSP/CRL endpo
• feodo_c2_check Check an IP against abuse.ch's Feodo Tracker botnet command-and-control blocklist (keyless): a hit means the IP is a known C2 server for a malware family (Emote
• dmarc_check Fetch and analyse a domain's DMARC record (_dmarc TXT): the policy (none/quarantine/reject) and warnings on a weak or missing policy. Read-only.
• tranco_rank Report a domain's popularity on the Tranco research list (keyless): its rank in the top ~1M sites, a band (top-1k/10k/100k/1M or 'unranked'), and how many recen
• rpki_validation Validate the BGP route-origin of an IP or prefix against RPKI (via RIPEstat): valid / invalid / unknown for the announcing ASN and covering prefix. 'invalid' me
• cve_lookup Look up a CVE in the NVD (NIST National Vulnerability Database): its description, CVSS base score / severity / vector, CWE weakness IDs, publication dates and r
• spoofability Judge how easily a domain's mail can be forged by correlating SPF and DMARC into one verdict: 'hardened' (DMARC enforcing), 'partial' (DMARC quarantine) or 'spo
• subdomain_takeover_check Check a domain's subdomains (enumerated from Certificate Transparency) for dangling-CNAME takeover risk: a CNAME that delegates to a third-party service (GitHub
• tls_certificate Inspect the leaf certificate a host serves on a live TLS handshake: subject, issuer, subject-alternative names, validity window and days to expiry, key and sign
• dns_lookup Resolve DNS records for a host name. Returns A, AAAA, MX, TXT, NS, CNAME and SOA by default; pass 'types' to narrow. Read-only.
• dshield_ip_check Look up an IP's reputation in the SANS Internet Storm Center (DShield) data (keyless): how many attack reports it has across how many target sensors over the ob
• host_exposure Report a host's internet-facing exposure from Shodan's InternetDB (keyless): open ports, detected products (CPEs), known CVEs, hostnames and tags. Passive — rea
• scan_site Run a passive web-security scan of a URL (via Astur). Returns an A–F grade, a 0–100 score and findings mapped to OWASP WSTG/ASVS. Non-intrusive — no active prob
• abuse_contact Find the abuse-reporting e-mail(s) for an IP (or a host's resolved IP) via RIPEstat's abuse-contact-finder — where to report a scanner or attacker surfaced by i
• kev_check Check whether a CVE is in CISA's Known Exploited Vulnerabilities (KEV) catalogue — i.e. confirmed exploited in the wild, the strongest 'patch this now' signal.
• reverse_dns Reverse-resolve an IP address to its PTR host name(s). Read-only.
• ip_reputation Check an IP against GreyNoise's Community data: whether it is internet background 'noise' (a mass scanner) and, if so, GreyNoise's classification — 'malicious',
• hsts_preload_check Check whether a domain is in the browsers' HSTS preload list (via hstspreload.org's keyless status API): the status (preloaded/pending/unknown), whether it was
• disclosure_contacts Consolidate where and how to report a security issue for a domain: the owner's own published channel (security_txt — RFC 9116 Contact, Policy, PGP key) and the
• rdap Look up registration data for a domain or IP via RDAP (the modern JSON successor to WHOIS): handle, name, statuses and lifecycle events, plus the raw record. Re
• tor_exit_check Check whether an IP is a current Tor exit node, from the Tor Project's public bulk exit list (keyless). Exit traffic is anonymised, so an IP seen in logs may no
• robots_sitemap Passively read a site's robots.txt and the sitemap it points to. Returns the disallowed paths (often naming admin/staging areas — a recon signal), any declared

Details

• Version: 1.0.34
• Transports: streamable-http
• Uptime (7 days): 100%
• Median latency: 907 ms
• First indexed: 2026-11-01T10:07:38.342Z
• Last seen in registry: 2026-11-01T10:07:38.361Z
• Website: https://fmelo.net

Badge for your README

Shows this live status and links here; updates hourly.

[![lookupd status](https://lookupd.com/badge/net.fmelo/cognita.svg)](https://lookupd.com/servers/net.fmelo/cognita)

• 62141 servers
• Last crawl: 2026-11-11T18:39:04.612Z
• API base: https://api.lookupd.com
• MCP URL: https://api.lookupd.com/mcp