dechonet.com · Remote MCP (no install) · Phishing link check · Free web tools · HTTP API · Detection benchmark · Status
Domain security reconnaissance for AI agents via the Model Context Protocol.
33 tools. No API key needed for non-commercial use. Phishing/smishing link checks, exposed admin page checks (admin screens, test servers, dev tools left open), DNS, SSL/TLS, post-quantum TLS readiness, HTTP security headers, email authentication, port scan, DNS propagation, reverse DNS, ASN/BGP, RDAP/WHOIS, subdomain discovery (CT logs), lookalike/typosquat detection, OWASP-mapped observable checks, brand-impersonation exposure, go-live readiness, MCP server checks before you connect one, domain change history — what changed since the last check — infrastructure history and pivots (past nameservers/IPs/issuers, and other domains seen on the same rare infrastructure), a daily watch you can set from the agent, and crypto checks — a wallet address's chain and OFAC sanctions listing, whether a site is an exchange's official address, and a check before an agent signs or sends.
Every result comes back interpreted, not just as raw JSON: a status, the key numbers, each issue with severity and confidence, and the concrete action to take. That is what an agent needs to tell a human what to do next.
Part of DechoNet. Every tool here is also a free web tool at dechonet.com — no sign-up — backed by error-fix guides. This package brings the same checks to AI agents.
No npx, no install. Point any MCP client that speaks Streamable HTTP at:
https://dechonet.com/mcp
| Client | How to connect |
|---|---|
| Claude Code | claude mcp add --transport http dechonet https://dechonet.com/mcp |
| Claude app / Desktop | Listed in the Claude connectors directory: Customize → Connectors, search DechoNet → Connect. Or + Add → Add custom connector with the URL (Free plan: one custom connector) |
| ChatGPT | chatgpt.com/plugins → + → Add custom MCP server → URL under Connection, no authentication → Create as a plugin (work/school accounts need an admin to allow custom MCP servers) |
| Cursor | ~/.cursor/mcp.json: {"mcpServers":{"dechonet":{"url":"https://dechonet.com/mcp"}}} |
| VS Code (Copilot) | Command Palette → MCP: Add Server → HTTP → https://dechonet.com/mcp → server ID dechonet → Global → Copilot Global (~/.copilot/mcp-config.json). .vscode/mcp.json is deprecated. |
| Gemini CLI | gemini mcp add --transport http dechonet https://dechonet.com/mcp (in settings.json use httpUrl, not url) |
| Codex | codex mcp add dechonet --url https://dechonet.com/mcp |
| Devin Desktop / CLI (formerly Windsurf) | devin mcp add -s user dechonet https://dechonet.com/mcp (saved to ~/.config/devin/mcp_config.json as mcpServers.dechonet.url) |
| Any stdio-only client | npm package — see Quick Start below |
Step-by-step for each client: dechonet.com/mcp. The remote endpoint also serves 3 curated prompts (audit_domain, monitor_setup, investigate_changes) and 2 reference resources.
Add to your claude_desktop_config.json:
{
"mcpServers": {
"dechonet": {
"command": "npx",
"args": ["-y", "dechonet-mcp"]
}
}
}Config file location:
- macOS:
~/Library/Application Support/Claude/claude_desktop_config.json - Windows:
%APPDATA%\Claude\claude_desktop_config.json
Restart Claude Desktop; DechoNet shows up in the chat input's tools menu. (Claude Desktop can also skip the install and add https://dechonet.com/mcp as a custom connector — see the table above.)
# Via npx (no install needed)
npx dechonet-mcp
# Or install globally
npm install -g dechonet-mcpThe same checks work from a terminal or a CI step — no MCP client needed:
npx dechonet-mcp ssl example.com
npx dechonet-mcp email example.com --json
npx dechonet-mcp scan example.com --fail-on bad # exit 2 when the overall grade is D or FChecks: dns, ssl, http, email, port, propagation, rdns, asn, whois, subdomains, lookalike, scan, owasp, golive, pqc, mcp, phishing, exposure, changes, history, impersonation, ip, subnet (or any tool name below). --json prints the structured result, --raw keeps the raw data, --port sets the TLS port. Exit codes: 0 done, 1 the lookup failed, 2 the result reached --fail-on (bad or warn). With no arguments the package runs as the MCP server.
| Tool | Description |
|---|---|
phishing_link_check |
Is this link a scam? — paste a text message or URL; follows shorteners, checks domain age, Korean brand impersonation, APK downloads, phishing feeds |
exposure_map |
Admin pages open to the internet? — subdomains from CT, each opened once: admin screens, staging, dev tools, VPN logins, default pages, directory listings (counts; per-host detail for the verified owner on the web report) |
security_scan |
Comprehensive scan — 9 checks in parallel, 0-100 Health Score, A-F grade |
dns_lookup |
DNS records + DNSSEC + SPF/DMARC validation |
ssl_check |
SSL/TLS certificate, chain, expiry, HSTS, CT history, A-F grade |
http_security |
HTTP redirect trace + 10 security headers audit, A-F grade |
email_auth |
SPF, DMARC, DKIM, BIMI, MTA-STS, DANE + blacklist check |
port_scan |
Open TCP ports with service identification |
dns_propagation |
DNS propagation across 6 public resolvers |
reverse_dns |
PTR record + FCrDNS verification |
asn_lookup |
ASN/BGP network identification + abuse contact |
whois_lookup |
RDAP/WHOIS domain registration data |
subdomain_discovery |
Passive subdomain enumeration from CT logs, operational-name flags (dev/staging/admin), wildcard detection |
lookalike_domains |
Typosquat variants that are actually registered — homoglyph, affix (brand-login), TLD swap, keyboard slips — with the domain's own defensive registrations separated out |
owasp_check |
OWASP-mapped checks that can be observed passively (headers, TLS, exposed files), honest about what is out of scope |
impersonation_exposure |
Brand impersonation exposure grade: third-party lookalikes + exposed operational subdomains + wildcard certs |
golive_check |
Go-live readiness — DNS, propagation, SSL, HTTP, registration in one READY / CAUTION / NOT READY verdict |
domain_history |
Past nameservers, A/AAAA, MX, certificate issuer, registrar (and an IP's ASN/PTR) with first and last seen — from DechoNet's own observations, not passive DNS |
infrastructure_pivot |
Other domains DechoNet saw with the same nameserver, IP, MX, issuer or registrar. Needs a free API key (DECHONET_API_KEY); shared infrastructure returns a count only |
domain_changes |
What changed since the last check — status, grade, issuer, DNS, issues. Works from lookup history even without a watch |
pqc_readiness |
Post-quantum TLS readiness: hybrid X25519MLKEM768 key exchange, whether the origin server or a CDN edge provides it, certificate signature algorithms. External indicator, not a full PQC audit |
mcp_server_check |
Before you connect a remote MCP server: authentication and OAuth metadata, tools that act (commands, files, messages, payments, secrets), agent-steering text in tool descriptions, CORS/Origin, HTTPS. Initialize and tools/list only — no tool is called |
watch_domain |
Register a domain for daily re-checks (SSL, DNS, HTTP, RDAP) so domain_changes accumulates a timeline. Writes a watch; idempotent |
set_expectations |
State what a domain should show from outside (a header present, DMARC enforcing, an issue gone, a grade, certificate days, DNS records, HTTPS answering), check it now with fresh reads and every day after. Each result comes with a signed observation receipt; with an API key, a set that stops holding is reported in your account's daily mail |
check_before_action |
Before logging in, paying, downloading or submitting: whether the page impersonates a brand, how new the domain is, whether it was flagged before, and — when the caller reports the page structure as host names — whether the card fields sit with a known payment provider. Answers danger / suspicious / unreachable / official / no_signals, with what was not checked; never 'safe' |
report_page |
Report a page (phishing, fake payment window, hidden instructions for AI agents, malicious download, or a verdict that looks wrong), an MCP server whose tool descriptions steer agents, or a network anomaly (the certificate or addresses you saw differ). Only the host and kind are kept; a report changes no verdict by itself — DechoNet checks the page itself, independent reports first |
verify_expectations |
Check a stored set (by id) or a one-off list from outside now — after a change, to see whether it is visible yet |
wallet_address_check |
Crypto wallet address: chain from the format (EVM, TRON, Bitcoin, Solana), checksum, the US Treasury OFAC SDN sanctions list (read daily) and how many pages DechoNet judged dangerous showed it. Not listed is not 'clean'; the address is not stored |
crypto_exchange_check |
Is a domain the official address of a Korean or global exchange, wallet or dApp — compared only with addresses the companies publish themselves; a domain that only uses the name gets its age, first certificate and a phishing check |
crypto_check_before_sign |
Before an agent signs or sends: the destination address, the page that asked and the wallet request (unlimited approvals, Permit signatures, setApprovalForAll) judged together — danger / suspicious / no_signals, with what was not checked |
ip_info |
Public IP, ISP, ASN, proxy detection |
email_header_analysis |
Email delivery route tracing + auth results |
subnet_calc |
CIDR subnet calculator (offline) |
Every tool response ends with a link to the full interactive report on dechonet.com for the human behind the agent.
Once connected, try asking Claude:
- "Audit the security posture of example.com"
- "Is the SSL certificate for mysite.com about to expire?"
- "Which subdomains of example.com are exposed in CT logs?"
- "Are there registered lookalike domains of mybrand.com?"
- "How exposed is mybrand.com to impersonation?"
- "Is example.com ready to go live?"
- "What changed on example.com since the last check?"
- "Analyze these email headers: [paste headers]"
- "What's the ASN for 8.8.8.8?"
For a self-hosted HTTP/SSE bridge (the hosted remote endpoint above is usually simpler):
npm run start:sse
# Server runs on http://localhost:3100
# SSE endpoint: http://localhost:3100/ssenpm install
npm run build # TypeScript → build/
npm run dev # Run with tsx (stdio)
npm run start:sse # Run SSE serverThe MCP server calls DechoNet's public API (https://dechonet.com/api/util/*) — the same backend as the dechonet.com web tools — and returns structured results with:
- Status (ok/warn/bad)
- KPIs (key numbers per tool)
- Issues with severity (critical/warning/info) and confidence levels
- Actionable remediation steps
- Raw data (full JSON)
All data comes from public sources (DNS, HTTP headers, SSL certificates, CT logs, RDAP). Passive by design: no active exploitation, and a registered lookalike is reported as a fact to verify, never as an accusation.
| Variable | Default | Description |
|---|---|---|
DECHONET_URL |
https://dechonet.com |
API base URL |
DECHONET_LOCALE |
en |
Response language (en or ko) |
DECHONET_API_KEY |
— | Optional free API key from your DechoNet account: your own rate-limit bucket, and required for infrastructure_pivot |
DECHONET_SESSION_COOKIE |
— | Your own DechoNet login cookie, only for the signed-in tools. Keep it secret |
PORT |
3100 |
SSE server port |
Free use (with or without a key) is for non-commercial purposes from November 8, 2026 — personal learning and research, checking your own domains, non-profit work. Using DechoNet inside a paid product, for clients, or regularly for company work needs MCP·API Pro (dechonet.com/pro); until payments open, ask at support@dechonet.com. Full terms: dechonet.com/terms §4.
DechoNet is a domain security reconnaissance platform — distributed observation, cross-verification. The same diagnostics ship three ways: free web tools, error-fix guides, and this MCP server.
- 🌐 Web tools (free, no sign-up): https://dechonet.com
- 📘 Guides (fix common DNS/SSL/HTTP/email errors): https://dechonet.com/guides
- 🎣 Phishing / smishing link check (opens the link like a Korean phone): https://dechonet.com/util/phishing
- 🩺 Full domain check (DNS, SSL, headers, email auth, ports, PQC in one score): https://dechonet.com/util/all
- 🔔 Monitoring (daily re-checks, change history): https://dechonet.com/pro
- 🛠 HTTP API (same tools, OpenAPI): https://dechonet.com/developers · https://dechonet.com/openapi.json
- 📏 How results are judged / monthly detection benchmark: https://dechonet.com/methodology · https://dechonet.com/benchmark
- 🟢 Service status: https://dechonet.com/status
- 🐦 X: https://x.com/Dechonetwork
MIT licensed. Issues and PRs welcome.
These tools appear only when the server has your DechoNet login: set DECHONET_SESSION_COOKIE to your own current cookie as it is sent, e.g. dn_acct=… (or dn_acct=…; dn_ws=… when you work in an agency workspace). Treat it like a password. It is sent only to the exact private endpoints below, never to the public diagnostics, and a public API key does not stand in for it. Without it the server lists the 33 public tools.
Business plan — active checks on domains you own (plans)
| Tool | Description |
|---|---|
asm_nuclei_start |
Start a limited active check (Nuclei) on a verified asset from your attack-surface report. Needs current DNS TXT ownership, the exact root URL from that report and confirm: "asm-nuclei-v2". Automatically runs asm_verify before creating the job; failed refresh blocks execution |
asm_nuclei_status |
Progress, coverage and sanitized findings. Partial or failed is not a clean result; technology detection is not proof of a vulnerability. Never starts requests |
asm_nuclei_cancel |
Stop new requests and end the job. Requests already sent cannot be recalled |
The v2 scope contains 35 fixed reviewed templates. Limits: 64 requests/120 seconds per execution, 130 seconds waiting, 280 seconds total job lifetime, global concurrency 1 and 1 request/second. All accounts share 1,000 requests per UTC day; the existing account quota also applies. Ownership proof lasts 5 minutes and is checked again during execution. A stopped, partial or failed job is not a clean result.
Investigator case spaces — case_kit_search and case_kit_observe work only with a case owner session or an existing case access cookie. Search reads stored, case-scoped page fingerprints; observe re-opens a case target under the same render rules and daily cap. Similar screens and kit candidates never confirm a person or a phishing verdict.