Dechonet Mcp

DechoNet MCP Server

dechonet.com · Remote MCP (no install) · Phishing link check · Free web tools · HTTP API · Detection benchmark · Status

Domain security reconnaissance for AI agents via the Model Context Protocol.

30 tools. No API key needed for non-commercial use. Phishing/smishing link checks, exposed admin page checks (admin screens, test servers, dev tools left open), DNS, SSL/TLS, post-quantum TLS readiness, HTTP security headers, email authentication, port scan, DNS propagation, reverse DNS, ASN/BGP, RDAP/WHOIS, subdomain discovery (CT logs), lookalike/typosquat detection, OWASP-mapped observable checks, brand-impersonation exposure, go-live readiness, MCP server checks before you connect one, domain change history — what changed since the last check — infrastructure history and pivots (past nameservers/IPs/issuers, and other domains seen on the same rare infrastructure), and a daily watch you can set from the agent.

Every result comes back interpreted, not just as raw JSON: a status, the key numbers, each issue with severity and confidence, and the concrete action to take. That is what an agent needs to tell a human what to do next.

Part of DechoNet. Every tool here is also a free web tool at dechonet.com — no sign-up — backed by error-fix guides. This package brings the same checks to AI agents.

Zero-install: remote endpoint

No npx, no install. Point any MCP client that speaks Streamable HTTP at:

https://dechonet.com/mcp

Client	How to connect
Claude Code	claude mcp add --transport http dechonet https://dechonet.com/mcp
Claude app / Desktop	Listed in the Claude connectors directory: Customize → Connectors, search DechoNet → Connect. Or + Add → Add custom connector with the URL (Free plan: one custom connector)
ChatGPT	chatgpt.com/plugins → + → Add custom MCP server → URL under Connection, no authentication → Create as a plugin (work/school accounts need an admin to allow custom MCP servers)
Cursor	~/.cursor/mcp.json: {"mcpServers":{"dechonet":{"url":"https://dechonet.com/mcp"}}}
VS Code (Copilot agent mode)	.mcp.json at the workspace root: {"mcpServers":{"dechonet":{"type":"http","url":"https://dechonet.com/mcp"}}} (in .vscode/mcp.json the root key is servers)
Gemini CLI	gemini mcp add --transport http dechonet https://dechonet.com/mcp (in settings.json use httpUrl, not url)
Codex	codex mcp add dechonet --url https://dechonet.com/mcp
Windsurf	~/.codeium/windsurf/mcp_config.json: {"mcpServers":{"dechonet":{"serverUrl":"https://dechonet.com/mcp"}}}
Any stdio-only client	npm package — see Quick Start below

Step-by-step for each client: dechonet.com/mcp. The remote endpoint also serves 3 curated prompts (audit_domain, monitor_setup, investigate_changes) and 2 reference resources.

Quick Start (stdio, Claude Desktop)

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "dechonet": {
      "command": "npx",
      "args": ["-y", "dechonet-mcp"]
    }
  }
}

Config file location:

• macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
• Windows: %APPDATA%\Claude\claude_desktop_config.json

Restart Claude Desktop; DechoNet shows up in the chat input's tools menu. (Claude Desktop can also skip the install and add https://dechonet.com/mcp as a custom connector — see the table above.)

Install

# Via npx (no install needed)
npx dechonet-mcp

# Or install globally
npm install -g dechonet-mcp

Available Tools

Tool	Description
phishing_link_check	Is this link a scam? — paste a text message or URL; follows shorteners, checks domain age, Korean brand impersonation, APK downloads, phishing feeds
exposure_map	Admin pages open to the internet? — subdomains from CT, each opened once: admin screens, staging, dev tools, VPN logins, default pages, directory listings (counts; per-host detail for the verified owner on the web report)
security_scan	Comprehensive scan — 9 checks in parallel, 0-100 Health Score, A-F grade
dns_lookup	DNS records + DNSSEC + SPF/DMARC validation
ssl_check	SSL/TLS certificate, chain, expiry, HSTS, CT history, A-F grade
http_security	HTTP redirect trace + 10 security headers audit, A-F grade
email_auth	SPF, DMARC, DKIM, BIMI, MTA-STS, DANE + blacklist check
port_scan	Open TCP ports with service identification
dns_propagation	DNS propagation across 6 public resolvers
reverse_dns	PTR record + FCrDNS verification
asn_lookup	ASN/BGP network identification + abuse contact
whois_lookup	RDAP/WHOIS domain registration data
subdomain_discovery	Passive subdomain enumeration from CT logs, operational-name flags (dev/staging/admin), wildcard detection
lookalike_domains	Typosquat variants that are actually registered — homoglyph, affix (brand-login), TLD swap, keyboard slips — with the domain's own defensive registrations separated out
owasp_check	OWASP-mapped checks that can be observed passively (headers, TLS, exposed files), honest about what is out of scope
impersonation_exposure	Brand impersonation exposure grade: third-party lookalikes + exposed operational subdomains + wildcard certs
golive_check	Go-live readiness — DNS, propagation, SSL, HTTP, registration in one READY / CAUTION / NOT READY verdict
domain_history	Past nameservers, A/AAAA, MX, certificate issuer, registrar (and an IP's ASN/PTR) with first and last seen — from DechoNet's own observations, not passive DNS
infrastructure_pivot	Other domains DechoNet saw with the same nameserver, IP, MX, issuer or registrar. Needs a free API key (DECHONET_API_KEY); shared infrastructure returns a count only
domain_changes	What changed since the last check — status, grade, issuer, DNS, issues. Works from lookup history even without a watch
pqc_readiness	Post-quantum TLS readiness: hybrid X25519MLKEM768 key exchange, whether the origin server or a CDN edge provides it, certificate signature algorithms. External indicator, not a full PQC audit
mcp_server_check	Before you connect a remote MCP server: authentication and OAuth metadata, tools that act (commands, files, messages, payments, secrets), agent-steering text in tool descriptions, CORS/Origin, HTTPS. Initialize and tools/list only — no tool is called
watch_domain	Register a domain for daily re-checks (SSL, DNS, HTTP, RDAP) so domain_changes accumulates a timeline. Writes a watch; idempotent
set_expectations	State what a domain should show from outside (a header present, DMARC enforcing, an issue gone, a grade, certificate days, DNS records, HTTPS answering), check it now with fresh reads and every day after. Each result comes with a signed observation receipt; with an API key, a set that stops holding is reported in your account's daily mail
check_before_action	Before logging in, paying, downloading or submitting: whether the page impersonates a brand, how new the domain is, whether it was flagged before, and — when the caller reports the page structure as host names — whether the card fields sit with a known payment provider. Answers danger / suspicious / unreachable / official / no_signals, with what was not checked; never 'safe'
report_page	Report a page (phishing, fake payment window, hidden instructions for AI agents, malicious download, or a verdict that looks wrong), an MCP server whose tool descriptions steer agents, or a network anomaly (the certificate or addresses you saw differ). Only the host and kind are kept; a report changes no verdict by itself — DechoNet checks the page itself, independent reports first
verify_expectations	Check a stored set (by id) or a one-off list from outside now — after a change, to see whether it is visible yet
ip_info	Public IP, ISP, ASN, proxy detection
email_header_analysis	Email delivery route tracing + auth results
subnet_calc	CIDR subnet calculator (offline)

Every tool response ends with a link to the full interactive report on dechonet.com for the human behind the agent.

Example Prompts

Once connected, try asking Claude:

• "Audit the security posture of example.com"
• "Is the SSL certificate for mysite.com about to expire?"
• "Which subdomains of example.com are exposed in CT logs?"
• "Are there registered lookalike domains of mybrand.com?"
• "How exposed is mybrand.com to impersonation?"
• "Is example.com ready to go live?"
• "What changed on example.com since the last check?"
• "Analyze these email headers: [paste headers]"
• "What's the ASN for 8.8.8.8?"

Local SSE Transport

For a self-hosted HTTP/SSE bridge (the hosted remote endpoint above is usually simpler):

npm run start:sse
# Server runs on http://localhost:3100
# SSE endpoint: http://localhost:3100/sse

Development

npm install
npm run build    # TypeScript → build/
npm run dev      # Run with tsx (stdio)
npm run start:sse # Run SSE server

How It Works

The MCP server calls DechoNet's public API (https://dechonet.com/api/util/*) — the same backend as the dechonet.com web tools — and returns structured results with:

• Status (ok/warn/bad)
• KPIs (key numbers per tool)
• Issues with severity (critical/warning/info) and confidence levels
• Actionable remediation steps
• Raw data (full JSON)

All data comes from public sources (DNS, HTTP headers, SSL certificates, CT logs, RDAP). Passive by design: no active exploitation, and a registered lookalike is reported as a fact to verify, never as an accusation.

Environment Variables

Variable	Default	Description
DECHONET_URL	https://dechonet.com	API base URL
DECHONET_LOCALE	en	Response language (en or ko)
DECHONET_API_KEY	—	Optional free API key from your DechoNet account: your own rate-limit bucket, and required for infrastructure_pivot
DECHONET_SESSION_COOKIE	—	Your own DechoNet login cookie, only for the signed-in tools. Keep it secret
PORT	3100	SSE server port

Terms of use

Free use (with or without a key) is for non-commercial purposes from November 8, 2026 — personal learning and research, checking your own domains, non-profit work. Using DechoNet inside a paid product, for clients, or regularly for company work needs MCP·API Pro (dechonet.com/pro); until payments open, ask at support@dechonet.com. Full terms: dechonet.com/terms §4.

About DechoNet

DechoNet is a domain security reconnaissance platform — distributed observation, cross-verification. The same diagnostics ship three ways: free web tools, error-fix guides, and this MCP server.

• 🌐 Web tools (free, no sign-up): https://dechonet.com
• 📘 Guides (fix common DNS/SSL/HTTP/email errors): https://dechonet.com/guides
• 🎣 Phishing / smishing link check (opens the link like a Korean phone): https://dechonet.com/util/phishing
• 🩺 Full domain check (DNS, SSL, headers, email auth, ports, PQC in one score): https://dechonet.com/util/all
• 🔔 Monitoring (daily re-checks, change history): https://dechonet.com/pro
• 🛠 HTTP API (same tools, OpenAPI): https://dechonet.com/developers · https://dechonet.com/openapi.json
• 📏 How results are judged / monthly detection benchmark: https://dechonet.com/methodology · https://dechonet.com/benchmark
• 🟢 Service status: https://dechonet.com/status
• 🐦 X: https://x.com/Dechonetwork

MIT licensed. Issues and PRs welcome.

Signed-in tools

These tools appear only when the server has your DechoNet login: set DECHONET_SESSION_COOKIE to your own current cookie as it is sent, e.g. dn_acct=… (or dn_acct=…; dn_ws=… when you work in an agency workspace). Treat it like a password. It is sent only to the exact private endpoints below, never to the public diagnostics, and a public API key does not stand in for it. Without it the server lists the 30 public tools.

Business plan — active checks on domains you own (plans)

Tool	Description
asm_nuclei_start	Start a limited active check (Nuclei) on a verified asset from your attack-surface report. Needs current DNS TXT ownership, the exact root URL from that report and confirm: "asm-nuclei-v1"
asm_nuclei_status	Progress, coverage and sanitized findings. Partial or failed is not a clean result; technology detection is not proof of a vulnerability. Never starts requests
asm_nuclei_cancel	Stop new requests and end the job. Requests already sent cannot be recalled

Investigator case spaces — case_kit_search and case_kit_observe work only with a case owner session or an existing case access cookie. Search reads stored, case-scoped page fingerprints; observe re-opens a case target under the same render rules and daily cap. Similar screens and kit candidates never confirm a person or a phishing verdict.