Security & Testing

dechonet.com

An MCP server providing network security diagnostics for DNS, TLS/SSL, HTTP headers, email authentication, and port scanning.

1 endpoint20 known toolsFirst detected May 29, 2026Last detected September 16, 2026

ENDPOINT 1

https://dechonet.com/mcp

No auth detected

MCP server metadata

Name: dechonet
Version: 1.1.0

Capabilities

toolspromptsresources

Server instructions

DechoNet domain-reconnaissance tools (free, no API key). Recommended workflow: 1) security_scan for the overall verdict, then the specific tool for each flagged area (dns_lookup, ssl_check, http_security, email_auth, subdomain_discovery, lookalike_domains, owasp_check, impersonation_exposure). 2) When the user cares about this domain going forward, call watch_domain once — DechoNet then re-checks it daily and records every change. 3) On any later session about the same domain, call domain_changes FIRST: it reports what changed since the last lookup or watch check (grade drops, new issues, cert renewals, DNS drift) — something a fresh one-off lookup cannot tell you. Every result is interpreted (status, key numbers, issues with severity and confidence, concrete actions) and ends with a link to the full interactive report you can hand to the user. All tools except watch_domain are read-only. Setup guide for humans: https://dechonet.com/mcp

Known tools 20

dns_lookup

Query DNS records (A, AAAA, MX, TXT, NS, SOA, CAA) for a domain and validate email-related records, including DNSSEC presence and SPF/DMARC syntax, returning severity-rated diagnostics.

Potential side effects

ssl_check

Inspect a host's served TLS/SSL certificate and connection: expiry date, issuer, SAN list, chain integrity, TLS version, and HSTS, returning an A+ to F grade weighted by certificate validity (40%), TLS version (25%), chain trust (15%), and HSTS (20%).

Inferred read-only

http_security

Follow a URL's HTTP redirect chain and audit response security headers (CSP, HSTS, X-Frame-Options, COOP, CORP, COEP, Permissions-Policy), grading A+ to F and flagging information leaks such as server-version disclosure.

Inferred read-only

email_auth

Assess a domain's email authentication and deliverability posture: MX records, SPF, DMARC, DKIM (probes 15 common selectors), BIMI, MTA-STS, TLS-RPT, and DANE, plus a blacklist check across all MX hosts, returning a 0-100 deliverability score.

Potential side effects

port_scan

Probe a host for a fixed set of common TCP ports (HTTP, HTTPS, SSH, FTP, SMTP, DNS, and common databases) and report which are open, the service name, and the response time.

Inferred read-only

dns_propagation

Query one DNS record across 8+ global public resolvers (Google, Cloudflare, Quad9, OpenDNS, and more) simultaneously and report which resolvers return stale versus updated values.

Inferred read-only

reverse_dns

Resolve the PTR (reverse DNS) record for an IPv4 or IPv6 address and verify forward-confirmed reverse DNS (FCrDNS) by checking that the PTR hostname resolves back to the same IP.

Inferred read-only

asn_lookup

Look up Autonomous System (ASN) / BGP information for an IP address or AS number: the network operator, announced prefixes, abuse contact, and a classification (cloud, CDN, ISP, hosting, or enterprise).

Inferred read-only

whois_lookup

Retrieve domain registration data via RDAP (with WHOIS fallback): registrar, creation/expiry/update dates, nameservers, and EPP status flags, highlighting risk states such as clientHold and pendingDelete.

Potential side effects

subdomain_discovery

Enumerate the subdomains of a domain from Certificate Transparency logs — fully passive (no packets are sent to the target; CT logs are public records of every TLS certificate ever issued).

Inferred read-only

lookalike_domains

Generate the typosquat/lookalike variants of a domain that phishers actually register — homoglyph swaps (l→1, o→0, rn→m), TLD swaps (.

Inferred read-only

ip_info

Report information about the caller's own public IP as seen by the server: IPv4/IPv6 address, ISP, ASN, approximate geolocation, and proxy/VPN heuristics.

Inferred read-only

email_header_analysis

Parse raw email headers to reconstruct the delivery path (each Received hop in order), extract SPF/DKIM/DMARC authentication results, measure per-hop delays, and flag unencrypted (non-TLS) hops.

Potential side effects

subnet_calc

Compute IPv4 subnet details from CIDR notation entirely locally — no network call: network and broadcast addresses, usable host range, total usable hosts, subnet mask, and wildcard mask.

Inferred read-only

security_scan

One-shot comprehensive audit of a domain: runs DNS, SSL, HTTP headers, email auth, port scan, DNS propagation, reverse DNS, and ASN/RDAP checks in parallel, then computes a 0-100 Health Score with an A-F grade and a prioritized action list.

Potential side effects

owasp_check

Assess a domain's OWASP posture from EXTERNAL OBSERVATION only: the OWASP Secure Headers Project plus the externally observable Top 10 subset — A02 Cryptographic Failures (TLS/cert), A05 Security Misconfiguration (header/info leaks), and A06 Vulnerable & Outdated Components (version disclosure) — returning an A+ to F grade.

Inferred read-only

impersonation_exposure

Assess how exposed a domain is to brand impersonation and phishing, PASSIVELY: live typosquat/lookalike domains (homoglyph, omission, transposition, TLD swap) that actually resolve, operational subdomains (dev/staging/admin) exposed in CT logs, and whether a wildcard certificate exists — returning an A+ (low exposure) to F (high exposure) grade.

Inferred read-only

domain_changes

Report what has CHANGED for a domain over time — the security regressions and drift that DechoNet's daily monitoring has recorded across every watch on the domain (SSL grade, headers, DNS, OWASP posture, impersonation exposure, etc.

Inferred read-only

watch_domain

Start (or reuse) a daily DechoNet watch on a domain so that changes are recorded over time — SSL grade/issuer/expiry, DNS records, HTTP security headers, domain registration, and optionally OWASP posture and impersonation exposure.

Inferred read-only

golive_check

Check whether a domain is ready to launch or migrate — a go/no-go verdict over five essentials: DNS resolves to an IP, has propagated consistently across global resolvers, SSL/TLS is ready, the site is reachable over HTTPS, and the domain registration is not about to expire.

Inferred read-only

CONNECT WITH APPROVAL

Client installation

Review this server and its permissions before adding it. Secret placeholders must be set locally.

Codex

~/.codex/config.toml

[mcp_servers.dechonet]
url = "https://dechonet.com/mcp"
enabled = true

Claude Code

.mcp.json

{
  "mcpServers": {
    "dechonet": {
      "type": "http",
      "url": "https://dechonet.com/mcp"
    }
  }
}

Claude Desktop

Settings → Connectors → Add custom connector

Name: dechonet
Remote MCP URL: https://dechonet.com/mcp

Add this remote URL as a custom connector in Claude Desktop. Availability depends on the user plan and workspace policy.

Cursor

.cursor/mcp.json

{
  "mcpServers": {
    "dechonet": {
      "url": "https://dechonet.com/mcp"
    }
  }
}

Visual Studio Code

.vscode/mcp.json

Add to Visual Studio Code

{
  "servers": {
    "dechonet": {
      "type": "http",
      "url": "https://dechonet.com/mcp"
    }
  }
}

Generic MCP

Client-specific MCP configuration

{
  "name": "dechonet",
  "transport": "streamable-http",
  "url": "https://dechonet.com/mcp"
}

MCP Inspector

Run the official MCP Inspector locally and enter the indexed Streamable HTTP endpoint.

TRUST AND VERIFICATION EVIDENCE

Loading Trust v2 evidence…

Checking the associated registrable domain. The BuiltWith key remains server-side.

Indexed

Evidence is source-attributed and does not guarantee that a third-party server is safe. Risk labels are conservative metadata heuristics.