DechoNet

DechoNet MCP Server

dechonet.com · Remote MCP (no install) · Phishing link check · Free web tools · HTTP API · Detection benchmark · Status

Domain security reconnaissance for AI agents via the Model Context Protocol.

30 tools. No API key needed for non-commercial use. Phishing/smishing link checks, exposed admin page checks (admin screens, test servers, dev tools left open), DNS, SSL/TLS, post-quantum TLS readiness, HTTP security headers, email authentication, port scan, DNS propagation, reverse DNS, ASN/BGP, RDAP/WHOIS, subdomain discovery (CT logs), lookalike/typosquat detection, OWASP-mapped observable checks, brand-impersonation exposure, go-live readiness, MCP server checks before you connect one, domain change history — what changed since the last check — infrastructure history and pivots (past nameservers/IPs/issuers, and other domains seen on the same rare infrastructure), and a daily watch you can set from the agent.

Every result comes back interpreted, not just as raw JSON: a status, the key numbers, each issue with severity and confidence, and the concrete action to take. That is what an agent needs to tell a human what to do next.

Part of DechoNet. Every tool here is also a free web tool at dechonet.com — no sign-up — backed by error-fix guides. This package brings the same checks to AI agents.

Zero-install: remote endpoint

No npx, no install. Point any MCP client that speaks Streamable HTTP at:

https://dechonet.com/mcp

Step-by-step for each client: dechonet.com/mcp. The remote endpoint also serves 3 curated prompts (audit_domain, monitor_setup, investigate_changes) and 2 reference resources.

Quick Start (stdio, Claude Desktop)

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "dechonet": {
      "command": "npx",
      "args": ["-y", "dechonet-mcp"]
    }
  }
}

Config file location:

• macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
• Windows: %APPDATA%\Claude\claude_desktop_config.json

Restart Claude Desktop; DechoNet shows up in the chat input's tools menu. (Claude Desktop can also skip the install and add https://dechonet.com/mcp as a custom connector — see the table above.)

Install

# Via npx (no install needed)
npx dechonet-mcp

# Or install globally
npm install -g dechonet-mcp

Command line

The same checks work from a terminal or a CI step — no MCP client needed:

npx dechonet-mcp ssl example.com
npx dechonet-mcp email example.com --json
npx dechonet-mcp scan example.com --fail-on bad   # exit 2 when the overall grade is D or F

Checks: dns, ssl, http, email, port, propagation, rdns, asn, whois, subdomains, lookalike, scan, owasp, golive, pqc, mcp, phishing, exposure, changes, history, impersonation, ip, subnet (or any tool name below). --json prints the structured result, --raw keeps the raw data, --port sets the TLS port. Exit codes: 0 done, 1 the lookup failed, 2 the result reached --fail-on (bad or warn). With no arguments the package runs as the MCP server.

Available Tools

Every tool response ends with a link to the full interactive report on dechonet.com for the human behind the agent.

Example Prompts

Once connected, try asking Claude:

• "Audit the security posture of example.com"
• "Is the SSL certificate for mysite.com about to expire?"
• "Which subdomains of example.com are exposed in CT logs?"
• "Are there registered lookalike domains of mybrand.com?"
• "How exposed is mybrand.com to impersonation?"
• "Is example.com ready to go live?"
• "What changed on example.com since the last check?"
• "Analyze these email headers: [paste headers]"
• "What's the ASN for 8.8.8.8?"

Local SSE Transport

For a self-hosted HTTP/SSE bridge (the hosted remote endpoint above is usually simpler):

npm run start:sse
# Server runs on http://localhost:3100
# SSE endpoint: http://localhost:3100/sse

Development

npm install
npm run build    # TypeScript → build/
npm run dev      # Run with tsx (stdio)
npm run start:sse # Run SSE server

How It Works

The MCP server calls DechoNet's public API (https://dechonet.com/api/util/*) — the same backend as the dechonet.com web tools — and returns structured results with:

• Status (ok/warn/bad)
• KPIs (key numbers per tool)
• Issues with severity (critical/warning/info) and confidence levels
• Actionable remediation steps
• Raw data (full JSON)

All data comes from public sources (DNS, HTTP headers, SSL certificates, CT logs, RDAP). Passive by design: no active exploitation, and a registered lookalike is reported as a fact to verify, never as an accusation.

Environment Variables

Terms of use

Free use (with or without a key) is for non-commercial purposes from November 8, 2026 — personal learning and research, checking your own domains, non-profit work. Using DechoNet inside a paid product, for clients, or regularly for company work needs MCP·API Pro (dechonet.com/pro); until payments open, ask at support@dechonet.com. Full terms: dechonet.com/terms §4.

About DechoNet

DechoNet is a domain security reconnaissance platform — distributed observation, cross-verification. The same diagnostics ship three ways: free web tools, error-fix guides, and this MCP server.

• 🌐 Web tools (free, no sign-up): https://dechonet.com
• 📘 Guides (fix common DNS/SSL/HTTP/email errors): https://dechonet.com/guides
• 🎣 Phishing / smishing link check (opens the link like a Korean phone): https://dechonet.com/util/phishing
• 🩺 Full domain check (DNS, SSL, headers, email auth, ports, PQC in one score): https://dechonet.com/util/all
• 🔔 Monitoring (daily re-checks, change history): https://dechonet.com/pro
• 🛠 HTTP API (same tools, OpenAPI): https://dechonet.com/developers · https://dechonet.com/openapi.json
• 📏 How results are judged / monthly detection benchmark: https://dechonet.com/methodology · https://dechonet.com/benchmark
• 🟢 Service status: https://dechonet.com/status
• 🐦 X: https://x.com/Dechonetwork

MIT licensed. Issues and PRs welcome.

Signed-in tools

These tools appear only when the server has your DechoNet login: set DECHONET_SESSION_COOKIE to your own current cookie as it is sent, e.g. dn_acct=… (or dn_acct=…; dn_ws=… when you work in an agency workspace). Treat it like a password. It is sent only to the exact private endpoints below, never to the public diagnostics, and a public API key does not stand in for it. Without it the server lists the 30 public tools.

Business plan — active checks on domains you own (plans)

Investigator case spaces — case_kit_search and case_kit_observe work only with a case owner session or an existing case access cookie. Search reads stored, case-scoped page fingerprints; observe re-opens a case target under the same render rules and daily cap. Similar screens and kit candidates never confirm a person or a phishing verdict.