Dechonet MCP Server

DechoNet MCP Server

Domain security reconnaissance for AI agents via the Model Context Protocol.

19 tools, free, no API key. DNS, SSL/TLS, HTTP security headers, email authentication, port scan, DNS propagation, reverse DNS, ASN/BGP, RDAP/WHOIS, subdomain discovery (CT logs), lookalike/typosquat detection, OWASP-mapped observable checks, brand-impersonation exposure, go-live readiness, and domain change history — what changed since the last check.

Every result comes back interpreted, not just as raw JSON: a status, the key numbers, each issue with severity and confidence, and the concrete action to take. That is what an agent needs to tell a human what to do next.

Part of DechoNet. Every tool here is also a free web tool at dechonet.com — no sign-up — backed by error-fix guides. This package brings the same checks to AI agents.

Zero-install: remote endpoint

No npx, no install, no key. Point any MCP client that speaks Streamable HTTP at:

https://dechonet.com/mcp

Claude Desktop / Claude Code (claude mcp add --transport http dechonet https://dechonet.com/mcp), Cursor, and other HTTP-capable clients connect directly. The remote endpoint also serves 3 curated prompts (audit_domain, monitor_setup, investigate_changes) and 2 reference resources.

Quick Start (stdio, Claude Desktop)

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "dechonet": {
      "command": "npx",
      "args": ["-y", "dechonet-mcp"]
    }
  }
}

Config file location:

• macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
• Windows: %APPDATA%\Claude\claude_desktop_config.json

Restart Claude Desktop. You'll see the DechoNet tools icon in the input area.

Install

# Via npx (no install needed)
npx dechonet-mcp

# Or install globally
npm install -g dechonet-mcp

Available Tools

Every tool response ends with a link to the full interactive report on dechonet.com for the human behind the agent.

Example Prompts

Once connected, try asking Claude:

• "Audit the security posture of example.com"
• "Is the SSL certificate for mysite.com about to expire?"
• "Which subdomains of example.com are exposed in CT logs?"
• "Are there registered lookalike domains of mybrand.com?"
• "How exposed is mybrand.com to impersonation?"
• "Is example.com ready to go live?"
• "What changed on example.com since the last check?"
• "Analyze these email headers: [paste headers]"
• "What's the ASN for 8.8.8.8?"

Local SSE Transport

For a self-hosted HTTP/SSE bridge (the hosted remote endpoint above is usually simpler):

npm run start:sse
# Server runs on http://localhost:3100
# SSE endpoint: http://localhost:3100/sse

Development

npm install
npm run build    # TypeScript → build/
npm run dev      # Run with tsx (stdio)
npm run start:sse # Run SSE server

How It Works

The MCP server calls DechoNet's public API (https://dechonet.com/api/util/*) — the same backend as the dechonet.com web tools — and returns structured results with:

• Status (ok/warn/bad)
• KPIs (key numbers per tool)
• Issues with severity (critical/warning/info) and confidence levels
• Actionable remediation steps
• Raw data (full JSON)

All data comes from public sources (DNS, HTTP headers, SSL certificates, CT logs, RDAP). Passive by design: no active exploitation, and a registered lookalike is reported as a fact to verify, never as an accusation.

Environment Variables

About DechoNet

DechoNet is a domain security reconnaissance platform — distributed observation, cross-verification. The same diagnostics ship three ways: free web tools, error-fix guides, and this MCP server.

• 🌐 Web tools (free, no sign-up): https://dechonet.com
• 📘 Guides (fix common DNS/SSL/HTTP/email errors): https://dechonet.com/guides
• 🔔 Monitoring (daily re-checks, change history): https://dechonet.com/pro
• 🐦 X: https://x.com/Dechonetwork

MIT licensed. Issues and PRs welcome.