Mcp

node-man/dechonet-mcp

Exposes 13 security reconnaissance tools through MCP, letting Claude run DNS lookups, SSL certificate checks, port scans, email authentication audits, ASN/BGP lookups, and WHOIS queries against any domain or IP. The standout is security_scan, which runs 9 parallel checks and returns a 0-100 health score with graded issues and remediation steps. All tools hit DechoNet's public API and return structured results with severity levels and confidence scores. Reach for this when you need Claude to audit domain security posture, troubleshoot DNS propagation, analyze email headers, or investigate network infrastructure without leaving the conversation. Runs via npx with no auth required.

GitHub stars: 1
tools: 33
auth: Secret needed
transport: STDIO, HTTP
env vars: 4
last updated: Nov 6, 2026

View on GitHub

Install

From registry metadata

$ npx add-mcp https://dechonet.com/mcp --name dechonet-mcp

Run in your terminal. add-mcp asks which agents to add it to (Claude Code, Codex, Cursor and more). Add -g to install it for every project.

Review the command, arguments and environment values before installing. MCP servers run with your local permissions.

Other ways

Claude Code

$ claude mcp add --transport http dechonet-mcp https://dechonet.com/mcp

Run in your terminal. Add --scope user to make it available in every project.

Tools

Verified live · 33 tools

Verified live against the running server on Nov 6, 2026.

dns_lookupQuery DNS records (A, AAAA, MX, TXT, NS, SOA, CAA) for a domain and validate email-related records, including DNSSEC presence and SPF/DMARC syntax, returning severity-rated diagnostics. Use this for a single authoritative answer about one domain. Use dns_propagation instead wh...1 params

Query DNS records (A, AAAA, MX, TXT, NS, SOA, CAA) for a domain and validate email-related records, including DNSSEC presence and SPF/DMARC syntax, returning severity-rated diagnostics. Use this for a single authoritative answer about one domain. Use dns_propagation instead wh...

Parameters* required

domain*string

Registrable domain or hostname to query, without scheme or path (e.g., 'example.com' or 'mail.example.com'). Do not include 'http://' or a trailing slash.

ssl_checkInspect a host's served TLS/SSL certificate and connection: expiry date, issuer, SAN list, chain integrity, revocation (OCSP, then CRL; unknown when neither answers — not graded unless revoked), TLS version, and HSTS, returning an A+ to F grade weighted by certificate validity...2 params

Inspect a host's served TLS/SSL certificate and connection: expiry date, issuer, SAN list, chain integrity, revocation (OCSP, then CRL; unknown when neither answers — not graded unless revoked), TLS version, and HSTS, returning an A+ to F grade weighted by certificate validity...

Parameters* required

host*string

Hostname to inspect, without scheme (e.g., 'example.com'). The host portion of a pasted URL is also accepted.

portnumber

TCP port for the TLS handshake. Defaults to 443 (standard HTTPS); set this only for a non-standard HTTPS port such as 8443.default: 443

http_securityFollow a URL's HTTP redirect chain and audit response security headers (CSP, HSTS, X-Frame-Options, COOP, CORP, COEP, Permissions-Policy), grading A+ to F on the six core headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy; COOP/COR...1 params

Follow a URL's HTTP redirect chain and audit response security headers (CSP, HSTS, X-Frame-Options, COOP, CORP, COEP, Permissions-Policy), grading A+ to F on the six core headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy; COOP/COR...

Parameters* required

url*string

Full URL including scheme (e.g., 'https://example.com/path'). If the scheme is omitted, https:// is assumed. Redirects are followed starting from this URL.

email_authAssess a domain's email authentication and deliverability posture: MX records, SPF, DMARC, DKIM (probes 15 common selectors), BIMI, MTA-STS, TLS-RPT, and DANE, plus a blacklist check across all MX hosts, returning a 0-100 deliverability score. Use this for a full sending/recei...1 params

Assess a domain's email authentication and deliverability posture: MX records, SPF, DMARC, DKIM (probes 15 common selectors), BIMI, MTA-STS, TLS-RPT, and DANE, plus a blacklist check across all MX hosts, returning a 0-100 deliverability score. Use this for a full sending/recei...

Parameters* required

domain*string

Email domain to assess — the part after '@' (e.g., 'example.com'). An IP address is also accepted for reverse/PTR-based checks.

port_scanProbe a host for a fixed set of common TCP ports (HTTP, HTTPS, SSH, FTP, SMTP, DNS, and common databases) and report which are open, the service name, and the response time. BEHAVIOR: this makes an ACTIVE TCP connection to the target. It is non-intrusive — a connect probe only...1 params

Probe a host for a fixed set of common TCP ports (HTTP, HTTPS, SSH, FTP, SMTP, DNS, and common databases) and report which are open, the service name, and the response time. BEHAVIOR: this makes an ACTIVE TCP connection to the target. It is non-intrusive — a connect probe only...

Parameters* required

host*string

Hostname or IP to probe (e.g., 'example.com' or '203.0.113.10'). A 'host:port' form is accepted to hint a specific port. Only supply targets you own or are authorized to test.

dns_propagationQuery one DNS record across 8+ global public resolvers (Google, Cloudflare, Quad9, OpenDNS, and more) simultaneously and report which resolvers return stale versus updated values. Use this after changing a record to confirm worldwide propagation. Use dns_lookup instead for a s...2 params

Query one DNS record across 8+ global public resolvers (Google, Cloudflare, Quad9, OpenDNS, and more) simultaneously and report which resolvers return stale versus updated values. Use this after changing a record to confirm worldwide propagation. Use dns_lookup instead for a s...

Parameters* required

domain*string

Domain whose record to compare across resolvers (e.g., 'example.com'), without scheme or path.

typestring

DNS record type to compare across resolvers. Defaults to A (IPv4 address), the most common propagation check.one of A · AAAA · MX · CNAME · TXT · NSdefault: A

reverse_dnsResolve the PTR (reverse DNS) record for an IPv4 or IPv6 address and verify forward-confirmed reverse DNS (FCrDNS) by checking that the PTR hostname resolves back to the same IP. Infers the hosting provider from PTR naming patterns. Use this to validate mail-server rDNS or ide...1 params

Resolve the PTR (reverse DNS) record for an IPv4 or IPv6 address and verify forward-confirmed reverse DNS (FCrDNS) by checking that the PTR hostname resolves back to the same IP. Infers the hosting provider from PTR naming patterns. Use this to validate mail-server rDNS or ide...

Parameters* required

ip*string

IP address to reverse-resolve, IPv4 or IPv6 (e.g., '8.8.8.8' or '2001:4860:4860::8888'). Must be an IP, not a hostname.

asn_lookupLook up Autonomous System (ASN) / BGP information for an IP address or AS number: the network operator, announced prefixes, abuse contact, and a classification (cloud, CDN, ISP, hosting, or enterprise). For an IPv4 address it also reports whether the address is on the Tor Proj...1 params

Look up Autonomous System (ASN) / BGP information for an IP address or AS number: the network operator, announced prefixes, abuse contact, and a classification (cloud, CDN, ISP, hosting, or enterprise). For an IPv4 address it also reports whether the address is on the Tor Proj...

Parameters* required

query*string

An IP address (e.g., '1.1.1.1') or an AS number in 'AS####' form (e.g., 'AS13335').

whois_lookupRetrieve domain registration data via RDAP (with WHOIS fallback): registrar, creation/expiry/update dates, nameservers, and EPP status flags, highlighting risk states such as clientHold and pendingDelete. Use this for ownership, lifecycle, and expiry questions about a register...1 params

Retrieve domain registration data via RDAP (with WHOIS fallback): registrar, creation/expiry/update dates, nameservers, and EPP status flags, highlighting risk states such as clientHold and pendingDelete. Use this for ownership, lifecycle, and expiry questions about a register...

Parameters* required

domain*string

Registered domain name to look up (e.g., 'example.com'). A subdomain is normalized to its registrable domain.

subdomain_discoveryEnumerate the subdomains of a domain from Certificate Transparency logs — fully passive (no packets are sent to the target; CT logs are public records of every TLS certificate ever issued). Flags operational-looking names (dev, staging, admin, vpn, legacy) and wildcard certifi...1 params

Enumerate the subdomains of a domain from Certificate Transparency logs — fully passive (no packets are sent to the target; CT logs are public records of every TLS certificate ever issued). Flags operational-looking names (dev, staging, admin, vpn, legacy) and wildcard certifi...

Parameters* required

domain*string

Registrable domain to enumerate (e.g., 'example.com'), without scheme or path. Subdomains found in CT logs for this domain are returned.

lookalike_domainsGenerate the typosquat/lookalike variants of a domain that phishers actually register — homoglyph swaps (l→1, o→0, rn→m), TLD swaps (.com→.co), character omissions, transpositions, repetitions, hyphenations — and check which of them are currently registered (live NS delegation...1 params

Generate the typosquat/lookalike variants of a domain that phishers actually register — homoglyph swaps (l→1, o→0, rn→m), TLD swaps (.com→.co), character omissions, transpositions, repetitions, hyphenations — and check which of them are currently registered (live NS delegation...

Parameters* required

domain*string

Domain to protect (e.g., 'example.com'), without scheme or path. Variants of its label and TLD are generated and checked.

ip_infoReport information about the caller's own public IP as seen by the server: IPv4/IPv6 address, ISP, ASN, approximate geolocation, and proxy/VPN heuristics. Takes no input — it reflects the egress IP of THIS MCP server's network, which is usually NOT the end user's IP. Use this...

Report information about the caller's own public IP as seen by the server: IPv4/IPv6 address, ISP, ASN, approximate geolocation, and proxy/VPN heuristics. Takes no input — it reflects the egress IP of THIS MCP server's network, which is usually NOT the end user's IP. Use this...

No parameters. Call it with no arguments.

email_header_analysisParse raw email headers to reconstruct the delivery path (each Received hop in order), extract SPF/DKIM/DMARC authentication results, measure per-hop delays, and flag unencrypted (non-TLS) hops. Use this to diagnose a specific message that was already delivered — spoofing, del...1 params

Parse raw email headers to reconstruct the delivery path (each Received hop in order), extract SPF/DKIM/DMARC authentication results, measure per-hop delays, and flag unencrypted (non-TLS) hops. Use this to diagnose a specific message that was already delivered — spoofing, del...

Parameters* required

headers*string

The complete raw email header block, copied verbatim — every line from the first 'Received:'/'From:' down to the blank line before the body. Paste as-is, including folded continuation lines; do not...

subnet_calcCompute IPv4 subnet details from CIDR notation entirely locally — no network call: network and broadcast addresses, usable host range, total usable hosts, subnet mask, and wildcard mask. /31 and /32 are handled per RFC 3021 (point-to-point / single host). Use this for IPv4 add...1 params

Compute IPv4 subnet details from CIDR notation entirely locally — no network call: network and broadcast addresses, usable host range, total usable hosts, subnet mask, and wildcard mask. /31 and /32 are handled per RFC 3021 (point-to-point / single host). Use this for IPv4 add...

Parameters* required

cidr*string

IPv4 address with a CIDR prefix length 0-32 (e.g., '192.168.1.0/24'). IPv4 only; host bits may be any address inside the block.

security_scanOne-shot comprehensive audit of a domain, scored 0-100 with an A+ to F grade and a prioritized action list. Five scored areas: the web connection (TLS certificate and HTTP security headers, measured on www when only www has an address), mail spoofing defence (SPF/DKIM/DMARC; a...1 params

One-shot comprehensive audit of a domain, scored 0-100 with an A+ to F grade and a prioritized action list. Five scored areas: the web connection (TLS certificate and HTTP security headers, measured on www when only www has an address), mail spoofing defence (SPF/DKIM/DMARC; a...

Parameters* required

domain*string

Domain to audit (e.g., 'example.com'). Scheme and path are stripped.

owasp_checkAssess a domain's OWASP posture from EXTERNAL OBSERVATION only: the OWASP Secure Headers Project plus the externally observable OWASP Top 10:2025 subset — A04 Cryptographic Failures (TLS/cert), A02 Security Misconfiguration (header/info leaks), and A03 Software Supply Chain Fa...1 params

Assess a domain's OWASP posture from EXTERNAL OBSERVATION only: the OWASP Secure Headers Project plus the externally observable OWASP Top 10:2025 subset — A04 Cryptographic Failures (TLS/cert), A02 Security Misconfiguration (header/info leaks), and A03 Software Supply Chain Fa...

Parameters* required

host*string

Hostname to assess, without scheme (e.g., 'example.com'). The host portion of a pasted URL is also accepted.

impersonation_exposureAssess how exposed a domain is to brand impersonation and phishing, PASSIVELY: live typosquat/lookalike domains (homoglyph, omission, transposition, TLD swap) that actually resolve, operational subdomains (dev/staging/admin) exposed in CT logs, and whether a wildcard certifica...1 params

Assess how exposed a domain is to brand impersonation and phishing, PASSIVELY: live typosquat/lookalike domains (homoglyph, omission, transposition, TLD swap) that actually resolve, operational subdomains (dev/staging/admin) exposed in CT logs, and whether a wildcard certifica...

Parameters* required

domain*string

Registrable domain to assess for impersonation exposure (e.g., 'example.com'). Scheme and path are stripped.

domain_changesReport what has changed for a domain over time — the security regressions and drift that DechoNet's daily monitoring has recorded across every watch on the domain (SSL grade, headers, DNS, OWASP posture, impersonation exposure, etc.). Use this to answer "what changed on my dom...1 params

Report what has changed for a domain over time — the security regressions and drift that DechoNet's daily monitoring has recorded across every watch on the domain (SSL grade, headers, DNS, OWASP posture, impersonation exposure, etc.). Use this to answer "what changed on my dom...

Parameters* required

domain*string

Domain whose recorded change history to fetch (e.g., 'example.com'). Scheme and path are stripped.

domain_historyShow how a domain's (or IPv4 address's) infrastructure has changed over time from DechoNet's stored observations: nameservers, A/AAAA, MX, CNAME, certificate issuer, registrar, RDAP nameservers and status, and for an IP its ASN and PTR — each value with when it was first and l...1 params

Show how a domain's (or IPv4 address's) infrastructure has changed over time from DechoNet's stored observations: nameservers, A/AAAA, MX, CNAME, certificate issuer, registrar, RDAP nameservers and status, and for an IP its ASN and PTR — each value with when it was first and l...

Parameters* required

target*string

Domain (e.g., 'example.com') or IPv4 address. Scheme, path and a leading www. are stripped.

infrastructure_pivotFind other domains DechoNet has seen with the same infrastructure value — a nameserver, IP address, MX host, certificate issuer or registrar — with first and last seen, to map related infrastructure (e.g. other phishing domains on the same rare nameserver). Use it after domain...2 params

Find other domains DechoNet has seen with the same infrastructure value — a nameserver, IP address, MX host, certificate issuer or registrar — with first and last seen, to map related infrastructure (e.g. other phishing domains on the same rare nameserver). Use it after domain...

Parameters* required

kind*string

Which kind of value to pivot on.one of dns:a · dns:aaaa · dns:ns · dns:mx · ssl:issuer · rdap:registrar

value*string

The value itself, e.g. 'ns1.example-dns.net' or '203.0.113.9'.

watch_domainStart (or reuse) a daily DechoNet watch on a domain so that changes are recorded over time — SSL grade/issuer/expiry, DNS records, HTTP security headers, domain registration, and optionally OWASP posture and impersonation exposure. Use this once when the user cares about a dom...2 params

Start (or reuse) a daily DechoNet watch on a domain so that changes are recorded over time — SSL grade/issuer/expiry, DNS records, HTTP security headers, domain registration, and optionally OWASP posture and impersonation exposure. Use this once when the user cares about a dom...

Parameters* required

domain*string

Registered domain to watch (e.g., 'example.com'). Scheme and path are stripped.

toolsarray

Which checks to re-run daily. Default ['ssl','dns','http','rdap'] (certificate, DNS, security headers, registration). Add 'owasp' and/or 'impersonation' for posture and brand-exposure tracking, 'pq...

set_expectationsRecord what a domain should show from outside and check it now — HSTS or another header present, DMARC enforcing, an issue key no longer reported, an HTTP or TLS grade at or above a level, a certificate with enough days left, a DNS record present, absent or containing a value,...3 params

Record what a domain should show from outside and check it now — HSTS or another header present, DMARC enforcing, an issue key no longer reported, an HTTP or TLS grade at or above a level, a certificate with enough days left, a DNS record present, absent or containing a value,...

Parameters* required

domain*string

Domain the checks are about (e.g. 'example.com'); scheme and path are stripped

expect*array

Checks, 1-20

labelstring

Optional short name for the set (shown on its page and in the mail)

verify_expectationsCheck expectations from outside now, with fresh reads: either a stored set by id (from set_expectations — its state is updated and an anonymous set is kept another 30 days), or a domain plus a list of checks once, storing nothing. Same checks and outcomes as set_expectations (...3 params

Check expectations from outside now, with fresh reads: either a stored set by id (from set_expectations — its state is updated and an anonymous set is kept another 30 days), or a domain plus a list of checks once, storing nothing. Same checks and outcomes as set_expectations (...

Parameters* required

domainstring

Domain to check once (with expect), when there is no stored set

expectarray

Checks for a one-off verify, 1-20

idstring

Stored set id ('ex_…') to re-check

check_before_actionCheck the page an agent is about to log in, pay, download from or submit to: whether the address impersonates a brand, how new the domain is, whether DechoNet or a licensed feed has already flagged it, and — opened from Seoul (and Tokyo for Japan-targeted pages) as a phone — w...4 params

Check the page an agent is about to log in, pay, download from or submit to: whether the address impersonates a brand, how new the domain is, whether DechoNet or a licensed feed has already flagged it, and — opened from Seoul (and Tokyo for Japan-targeted pages) as a phone — w...

Parameters* required

action*string

What is about to happen on the pageone of login · pay · download · submit · follow

expectedBrandstring

Brand the page is believed to belong to (e.g. 'PayPal', 'Shinhan Card'); a domain without that name is noted

pageobject

Optional page structure, host names only

url*string

Address of the page (https://…)

crypto_check_before_signBefore an agent signs or sends from a crypto wallet: send the destination address (to), the page that asked (url) and/or the wallet request it is about to approve (request: the EIP-1193 method and params). The address is checked for its chain and checksum, the US Treasury OFAC...3 params

Before an agent signs or sends from a crypto wallet: send the destination address (to), the page that asked (url) and/or the wallet request it is about to approve (request: the EIP-1193 method and params). The address is checked for its chain and checksum, the US Treasury OFAC...

Parameters* required

requestobject

The wallet request about to be approved

tostring

Destination wallet address (0x…, T…, bc1…, Solana)

urlstring

Address of the page that asked for the signature or transfer (https://…)

wallet_address_checkCheck one crypto wallet address: which chain it belongs to (EVM, TRON, Bitcoin, Solana — from the format alone), whether its checksum is valid (EIP-55, Base58Check, bech32/bech32m), whether it is on the US Treasury OFAC SDN sanctions list (read daily) or among the addresses th...1 params

Check one crypto wallet address: which chain it belongs to (EVM, TRON, Bitcoin, Solana — from the format alone), whether its checksum is valid (EIP-55, Base58Check, bech32/bech32m), whether it is on the US Treasury OFAC SDN sanctions list (read daily) or among the addresses th...

Parameters* required

address*string

Wallet address (0x…, T…, bc1…/1…/3…, or a Solana address)

crypto_exchange_checkCheck whether a domain or link is the official address of a crypto exchange, wallet or dApp — Korean exchanges (Upbit, Bithumb, Coinone, GOPAX, DigitalX/Korbit) and major global exchanges, wallets and dApps — compared with the addresses the companies publish themselves (the Ko...1 params

Check whether a domain or link is the official address of a crypto exchange, wallet or dApp — Korean exchanges (Upbit, Bithumb, Coinone, GOPAX, DigitalX/Korbit) and major global exchanges, wallets and dApps — compared with the addresses the companies publish themselves (the Ko...

Parameters* required

domain*string

Domain or link to check (e.g. 'upbit-event.example' or 'https://…')

report_pageReport a page to DechoNet: phishing or brand impersonation, a fake payment window (card fields where a payment provider should be), hidden instructions aimed at AI agents, a malicious download, a DechoNet verdict that looks wrong (false_positive) or a danger it missed (missed)...3 params

Report a page to DechoNet: phishing or brand impersonation, a fake payment window (card fields where a payment provider should be), hidden instructions aimed at AI agents, a malicious download, a DechoNet verdict that looks wrong (false_positive) or a danger it missed (missed)...

Parameters* required

kind*string

What is wrong with the pageone of phishing · fake_payment · hidden_instructions · malicious_download · false_positive · missed

observedobject

network_anomaly only: the certificate serial (hex) and issuer, and the addresses, you saw for the host

url*string

Address of the page (only its host is kept)

golive_checkCheck whether a domain is ready to launch or migrate — a go/no-go verdict over five essentials: DNS resolves to an IP, has propagated consistently across global resolvers, SSL/TLS is ready, the site is reachable over HTTPS, and the domain registration is not about to expire. U...1 params

Check whether a domain is ready to launch or migrate — a go/no-go verdict over five essentials: DNS resolves to an IP, has propagated consistently across global resolvers, SSL/TLS is ready, the site is reachable over HTTPS, and the domain registration is not about to expire. U...

Parameters* required

domain*string

Domain to check for launch/migration readiness (e.g., 'example.com'). Scheme and path are stripped.

pqc_readinessCheck whether a website's public TLS endpoint is ready for post-quantum cryptography: does it complete a TLS 1.3 handshake that offers only the hybrid X25519MLKEM768 key exchange (ML-KEM), and does the organisation's own server provide it or a CDN edge in front of it. Also rep...1 params

Check whether a website's public TLS endpoint is ready for post-quantum cryptography: does it complete a TLS 1.3 handshake that offers only the hybrid X25519MLKEM768 key exchange (ML-KEM), and does the organisation's own server provide it or a CDN edge in front of it. Also rep...

Parameters* required

domain*string

Domain whose HTTPS endpoint to check (e.g., 'example.com'). Scheme and path are stripped.

mcp_server_checkCheck a remote MCP server from outside before connecting it to an agent: whether it requires authentication (and publishes OAuth protected-resource metadata, RFC 9728), which of its tools act on the world (run commands, write or delete files, send messages, make payments, read...1 params

Check a remote MCP server from outside before connecting it to an agent: whether it requires authentication (and publishes OAuth protected-resource metadata, RFC 9728), which of its tools act on the world (run commands, write or delete files, send messages, make payments, read...

Parameters* required

url*string

The remote MCP endpoint (e.g., 'https://example.com/mcp'). Query strings are removed.

phishing_link_checkCheck the links in a suspicious text message (smishing) or e-mail before anyone taps them. Paste the whole message or a single URL: every link is extracted, followed through URL shorteners to its real destination, and judged on observable signals — domain age from RDAP, impers...1 params

Check the links in a suspicious text message (smishing) or e-mail before anyone taps them. Paste the whole message or a single URL: every link is extracted, followed through URL shorteners to its real destination, and judged on observable signals — domain age from RDAP, impers...

Parameters* required

text*string

The link(s) to check — a URL, or the message text with verification codes, passwords and personal details removed (any language). Only the links are used (up to 5); the text is not stored.

exposure_mapMap what an organisation exposes to the internet beyond its home page: subdomains from Certificate Transparency logs (plus hosts DechoNet has already observed), each opened once from outside and sorted into developer/ops tools, directory listings, admin screens, VPN/remote-acc...1 params

Map what an organisation exposes to the internet beyond its home page: subdomains from Certificate Transparency logs (plus hosts DechoNet has already observed), each opened once from outside and sorted into developer/ops tools, directory listings, admin screens, VPN/remote-acc...

Parameters* required

domain*string

The organisation's domain (e.g., 'example.co.kr'). Scheme, path and a leading www. are stripped.

Configuration

DECHONET_URL

API base URL (default: https://dechonet.com)

DECHONET_LOCALE

Response language: en or ko (default: en)

DECHONET_API_KEYsecret

Optional free API key (dechonet.com account page): own rate limits; required for infrastructure_pivot

DECHONET_SESSION_COOKIEsecret

Optional: your own DechoNet login cookie (dn_acct), only for the signed-in tools (Business-plan Nuclei checks, investigator cases)

Readme

DechoNet MCP Server

dechonet.com · Remote MCP (no install) · Phishing link check · Free web tools · HTTP API · Detection benchmark · Status

Domain security reconnaissance for AI agents via the Model Context Protocol.

View the full README on GitHub

Details

Repository: github.com/node-man/dechonet-mcp
Website: dechonet.com/mcp
Category: Security & Pentesting
Package: dechonet-mcp
Transport: STDIO, HTTP
Auth: Required
Registry: MCP registry, active
Resources: 2
Prompts: 4
Tools verified: Nov 6, 2026

Related Security & Pentesting MCP servers

View all

GhostFreeshane-js/ghostfreeMCP server that scans your repo's dependencies for security vulnerabilities based on published CVEs.1stars

Securityscorecard Mcpcallmarcus/security-scorecard-mcpCommunity-built, comprehensive MCP server for the SecurityScorecard API (unofficial).0stars

Obsidian Mcp Securedewtech-technologies/obsidian-mcp-secureSecure MCP server for Obsidian with OWASP Top 10 controls and full audit logging.0stars

Tubemind Secure Mcpdewtech-technologies/tubemind-secure-mcpSecure MCP server for YouTube intelligence — 18 tools, OAuth2, OWASP Top 10 controls.0stars

Dep Oracleertugrulakben/dep-oraclePredictive dependency security engine. Trust scores, zombie detection, blast radius analysis.0stars

Dlp Mcpcx-anand-nandeshwar/security-mcp-marketplaceThe DLP MCP provides the compliance violation in the one drive, google drive documents.0stars