MCP server

Dechonet Official

com.dechonet/mcp

Checked 26 Oct 2026, 08:29 UTC · Connected to it and listed its tools

30 security tools for AI agents: phishing links, exposure maps, DNS, SSL, PQC, history, pivots.

Website Source

At a glance

Type

MCP server

Publisher

dechonet.com (verified by the MCP Registry)

Status

Working at last check

Tools

30

Token cost

About 10,624 tokens per request

Sets up in

Claude Code, Claude Desktop, Codex, Gemini CLI, Cursor, VS Code, Antigravity, ChatGPT, OpenAI API, Grok

Last checked

26 Oct 2026, 08:29 UTC

Connect it to your agent

Add to CursorAdd to VS CodeVS Code Insiders

Opens the app, which shows the server and asks you to confirm. For other apps, copy the setup below.

Claude Code

claude mcp add --transport http dechonet https://dechonet.com/mcp

Claude Desktop

Settings → Connectors → Add custom connector, and paste the URL.

Codex (config.toml)

[mcp_servers.dechonet]
url = "https://dechonet.com/mcp"

Gemini CLI

{"mcpServers":{"dechonet":{"httpUrl":"https://dechonet.com/mcp"}}}

Cursor

{"mcpServers":{"dechonet":{"url":"https://dechonet.com/mcp"}}}

VS Code

{"servers":{"dechonet":{"type":"http","url":"https://dechonet.com/mcp"}}}

Antigravity

agy mcp add dechonet https://dechonet.com/mcp

ChatGPT

Settings → Apps & Connectors → Advanced settings: turn on Developer mode, then Create a connector and paste the URL. Which plans can do this varies.

OpenAI API (Responses tools)

{"type":"mcp","server_label":"dechonet","server_url":"https://dechonet.com/mcp","require_approval":"always"}

Grok (xAI API tools)

{"type":"mcp","server_label":"dechonet","server_url":"https://dechonet.com/mcp"}

Tools

• asn_lookup ~198 tokens
  Look up Autonomous System (ASN) / BGP information for an IP address or AS number: the network operator, announced prefixes, abuse contact, and a classification (cloud, CDN, ISP, hosting, or enterprise). Use this to identify who runs a network or whether an IP is cloud/CDN-hosted. Use reverse_dns ins
• check_before_action ~705 tokens
  Check the page an agent is about to log in, pay, download from or submit to: whether the address impersonates a brand, how new the domain is, whether DechoNet or a licensed feed has already flagged it, and — opened from Seoul (and Tokyo for Japan-targeted pages) as a phone — what the page turns into
• dns_lookup ~259 tokens
  Query DNS records (A, AAAA, MX, TXT, NS, SOA, CAA) for a domain and validate email-related records, including DNSSEC presence and SPF/DMARC syntax, returning severity-rated diagnostics. Use this for a single authoritative answer about one domain. Use dns_propagation instead when you need to compare
• dns_propagation ~255 tokens
  Query one DNS record across 8+ global public resolvers (Google, Cloudflare, Quad9, OpenDNS, and more) simultaneously and report which resolvers return stale versus updated values. Use this after changing a record to confirm worldwide propagation. Use dns_lookup instead for a single authoritative ans
• domain_changes ~356 tokens
  Report what has changed for a domain over time — the security regressions and drift that DechoNet's daily monitoring has recorded across every watch on the domain (SSL grade, headers, DNS, OWASP posture, impersonation exposure, etc.). Use this to answer "what changed on my domain since yesterday/las
• domain_history ~280 tokens
  Show how a domain's (or IPv4 address's) infrastructure has changed over time from DechoNet's stored observations: nameservers, A/AAAA, MX, CNAME, certificate issuer, registrar, RDAP nameservers and status, and for an IP its ASN and PTR — each value with when it was first and last seen. Use this when
• email_auth ~242 tokens
  Assess a domain's email authentication and deliverability posture: MX records, SPF, DMARC, DKIM (probes 15 common selectors), BIMI, MTA-STS, TLS-RPT, and DANE, plus a blacklist check across all MX hosts, returning a 0-100 deliverability score. Use this for a full sending/receiving readiness review o
• email_header_analysis ~292 tokens
  Parse raw email headers to reconstruct the delivery path (each Received hop in order), extract SPF/DKIM/DMARC authentication results, measure per-hop delays, and flag unencrypted (non-TLS) hops. Use this to diagnose a specific message that was already delivered — spoofing, delays, or where mail was
• exposure_map ~330 tokens
  Map what an organisation exposes to the internet beyond its home page: subdomains from Certificate Transparency logs (plus hosts DechoNet has already observed), each opened once from outside and sorted into developer/ops tools, directory listings, admin screens, VPN/remote-access logins, staging ser
• golive_check ~291 tokens
  Check whether a domain is ready to launch or migrate — a go/no-go verdict over five essentials: DNS resolves to an IP, has propagated consistently across global resolvers, SSL/TLS is ready, the site is reachable over HTTPS, and the domain registration is not about to expire. Use this right before fl
• http_security ~288 tokens
  Follow a URL's HTTP redirect chain and audit response security headers (CSP, HSTS, X-Frame-Options, COOP, CORP, COEP, Permissions-Policy), grading A+ to F on the six core headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy; COOP/CORP/COEP are reported but
• impersonation_exposure ~342 tokens
  Assess how exposed a domain is to brand impersonation and phishing, PASSIVELY: live typosquat/lookalike domains (homoglyph, omission, transposition, TLD swap) that actually resolve, operational subdomains (dev/staging/admin) exposed in CT logs, and whether a wildcard certificate exists — returning a
• infrastructure_pivot ~314 tokens
  Find other domains DechoNet has seen with the same infrastructure value — a nameserver, IP address, MX host, certificate issuer or registrar — with first and last seen, to map related infrastructure (e.g. other phishing domains on the same rare nameserver). Use it after domain_history or dns_lookup
• ip_info ~154 tokens
  Report information about the caller's own public IP as seen by the server: IPv4/IPv6 address, ISP, ASN, approximate geolocation, and proxy/VPN heuristics. Takes no input — it reflects the egress IP of THIS MCP server's network, which is usually NOT the end user's IP. Use this to discover the server'
• lookalike_domains ~280 tokens
  Generate the typosquat/lookalike variants of a domain that phishers actually register — homoglyph swaps (l→1, o→0, rn→m), TLD swaps (.com→.co), character omissions, transpositions, repetitions, hyphenations — and check which of them are currently registered (live NS delegation via DoH). Use this to
• mcp_server_check Changes files · Sends messages · Moves money · ~340 tokens
  Check a remote MCP server from outside before connecting it to an agent: whether it requires authentication (and publishes OAuth protected-resource metadata, RFC 9728), which of its tools act on the world (run commands, write or delete files, send messages, make payments, read secrets), whether its
• owasp_check ~428 tokens
  Assess a domain's OWASP posture from EXTERNAL OBSERVATION only: the OWASP Secure Headers Project plus the externally observable OWASP Top 10:2025 subset — A04 Cryptographic Failures (TLS/cert), A02 Security Misconfiguration (header/info leaks), and A03 Software Supply Chain Failures (outdated compon
• phishing_link_check ~451 tokens
  Check the links in a suspicious text message (smishing) or e-mail before anyone taps them. Paste the whole message or a single URL: every link is extracted, followed through URL shorteners to its real destination, and judged on observable signals — domain age from RDAP, impersonation of Korean banks
• port_scan ~300 tokens
  Probe a host for a fixed set of common TCP ports (HTTP, HTTPS, SSH, FTP, SMTP, DNS, and common databases) and report which are open, the service name, and the response time. BEHAVIOR: this makes an ACTIVE TCP connection to the target. It is non-intrusive — a connect probe only; it does not authentic
• pqc_readiness ~358 tokens
  Check whether a website's public TLS endpoint is ready for post-quantum cryptography: does it complete a TLS 1.3 handshake that offers only the hybrid X25519MLKEM768 key exchange (ML-KEM), and does the organisation's own server provide it or a CDN edge in front of it. Also reports what the certifica
• report_page ~469 tokens
  Report a page to DechoNet: phishing or brand impersonation, a fake payment window (card fields where a payment provider should be), hidden instructions aimed at AI agents, a malicious download, a DechoNet verdict that looks wrong (false_positive) or a danger it missed (missed), an MCP server whose t
• reverse_dns ~211 tokens
  Resolve the PTR (reverse DNS) record for an IPv4 or IPv6 address and verify forward-confirmed reverse DNS (FCrDNS) by checking that the PTR hostname resolves back to the same IP. Infers the hosting provider from PTR naming patterns. Use this to validate mail-server rDNS or identify a single IP's hos
• security_scan ~439 tokens
  One-shot comprehensive audit of a domain, scored 0-100 with an A+ to F grade and a prioritized action list. Five scored areas: the web connection (TLS certificate and HTTP security headers, measured on www when only www has an address), mail spoofing defence (SPF/DKIM/DMARC; a domain that uses no ma
• set_expectations ~837 tokens
  Record what a domain should show from outside and check it now — HSTS or another header present, DMARC enforcing, an issue key no longer reported, an HTTP or TLS grade at or above a level, a certificate with enough days left, a DNS record present, absent or containing a value, HTTPS answering. Decho
• ssl_check ~447 tokens
  Inspect a host's served TLS/SSL certificate and connection: expiry date, issuer, SAN list, chain integrity, revocation (OCSP, then CRL; unknown when neither answers — not graded unless revoked), TLS version, and HSTS, returning an A+ to F grade weighted by certificate validity (40%), TLS version (25
• subdomain_discovery ~278 tokens
  Enumerate the subdomains of a domain from Certificate Transparency logs — fully passive (no packets are sent to the target; CT logs are public records of every TLS certificate ever issued). Flags operational-looking names (dev, staging, admin, vpn, legacy) and wildcard certificates, because forgotte
• subnet_calc ~214 tokens
  Compute IPv4 subnet details from CIDR notation entirely locally — no network call: network and broadcast addresses, usable host range, total usable hosts, subnet mask, and wildcard mask. /31 and /32 are handled per RFC 3021 (point-to-point / single host). Use this for IPv4 address planning. It does
• verify_expectations ~627 tokens
  Check expectations from outside now, with fresh reads: either a stored set by id (from set_expectations — its state is updated and an anonymous set is kept another 30 days), or a domain plus a list of checks once, storing nothing. Same checks and outcomes as set_expectations (pass / fail / unknown,
• watch_domain ~424 tokens
  Start (or reuse) a daily DechoNet watch on a domain so that changes are recorded over time — SSL grade/issuer/expiry, DNS records, HTTP security headers, domain registration, and optionally OWASP posture and impersonation exposure. Use this once when the user cares about a domain beyond a one-off ch
• whois_lookup ~215 tokens
  Retrieve domain registration data via RDAP (with WHOIS fallback): registrar, creation/expiry/update dates, nameservers, and EPP status flags, highlighting risk states such as clientHold and pendingDelete. Use this for ownership, lifecycle, and expiry questions about a registered domain. Use dns_look

Browse

• Claude tools
• Stripe tools
• Website monitoring
• Domains and DNS
• Email
• SMS and text messages

Related MCP servers

• 47620 Solana Data
  Pay-per-call Solana data for AI agents over x402: token, account, tx, trending. No signup, no key.
• Breach402 — Email Data-Breach Check
  Data-breach & credential-exposure check for one owner-approved email. $1 USDC on Solana (x402).
• CanaryGuard 402
  Deterministic prompt-injection detection & sanitization for AI agents via x402 on Base.
• Polyform
  Pay-per-call data APIs for AI agents. USDC on Base via x402. 33 tools, no signup.
• Phishunt
  Public phishing feed: suspicious/confirmed phishing URLs detected hourly. No auth, CC0.
• Riley Craig x402 Agent Store
  AI brand/token visibility, prediction-market odds & cheap x402 data feeds for AI agents.
• MeshMarket
  The agent-to-agent capability exchange — rent memory, reasoning and safety, settled per call.
• TipRanks
  Live TipRanks market data: analyst ratings, Smart Score, technicals, options, portfolios.

Badge for your README

[![AptLynx](https://aptlynx.net/badge/com.dechonet/mcp.svg)](https://aptlynx.net/servers/com.dechonet/mcp)

Listing text is written by the maker; AptLynx lists tools and does not vouch for them. Find another tool · Browse by topic · For agents