# nel-veil [Health: Active] **Category:** 🔒 Security **Repository:** https://github.com/NELPROINC/nel-veil-mcp **GitHub Stars:** 0 **npm Downloads (last month):** 236 **Views:** 0 **Installs:** 0 **Upvotes:** 0 **Directory Page:** https://allmcps.com/mcp/nel-veil-2 ## Description Free passive security scanning - check any domain's DMARC, TLS, headers, and exposures. ## Tools Capabilities this server exposes over MCP: - **check_email_spoofing** — Answers: can someone send email that appears to come from this domain? Checks the published SPF, DKIM and DMARC DNS records — whether DMARC exists, whether its policy actually blocks spoofed mail (p=none only monitors, it does not stop anything), whether SPF is present and not overly permissive, and whether the records are syntactically valid. Returns a 0-100 score plus specific findings, each tied to the record it came from, so the exact problem can be quoted. This is a free check that uses public information: DNS records and ordinary HTTP requests. It does no port scanning and no exploit testing. Use this for any question about email spoofing, phishing impersonation, DMARC/SPF/DKIM setup, or whether an email domain is protected. For a broader picture covering TLS, headers and exposed files too, use scan_domain instead. - **check_tls** — Answers: does this domain's TLS configuration have known weaknesses? Returns the Qualys SSL Labs assessment grade for the host, plus findings for specific known problems when present: Heartbleed, POODLE, RC4 support, deprecated protocol versions, missing forward secrecy, and certificate chain issues. IMPORTANT — this one is NOT passive. It queries Qualys SSL Labs, which performs an ACTIVE assessment of the target from Qualys's own infrastructure (reusing a recent cached result when Qualys has one). NEL sends no probe itself, but running this does cause the target to be actively tested by a third party. Prefer it for a domain you own or are authorised to test. It is free, and it does no port scanning and no exploit testing of its own. It does NOT report certificate expiry dates, the issuer, or hostname validity — if you need those, read the certificate directly. It also does not check HTTP security headers — use check_security_headers for those. - **check_security_headers** — Answers: does this site send the HTTP response headers that protect visitors in the browser? Checks for Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options / frame-ancestors, Referrer-Policy and Permissions-Policy — whether each is present and whether its value is actually protective rather than nominal. Returns a 0-100 score plus a finding per header explaining what a missing or weak value exposes. This is a free check that uses public information: DNS records and ordinary HTTP requests. It does no port scanning and no exploit testing. Use this for clickjacking, XSS mitigation, CSP or HSTS questions. It does not check the TLS certificate itself — use check_tls for that. - **check_exposed_files** — Answers: is this domain publicly serving files it should not be? Requests a small, fixed list of well-known sensitive paths — things like .env, .git/config, backup archives and exposed configuration — and reports which return real content rather than a 404. Returns a 0-100 score plus a finding per exposed path. How it works, stated plainly: it makes ordinary GET requests for a small FIXED list of well-known paths. It does not brute-force, fuzz, or enumerate — the list never grows and never adapts to what it finds. Note that these are paths an ordinary crawler would not request (.env, .git/config), so the requests are recognisable in a target's logs as a security check rather than routine crawling. This is a free check that uses public information: DNS records and ordinary HTTP requests. It does no port scanning and no exploit testing. Use this for leaked secrets, exposed configuration, or accidentally published files. It does not discover subdomains. - **check_subdomain_takeover** — Answers: does this domain have DNS records pointing at services someone else could claim? Inspects published DNS records for dangling CNAMEs — entries still pointing at a de-provisioned cloud or SaaS host (an unclaimed bucket, an expired app instance) that an attacker could register and then serve content from a hostname users already trust. Returns a 0-100 score plus a finding per at-risk record, naming the record and the service it points to. How it works, stated plainly: it resolves a small fixed list of common subdomain names (www, mail, dev, staging and similar) and, for any that resolve to a known cloud or SaaS host, makes one ordinary HTTPS GET to check for that provider's unclaimed-resource page. So it is not DNS-only — it does send a small number of HTTP requests to subdomains of the target. It never registers, claims, or modifies anything. This is a free check that uses public information: DNS records and ordinary HTTP requests. It does no port scanning and no exploit testing. Use this for dangling DNS, abandoned cloud resources, or subdomain hijacking risk. - **scan_domain** — Answers: what is this domain's overall security posture? Runs every passive NEL VEIL module in one pass — DNS, email authentication (SPF/DKIM/DMARC), TLS, HTTP security headers, cookies, CORS, exposed files, subdomain-takeover risk, technology fingerprinting, breach exposure, domain reputation, cloud misconfiguration and JavaScript supply chain — and returns findings from all of them with a per-module score. Use this when the question is broad: how secure is this domain, review this vendor, what should we fix first. For a single specific question prefer the narrower tool — check_email_spoofing, check_tls, check_security_headers, check_exposed_files or check_subdomain_takeover — which is faster and easier to read. It is free. What it actually sends, stated plainly, because "passive" means different things to different people. It performs NO port scanning and NO exploit testing. It DOES: request a fixed list of well-known paths, including common admin panels such as /phpmyadmin/ and /manager/html, to report whether they are publicly reachable; resolve a small fixed list of common subdomain names and make one HTTPS request to any that point at a known cloud host; and query Qualys SSL Labs, which performs its own ACTIVE TLS assessment of the target from Qualys's infrastructure. None of that is intrusive in the sense of attacking anything, and all of it is information the domain publishes — but it is more than a crawler does, and it is recognisable in the target's logs as a security scan. Prefer running it against a domain you own or are authorised to assess. Active scanning (port scans, API probing, proof-of-concept exploit checks) is deliberately not available through this MCP server; it requires proving control of the domain and runs only at nelprofessional.com. - **get_scan_report** — Answers: what did an earlier NEL VEIL scan find? Fetches the stored results of a scan already run at nelprofessional.com, by its scan id (the scn_... identifier shown on the scan page and in its shareable report link). Returns the saved findings and score for that scan. Use this to pull a scan someone already ran on the website into the conversation — to summarise it, compare it against a later scan, or turn it into a remediation plan. It cannot start a new scan: use scan_domain for that. It only reads scans that exist and are publicly retrievable by id. - **list_compliance_frameworks** — Answers: which laws, regulations and standards can this tool report on, and which can it not? Returns the full register — 102 frameworks across Canada, the United States, the EU/EEA, the United Kingdom, Asia-Pacific, Africa and global standards (ISO 27001, SOC 2, PCI DSS, NIST CSF and others) — grouped by region, each with its id, jurisdiction, regulator and subject area. Each entry says whether it is externally ASSESSABLE. Around a quarter are not: an anti-money-laundering regime, a consumer-protection statute, a criminal offences provision or a securities disclosure rule imposes no technical safeguard an external scan could ever evidence, and the entry says so in words rather than being quietly scored. Use it to find the id to pass to check_compliance, or to answer 'can you check us against ?' honestly. It runs no scan, costs nothing and takes no domain. For an actual assessment use check_compliance. - **check_compliance** — Answers: what do this domain's public-facing security signals suggest about its alignment with the laws and standards that apply to it? Runs one passive scan and maps the findings onto a register of 102 frameworks — GDPR, UK GDPR, PIPEDA, CCPA/CPRA and the US state privacy acts, NIS2, DORA, the EU AI Act, PIPL, APPI, POPIA, ISO 27001, SOC 2, PCI DSS, NIST CSF and more — returning a per-framework readiness score with the specific provision each finding bears on. READ THE COVERAGE FIELD BEFORE RELAYING A SCORE. Every framework reports how many of the scan categories it relies on were actually observed, as "9/16". A framework whose relevant checks did not run has a NULL score and the tier "Not assessed", with a reason — it is not clean, it is unknown. A clean result over fewer than half a framework's categories is reported as "Partial" rather than "Strong". A framework with no externally observable duty is "Not assessable" and is never scored. Optionally narrow with `frameworks` (ids from list_compliance_frameworks) or `region`. THESE ARE NOT AUDIT RESULTS, NOT A CERTIFICATION AND NOT LEGAL ADVICE. They are indicative readiness signals from public-surface evidence, and every framework also carries a note on what it requires that no external scan can see — consent records, impact assessments, retention schedules, vendor agreements, board governance. Say so when you relay them. It is free and passive, with the same disclosure as scan_domain: no port scanning and no exploit testing, but it does request well-known paths, resolve common subdomains and use the Qualys SSL Labs assessment. Prefer a domain you own or are authorised to assess. ## Claude Desktop Quick Installation Install path detected from listing signals. Uses `npx` (confidence: high): ```json "mcpServers": { "nel-veil": { "command": "npx", "args": ["-y","nel-veil-mcp"] } } ``` ## Documentation & README # NEL VEIL MCP — free domain security checks for AI agents Ask your agent *"can someone spoof email from example.com?"* and get a real answer in about ten seconds. NEL VEIL MCP gives any MCP-compatible agent **nine tools** for checking a domain's public security posture: email spoofing (DMARC/SPF/DKIM), TLS weaknesses, HTTP security headers, publicly exposed files, subdomain-takeover risk, a combined scan, retrieval of an earlier scan, and compliance readiness against a register of 102 global frameworks. **Free. No API key. No signup.** --- ## Install **Claude Code** — one command: ```bash claude mcp add nel-veil -- npx -y nel-veil-mcp ``` **Any MCP client** — add this to your config file: ```json { "mcpServers": { "nel-veil": { "command": "npx", "args": ["-y", "nel-veil-mcp"] } } } ``` **Run it directly**, to check it works: ```bash npx -y nel-veil-mcp ``` It prints a ready line **to stderr** — something like `nel-veil-mcp 0.2.1 ready — 9 tools, free passive tier.` — and then waits for JSON-RPC on stdin. That is correct: it is a stdio server, not a CLI, and stdout carries the protocol, so nothing else is ever written there. Requires Node 18 or newer. --- ## 30 seconds: is your domain spoofable? After installing, ask your agent: > Check if example.com can be email-spoofed. It calls `check_email_spoofing`. Real output for `example.com` at the time of writing: ``` Check if a domain can be email-spoofed — example.com Score: 100/100 (done) 2 findings: [LOW] DMARC has no reporting address (rua/ruf), you have no visibility into spoofing [LOW] DKIM key may be 1024-bit (weak), 2048-bit recommended Free check, built from public information. No port scanning and no exploit testing — though some checks (well-known path requests, admin-panel reachability) do more than passive reading; see nelprofessional.com/mcp. Active scanning requires verified domain ownership and runs only at nelprofessional.com. More: https://www.nelprofessional.com/mcp ``` That domain is in good shape. The finding people are most often surprised by is a DMARC policy of `p=none` — it looks configured, monitors everything, and blocks nothing. --- ## Tools | Tool | Answers | |---|---| | `check_email_spoofing` | Can someone send email that appears to come from this domain? (DMARC/SPF/DKIM) | | `check_tls` | Is this domain's certificate valid, trusted and not about to expire — and is the connection still negotiating a deprecated TLS version? | | `check_security_headers` | Does this site send the headers that protect visitors in the browser? | | `check_exposed_files` | Is this domain publicly serving files it should not be? | | `check_subdomain_takeover` | Are there DNS records pointing at services someone else could claim? | | `scan_domain` | All of the above at once, with a per-module score. | | `get_scan_report` | Retrieve a scan already run at nelprofessional.com, by its `scn_…` id. | | `list_compliance_frameworks` | Which laws and standards can this be checked against — and which can it not? | | `check_compliance` | What do these findings suggest about alignment with GDPR, NIS2, PIPEDA, CCPA, ISO 27001, SOC 2 and 96 more? | Each returns a 0–100 score plus specific findings you can act on. ### Compliance `check_compliance` maps one passive scan onto a register of **102 frameworks** across Canada, the United States, the EU/EEA, the United Kingdom, Asia-Pacific, Africa and the global standards — citing the specific provision each finding bears on. Read the **coverage** field before repeating a score. Every framework reports how many of the scan categories it relies on were actually observed, as `9/16`: - A framework whose relevant checks did not run has a **null score** and the tier **"Not assessed"**, with a reason. That is unknown, not clean. - A clean result over fewer than half a framework's categories is **"Partial"**, not "Strong". - **26 of the 102 are "Not assessable"** — an anti-money-laundering regime, a consumer-protection statute, a criminal offences provision or a securities disclosure rule imposes no technical safeguard an external scan could ever evidence. They are listed and explained, never scored. These are indicative readiness signals from public-surface evidence. **They are not an audit, not a certification and not legal advice**, and every framework also carries a note on what it requires that no external scan can see — consent records, impact assessments, retention schedules, vendor agreements, board governance. --- ## What this sends — stated plainly Being precise here matters more than sounding safe, because this is the paragraph you rely on when deciding whether you may point a tool at someone else's domain. **No tool here does port scanning or exploit testing.** Those are genuinely intrusive, they need the domain owner's permission, and they are deliberately not exposed over MCP at all. **But "passive" is not the same as "invisible", and several of these tools do more than read public records:** - **`check_tls` connects to the domain, but only as a browser would.** It makes **one ordinary TLS handshake to port 443**, from NEL's own infrastructure, and reads what the server presents: certificate issuer and subject, the validity window and how many days remain, the subject alternative names, and the negotiated protocol and cipher. Nothing else is contacted, and no third party is asked to test the target. It reports an expired certificate, one expiring within 14 or 30 days, a self-signed certificate, an untrusted chain, a certificate that does not cover the hostname, and a connection negotiated over TLS 1.0 or 1.1. **What one handshake cannot tell you:** it shows what the server chose for *that* connection, not everything the server would accept. It does not enumerate supported cipher suites, does not test for Heartbleed, POODLE, DROWN or RC4 support, and produces no letter grade. Those need the deep assessment described below. - **`check_subdomain_takeover` is not DNS-only.** It resolves a small fixed list of common subdomain names and makes one HTTPS request to any that point at a known cloud host. It never claims or modifies anything. - **`check_exposed_files`** requests a small fixed list of well-known paths (`.env`, `.git/config` and similar). It never brute-forces or fuzzes — the list does not grow or adapt — but these are paths a crawler would not request, so they are recognisable in a target's logs as a security check. - **`scan_domain`** runs all of the above, and additionally checks whether common admin panels (`/phpmyadmin/`, `/manager/html`) are publicly reachable. Everything above is information the domain publishes. None of it attacks anything. But it is more than ordinary crawling, so prefer running it against a domain you own or are authorised to assess. Active scanning — port exposure, API probing, proof-of-concept checks, and the deep TLS assessment (`tls_labs`) that produces the Qualys SSL Labs grade along with the Heartbleed, POODLE, DROWN and RC4 tests — lives at [nelprofessional.com](https://www.nelprofessional.com), behind DNS-TXT proof that you control the domain. None of it is reachable from this MCP server. That is the right place for it, because a human proves ownership once and NEL can stand behind the result. **Rate limits.** Ten single checks and three full scans per minute, per IP address. If you hit it, wait a minute. **Privacy.** This package sends no API key, no email address, and no account identifier. Each request carries the domain you asked about and a `nel-veil-mcp` user-agent. Note that, like any HTTP service, NEL sees the IP the request came from — it is what the rate limit is keyed on. --- ## Configuration | Variable | Default | Purpose | |---|---|---| | `NEL_API_URL` | `https://api.nelprofessional.com` | Point at a self-hosted NEL backend. Only needed for local development. | --- ## Development These steps need the [git repository](https://github.com/NELPROINC/nel-veil-mcp), not the published npm package — the tarball ships only `dist/`, so `src/` and `scripts/` are not in it. ```bash git clone https://github.com/NELPROINC/nel-veil-mcp.git cd nel-veil-mcp npm install npm run build node scripts/mcp-smoke.mjs example.com ``` `scripts/mcp-smoke.mjs` launches the built server exactly as `npx` would, performs the MCP handshake, lists the tools and calls one for real — so it catches transport and schema problems a unit test would not. --- ## About NEL VEIL NEL VEIL is the security scanner behind [NEL Professional](https://www.nelprofessional.com), a marketplace connecting organisations with verified cybersecurity professionals. The same modules that power this MCP server power the scans on the site. Full documentation: [nelprofessional.com/mcp](https://www.nelprofessional.com/mcp) --- ## License MIT — see [LICENSE](https://github.com/NELPROINC/nel-veil-mcp/blob/HEAD/LICENSE).