# node-man/dechonet-mcp [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/node-man/dechonet-mcp  
**GitHub Stars:** 1  
**npm Downloads (last month):** 175  
**Views:** 3  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/node-man-dechonet-mcp

## Description
Domain security reconnaissance for AI agents. 13 tools — DNS + DNSSEC, SSL/TLS chain & grade, HTTP security headers, SPF/DKIM/DMARC email auth, TCP port scan, ASN, RDAP/WHOIS — plus a one-shot securityscan returning a 0-100 Health Score (A–F). Free, no API key. npx -y dechonet-mcp

## Tools
Capabilities this server exposes over MCP:

- **dns_lookup** — Query DNS records (A, AAAA, MX, TXT, NS, SOA, CAA) for a domain and validate email-related records, including DNSSEC presence and SPF/DMARC syntax, returning severity-rated diagnostics. Use this for a single authoritative answer about one domain. Use dns_propagation instead when you need to compare answers across multiple global resolvers (e.g., right after a change), or email_auth for a full SPF/DKIM/DMARC deliverability assessment. Read-only; requires no API key or authentication; subject to rate limiting. Returns a text report: status, KPI summary, detected issues, and recommended actions.
- **ssl_check** — Inspect a host's served TLS/SSL certificate and connection: expiry date, issuer, SAN list, chain integrity, TLS version, and HSTS, returning an A+ to F grade weighted by certificate validity (40%), TLS version (25%), chain trust (15%), and HSTS (20%). Use this to diagnose certificate or HTTPS-handshake problems for one host. Use http_security instead to audit response security headers, or security_scan for an all-in-one domain report. Read-only: it completes a TLS handshake but sends no application data; requires no API key; rate-limited. Returns a text report: grade, expiry/issuer KPIs, issues, and actions.
- **http_security** — Follow a URL's HTTP redirect chain and audit response security headers (CSP, HSTS, X-Frame-Options, COOP, CORP, COEP, Permissions-Policy), grading A+ to F and flagging information leaks such as server-version disclosure. Use this for HTTP-layer/header posture. Use ssl_check instead for certificate or TLS-handshake issues, or security_scan for a full domain report. Read-only (an HTTP GET-style probe that sends no payload); requires no API key; rate-limited. Returns a text report: grade, header findings, redirect trace, issues, and actions.
- **email_auth** — Assess a domain's email authentication and deliverability posture: MX records, SPF, DMARC, DKIM (probes 15 common selectors), BIMI, MTA-STS, TLS-RPT, and DANE, plus a blacklist check across all MX hosts, returning a 0-100 deliverability score. Use this for a full sending/receiving readiness review of a domain. Use dns_lookup instead if you only need raw TXT/MX records, or email_header_analysis to diagnose a specific message that was already sent. Read-only; requires no API key; rate-limited. Returns a text report: score, per-mechanism KPIs, issues, and actions.
- **port_scan** — Probe a host for a fixed set of common TCP ports (HTTP, HTTPS, SSH, FTP, SMTP, DNS, and common databases) and report which are open, the service name, and the response time. BEHAVIOR: this makes an ACTIVE TCP connection to the target. It is non-intrusive — a connect probe only; it does not authenticate, send exploits, or transfer data — and changes nothing on the target (read-only), but the connection is visible in the target's logs, so only scan hosts you own or are explicitly authorized to test. Use this to confirm which services are exposed. Use ssl_check or http_security instead to assess a specific service's configuration. Requires no API key; rate-limited. Returns a per-port open/closed list with service names.
- **dns_propagation** — Query one DNS record across 8+ global public resolvers (Google, Cloudflare, Quad9, OpenDNS, and more) simultaneously and report which resolvers return stale versus updated values. Use this after changing a record to confirm worldwide propagation. Use dns_lookup instead for a single authoritative answer with SPF/DMARC validation. Read-only; requires no API key; rate-limited. Returns per-resolver values and a consistency verdict.
- **reverse_dns** — Resolve the PTR (reverse DNS) record for an IPv4 or IPv6 address and verify forward-confirmed reverse DNS (FCrDNS) by checking that the PTR hostname resolves back to the same IP. Infers the hosting provider from PTR naming patterns. Use this to validate mail-server rDNS or identify a single IP's host. Use asn_lookup instead for network/BGP ownership of the IP. Read-only; requires no API key; rate-limited. Returns the PTR hostname, FCrDNS pass/fail, and a provider guess.
- **asn_lookup** — Look up Autonomous System (ASN) / BGP information for an IP address or AS number: the network operator, announced prefixes, abuse contact, and a classification (cloud, CDN, ISP, hosting, or enterprise). Use this to identify who runs a network or whether an IP is cloud/CDN-hosted. Use reverse_dns instead for the host-level PTR name of a single IP. Read-only; requires no API key; rate-limited. Returns operator, prefixes, classification, and abuse contact.
- **whois_lookup** — Retrieve domain registration data via RDAP (with WHOIS fallback): registrar, creation/expiry/update dates, nameservers, and EPP status flags, highlighting risk states such as clientHold and pendingDelete. Use this for ownership, lifecycle, and expiry questions about a registered domain. Use dns_lookup instead for live DNS records, or reverse_dns/asn_lookup for IP-level ownership. Read-only; requires no API key; rate-limited. Returns registrar, key dates, nameservers, and status flags.
- **subdomain_discovery** — Enumerate the subdomains of a domain from Certificate Transparency logs — fully passive (no packets are sent to the target; CT logs are public records of every TLS certificate ever issued). Flags operational-looking names (dev, staging, admin, vpn, legacy) and wildcard certificates, because forgotten subdomains are a common takeover path. Use this as the first recon step to map a domain's attack surface. Use dns_lookup to check whether a discovered name still resolves, or lookalike_domains for typosquat variants of the domain name itself. Read-only; requires no API key; rate-limited. Returns the subdomain count, risky-name count, wildcard flag, and the hostname list.
- **lookalike_domains** — Generate the typosquat/lookalike variants of a domain that phishers actually register — homoglyph swaps (l→1, o→0, rn→m), TLD swaps (.com→.co), character omissions, transpositions, repetitions, hyphenations — and check which of them are currently registered (live NS delegation via DoH). Use this to assess brand-impersonation and phishing exposure for a domain the user is responsible for. A registered variant is NOT proof of abuse (it may be an unrelated legitimate site) — follow up with whois_lookup on each hit for its owner and registration date. Read-only; requires no API key; rate-limited. Returns generated/checked counts and the registered variants with the technique that produced each.
- **ip_info** — Report information about the caller's own public IP as seen by the server: IPv4/IPv6 address, ISP, ASN, approximate geolocation, and proxy/VPN heuristics. Takes no input — it reflects the egress IP of THIS MCP server's network, which is usually NOT the end user's IP. Use this to discover the server's outbound IP or test connectivity. To inspect a specific, known IP instead, use asn_lookup or reverse_dns. Read-only; requires no API key; rate-limited.
- **email_header_analysis** — Parse raw email headers to reconstruct the delivery path (each Received hop in order), extract SPF/DKIM/DMARC authentication results, measure per-hop delays, and flag unencrypted (non-TLS) hops. Use this to diagnose a specific message that was already delivered — spoofing, delays, or where mail was lost. Use email_auth instead to assess a domain's sending configuration before sending. Read-only; requires no API key; rate-limited. INPUT is the full raw header block. OUTPUT is a text report containing: the ordered hop route, per-mechanism auth results (pass/fail), detected inter-hop delays, and the encryption status of each hop.
- **subnet_calc** — Compute IPv4 subnet details from CIDR notation entirely locally — no network call: network and broadcast addresses, usable host range, total usable hosts, subnet mask, and wildcard mask. /31 and /32 are handled per RFC 3021 (point-to-point / single host). Use this for IPv4 address planning. It does not query DNS or contact any host, so it is purely computational. Requires no API key and is NOT rate-limited (computed in-process). Returns the calculated fields as text.
- **security_scan** — One-shot comprehensive audit of a domain: runs DNS, SSL, HTTP headers, email auth, port scan, DNS propagation, reverse DNS, and ASN/RDAP checks in parallel, then computes a 0-100 Health Score with an A-F grade and a prioritized action list. Use this as the default starting point for "is this domain healthy/secure?" questions. Call the individual tools (e.g., ssl_check, email_auth) instead when you need depth on one area. BEHAVIOR: this includes an ACTIVE port_scan of the domain's host, so only run it on domains you own or are authorized to test. Read-only otherwise; requires no API key; rate-limited (it makes multiple backend calls). Returns the score, per-area breakdown, top actions, and per-area summaries.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "dechonet-mcp": {
    "command": "npx",
    "args": ["-y","dechonet-mcp"]
  }
}
```

## Documentation

## What node-man/dechonet-mcp MCP server does

The node-man/dechonet-mcp MCP server exposes domain and network reconnaissance functions through the Model Context Protocol. It covers DNS records and DNSSEC, TLS certificates and connection properties, HTTP security headers, email authentication, TCP port exposure, DNS propagation, reverse DNS, ASN and BGP ownership, RDAP/WHOIS registration data, certificate-transparency subdomain discovery, lookalike-domain checks, caller IP information, raw email-header analysis, IPv4 subnet calculations, and a combined security scan.

Results are returned as text reports. Depending on the tool, reports include grades, scores, key indicators, detected issues, severity and confidence levels, raw data, resolver comparisons, or recommended actions. The combined scan produces a 0–100 Health Score with an A–F grade and runs several checks in parallel.

## How it works

The node-man/dechonet-mcp MCP server uses DechoNet's public API at `https://dechonet.com/api/util/*`, the same backend used by the site's web tools. The underlying data comes from public DNS, HTTP, TLS, RDAP, Certificate Transparency, and related sources. The server does not require an API key or other authentication.

Most checks are read-only observations. `subdomain_discovery` uses public Certificate Transparency records without sending packets to the target, while `subnet_calc` performs its calculation locally and does not make a network request. `email_header_analysis` accepts a complete raw header block and reconstructs its delivery route, authentication results, delays, and TLS status.

`port_scan` is different: it makes active TCP connect probes against a fixed set of common ports. The comprehensive `security_scan` includes that port scan, so use either tool only against systems you own or are authorized to test. The connection can appear in the target's logs, although the probe does not authenticate, exploit, or transfer data.

## Setup and configuration

For a local stdio connection, run:

```bash
npx -y dechonet-mcp
```

Claude Desktop can launch the package with `npx` and the arguments `-y` and `dechonet-mcp`. The README identifies Claude Desktop as a supported client and also describes a local Node build and an optional SSE mode for development or remote-style HTTP connections.

Configuration can use `DECHONET_URL` to change the API base URL, `DECHONET_LOCALE` to select English or Korean responses, and `PORT` to set the SSE port. Their documented defaults are `https://dechonet.com`, `en`, and `3100`, respectively. None is required for the default npx setup.

## Tools and capabilities

- Inspect A, AAAA, MX, TXT, NS, SOA, and CAA records, including SPF, DMARC, and DNSSEC diagnostics.
- Compare DNS answers across eight or more public resolvers to identify stale propagation.
- Grade certificates, TLS versions, chain trust, HSTS, redirect chains, and HTTP security headers.
- Review SPF, DKIM, DMARC, BIMI, MTA-STS, TLS-RPT, DANE, and MX-host blacklist status.
- Identify open common TCP ports, PTR and forward-confirmed reverse DNS, ASN ownership, prefixes, and abuse contacts.
- Retrieve domain registration dates, registrar data, nameservers, and EPP status flags through RDAP with WHOIS fallback.
- Discover certificate-log subdomains, generate registered lookalike variants, inspect the server's observed public IP, analyze email headers, and calculate IPv4 subnet ranges.

## Limitations and notes

The node-man/dechonet-mcp MCP server is subject to rate limits for network-backed checks. Its IP information describes the MCP server's egress address, which may not be the end user's address. A registered lookalike domain is not evidence of abuse, and findings should be investigated in context. The port and combined security scans require authorization for the targets being tested.

_Full upstream README: https://allmcps.com/mcp/node-man-dechonet-mcp/readme_