Shohei

What kent-tokyo/shohei MCP server does

The kent-tokyo/shohei MCP server brings infrastructure and security diagnostics into MCP-compatible agent workflows. Its scope covers DNS operations, TLS and certificate inspection, email authentication, IP reputation, HTTP analysis, web reconnaissance, and selected threat-intelligence checks.

Use it to investigate a domain’s operational and security posture rather than to modify infrastructure. Checks can produce findings such as DNS inconsistencies, certificate-chain details, missing email controls, exposed ports, redirect behavior, detected technologies, or known CVEs associated with a fingerprinted technology.

How it works

An MCP client can call diagnostic tools and receive serializable result types intended for agent processing. The server performs checks against DNS resolvers, domain and network endpoints, and free or open APIs. No API keys are required according to the project documentation.

DNS functions include queries against multiple global resolvers, iterative resolution tracing, DNSSEC chain inspection, reverse DNS, propagation checks, resolver comparisons, and latency tests over system DNS, DoH, DoT, and DoQ. Network-oriented checks can test TCP reachability, inspect banners, trace hops, assess IPv6 support, and examine DNS amplification or wildcard behavior.

The project is implemented in Rust and requires Rust 1.85 or later for the documented release. It is also described as usable as a library in Rust projects, CI/CD pipelines, and automation frameworks.

Tools and capabilities

The kent-tokyo/shohei MCP server supports the following diagnostic areas:

• Inspect TLS versions, cipher suites, certificate chains, OCSP behavior, DANE/TLSA, and IPv6 connectivity.
• Score email security controls including MX, SPF, DKIM, DMARC, BIMI, MTA-STS, TLS-RPT, and ARC records.
• Check IP blocklists, reverse DNS, forward-confirmed reverse DNS, CDN or WAF indicators, and DNS delegation.
• Audit security headers such as CSP, HSTS, X-Frame-Options, Referrer-Policy, and Permissions-Policy.
• Enumerate common subdomains, test 15 common TCP ports, detect parked domains, and identify possible subdomain takeovers.
• Fingerprint web technologies, query the NVD for CVEs, generate typosquatting variants, and trace URL redirects.
• Validate RPKI/ROA data, inspect DNSSEC trust paths, perform AXFR checks, and identify HTTP protocol versions.

The repository also documents batch input, JSON output, watch mode, and an optional terminal interface for command-line use. These features complement the MCP interface but are not necessarily separate MCP tools.

Limitations and notes

Results depend on the reachability and responses of the inspected domains, resolvers, services, and external APIs. The documentation describes diagnostics and analysis capabilities; it does not describe remediation or infrastructure changes. The project reports fixes for SSRF-related issues and other bugs in version 2.5.1, so deployments should use an appropriate current release. The stated license is MIT.