Dechonet MCP

What node-man/dechonet-mcp MCP server does

The node-man/dechonet-mcp MCP server exposes domain and network reconnaissance functions through the Model Context Protocol. It covers DNS records and DNSSEC, TLS certificates and connection properties, HTTP security headers, email authentication, TCP port exposure, DNS propagation, reverse DNS, ASN and BGP ownership, RDAP/WHOIS registration data, certificate-transparency subdomain discovery, lookalike-domain checks, caller IP information, raw email-header analysis, IPv4 subnet calculations, and a combined security scan.

Results are returned as text reports. Depending on the tool, reports include grades, scores, key indicators, detected issues, severity and confidence levels, raw data, resolver comparisons, or recommended actions. The combined scan produces a 0–100 Health Score with an A–F grade and runs several checks in parallel.

How it works

The node-man/dechonet-mcp MCP server uses DechoNet's public API at https://dechonet.com/api/util/*, the same backend used by the site's web tools. The underlying data comes from public DNS, HTTP, TLS, RDAP, Certificate Transparency, and related sources. The server does not require an API key or other authentication.

Most checks are read-only observations. subdomain_discovery uses public Certificate Transparency records without sending packets to the target, while subnet_calc performs its calculation locally and does not make a network request. email_header_analysis accepts a complete raw header block and reconstructs its delivery route, authentication results, delays, and TLS status.

port_scan is different: it makes active TCP connect probes against a fixed set of common ports. The comprehensive security_scan includes that port scan, so use either tool only against systems you own or are authorized to test. The connection can appear in the target's logs, although the probe does not authenticate, exploit, or transfer data.

Setup and configuration

For a local stdio connection, run:

npx -y dechonet-mcp

Claude Desktop can launch the package with npx and the arguments -y and dechonet-mcp. The README identifies Claude Desktop as a supported client and also describes a local Node build and an optional SSE mode for development or remote-style HTTP connections.

Configuration can use DECHONET_URL to change the API base URL, DECHONET_LOCALE to select English or Korean responses, and PORT to set the SSE port. Their documented defaults are https://dechonet.com, en, and 3100, respectively. None is required for the default npx setup.

Tools and capabilities

• Inspect A, AAAA, MX, TXT, NS, SOA, and CAA records, including SPF, DMARC, and DNSSEC diagnostics.
• Compare DNS answers across eight or more public resolvers to identify stale propagation.
• Grade certificates, TLS versions, chain trust, HSTS, redirect chains, and HTTP security headers.
• Review SPF, DKIM, DMARC, BIMI, MTA-STS, TLS-RPT, DANE, and MX-host blacklist status.
• Identify open common TCP ports, PTR and forward-confirmed reverse DNS, ASN ownership, prefixes, and abuse contacts.
• Retrieve domain registration dates, registrar data, nameservers, and EPP status flags through RDAP with WHOIS fallback.
• Discover certificate-log subdomains, generate registered lookalike variants, inspect the server's observed public IP, analyze email headers, and calculate IPv4 subnet ranges.

Limitations and notes

The node-man/dechonet-mcp MCP server is subject to rate limits for network-backed checks. Its IP information describes the MCP server's egress address, which may not be the end user's address. A registered lookalike domain is not evidence of abuse, and findings should be investigated in context. The port and combined security scans require authorization for the targets being tested.