Every change Wellknown observed on this MCP server, newest first, with what it was before and what it became. Tool-surface changes carry the definition diff. Nothing here is edited after the fact.
Added "mcp_server_check"; changed the definition of "ssl_check" (29 tools before, 30 now)
⟨47 unchanged words⟩ trust (15%), and HSTS (20%). From Seoul it also lists the protocol versions and cipher suites the server accepts — including SSL 3.0, RC4, 3DES, export, NULL and anonymous suites and the Korean SEED/ARIA ciphers — with TLS compression, secure renegotiation, TLS_FALLBACK_SCSV, DH group size and TLS 1.3 key exchange groups; weak findings cap the grade as SSL Labs does (F, C or B). Use this to diagnose certificate or HTTPS-handshake problems ⟨12 unchanged words⟩ security_scan for an all-in-one domain report. Read-only:it completesoneafull TLS handshakebutplussendsopening ClientHello messages whose first answer is read; no applicationdata;data and no vulnerability probes; requires no API key; rate-limited. Returns a text ⟨7 unchanged words⟩
MCP Server Check — Check a remote MCP server from outside before connecting it to an agent: whether it requires authentication (and publishes OAuth protected-resource metadata, RFC 9728), which of its tools act on the world (run commands, write or delete files, send messages, make payments, read secrets), whether its server instructions or tool and parameter descriptions contain text that steers an agent (tool poisoning), whether a web page on any site could call it (CORS and Origin), HTTPS, and tool annotations. Sends initialize and tools/list only — no tool is ever called; query strings are removed before any…
Changed the definition of "owasp_check" and "security_scan"
⟨98 unchanged words⟩ , not a full OWASP Top 10 assessment.Unlike security_scan thisThis is PASSIVE (a normal HTTPS request, the ⟨76 unchanged words⟩
One-shot comprehensive audit of a domain, scored 0-100 with an A+ to F grade and a prioritized action list. Five scored areas:runstheDNS,webSSL,
Changed the definition of "report_page"
⟨23 unchanged words⟩ aimed at AI agents, a malicious download,ora DechoNet verdict that looks wrong (false_positive) or a danger it missed (missed).,Onlyan MCP server whose tool descriptions steer agents (malicious_mcp — url is thehostMCPandendpoint), or a network anomaly (network_anomaly — thekindcertificateareserial/issuerkeptor addresses you saw for the host
Added "check_before_action", "report_page", "set_expectations" and 1 more; changed the definition of "asn_lookup", "dns_lookup", "dns_propagation" and 22 more (25 tools before, 29 now)
⟨114 unchanged words⟩ "string"}},"type":"object"},"receipts":{"description":"Signed observation receipts behind this result, one per lookup: when, from where and under which rules version DechoNet observed it. Each url shows the record and checks its Ed25519 signature.","items":{"properties":{"id":{"type":"string"},"tool":{"type":"string"},"url":{"type":"string"}},"required":["tool","id","url"],"type":"object"},"type":"array"},"reportUrl":{"description":"Human-facing interactive report for ⟨49 unchanged words⟩
⟨114 unchanged words⟩ "string"}},"type":"object"},"receipts":{"description":"Signed observation receipts behind this result, one per lookup: when, from where and under which rules version DechoNet observed it. Each url shows the record and checks its Ed25519 signature.","items":{"properties":{"id":{"type":"string"},"tool":{"type":"string"},"url":{"type":"string"}},"required":["tool","id","url"],"type":"object"},"type":"array"},"
Changed the definition of "domain_changes", "infrastructure_pivot", "owasp_check" and 3 more
⟨58 unchanged words⟩ cannot be reconstructed from a single live lookup.WhenItaisdomaintheyoufirsthavecheck to run when a domain looked at before comes upagain, start with this tool.again. Two sources: (a) the daily watch timeline if the domain iswatched (start oneunderwithDechoNet
Changed the definition of "asn_lookup", "dns_lookup", "dns_propagation" and 10 more
⟨68 unchanged words⟩ :"object"},"type":"array"},"observation":{"description":"How much was actually observed and when. A partial observation means some checks did not answer: missing parts are not verified, never clean.","properties":{"ageMinutes":{"type":["number","null"]},"cached":{"type":"boolean"},"observedAt":{"type":["string","null"]},"state":{"enum":["complete","partial","unknown"],"type":"string"}},"type":"object"},"reportUrl":{"description":"Human-facing interactive report for ⟨49 unchanged words⟩
⟨68 unchanged words⟩ :"object"},"type":"array"},"observation":{"description":"How much was actually observed and when. A partial observation means some checks did not answer: missing parts are not verified, never clean.","properties":{"ageMinutes":{"type":["number","null"]},"cached":{"type":"boolean"},"observedAt":{"type":["string","null"]},"state":{"enum":["complete","partial","unknown"],"type":"string"}},"type":"object"},"
Removed "asm_nuclei_cancel", "asm_nuclei_start", "asm_nuclei_status" and 2 more; changed the definition of "domain_history" and "infrastructure_pivot" (30 tools before, 25 now)
⟨33 unchanged words⟩ ,"observed":{"type":"boolean"},"reportUrl":{"description":"Human-facing page on dechonet.com for this target","type":"string"},"target":{"type":"string"}},"required":["target","observed","kinds","reportUrl"],"type":"object"}
⟨4 unchanged words⟩ ,"note":{"type":"string"},"reportUrl":{"description":"How DechoNet observes infrastructure (dechonet.com)","type":"string"},"
Added "asm_nuclei_cancel", "asm_nuclei_start", "asm_nuclei_status" and 2 more; changed the definition of "phishing_link_check" (25 tools before, 30 now)
⟨130 unchanged words⟩ — never present this as "safe").Read-only:Readsthelanding-pagefirstHTML;64inconclusiveKBlinksofmaythealsolandingrun pageisscripts
Changed the definition of "domain_history"
⟨77 unchanged words⟩ DechoNet itself observed (lookups, watches, own discovery, and a daily re-resolution of the Korean-brand and phishing names it tracks) — not full passive DNS. Read-only; requires no API key; rate-limited. ⟨8 unchanged words⟩
Changed the definition of "ssl_check"
⟨9 unchanged words⟩ date, issuer, SAN list, chain integrity, revocation (OCSP, then CRL; unknown when neither answers — not graded unless revoked), TLS version, and HSTS, returning an A+ ⟨70 unchanged words⟩
Added "domain_history" and "infrastructure_pivot" (23 tools before, 25 now)
Infrastructure History — Show how a domain's (or IPv4 address's) infrastructure has changed over time from DechoNet's stored observations: nameservers, A/AAAA, MX, CNAME, certificate issuer, registrar, RDAP nameservers and status, and for an IP its ASN and PTR — each value with when it was first and last seen. Use this when the question is about the past ("when did the nameservers change?", "which IPs has it used?"); use dns_lookup or rdap_lookup for the current state. Coverage: only what DechoNet itself observed (lookups, watches, own discovery) — not passive DNS. Read-only; requires no API key; rate-limited. Return…
Infrastructure Pivot — Find other domains DechoNet has seen with the same infrastructure value — a nameserver, IP address, MX host, certificate issuer or registrar — with first and last seen, to map related infrastructure (e.g. other phishing domains on the same rare nameserver). Use it after domain_history or dns_lookup gives you a distinctive value. Shared infrastructure (CDN edges, public CAs, large registrars and DNS hosts) returns a count only, since sharing it says nothing about ownership. Read-only; REQUIRES a free DechoNet API key (account page; remote: send Authorization: Bearer dn_…, npm: set DECHONET_API…
Changed the definition of "exposure_map", "owasp_check" and "phishing_link_check"
⟨2 unchanged words⟩ {"description":"hosts per category (devtool, api_docs, listing, admin, remote, staging, default_page, login ⟨41 unchanged words⟩
⟨92 unchanged words⟩ OWASP Top 10 assessment. Unlike security_scan this isfullyPASSIVE (a normalHTTPHTTPSGETrequest,plus
Added "exposure_map"; changed the definition of "watch_domain" (22 tools before, 23 now)
⟨46 unchanged words⟩ record the day post-quantum key exchange is turnedon.on, 'exposure' to catch a newly exposed admin screen, dev tool or staging server.","items":{"enum":["ssl","dns","http","rdap","owasp","impersonation","pqc","exposure"],"type":"string"},"type": ⟨5 unchanged words⟩
Exposed Admin Page Check — Map what an organisation exposes to the internet beyond its home page: subdomains from Certificate Transparency logs (plus hosts DechoNet has already observed), each opened once from outside and sorted into developer/ops tools, directory listings, admin screens, VPN/remote-access logins, staging servers, default install pages, login pages and so on — the forgotten assets AI-driven attack tools look for first. Use this when a user wants to know their attack surface or after a breach in their sector. Returns counts per category, a verdict (bad/warn/ok) and what to do. Public view only: the per-…
Added "phishing_link_check"; changed the definition of "http_security" (21 tools before, 22 now)
⟨16 unchanged words⟩ COEP, Permissions-Policy), grading A+ to F on the six core headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy; COOP/CORP/COEP are reported but not graded) and flagging information leaks such as server-version disclosure. ⟨47 unchanged words⟩
Phishing / Smishing Link Check — Check the links in a suspicious text message (smishing) or e-mail before anyone taps them. Paste the whole message or a single URL: every link is extracted, followed through URL shorteners to its real destination, and judged on observable signals — domain age from RDAP, impersonation of Korean banks/couriers/telecoms/portals (brand keyword, lookalike spelling, or the brand domain worn as a subdomain), Android APK downloads, punycode, public phishing/malware feeds, and DechoNet's own impersonation tracking. Use this when a user asks whether a link or message is a scam. Verdicts: danger, suspic…
Added "pqc_readiness"; changed the definition of "watch_domain" (20 tools before, 21 now)
⟨35 unchanged words⟩ Add 'owasp' and/or 'impersonation' for posture and brand-exposuretracking.tracking, 'pqc' to record the day post-quantum key exchange is turned on.","items":{"enum":["ssl","dns","http","rdap","owasp","impersonation","pqc"],"type":"string"},"type": ⟨5 unchanged words⟩
Post-Quantum TLS Readiness — Check whether a website's public TLS endpoint is ready for post-quantum cryptography: does it complete a TLS 1.3 handshake that offers only the hybrid X25519MLKEM768 key exchange (ML-KEM), and does the organisation's own server provide it or a CDN edge in front of it. Also reports what the certificate chain is signed with (tracked, not scored: public CAs do not issue post-quantum certificates yet). Verdicts: ready (the origin server supports it), partial (a CDN edge provides it; the CDN-to-origin leg is invisible), not_ready (the hybrid-only handshake was refused), unknown (inconclusive; do n…
Removed "pqc_readiness"; changed the definition of "watch_domain" (21 tools before, 20 now)
⟨35 unchanged words⟩ Add 'owasp' and/or 'impersonation' for posture and brand-exposuretracking, 'pqc' to record the day post-quantum key exchange is turned on.tracking.","items":{"enum":["ssl","dns","http","rdap","owasp","impersonation","pqc"],"type":"string"},"type": ⟨5 unchanged words⟩
Post-Quantum TLS Readiness — Check whether a website's public TLS endpoint is ready for post-quantum cryptography: does it complete a TLS 1.3 handshake that offers only the hybrid X25519MLKEM768 key exchange (ML-KEM), and does the organisation's own server provide it or a CDN edge in front of it. Also reports what the certificate chain is signed with (tracked, not scored: public CAs do not issue post-quantum certificates yet). Verdicts: ready (the origin server supports it), partial (a CDN edge provides it; the CDN-to-origin leg is invisible), not_ready (the hybrid-only handshake was refused), unknown (inconclusive; do n…
Added "pqc_readiness"; changed the definition of "watch_domain" (20 tools before, 21 now)
⟨35 unchanged words⟩ Add 'owasp' and/or 'impersonation' for posture and brand-exposuretracking.tracking, 'pqc' to record the day post-quantum key exchange is turned on.","items":{"enum":["ssl","dns","http","rdap","owasp","impersonation","pqc"],"type":"string"},"type": ⟨5 unchanged words⟩
Post-Quantum TLS Readiness — Check whether a website's public TLS endpoint is ready for post-quantum cryptography: does it complete a TLS 1.3 handshake that offers only the hybrid X25519MLKEM768 key exchange (ML-KEM), and does the organisation's own server provide it or a CDN edge in front of it. Also reports what the certificate chain is signed with (tracked, not scored: public CAs do not issue post-quantum certificates yet). Verdicts: ready (the origin server supports it), partial (a CDN edge provides it; the CDN-to-origin leg is invisible), not_ready (the hybrid-only handshake was refused), unknown (inconclusive; do n…
Changed the definition of "domain_changes", "impersonation_exposure" and "owasp_check"
Report what hasCHANGEDchanged for a domain over time — the security ⟨46 unchanged words⟩ cannot be reconstructed from a single live lookup.Call it FIRST wheneverWhen a domain you have looked at before comes upagain.again, start with this tool. Two sources: (a) the daily watch ⟨69 unchanged words⟩
⟨41 unchanged words⟩ Certificate recorded, valid to 2026-11-26
Authorization not required
Unknown → Live
First tool surface recorded: 20 tools (server version 1.1.0)
https://dechonet.com/mcp (mcp_streamable_http) — from mcp_registry
Showing the latest 23 events. The API returns up to 500 and filters by kind: ?kind=tool_surface_changed
⟨11 unchanged words⟩ },"areas":{"description":"Per-area verdicts(dns,of the scored areas (ssl, http, email,port, propagationrdap,rdapdns,reverseDnsexposure,asnreputation)","items":{"properties":{"area" ⟨64 unchanged words⟩ ,"required":["tool","id","url"],"type":"object"},"type":"array"},"reference":{"description":"Reference areas, not scored (propagation, reverseDns, asn): the tool status","items":{"properties":{"area":{"type":"string"},"status":{"type":"string"}},"required":["area","status"],"type":"object"},"type": ⟨24 unchanged words⟩
⟨12 unchanged words⟩ ,"hidden_instructions","malicious_download","false_positive","missed","malicious_mcp","network_anomaly"],"type":"string"},"observed":{"description":"network_anomaly only: the certificate serial (hex) and issuer, and the addresses, you saw for the host","properties":{"ips":{"items":{"type":"string"},"type":"array"},"issuer":{"type":"string"},"serial":{"type":"string"}},"type":"object"},"url":{"description":"Address of ⟨14 unchanged words⟩
⟨114 unchanged words⟩ "string"}},"type":"object"},"receipts":{"description":"Signed observation receipts behind this result, one per lookup: when, from where and under which rules version DechoNet observed it. Each url shows the record and checks its Ed25519 signature.","items":{"properties":{"id":{"type":"string"},"tool":{"type":"string"},"url":{"type":"string"}},"required":["tool","id","url"],"type":"object"},"type":"array"},"reportUrl":{"description":"Human-facing interactive report for ⟨49 unchanged words⟩
⟨83 unchanged words⟩ :"object"},"type":"array"},"receipts":{"description":"Signed observation receipts behind this result, one per lookup: when, from where and under which rules version DechoNet observed it. Each url shows the record and checks its Ed25519 signature.","items":{"properties":{"id":{"type":"string"},"tool":{"type":"string"},"url":{"type":"string"}},"required":["tool","id","url"],"type":"object"},"type":"array"},"reportUrl":{"description":"Where a human can ⟨25 unchanged words⟩
⟨33 unchanged words⟩ ,"observed":{"type":"boolean"},"receipts":{"description":"Signed observation receipts behind this result, one per lookup: when, from where and under which rules version DechoNet observed it. Each url shows the record and checks its Ed25519 signature.","items":{"properties":{"id":{"type":"string"},"tool":{"type":"string"},"url":{"type":"string"}},"required":["tool","id","url"],"type":"object"},"type":"array"},"reportUrl":{"description":"Human-facing page on dechonet.com ⟨15 unchanged words⟩
⟨114 unchanged words⟩ "string"}},"type":"object"},"receipts":{"description":"Signed observation receipts behind this result, one per lookup: when, from where and under which rules version DechoNet observed it. Each url shows the record and checks its Ed25519 signature.","items":{"properties":{"id":{"type":"string"},"tool":{"type":"string"},"url":{"type":"string"}},"required":["tool","id","url"],"type":"object"},"type":"array"},"reportUrl":{"description":"Human-facing interactive report for ⟨49 unchanged words⟩
⟨114 unchanged words⟩ "string"}},"type":"object"},"receipts":{"description":"Signed observation receipts behind this result, one per lookup: when, from where and under which rules version DechoNet observed it. Each url shows the record and checks its Ed25519 signature.","items":{"properties":{"id":{"type":"string"},"tool":{"type":"string"},"url":{"type":"string"}},"required":["tool","id","url"],"type":"object"},"type":"array"},"reportUrl":{"description":"Human-facing interactive report for ⟨49 unchanged words⟩
⟨29 unchanged words⟩ ,"probed":{"type":"number"},"receipts":{"description":"Signed observation receipts behind this result, one per lookup: when, from where and under which rules version DechoNet observed it. Each url shows the record and checks its Ed25519 signature.","items":{"properties":{"id":{"type":"string"},"tool":{"type":"string"},"url":{"type":"string"}},"required":["tool","id","url"],"type":"object"},"type":"array"},"reportUrl":{"type":"string"},"status" ⟨19 unchanged words⟩
⟨20 unchanged words⟩ ,"passCount":{"type":"number"},"receipts":{"description":"Signed observation receipts behind this result, one per lookup: when, from where and under which rules version DechoNet observed it. Each url shows the record and checks its Ed25519 signature.","items":{"properties":{"id":{"type":"string"},"tool":{"type":"string"},"url":{"type":"string"}},"required":["tool","id","url"],"type":"object"},"type":"array"},"reportUrl":{"description":"Human-facing interactive report on ⟨20 unchanged words⟩
⟨114 unchanged words⟩ "string"}},"type":"object"},"receipts":{"description":"Signed observation receipts behind this result, one per lookup: when, from where and under which rules version DechoNet observed it. Each url shows the record and checks its Ed25519 signature.","items":{"properties":{"id":{"type":"string"},"tool":{"type":"string"},"url":{"type":"string"}},"required":["tool","id","url"],"type":"object"},"type":"array"},"reportUrl":{"description":"Human-facing interactive report for ⟨49 unchanged words⟩
⟨10 unchanged words⟩ high exposure)","type":"string"},"receipts":{"description":"Signed observation receipts behind this result, one per lookup: when, from where and under which rules version DechoNet observed it. Each url shows the record and checks its Ed25519 signature.","items":{"properties":{"id":{"type":"string"},"tool":{"type":"string"},"url":{"type":"string"}},"required":["tool","id","url"],"type":"object"},"type":"array"},"reportUrl":{"description":"Human-facing interactive report on ⟨53 unchanged words⟩
⟨4 unchanged words⟩ ,"note":{"type":"string"},"receipts":{"description":"Signed observation receipts behind this result, one per lookup: when, from where and under which rules version DechoNet observed it. Each url shows the record and checks its Ed25519 signature.","items":{"properties":{"id":{"type":"string"},"tool":{"type":"string"},"url":{"type":"string"}},"required":["tool","id","url"],"type":"object"},"type":"array"},"reportUrl":{"description":"How DechoNet observes infrastructure ⟨36 unchanged words⟩
⟨114 unchanged words⟩ "string"}},"type":"object"},"receipts":{"description":"Signed observation receipts behind this result, one per lookup: when, from where and under which rules version DechoNet observed it. Each url shows the record and checks its Ed25519 signature.","items":{"properties":{"id":{"type":"string"},"tool":{"type":"string"},"url":{"type":"string"}},"required":["tool","id","url"],"type":"object"},"type":"array"},"reportUrl":{"description":"Human-facing interactive report for ⟨49 unchanged words⟩
⟨114 unchanged words⟩ "string"}},"type":"object"},"receipts":{"description":"Signed observation receipts behind this result, one per lookup: when, from where and under which rules version DechoNet observed it. Each url shows the record and checks its Ed25519 signature.","items":{"properties":{"id":{"type":"string"},"tool":{"type":"string"},"url":{"type":"string"}},"required":["tool","id","url"],"type":"object"},"type":"array"},"reportUrl":{"description":"Human-facing interactive report for ⟨49 unchanged words⟩
⟨62 unchanged words⟩ :"string"},"type":"array"},"receipts":{"description":"Signed observation receipts behind this result, one per lookup: when, from where and under which rules version DechoNet observed it. Each url shows the record and checks its Ed25519 signature.","items":{"properties":{"id":{"type":"string"},"tool":{"type":"string"},"url":{"type":"string"}},"required":["tool","id","url"],"type":"object"},"type":"array"},"reportUrl":{"description":"Human-facing interactive report on ⟨22 unchanged words⟩
⟨24 unchanged words⟩ :"object"},"type":"array"},"receipts":{"description":"Signed observation receipts behind this result, one per lookup: when, from where and under which rules version DechoNet observed it. Each url shows the record and checks its Ed25519 signature.","items":{"properties":{"id":{"type":"string"},"tool":{"type":"string"},"url":{"type":"string"}},"required":["tool","id","url"],"type":"object"},"type":"array"},"reportUrl":{"type":"string"},"verdict" ⟨20 unchanged words⟩
⟨114 unchanged words⟩ "string"}},"type":"object"},"receipts":{"description":"Signed observation receipts behind this result, one per lookup: when, from where and under which rules version DechoNet observed it. Each url shows the record and checks its Ed25519 signature.","items":{"properties":{"id":{"type":"string"},"tool":{"type":"string"},"url":{"type":"string"}},"required":["tool","id","url"],"type":"object"},"type":"array"},"reportUrl":{"description":"Human-facing interactive report for ⟨49 unchanged words⟩
⟨31 unchanged words⟩ "type":["string","null"]},"receipts":{"description":"Signed observation receipts behind this result, one per lookup: when, from where and under which rules version DechoNet observed it. Each url shows the record and checks its Ed25519 signature.","items":{"properties":{"id":{"type":"string"},"tool":{"type":"string"},"url":{"type":"string"}},"required":["tool","id","url"],"type":"object"},"type":"array"},"reportUrl":{"description":"Human-facing interactive report on ⟨47 unchanged words⟩
⟨114 unchanged words⟩ "string"}},"type":"object"},"receipts":{"description":"Signed observation receipts behind this result, one per lookup: when, from where and under which rules version DechoNet observed it. Each url shows the record and checks its Ed25519 signature.","items":{"properties":{"id":{"type":"string"},"tool":{"type":"string"},"url":{"type":"string"}},"required":["tool","id","url"],"type":"object"},"type":"array"},"reportUrl":{"description":"Human-facing interactive report for ⟨49 unchanged words⟩
⟨44 unchanged words⟩ to F","type":"string"},"receipts":{"description":"Signed observation receipts behind this result, one per lookup: when, from where and under which rules version DechoNet observed it. Each url shows the record and checks its Ed25519 signature.","items":{"properties":{"id":{"type":"string"},"tool":{"type":"string"},"url":{"type":"string"}},"required":["tool","id","url"],"type":"object"},"type":"array"},"reportUrl":{"description":"Human-facing interactive report on ⟨17 unchanged words⟩
⟨114 unchanged words⟩ "string"}},"type":"object"},"receipts":{"description":"Signed observation receipts behind this result, one per lookup: when, from where and under which rules version DechoNet observed it. Each url shows the record and checks its Ed25519 signature.","items":{"properties":{"id":{"type":"string"},"tool":{"type":"string"},"url":{"type":"string"}},"required":["tool","id","url"],"type":"object"},"type":"array"},"reportUrl":{"description":"Human-facing interactive report for ⟨49 unchanged words⟩
⟨114 unchanged words⟩ "string"}},"type":"object"},"receipts":{"description":"Signed observation receipts behind this result, one per lookup: when, from where and under which rules version DechoNet observed it. Each url shows the record and checks its Ed25519 signature.","items":{"properties":{"id":{"type":"string"},"tool":{"type":"string"},"url":{"type":"string"}},"required":["tool","id","url"],"type":"object"},"type":"array"},"reportUrl":{"description":"Human-facing interactive report for ⟨49 unchanged words⟩
⟨30 unchanged words⟩ prefix length","type":"number"},"receipts":{"description":"Signed observation receipts behind this result, one per lookup: when, from where and under which rules version DechoNet observed it. Each url shows the record and checks its Ed25519 signature.","items":{"properties":{"id":{"type":"string"},"tool":{"type":"string"},"url":{"type":"string"}},"required":["tool","id","url"],"type":"object"},"type":"array"},"reportUrl":{"description":"Human-facing interactive report on ⟨33 unchanged words⟩
⟨18 unchanged words⟩ :"string"},"type":"array"},"receipts":{"description":"Signed observation receipts behind this result, one per lookup: when, from where and under which rules version DechoNet observed it. Each url shows the record and checks its Ed25519 signature.","items":{"properties":{"id":{"type":"string"},"tool":{"type":"string"},"url":{"type":"string"}},"required":["tool","id","url"],"type":"object"},"type":"array"},"reportUrl":{"type":"string"},"watches" ⟨41 unchanged words⟩
⟨114 unchanged words⟩ "string"}},"type":"object"},"receipts":{"description":"Signed observation receipts behind this result, one per lookup: when, from where and under which rules version DechoNet observed it. Each url shows the record and checks its Ed25519 signature.","items":{"properties":{"id":{"type":"string"},"tool":{"type":"string"},"url":{"type":"string"}},"required":["tool","id","url"],"type":"object"},"type":"array"},"reportUrl":{"description":"Human-facing interactive report for ⟨49 unchanged words⟩
Check a Page Before Logging In or Paying — Check the page an agent is about to log in, pay, download from or submit to: whether the address impersonates a brand, how new the domain is, whether DechoNet or a licensed feed has already flagged it, and — opened from Seoul (and Tokyo for Japan-targeted pages) as a phone — what the page turns into, including text it hides from people but an AI agent would read (instructions to ignore its rules, hand over secrets or keep the user out of it raise the answer to suspicious). For a payment, the caller can report the page structure as host names only (where forms submit, which origins frames come…
Report a Page — Report a page to DechoNet: phishing or brand impersonation, a fake payment window (card fields where a payment provider should be), hidden instructions aimed at AI agents, a malicious download, or a DechoNet verdict that looks wrong (false_positive) or a danger it missed (missed). Only the host and the kind are kept, for 90 days, with an anonymous reporter hash used to count independent reports — no path, query, page text or free text. A report changes no verdict by itself: DechoNet opens the page itself and only what it observes counts; pages reported by several independent sources are looke…
Set Outside Expectations (daily re-check) — Record what a domain should show from outside and check it now — HSTS or another header present, DMARC enforcing, an issue key no longer reported, an HTTP or TLS grade at or above a level, a certificate with enough days left, a DNS record present, absent or containing a value, HTTPS answering. DechoNet reads the domain fresh (not from cache) with its public dns / ssl / http / email tools, from its own servers and the Seoul observation point, and then re-checks the set every day. Each result is pass, fail or unknown; unknown (a tool or part of it did not answer) is never a pass. Without an API…
Verify Outside Expectations Now — Check expectations from outside now, with fresh reads: either a stored set by id (from set_expectations — its state is updated and an anonymous set is kept another 30 days), or a domain plus a list of checks once, storing nothing. Same checks and outcomes as set_expectations (pass / fail / unknown, unknown is never a pass), each tool read once with a signed observation receipt. Typical use: right after a change, to see whether it is visible from outside yet — DNS and CDN changes can take minutes to hours to show. Rate-limited (a few checks per minute).
⟨87 unchanged words⟩ : Bearer dn_…, npm: set DECHONET_API_KEY); up to 20 rows,100perwithcallMCP·API(higherPro;for some keys); rate-limited. Coverage: only DechoNet's own observations.
⟨10 unchanged words⟩ OWASP Secure Headers Project plus the externally observable OWASP Top 10:2025 subset —A02A04 Cryptographic Failures (TLS/cert),A05A02 Security Misconfiguration (header/info leaks), andA06A03VulnerableSoftware&SupplyOutdatedChainComponentsFailures (outdated components via version disclosure) — returning an A+ to F grade. Scope: A01 (Access Control, incl. SSRF),A03A05 (Injection),A04A06 (Insecure Design), A07 (Authentication), A08, A09 and A10 (SSRFExceptional Conditions) are not checked — they need authenticated ⟨8 unchanged words⟩ them as out-of-scope rather than "pass".Present theThe resultasis an external-posture check, not a full OWASP ⟨89 unchanged words⟩
⟨123 unchanged words⟩ own domain), no_signals (no warning signsfoundfound;—thisneverispresentnotthisaasfinding"that the link is safe"). Reads landing-page HTML; inconclusive links may also ⟨41 unchanged words⟩
{"properties":{"text":{"description":"Thesuspiciouslink(s) to check — a URL, or the messageexactlytextaswithreceivedverification codes, passwords and personal details removed (any language), or.justOnly theURL.linksUpare used (up to 5);linksthearetextchecked.is not stored.","type":"string"}},"required": ⟨3 unchanged words⟩
⟨84 unchanged words⟩ (the hybrid-only handshake was refused), unknown (inconclusive;inconclusivedo— notreporttheitsame as "no"). Scope: only the ⟨15 unchanged words⟩ TLS codepoints yet) are not observable, sopresentthe resultasis an external indicator of migration progress, not ⟨26 unchanged words⟩
⟨7 unchanged words⟩ DNS, SSL, HTTP headers, email auth,port scan,DNS propagation, reverse DNS, and ASN/RDAP checks ⟨39 unchanged words⟩ you need depth on one area. BEHAVIOR:thispassiveincludes—anpublicACTIVElookupsport_scanandofordinarytheHTTPSdomain'srequestshost,only;soopenonlyportsrunareitNOTonscanneddomainshereyou(thatownareaorisareleftauthorizedouttooftest.theRead-onlyscore;otherwise;port_scan is the separate, active check). Read-only; requires no API key; rate-limited (it makes ⟨14 unchanged words⟩
{"properties":{"domain":{"description":"Domain to auditend-to-end(e.g., 'example.com'). Scheme and path are stripped.NOTE: the host is also port-scanned, so use only targets you are authorized to test.","type":"string"}},"required": ⟨3 unchanged words⟩
⟨68 unchanged words⟩ :"object"},"type":"array"},"observation":{"description":"How much was actually observed and when. A partial observation means some checks did not answer: missing parts are not verified, never clean.","properties":{"ageMinutes":{"type":["number","null"]},"cached":{"type":"boolean"},"observedAt":{"type":["string","null"]},"state":{"enum":["complete","partial","unknown"],"type":"string"}},"type":"object"},"reportUrl":{"description":"Human-facing interactive report for ⟨49 unchanged words⟩
⟨68 unchanged words⟩ :"object"},"type":"array"},"observation":{"description":"How much was actually observed and when. A partial observation means some checks did not answer: missing parts are not verified, never clean.","properties":{"ageMinutes":{"type":["number","null"]},"cached":{"type":"boolean"},"observedAt":{"type":["string","null"]},"state":{"enum":["complete","partial","unknown"],"type":"string"}},"type":"object"},"reportUrl":{"description":"Human-facing interactive report for ⟨49 unchanged words⟩
⟨68 unchanged words⟩ :"object"},"type":"array"},"observation":{"description":"How much was actually observed and when. A partial observation means some checks did not answer: missing parts are not verified, never clean.","properties":{"ageMinutes":{"type":["number","null"]},"cached":{"type":"boolean"},"observedAt":{"type":["string","null"]},"state":{"enum":["complete","partial","unknown"],"type":"string"}},"type":"object"},"reportUrl":{"description":"Human-facing interactive report for ⟨49 unchanged words⟩
⟨68 unchanged words⟩ :"object"},"type":"array"},"observation":{"description":"How much was actually observed and when. A partial observation means some checks did not answer: missing parts are not verified, never clean.","properties":{"ageMinutes":{"type":["number","null"]},"cached":{"type":"boolean"},"observedAt":{"type":["string","null"]},"state":{"enum":["complete","partial","unknown"],"type":"string"}},"type":"object"},"reportUrl":{"description":"Human-facing interactive report for ⟨49 unchanged words⟩
⟨68 unchanged words⟩ :"object"},"type":"array"},"observation":{"description":"How much was actually observed and when. A partial observation means some checks did not answer: missing parts are not verified, never clean.","properties":{"ageMinutes":{"type":["number","null"]},"cached":{"type":"boolean"},"observedAt":{"type":["string","null"]},"state":{"enum":["complete","partial","unknown"],"type":"string"}},"type":"object"},"reportUrl":{"description":"Human-facing interactive report for ⟨49 unchanged words⟩
⟨68 unchanged words⟩ :"object"},"type":"array"},"observation":{"description":"How much was actually observed and when. A partial observation means some checks did not answer: missing parts are not verified, never clean.","properties":{"ageMinutes":{"type":["number","null"]},"cached":{"type":"boolean"},"observedAt":{"type":["string","null"]},"state":{"enum":["complete","partial","unknown"],"type":"string"}},"type":"object"},"reportUrl":{"description":"Human-facing interactive report for ⟨49 unchanged words⟩
⟨68 unchanged words⟩ :"object"},"type":"array"},"observation":{"description":"How much was actually observed and when. A partial observation means some checks did not answer: missing parts are not verified, never clean.","properties":{"ageMinutes":{"type":["number","null"]},"cached":{"type":"boolean"},"observedAt":{"type":["string","null"]},"state":{"enum":["complete","partial","unknown"],"type":"string"}},"type":"object"},"reportUrl":{"description":"Human-facing interactive report for ⟨49 unchanged words⟩
⟨68 unchanged words⟩ :"object"},"type":"array"},"observation":{"description":"How much was actually observed and when. A partial observation means some checks did not answer: missing parts are not verified, never clean.","properties":{"ageMinutes":{"type":["number","null"]},"cached":{"type":"boolean"},"observedAt":{"type":["string","null"]},"state":{"enum":["complete","partial","unknown"],"type":"string"}},"type":"object"},"reportUrl":{"description":"Human-facing interactive report for ⟨49 unchanged words⟩
⟨68 unchanged words⟩ :"object"},"type":"array"},"observation":{"description":"How much was actually observed and when. A partial observation means some checks did not answer: missing parts are not verified, never clean.","properties":{"ageMinutes":{"type":["number","null"]},"cached":{"type":"boolean"},"observedAt":{"type":["string","null"]},"state":{"enum":["complete","partial","unknown"],"type":"string"}},"type":"object"},"reportUrl":{"description":"Human-facing interactive report for ⟨49 unchanged words⟩
⟨68 unchanged words⟩ :"object"},"type":"array"},"observation":{"description":"How much was actually observed and when. A partial observation means some checks did not answer: missing parts are not verified, never clean.","properties":{"ageMinutes":{"type":["number","null"]},"cached":{"type":"boolean"},"observedAt":{"type":["string","null"]},"state":{"enum":["complete","partial","unknown"],"type":"string"}},"type":"object"},"reportUrl":{"description":"Human-facing interactive report for ⟨49 unchanged words⟩
⟨68 unchanged words⟩ :"object"},"type":"array"},"observation":{"description":"How much was actually observed and when. A partial observation means some checks did not answer: missing parts are not verified, never clean.","properties":{"ageMinutes":{"type":["number","null"]},"cached":{"type":"boolean"},"observedAt":{"type":["string","null"]},"state":{"enum":["complete","partial","unknown"],"type":"string"}},"type":"object"},"reportUrl":{"description":"Human-facing interactive report for ⟨49 unchanged words⟩
Owned ASM Nuclei cancel — Stop new requests and terminate this workspace scanner with edit permission. Already transmitted requests cannot be recalled. Poll for cancellation acknowledgement.
Owned ASM Nuclei start — Explicitly start limited active requests to a selected currently verified asset in your owned ASM report. Requires current workspace edit access, ASM plan and current account-bound DNS TXT ownership (legacy public/domain-only proof is insufficient); public API keys grant no account authority. No exploits or arbitrary templates/CLI.
Owned ASM Nuclei status — Read private job status, coverage and sanitized evidence with current view permission and ownership. Partial, failed or unconfigured is not a clean result; technology detection is not proof of a vulnerability.
Case render fingerprint observation — Explicitly observe an existing authenticated case member under conditional-render rules and daily cap. Requires edit access and current case owner session or access cookie. Search and page GET do not render; unavailable is not a clean result.
Case render fingerprint search — Search render fingerprints within an authenticated case and allowed public discovery data. Requires the case owner session or existing case access cookie; public API keys do not grant case access. Screen, same-kit and operational candidates are distinct; scores are proximity, not probability, operator identity or phishing verdicts. Kits can be sold or copied.
Owned ASM Nuclei cancel — Stop new requests and terminate this workspace scanner with edit permission. Already transmitted requests cannot be recalled. Poll for cancellation acknowledgement.
Owned ASM Nuclei start — Explicitly start limited active requests to a selected currently verified asset in your owned ASM report. Requires current workspace edit access, ASM plan and current account-bound DNS TXT ownership (legacy public/domain-only proof is insufficient); public API keys grant no account authority. No exploits or arbitrary templates/CLI.
Owned ASM Nuclei status — Read private job status, coverage and sanitized evidence with current view permission and ownership. Partial, failed or unconfigured is not a clean result; technology detection is not proof of a vulnerability.
Case render fingerprint observation — Explicitly observe an existing authenticated case member under conditional-render rules and daily cap. Requires edit access and current case owner session or access cookie. Search and page GET do not render; unavailable is not a clean result.
Case render fingerprint search — Search render fingerprints within an authenticated case and allowed public discovery data. Requires the case owner session or existing case access cookie; public API keys do not grant case access. Screen, same-kit and operational candidates are distinct; scores are proximity, not probability, operator identity or phishing verdicts. Kits can be sold or copied.
⟨42 unchanged words⟩ age from RDAP, impersonation of Korean banks/couriers/telecoms/portals and global brands incl. AI services such as ChatGPT/Claude/Gemini (brand keyword, lookalike spelling, or the brand domain worn as a subdomain), ClickFix pages (a fake "verify you are human" check that has the visitor paste a command into Win+R/PowerShell), Android APK downloads, punycode, public phishing/malware feeds, ⟨37 unchanged words⟩ present this as "safe"). Read-only: the first 64 KB of the landing pagebodiesisareread but scripts never run, and the message text is not stored; requires ⟨14 unchanged words⟩
⟨39 unchanged words⟩ ) — returning an A+ to F grade.IMPORTANT SCOPEScope:this does NOT checkA01 (Access Control), A03 (Injection), A04, A07 (Authentication), A08, A09,orand A10 (SSRF) are not checked —thosetheyrequireneed authenticated access or active/injection testing,andsoaretheexplicitlyresultreportedlists them as out-of-scope,neverratherasthan "pass".Do notPresentpresentthethisresult as an external-posture check, not a full OWASP Top 10 assessment. Unlike security_scan ⟨60 unchanged words⟩