Every change Wellknown observed on this MCP server, newest first, with what it was before and what it became. Tool-surface changes carry the definition diff. Nothing here is edited after the fact.
Added "bulk_threat_check", "threat_check" and "watch_status" (10 tools before, 13 now)
Check up to 100 domains or IPv4 addresses at once against ThreatCluster's high-confidence 30-day IOC feed; each domain is resolved and its IPv4 matched too. IOC only (no ransomware-claim lookups; use threat_check for one domain). Stale feed returns an error and is not charged. Costs $0.50 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.
Is this domain known-bad? Resolves the hostname (A/AAAA), matches the name, its parent domains and resolved IPv4 against ThreatCluster's high-confidence 30-day IOC feed (cached, refreshed about hourly), and looks up ransomware leak-site claims naming the domain (commercially reusable sources via Dragons Eye). Returns verdict listed, claimed, listed_and_claimed or no_known_threat with the matching reports. No match is not proof of safety; claims are unverified attacker assertions. Stale feed or source failure returns an error and is not charged. Costs $0.02 USDC per call via x402 (payment goes…
Free. Status of a paid domain watch (created with HTTP POST /v1/watch): items, expiry, last check, current DNS/IOC/claim state, last webhook delivery.
Added "full_site_audit" (9 tools before, 10 now)
Full site audit report for one domain, for client reports, vendor reviews or a pre-launch check. Runs every check (TLS from CT logs + live probe, DNS/DNSSEC/CAA, registration expiry and transfer lock, SPF/DMARC/DKIM/MTA-STS, security headers) plus HTTP->HTTPS redirect, www/apex consistency, RFC 9116 security.txt, robots.txt and sitemap. Returns the A-F grade and score (same weights as domain_grade), an action plan sorted critical > high > medium > low where each item has the exact fix and effort, and every raw section. Use domain_grade for just the letter. Fails (not charged) if 3+ core check…
Certificate recorded, valid to 2027-01-08
Authorization not required
Changed the definition of "check_cert", "check_dns", "check_domain_expiry" and 6 more
Certificate status forCheckathehostnameTLSfromcertificateCertificateofTransparencyonelogshostname:(issuer, validity dates, days left, % of lifetime used, renewal cadence,and a
Added "check_email_auth", "check_security_headers" and "domain_grade" (6 tools before, 9 now)
Email authentication posture for a domain: SPF validity and lookup count, DMARC policy, DKIM on common selectors, MTA-STS mode, TLS-RPT, BIMI, a rough 0-100 score and plain-English fixes. Live DNS.
HTTP security headers for a site from one live HTTPS request: redirect chain, HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, an A-F grade and findings.
Domain security grade A-F for vendor-risk or due-diligence: runs the TLS (CT logs + live probe), DNS (DNSSEC, CAA), registration expiry, email-auth and HTTP security-header checks and returns one letter, a 0-100 score, points per category and the top fixes. Different from site_health, which returns raw cert/DNS/expiry data with no grade.
Unknown → Live
First tool surface recorded: 6 tools (server version 1.0.0)
https://api.orioncmd.com/mcp (mcp_streamable_http) — from mcp_registry, with the record
Showing the latest 9 events. The API returns up to 500 and filters by kind: ?kind=tool_surface_changed
{"destructiveHint":false,"idempotentHint":true,"openWorldHint":true,"readOnlyHint":true}
LiveLook up the live DNSviaofDoHa domain: NS, A/AAAA/CNAME, MX, SPF, DMARC, CAA (tree-climbingclimbing to the parent zone),and DNSSEC status, with plain-English findings. Use it for a DNS inventory or to debug resolution; use check_email_auth for a deeper SPF/DMARC/DKIM/MTA-STS review. Queries Cloudflare DNS-over-HTTPS (1.1.1.1) at call time; read-only, nothing is stored. Costs $0.01 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.
{"destructiveHint":false,"idempotentHint":true,"openWorldHint":true,"readOnlyHint":true}
DomainCheckregistrationwhenexpiryaviadomainRDAPregistration expires: registrar,registered/expiresregistered and expiry dates, days left, EPP status codes and nameservers,nameservers.from the registry's RDAP server. Use it for renewal risk on the registered domain (not the certificate; use check_cert for that). Some TLDs publish no RDAP service, in which case found=false explains why. Read-only. Costs $0.01 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.
{"destructiveHint":false,"idempotentHint":true,"openWorldHint":true,"readOnlyHint":true}
posturesetupforof a domain: SPF validity andlookupDNS-lookup count (limit 10), DMARC policy, pct and reporting, DKIM on commonselectorsselector names, MTA-STS mode, TLS-RPT,and BIMI, with a rough 0-100 score and plain-English fixes. Use it before sending mail from a domain or when mail lands in spam. DKIM is only checked on common selectors, so "not found" is not proof DKIM is missing. LiveDNS.DNS via Cloudflare DoH; read-only, no email is sent. Costs $0.01 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.
{"destructiveHint":false,"idempotentHint":true,"openWorldHint":true,"readOnlyHint":true}
Check the HTTP security headersforof asitewebsitefromwith one live HTTPSrequestGET: redirect chain (up to 5 hops), final status, HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and COOP,anwith a simple A-F header grade and findings. Use it for web-hardening checks; it is not a vulnerability scan. The page body is not read or stored. Costs $0.01 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.
{"destructiveHint":false,"idempotentHint":true,"openWorldHint":true,"readOnlyHint":true}
DomainGrade a domain's securitygradeposture A-F in one call, for vendor-risk or due-diligence:runschecks. Runs the TLS(CT logs + live probe), DNS (DNSSEC, CAA),registration expiryregistration-expiry, email-auth andHTTP security-headerHTTP-header checks and returns one letter, a 0-100 score, points per category (TLS 25, email 25, headers 20, DNS 15, registration 15) and the top fixes.DifferentUsefromit when you want a verdict; use site_health,whichorreturnsthe single checks when you need rawcert/DNS/expirydata.dataUnavailablewithcategoriesnoaregrade.left out of the percentage (partial=true). Read-only; takes about 3-10 s. Costs $0.03 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.
{"destructiveHint":false,"idempotentHint":true,"openWorldHint":true,"readOnlyHint":true}
FREE.Free.PricesReturn the price of every paid tool, the payment network (Base) andpaymentthe receiving address,forsotheyoupaidcantools.budget before calling. No input, no network request, no payment.
before
—after
{"destructiveHint":false,"idempotentHint":true,"openWorldHint":false,"readOnlyHint":true,"title":"Prices (free)"}Bundle:Run check_cert+, check_dns+and check_domain_expirywithtogether and return their raw results plus a short summary, the renewal-stallheuristicflag and the Let's Encrypt 64-day certificate note (from 2027-02-10).note.Use it for a full data dump in one call; use domain_grade if you want a single scored A-F answer that also covers email auth and HTTP headers. If one or two sources fail you get partial=true with the rest. Read-only. Costs $0.03 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.
{"destructiveHint":false,"idempotentHint":true,"openWorldHint":true,"readOnlyHint":true}
FREE.Free. Check that adomain/hostnamedomain or URL is well-formedbeforeandpayinggetforthe normalized hostname, before calling a paid check.ReturnsOffline:thenonormalizednetworkhost.request, no payment. Rejects IP addresses, single-label names and URLs with credentials.
{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"domain":{"description":"Hostname or URL to normalize, e.g. example.com or https://www.example.com/path","maxLength":300,"type":"string"}}," ⟨4 unchanged words⟩
before
—after
{"destructiveHint":false,"idempotentHint":true,"openWorldHint":false,"readOnlyHint":true,"title":"Validate domain (free)"}