{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_999nww9q5sks","handle":"sitecheck-web-intel","url":"https://wellknown.network/agents/sitecheck-web-intel","links":{"self":"https://wellknown.network/agents/sitecheck-web-intel/record.json","html":"https://wellknown.network/agents/sitecheck-web-intel","markdown":"https://wellknown.network/agents/sitecheck-web-intel/record.md","api":"https://wellknown.network/api/v1/agents/sitecheck-web-intel","status":"https://wellknown.network/api/v1/agents/sitecheck-web-intel/status","claim":"https://wellknown.network/agents/sitecheck-web-intel/claim","claimApi":"https://wellknown.network/api/v1/claims","claimDescriptor":"https://wellknown.network/agents/sitecheck-web-intel/claim.json","badge":"https://wellknown.network/agents/sitecheck-web-intel/badge.svg","openapi":"https://wellknown.network/openapi.json","history":"https://wellknown.network/api/v1/agents/sitecheck-web-intel/history","tools":"https://wellknown.network/api/v1/agents/sitecheck-web-intel/tools"},"ard":{"identifier":"urn:air:api.webintel-api.workers.dev:server:sitecheck-web-intel","type":"application/mcp-server-card+json"},"kind":"mcp_server","declared":{"name":"SiteCheck Web Intel","summary":"129 pay-per-call agent tools: security, threat intelligence, web search and SEO data tools. x402","description":"129 pay-per-call agent tools: security, threat intelligence, web search and SEO data tools. x402","publisher":{"name":"bck-stack","url":null},"homepage":"https://api.webintel-api.workers.dev","repository":null,"version":"1.0.0","license":null,"protocols":["mcp"],"tags":[],"pricing":null,"endpoints":[{"url":"https://api.webintel-api.workers.dev/mcp?ref=registry","type":"mcp_streamable_http","auth":null,"probeable":true}],"skills":null,"tools":null,"extra":{"updatedAt":"2026-10-23T18:17:40.362664Z","publishedAt":"2026-10-23T18:17:40.362664Z","registryName":"io.github.bck-stack/sitecheck-web-intel"},"attribution":{"kind":"mcp_registry","name":"mcp_registry","summary":"mcp_registry","version":"mcp_registry","description":"mcp_registry","homepageUrl":"mcp_registry","publisherName":"mcp_registry"}},"derived":{"capabilities":[{"slug":"code.security-review","name":"Security Review","confidence":1,"provenance":"derived"},{"slug":"documents.conversion","name":"Document Conversion","confidence":1,"provenance":"derived"},{"slug":"data.web-search","name":"Web Search","confidence":1,"provenance":"derived"},{"slug":"data.database","name":"Databases","confidence":1,"provenance":"derived"},{"slug":"data.news","name":"News & Feeds","confidence":1,"provenance":"derived"},{"slug":"security.identity","name":"Identity & Access","confidence":1,"provenance":"derived"},{"slug":"data.web-scraping","name":"Web Scraping","confidence":0.992,"provenance":"derived"},{"slug":"commerce.ecommerce","name":"E-commerce Operations","confidence":0.992,"provenance":"derived"}],"categories":["code","commerce","data","documents","security"],"language":"en"},"observed":{"status":"live","statusReason":"Responded 2h ago.","lastOkAt":"2026-10-28T05:28:26.644Z","lastProbedAt":"2026-10-28T05:28:26.644Z","statusComputedAt":"2026-10-28T05:32:19.371Z","reliability30d":{"probes":7,"successRate":1,"p50Ms":50,"basis":"service","measures":{"availability":"availability","latency":"response time","tools":"tool surface observed","summary":"Checks reached the service itself."},"checks":{"total":7,"ok":7,"authBoundaryOk":0,"serviceOk":7,"note":"Counted from the observation rows for the window, checks of the server only (HTTP, A2A card, MCP initialize). ok = authBoundaryOk + serviceOk. `probes` is the sum of daily rollups and includes registry checks, so it can differ from `total`."}},"latestObservations":[{"at":"2026-10-28T05:28:26.644Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":37,"error":null,"detail":{"tools":[{"name":"security_dns_records","description":"DNS records of a domain (A, AAAA, MX, NS, TXT, CNAME, CAA, SOA) resolved live through the public AdGuard DNS JSON resolver (NextDNS as backup). Shows answers as"},{"name":"security_whois_rdap","description":"Domain registration facts via RDAP (IANA bootstrap, then the registry's own server): registration, last change and expiry dates, days left, registrar name, stat"},{"name":"security_ssl_cert_chain","description":"HTTPS certificate chain and cipher audit for a host (port 443) from Qualys SSL Labs' cached report: grade, number of certificates in the chain, trust store, TLS"},{"name":"security_crtsh_transparency","description":"Subdomain names found in public Certificate Transparency logs for a domain (via CertSpotter): unique host names and wildcard names, issuers, latest issue date a"},{"name":"security_ip_geolocation_asn","description":"IPv4 or IPv6 address → covering BGP prefix, origin AS number and holder name, whether the prefix is announced, and a coarse country and map point, all from RIPE"},{"name":"security_security_headers","description":"Checks the live HTTP response headers of a site's home page (one GET, https) for Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, X-F"},{"name":"security_dmarc_spf_dkim","description":"Email authentication DNS records for a domain: DMARC policy (p, sp, pct, rua), SPF record and its all-mechanism, and DKIM public keys for a selector you give or"},{"name":"security_urlhaus_malware","description":"Checks whether a host (domain or IP) is known to abuse.ch URLhaus as a malware distribution host: first seen, number of malware URLs, Spamhaus DBL / SURBL statu"},{"name":"security_phishtank_check","description":"Looks one http or https URL up in the PhishTank phishing database (live checkurl lookup, no key). Returns whether PhishTank has the URL and, if so, its phish id"},{"name":"security_cve_nvd_lookup","description":"One CVE record from the NIST National Vulnerability Database: description, published and last-modified dates, NVD status, primary CVSS score and severity (v4.0,"},{"name":"security_tor_exit_nodes","description":"Checks an IPv4 address against the Tor Project's bulk exit list (about 1,200 active exit IPs). If it is an exit, adds the relays for that address from Onionoo: "},{"name":"security_vpn_proxy_detector","description":"Checks an IPv4 address against the public X4BNet list of commercial VPN provider address ranges (about 11,000 CIDR blocks, refreshed by the list's maintainer). "},{"name":"security_shodan_host_summary","description":"Shodan InternetDB summary for an IPv4 address (free, no key): open TCP ports, host names seen, CPE software identifiers, tags and CVE IDs Shodan associates with"},{"name":"security_censys_exposure","description":"Censys host view for an IPv4 address: the services, ports and protocols Censys has observed on it with their last scan time and detected software, plus autonomo"},{"name":"security_abuseipdb_check","description":"AbuseIPDB reputation for an IPv4 address over the last 90 days: abuse confidence score (0-100), number of abuse reports, last report date, ISP, usage type and c"},{"name":"security_grey_noise_noise","description":"GreyNoise Community lookup for an IPv4 address: whether it was seen mass-scanning the internet recently (noise), whether it is a known benign service (riot), it"},{"name":"security_hibp_breach_check","description":"Lists the data breaches HaveIBeenPwned has recorded for a domain (breach name, breach date, accounts affected, data types exposed, verified flag). It is the pub"},{"name":"security_cisa_known_exploits","description":"CISA's Known Exploited Vulnerabilities catalog (public JSON). With cveId: whether that CVE is on the list, with vendor, product, date added, federal due date, r"},{"name":"security_open_port_scanner","description":"Lists the TCP ports Shodan has seen open on an IPv4 address, from its pre-collected passive scan data (not a live scan: nothing connects to the address now). Th"},{"name":"security_dns_propagation","description":"Asks two independent public DNS resolvers (AdGuard DNS and NextDNS) for the same name and record type right now and reports whether they agree, with each answer"},{"name":"security_reverse_dns_ptr","description":"Reverse DNS (PTR) names for an IPv4 address, and forward-confirmed reverse DNS: whether each PTR name resolves back (A record) to the same address. Up to 3 PTR "},{"name":"security_bgp_prefix_origin","description":"For an IPv4 prefix (e.g. 8.8.8.0/24): the origin AS seen announcing it now across RIPE RIS peers, its RPKI status for that origin (valid, invalid or unknown), r"},{"name":"security_dnssec_validator","description":"DNSSEC check for a domain: whether a DS record exists at the parent zone (the domain is signed), and whether two public validating resolvers (AdGuard DNS, NextD"},{"name":"security_cors_misconfig","description":"Checks how a site's home page answers a cross-origin request from a made-up origin: whether it echoes that origin back, sends a wildcard (*), and whether creden"},{"name":"security_cookie_security","description":"Lists the cookies a site sets on its public home page (one anonymous GET, no login) with their Secure, HttpOnly and SameSite flags, and flags the ones missing a"},{"name":"security_subdomain_takeover","description":"For a subdomain: finds its CNAME, matches the target against the public can-i-take-over-xyz fingerprint list (services such as GitHub Pages, S3, Azure, WordPres"},{"name":"security_robots_security_txt","description":"Reads a site's public robots.txt (crawl rules, sitemaps, AI-crawler rules) and security.txt (RFC 9116: contact, expiry, policy), and says whether security.txt i"},{"name":"security_email_disposable","description":"Checks whether an email address's domain (or a domain you give) is on the community disposable and temporary email blocklist (about 9,900 domains). Only the dom"},{"name":"security_domain_typosquatting","description":"For a brand domain, generates up to 24 lookalike names (letter omission, doubling and swapping, plus .co/.net/.org/.io swaps) and checks which ones have name se"},{"name":"security_asn_peers_upstream","description":"For an autonomous system (e.g. AS13335): how many upstream (transit) and downstream neighbours RIPEstat sees in BGP, the top upstreams ranked by 'power' with th"},{"name":"security_tls_cipher_enum","description":"TLS versions a host accepts (SSL 3, TLS 1.0 and 1.1 flagged as deprecated) and its cipher-suite strength from Qualys SSL Labs' cached report: suite count per pr"},{"name":"security_open_resolver_check","description":"Reports whether Shodan's pre-collected passive scan data shows TCP port 53 (DNS) open on an IPv4 address. It is a passive port fact only: it does not send a que"},{"name":"security_ntp_monlist_audit","description":"Reports whether Shodan's pre-collected passive scan data shows NTP (port 123) seen open on an IPv4 address. Passive and possibly old; the monlist amplification "},{"name":"security_snmp_exposure","description":"Reports whether Shodan's pre-collected passive scan data shows SNMP (UDP port 161) seen open on an IPv4 address. Passive and possibly old; no community string i"},{"name":"security_ssh_banner_audit","description":"From Shodan's pre-collected passive scan data: whether TCP port 22 was seen open on an IPv4 address and any OpenSSH version identified in its software (CPE) lis"},{"name":"security_smb_exposure_test","description":"Checks Shodan's passive scan records for TCP port 445 (SMB) on an IPv4 address. Says whether SMB was seen open and when the record was last refreshed by the hos"},{"name":"security_rdp_exposure_check","description":"Checks Shodan's passive scan records for TCP port 3389 (RDP) on an IPv4 address. Says whether RDP was seen open (not a live test, and the record can be days old"},{"name":"security_spameatingmonkey","description":"Checks an IPv4 mail-sending address against the SpamEatingMonkey DNS blocklist (bl.spameatingmonkey.net) through public DNS. A listed address returns its 127.0."},{"name":"security_barracuda_reputation","description":"Checks an IPv4 mail-sending address against the Barracuda Reputation Block List (b.barracudacentral.org) through public DNS. Listed addresses return a 127.0.0.x"},{"name":"security_spamhaus_zen","description":"Spamhaus blocklist check through Spamhaus's official Data Query Service: an IPv4 address against ZEN (SBL spam sources, CSS snowshoe, XBL exploited/botnet hosts"},{"name":"security_surbl_uri_lookup","description":"Checks a domain against SURBL's multi-list (multi.surbl.org): whether it appears in spam or phishing URI lists. Listed domains return a 127.0.0.x code. Not list"},{"name":"security_openphish_feed","description":"Checks a URL or host against the OpenPhish public phishing feed (about 300 currently active phishing URLs, updated continuously). Returns whether the exact URL "},{"name":"security_threatfox_iocs","description":"Searches abuse.ch ThreatFox for indicators of compromise matching a term (IP, IP:port, domain, URL or file hash): IOC, type, malware family, threat type, confid"},{"name":"security_malbazaar_samples","description":"Looks up a file hash (SHA-256, SHA-1 or MD5) in abuse.ch MalwareBazaar: whether the sample is known, its other hashes, file name, type, size, signature (malware"},{"name":"security_feodotracker_c2","description":"Checks an IPv4 address against the abuse.ch Feodo Tracker botnet C2 blocklist (Emotet, QakBot and similar). A hit returns the port, online status, malware famil"},{"name":"security_sslbl_abuse_certs","description":"Checks a certificate SHA-1 fingerprint (40 hex characters) against the abuse.ch SSL Blacklist of certificates seen on malware botnet C2 servers. A hit returns t"},{"name":"security_ipsum_threat_level","description":"Checks an IPv4 address against IPsum, an aggregate of public blocklists: returns the number of source feeds that list it (its level, 1 to 8) and whether it is l"},{"name":"security_cymru_asn_lookup","description":"Maps an IPv4 address to its origin AS number, the BGP prefix that covers it, the country, the registry and the allocation date, using Team Cymru's public IP-to-"},{"name":"security_blocklist_de","description":"Checks an IPv4 address against the Blocklist.de 'all' list of IPs reported for attacks such as failed logins, SSH and mail abuse (about 24,000 addresses). A hit"},{"name":"security_ciarmy_bad_ips","description":"Checks an IPv4 address against the CI Army (CINS Score) bad-IP list, a collective-intelligence list of addresses that recently showed hostile activity across a "},{"name":"security_talos_ip_blacklist","description":"Cisco Talos reputation for an IPv4 address: threat level (favorable, neutral, poor, untrusted), web reputation score, forward/reverse DNS match, hostname, owner"},{"name":"security_mx_server_test","description":"For a mail domain: lists up to 3 MX hosts with their IPv4 addresses and, from Shodan's pre-collected passive scan data, which SMTP ports (25, 465, 587) were see"},{"name":"security_dkim_key_checker","description":"Reads the DKIM public key published at <selector>._domainkey.<domain>: key type, whether it is revoked (empty p=), decoded key size in bytes and a strength hint"},{"name":"security_bimi_record_audit","description":"Reads a domain's BIMI record (default._bimi.<domain> TXT): whether it is published, the SVG logo URL (l=) and the certificate URL (a=, a VMC or CMC for mailbox "},{"name":"security_mta_sts_validator","description":"Checks MTA-STS for a mail domain: the _mta-sts TXT record (v=STSv1 and id) and the HTTPS policy file (mode enforce, testing or none, the MX patterns and max_age"},{"name":"security_dns_caa_records","description":"Lists the CAA (Certification Authority Authorization) records published on a domain: which CAs may issue certificates (issue), wildcard certificates (issuewild)"},{"name":"security_tls_alpn_detector","description":"Reports which newer HTTP protocols a site advertises: HTTP/3 (h3) and older draft or HTTP/2 alternatives in its Alt-Svc response header, and the Alt-Svc max-age"},{"name":"security_cert_revocation_crl","description":"For a domain's current certificate (taken from public Certificate Transparency data via CertSpotter): reads its CRL Distribution Point, downloads that public CR"},{"name":"security_mitre_attck_matrix","description":"Looks up one MITRE ATT&CK technique (e.g. T1059 or T1059.001) on its official public page: its name, the tactic-level summary text and the page title. Reads one"},{"name":"security_epss_exploit_score","description":"EPSS (Exploit Prediction Scoring System) for one CVE from FIRST's public API: the estimated probability (0 to 1) of exploitation in the next 30 days, its percen"},{"name":"security_cve_details_feed","description":"Vulnerability trend for a vendor (optionally one product) from the NIST NVD: CVEs published in the last N days (default 7, up to 120; a big vendor over a long w"},{"name":"security_jwt_token_inspector","description":"Decodes a JWT you supply (header and payload, base64url JSON) and reports its algorithm, key id, claims, and time checks (exp, nbf, iat). Flags alg none, symmet"},{"name":"security_csp_evaluator_audit","description":"Reads the Content-Security-Policy header of a site's home page and lists weak points: 'unsafe-inline' and 'unsafe-eval' in script sources, bare wildcards, data:"},{"name":"security_referrer_policy_audit","description":"Reads a site's Referrer-Policy header and its <meta name=referrer> tag from the home page, works out the policy a browser would apply, and rates how much of the"},{"name":"security_crossdomain_xml_test","description":"Reads a site's public crossdomain.xml (Adobe Flash) and clientaccesspolicy.xml (Silverlight) if they exist, lists the origins they allow, and flags wildcard gra"},{"name":"search_website_content_crawler","description":"Reads one public web page and returns its title, description and main text as Markdown (headings, links, lists), plus link counts. Reads only the page you name:"},{"name":"search_wayback_cdx","description":"Internet Archive Wayback Machine CDX index: archived snapshots of a URL or domain (timestamp, original URL, MIME type, HTTP status, length) with a link to each "},{"name":"search_google_search","description":"Organic web search results from the Brave Search API (an independent web index, not Google's): rank, title, URL, snippet, site name, page age and language for t"},{"name":"search_google_ads","description":"Google Ads Transparency Center: search advertisers by name or domain (verified name, advertiser ID, country, approximate ad count), or list the ads of an advert"},{"name":"search_wsj_articles","description":"WSJ World News headlines from the public Dow Jones RSS feed (latest items; keyword filter on title/summary). Headlines and short summaries only; full articles a"},{"name":"search_bing_search","description":"Bing web search results (Bing's public RSS search output, no key): result title, URL and snippet, in Bing's ranking order. Shows the first page of results Bing "},{"name":"search_google_news","description":"Google News search (public Google News RSS search feed, no key, English/US edition): headline, publisher, publish time and the Google News link for the newest m"},{"name":"search_pr_newswire","description":"PR Newswire latest news-release list from its public RSS feed (keyword filter on title/summary). Press release headlines and summaries. Public feed, no key. Pri"},{"name":"search_beehiiv_newsletter","description":"Post archive of a beehiiv newsletter (by beehiiv subdomain, e.g. superhuman, or the newsletter's own domain if hosted on beehiiv): newsletter name, total posts,"},{"name":"search_benzinga","description":"Latest Benzinga financial news (the public JSON feed behind benzinga.com): headline, teaser, author, time, URL, tickers, channels and tags. Filter by stock tick"},{"name":"search_markdown_to_pdf_mcp","description":"npm registry search for MCP servers that convert Markdown to PDF (public npm search API, no key): package name, version, description, publisher, last publish da"},{"name":"search_unpaywall","description":"Unpaywall open-access lookup by DOI (free API; it requires a contact e-mail set in UNPAYWALL_EMAIL, not a key): is the paper open access, OA status, best free f"},{"name":"search_reuters_articles","description":"Latest Reuters articles: headline, publication time and link, newest first, optionally matching search words, from the last 1-30 days. Found through Google News"},{"name":"search_fifa_team_rankings","description":"FIFA men's national team world ranking (FIFA public ranking API, no key): position, team, country code, total points, previous points and previous rank for one "},{"name":"search_university_rankings_mega_pack","description":"University rankings side by side from ShanghaiRanking ARWU (rank, national rank, total and six indicator scores) and Times Higher Education World University Ran"},{"name":"search_freightwaves","description":"FreightWaves latest news from its public RSS feed (keyword filter on title/summary/categories). Feed carries only the latest few items. Public feed, no key. Pri"},{"name":"search_crossref","description":"Crossref works search (public REST API, no key): DOI, title, type, container (journal or book), year, authors and link for matching scholarly records. Metadata "},{"name":"search_bbc_news_articles","description":"BBC News top stories from the public BBC RSS feed (latest items; keyword filter on title/summary). Headlines and summaries only, no full article text. Public fe"},{"name":"search_article_extractor","description":"Extracts one article from a public news or blog page: headline (og:title or h1), author, published and modified times, description and the article body as Markd"},{"name":"search_owgr_golf_rankings","description":"Official World Golf Ranking (OWGR public ranking API, no key): current men's position, player name, country, total points, average points and last week's positi"},{"name":"search_techcrunch_articles","description":"TechCrunch latest articles from its public RSS feed (keyword filter on title/summary/tags). Headlines and excerpts only. Public feed, no key. Price: $0.002 in U"},{"name":"search_prnewswire_press_releases","description":"PR Newswire health-category press releases from its public RSS feed (keyword filter on title/summary). Latest items only. Public feed, no key. Price: $0.002 in "},{"name":"search_emedicine_articles","description":"Medscape eMedicine (Medscape Reference) clinical articles by specialty: title, topic category, article id and URL from the public specialty index, filtered by w"},{"name":"search_openprescribing","description":"NHS England primary-care prescribing for a drug (official NHSBSA English Prescribing Dataset, monthly, ~2 months behind; the raw data behind OpenPrescribing.net"},{"name":"search_ft_com_articles","description":"Financial Times headlines from the public FT RSS feeds: international homepage or any section/topic stream (world, markets, companies, technology, opinion, glob"},{"name":"search_wechat_articles","description":"WeChat Official Account (公众号) articles matching a query, from Sogou WeChat search (weixin.sogou.com): title, summary, account name, publish time and link, 10 pe"},{"name":"search_hacker_news","description":"Hacker News story search through the official HN Search API (Algolia, public, no key): title, article URL, author, points, comment count and discussion link. Re"},{"name":"search_drive_com_au_news","description":"Latest Drive.com.au (Australia) articles: headline, publisher, publish time and link, newest first, optionally matching search words, from the last 1-30 days. F"},{"name":"search_gtex_gene_expression","description":"GTEx Portal gene expression (public API v2, no key): median TPM of one gene in human tissues, sorted highest first, with the GENCODE id it was matched to. Uses "},{"name":"search_cnbc","description":"CNBC top news from CNBC's public RSS feed (keyword filter on title/summary). Latest items only. Public feed, no key. Price: $0.002 in USDC per successful call, "},{"name":"search_dappradar_rankings","description":"Top 50 dapps from DappRadar's public rankings page: rank, name, token symbol, chains, market cap, token price, price change, trading volume, unique active walle"},{"name":"search_german_impressum","description":"Reads the Impressum (legal notice required on German websites, §5 TMG/DDG) at the page URL you give: e-mail addresses, phone numbers, postal address lines and t"},{"name":"search_datacite_metadata","description":"DataCite DOI search (public REST API, no key): DOI, title, publication year, resource type, publisher, creators and landing page for datasets, software and othe"},{"name":"search_al_jazeera_articles","description":"Al Jazeera latest articles from its public RSS feed (keyword filter on title/summary/categories). Latest items only. Public feed, no key. Price: $0.002 in USDC "},{"name":"search_defector_articles","description":"Defector articles from its public RSS feed (keyword filter on title/summary/tags). Latest items only; excerpts are as published in the feed. Public feed, no key"}],"toolCount":129,"toolsHash":"2b8cddd34f2c739236ddf55947a910f009cabe7beccbb64c2d7aa599059d6014","serverName":"sitecheck-web-intel","capabilities":["tools"],"serverVersion":"1.0.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-27T21:30:37.090Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":41,"error":null,"detail":{"tools":[{"name":"security_dns_records","description":"DNS records of a domain (A, AAAA, MX, NS, TXT, CNAME, CAA, SOA) resolved live through the public AdGuard DNS JSON resolver (NextDNS as backup). Shows answers as"},{"name":"security_whois_rdap","description":"Domain registration facts via RDAP (IANA bootstrap, then the registry's own server): registration, last change and expiry dates, days left, registrar name, stat"},{"name":"security_ssl_cert_chain","description":"HTTPS certificate chain and cipher audit for a host (port 443) from Qualys SSL Labs' cached report: grade, number of certificates in the chain, trust store, TLS"},{"name":"security_crtsh_transparency","description":"Subdomain names found in public Certificate Transparency logs for a domain (via CertSpotter): unique host names and wildcard names, issuers, latest issue date a"},{"name":"security_ip_geolocation_asn","description":"IPv4 or IPv6 address → covering BGP prefix, origin AS number and holder name, whether the prefix is announced, and a coarse country and map point, all from RIPE"},{"name":"security_security_headers","description":"Checks the live HTTP response headers of a site's home page (one GET, https) for Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, X-F"},{"name":"security_dmarc_spf_dkim","description":"Email authentication DNS records for a domain: DMARC policy (p, sp, pct, rua), SPF record and its all-mechanism, and DKIM public keys for a selector you give or"},{"name":"security_urlhaus_malware","description":"Checks whether a host (domain or IP) is known to abuse.ch URLhaus as a malware distribution host: first seen, number of malware URLs, Spamhaus DBL / SURBL statu"},{"name":"security_phishtank_check","description":"Looks one http or https URL up in the PhishTank phishing database (live checkurl lookup, no key). Returns whether PhishTank has the URL and, if so, its phish id"},{"name":"security_cve_nvd_lookup","description":"One CVE record from the NIST National Vulnerability Database: description, published and last-modified dates, NVD status, primary CVSS score and severity (v4.0,"},{"name":"security_tor_exit_nodes","description":"Checks an IPv4 address against the Tor Project's bulk exit list (about 1,200 active exit IPs). If it is an exit, adds the relays for that address from Onionoo: "},{"name":"security_vpn_proxy_detector","description":"Checks an IPv4 address against the public X4BNet list of commercial VPN provider address ranges (about 11,000 CIDR blocks, refreshed by the list's maintainer). "},{"name":"security_shodan_host_summary","description":"Shodan InternetDB summary for an IPv4 address (free, no key): open TCP ports, host names seen, CPE software identifiers, tags and CVE IDs Shodan associates with"},{"name":"security_censys_exposure","description":"Censys host view for an IPv4 address: the services, ports and protocols Censys has observed on it with their last scan time and detected software, plus autonomo"},{"name":"security_abuseipdb_check","description":"AbuseIPDB reputation for an IPv4 address over the last 90 days: abuse confidence score (0-100), number of abuse reports, last report date, ISP, usage type and c"},{"name":"security_grey_noise_noise","description":"GreyNoise Community lookup for an IPv4 address: whether it was seen mass-scanning the internet recently (noise), whether it is a known benign service (riot), it"},{"name":"security_hibp_breach_check","description":"Lists the data breaches HaveIBeenPwned has recorded for a domain (breach name, breach date, accounts affected, data types exposed, verified flag). It is the pub"},{"name":"security_cisa_known_exploits","description":"CISA's Known Exploited Vulnerabilities catalog (public JSON). With cveId: whether that CVE is on the list, with vendor, product, date added, federal due date, r"},{"name":"security_open_port_scanner","description":"Lists the TCP ports Shodan has seen open on an IPv4 address, from its pre-collected passive scan data (not a live scan: nothing connects to the address now). Th"},{"name":"security_dns_propagation","description":"Asks two independent public DNS resolvers (AdGuard DNS and NextDNS) for the same name and record type right now and reports whether they agree, with each answer"},{"name":"security_reverse_dns_ptr","description":"Reverse DNS (PTR) names for an IPv4 address, and forward-confirmed reverse DNS: whether each PTR name resolves back (A record) to the same address. Up to 3 PTR "},{"name":"security_bgp_prefix_origin","description":"For an IPv4 prefix (e.g. 8.8.8.0/24): the origin AS seen announcing it now across RIPE RIS peers, its RPKI status for that origin (valid, invalid or unknown), r"},{"name":"security_dnssec_validator","description":"DNSSEC check for a domain: whether a DS record exists at the parent zone (the domain is signed), and whether two public validating resolvers (AdGuard DNS, NextD"},{"name":"security_cors_misconfig","description":"Checks how a site's home page answers a cross-origin request from a made-up origin: whether it echoes that origin back, sends a wildcard (*), and whether creden"},{"name":"security_cookie_security","description":"Lists the cookies a site sets on its public home page (one anonymous GET, no login) with their Secure, HttpOnly and SameSite flags, and flags the ones missing a"},{"name":"security_subdomain_takeover","description":"For a subdomain: finds its CNAME, matches the target against the public can-i-take-over-xyz fingerprint list (services such as GitHub Pages, S3, Azure, WordPres"},{"name":"security_robots_security_txt","description":"Reads a site's public robots.txt (crawl rules, sitemaps, AI-crawler rules) and security.txt (RFC 9116: contact, expiry, policy), and says whether security.txt i"},{"name":"security_email_disposable","description":"Checks whether an email address's domain (or a domain you give) is on the community disposable and temporary email blocklist (about 9,900 domains). Only the dom"},{"name":"security_domain_typosquatting","description":"For a brand domain, generates up to 24 lookalike names (letter omission, doubling and swapping, plus .co/.net/.org/.io swaps) and checks which ones have name se"},{"name":"security_asn_peers_upstream","description":"For an autonomous system (e.g. AS13335): how many upstream (transit) and downstream neighbours RIPEstat sees in BGP, the top upstreams ranked by 'power' with th"},{"name":"security_tls_cipher_enum","description":"TLS versions a host accepts (SSL 3, TLS 1.0 and 1.1 flagged as deprecated) and its cipher-suite strength from Qualys SSL Labs' cached report: suite count per pr"},{"name":"security_open_resolver_check","description":"Reports whether Shodan's pre-collected passive scan data shows TCP port 53 (DNS) open on an IPv4 address. It is a passive port fact only: it does not send a que"},{"name":"security_ntp_monlist_audit","description":"Reports whether Shodan's pre-collected passive scan data shows NTP (port 123) seen open on an IPv4 address. Passive and possibly old; the monlist amplification "},{"name":"security_snmp_exposure","description":"Reports whether Shodan's pre-collected passive scan data shows SNMP (UDP port 161) seen open on an IPv4 address. Passive and possibly old; no community string i"},{"name":"security_ssh_banner_audit","description":"From Shodan's pre-collected passive scan data: whether TCP port 22 was seen open on an IPv4 address and any OpenSSH version identified in its software (CPE) lis"},{"name":"security_smb_exposure_test","description":"Checks Shodan's passive scan records for TCP port 445 (SMB) on an IPv4 address. Says whether SMB was seen open and when the record was last refreshed by the hos"},{"name":"security_rdp_exposure_check","description":"Checks Shodan's passive scan records for TCP port 3389 (RDP) on an IPv4 address. Says whether RDP was seen open (not a live test, and the record can be days old"},{"name":"security_spameatingmonkey","description":"Checks an IPv4 mail-sending address against the SpamEatingMonkey DNS blocklist (bl.spameatingmonkey.net) through public DNS. A listed address returns its 127.0."},{"name":"security_barracuda_reputation","description":"Checks an IPv4 mail-sending address against the Barracuda Reputation Block List (b.barracudacentral.org) through public DNS. Listed addresses return a 127.0.0.x"},{"name":"security_spamhaus_zen","description":"Spamhaus blocklist check through Spamhaus's official Data Query Service: an IPv4 address against ZEN (SBL spam sources, CSS snowshoe, XBL exploited/botnet hosts"},{"name":"security_surbl_uri_lookup","description":"Checks a domain against SURBL's multi-list (multi.surbl.org): whether it appears in spam or phishing URI lists. Listed domains return a 127.0.0.x code. Not list"},{"name":"security_openphish_feed","description":"Checks a URL or host against the OpenPhish public phishing feed (about 300 currently active phishing URLs, updated continuously). Returns whether the exact URL "},{"name":"security_threatfox_iocs","description":"Searches abuse.ch ThreatFox for indicators of compromise matching a term (IP, IP:port, domain, URL or file hash): IOC, type, malware family, threat type, confid"},{"name":"security_malbazaar_samples","description":"Looks up a file hash (SHA-256, SHA-1 or MD5) in abuse.ch MalwareBazaar: whether the sample is known, its other hashes, file name, type, size, signature (malware"},{"name":"security_feodotracker_c2","description":"Checks an IPv4 address against the abuse.ch Feodo Tracker botnet C2 blocklist (Emotet, QakBot and similar). A hit returns the port, online status, malware famil"},{"name":"security_sslbl_abuse_certs","description":"Checks a certificate SHA-1 fingerprint (40 hex characters) against the abuse.ch SSL Blacklist of certificates seen on malware botnet C2 servers. A hit returns t"},{"name":"security_ipsum_threat_level","description":"Checks an IPv4 address against IPsum, an aggregate of public blocklists: returns the number of source feeds that list it (its level, 1 to 8) and whether it is l"},{"name":"security_cymru_asn_lookup","description":"Maps an IPv4 address to its origin AS number, the BGP prefix that covers it, the country, the registry and the allocation date, using Team Cymru's public IP-to-"},{"name":"security_blocklist_de","description":"Checks an IPv4 address against the Blocklist.de 'all' list of IPs reported for attacks such as failed logins, SSH and mail abuse (about 24,000 addresses). A hit"},{"name":"security_ciarmy_bad_ips","description":"Checks an IPv4 address against the CI Army (CINS Score) bad-IP list, a collective-intelligence list of addresses that recently showed hostile activity across a "},{"name":"security_talos_ip_blacklist","description":"Cisco Talos reputation for an IPv4 address: threat level (favorable, neutral, poor, untrusted), web reputation score, forward/reverse DNS match, hostname, owner"},{"name":"security_mx_server_test","description":"For a mail domain: lists up to 3 MX hosts with their IPv4 addresses and, from Shodan's pre-collected passive scan data, which SMTP ports (25, 465, 587) were see"},{"name":"security_dkim_key_checker","description":"Reads the DKIM public key published at <selector>._domainkey.<domain>: key type, whether it is revoked (empty p=), decoded key size in bytes and a strength hint"},{"name":"security_bimi_record_audit","description":"Reads a domain's BIMI record (default._bimi.<domain> TXT): whether it is published, the SVG logo URL (l=) and the certificate URL (a=, a VMC or CMC for mailbox "},{"name":"security_mta_sts_validator","description":"Checks MTA-STS for a mail domain: the _mta-sts TXT record (v=STSv1 and id) and the HTTPS policy file (mode enforce, testing or none, the MX patterns and max_age"},{"name":"security_dns_caa_records","description":"Lists the CAA (Certification Authority Authorization) records published on a domain: which CAs may issue certificates (issue), wildcard certificates (issuewild)"},{"name":"security_tls_alpn_detector","description":"Reports which newer HTTP protocols a site advertises: HTTP/3 (h3) and older draft or HTTP/2 alternatives in its Alt-Svc response header, and the Alt-Svc max-age"},{"name":"security_cert_revocation_crl","description":"For a domain's current certificate (taken from public Certificate Transparency data via CertSpotter): reads its CRL Distribution Point, downloads that public CR"},{"name":"security_mitre_attck_matrix","description":"Looks up one MITRE ATT&CK technique (e.g. T1059 or T1059.001) on its official public page: its name, the tactic-level summary text and the page title. Reads one"},{"name":"security_epss_exploit_score","description":"EPSS (Exploit Prediction Scoring System) for one CVE from FIRST's public API: the estimated probability (0 to 1) of exploitation in the next 30 days, its percen"},{"name":"security_cve_details_feed","description":"Vulnerability trend for a vendor (optionally one product) from the NIST NVD: CVEs published in the last N days (default 7, up to 120; a big vendor over a long w"},{"name":"security_jwt_token_inspector","description":"Decodes a JWT you supply (header and payload, base64url JSON) and reports its algorithm, key id, claims, and time checks (exp, nbf, iat). Flags alg none, symmet"},{"name":"security_csp_evaluator_audit","description":"Reads the Content-Security-Policy header of a site's home page and lists weak points: 'unsafe-inline' and 'unsafe-eval' in script sources, bare wildcards, data:"},{"name":"security_referrer_policy_audit","description":"Reads a site's Referrer-Policy header and its <meta name=referrer> tag from the home page, works out the policy a browser would apply, and rates how much of the"},{"name":"security_crossdomain_xml_test","description":"Reads a site's public crossdomain.xml (Adobe Flash) and clientaccesspolicy.xml (Silverlight) if they exist, lists the origins they allow, and flags wildcard gra"},{"name":"search_website_content_crawler","description":"Reads one public web page and returns its title, description and main text as Markdown (headings, links, lists), plus link counts. Reads only the page you name:"},{"name":"search_wayback_cdx","description":"Internet Archive Wayback Machine CDX index: archived snapshots of a URL or domain (timestamp, original URL, MIME type, HTTP status, length) with a link to each "},{"name":"search_google_search","description":"Organic web search results from the Brave Search API (an independent web index, not Google's): rank, title, URL, snippet, site name, page age and language for t"},{"name":"search_google_ads","description":"Google Ads Transparency Center: search advertisers by name or domain (verified name, advertiser ID, country, approximate ad count), or list the ads of an advert"},{"name":"search_wsj_articles","description":"WSJ World News headlines from the public Dow Jones RSS feed (latest items; keyword filter on title/summary). Headlines and short summaries only; full articles a"},{"name":"search_bing_search","description":"Bing web search results (Bing's public RSS search output, no key): result title, URL and snippet, in Bing's ranking order. Shows the first page of results Bing "},{"name":"search_google_news","description":"Google News search (public Google News RSS search feed, no key, English/US edition): headline, publisher, publish time and the Google News link for the newest m"},{"name":"search_pr_newswire","description":"PR Newswire latest news-release list from its public RSS feed (keyword filter on title/summary). Press release headlines and summaries. Public feed, no key. Pri"},{"name":"search_beehiiv_newsletter","description":"Post archive of a beehiiv newsletter (by beehiiv subdomain, e.g. superhuman, or the newsletter's own domain if hosted on beehiiv): newsletter name, total posts,"},{"name":"search_benzinga","description":"Latest Benzinga financial news (the public JSON feed behind benzinga.com): headline, teaser, author, time, URL, tickers, channels and tags. Filter by stock tick"},{"name":"search_markdown_to_pdf_mcp","description":"npm registry search for MCP servers that convert Markdown to PDF (public npm search API, no key): package name, version, description, publisher, last publish da"},{"name":"search_unpaywall","description":"Unpaywall open-access lookup by DOI (free API; it requires a contact e-mail set in UNPAYWALL_EMAIL, not a key): is the paper open access, OA status, best free f"},{"name":"search_reuters_articles","description":"Latest Reuters articles: headline, publication time and link, newest first, optionally matching search words, from the last 1-30 days. Found through Google News"},{"name":"search_fifa_team_rankings","description":"FIFA men's national team world ranking (FIFA public ranking API, no key): position, team, country code, total points, previous points and previous rank for one "},{"name":"search_university_rankings_mega_pack","description":"University rankings side by side from ShanghaiRanking ARWU (rank, national rank, total and six indicator scores) and Times Higher Education World University Ran"},{"name":"search_freightwaves","description":"FreightWaves latest news from its public RSS feed (keyword filter on title/summary/categories). Feed carries only the latest few items. Public feed, no key. Pri"},{"name":"search_crossref","description":"Crossref works search (public REST API, no key): DOI, title, type, container (journal or book), year, authors and link for matching scholarly records. Metadata "},{"name":"search_bbc_news_articles","description":"BBC News top stories from the public BBC RSS feed (latest items; keyword filter on title/summary). Headlines and summaries only, no full article text. Public fe"},{"name":"search_article_extractor","description":"Extracts one article from a public news or blog page: headline (og:title or h1), author, published and modified times, description and the article body as Markd"},{"name":"search_owgr_golf_rankings","description":"Official World Golf Ranking (OWGR public ranking API, no key): current men's position, player name, country, total points, average points and last week's positi"},{"name":"search_techcrunch_articles","description":"TechCrunch latest articles from its public RSS feed (keyword filter on title/summary/tags). Headlines and excerpts only. Public feed, no key. Price: $0.002 in U"},{"name":"search_prnewswire_press_releases","description":"PR Newswire health-category press releases from its public RSS feed (keyword filter on title/summary). Latest items only. Public feed, no key. Price: $0.002 in "},{"name":"search_emedicine_articles","description":"Medscape eMedicine (Medscape Reference) clinical articles by specialty: title, topic category, article id and URL from the public specialty index, filtered by w"},{"name":"search_openprescribing","description":"NHS England primary-care prescribing for a drug (official NHSBSA English Prescribing Dataset, monthly, ~2 months behind; the raw data behind OpenPrescribing.net"},{"name":"search_ft_com_articles","description":"Financial Times headlines from the public FT RSS feeds: international homepage or any section/topic stream (world, markets, companies, technology, opinion, glob"},{"name":"search_wechat_articles","description":"WeChat Official Account (公众号) articles matching a query, from Sogou WeChat search (weixin.sogou.com): title, summary, account name, publish time and link, 10 pe"},{"name":"search_hacker_news","description":"Hacker News story search through the official HN Search API (Algolia, public, no key): title, article URL, author, points, comment count and discussion link. Re"},{"name":"search_drive_com_au_news","description":"Latest Drive.com.au (Australia) articles: headline, publisher, publish time and link, newest first, optionally matching search words, from the last 1-30 days. F"},{"name":"search_gtex_gene_expression","description":"GTEx Portal gene expression (public API v2, no key): median TPM of one gene in human tissues, sorted highest first, with the GENCODE id it was matched to. Uses "},{"name":"search_cnbc","description":"CNBC top news from CNBC's public RSS feed (keyword filter on title/summary). Latest items only. Public feed, no key. Price: $0.002 in USDC per successful call, "},{"name":"search_dappradar_rankings","description":"Top 50 dapps from DappRadar's public rankings page: rank, name, token symbol, chains, market cap, token price, price change, trading volume, unique active walle"},{"name":"search_german_impressum","description":"Reads the Impressum (legal notice required on German websites, §5 TMG/DDG) at the page URL you give: e-mail addresses, phone numbers, postal address lines and t"},{"name":"search_datacite_metadata","description":"DataCite DOI search (public REST API, no key): DOI, title, publication year, resource type, publisher, creators and landing page for datasets, software and othe"},{"name":"search_al_jazeera_articles","description":"Al Jazeera latest articles from its public RSS feed (keyword filter on title/summary/categories). Latest items only. Public feed, no key. Price: $0.002 in USDC "},{"name":"search_defector_articles","description":"Defector articles from its public RSS feed (keyword filter on title/summary/tags). Latest items only; excerpts are as published in the feed. Public feed, no key"}],"toolCount":129,"toolsHash":"2b8cddd34f2c739236ddf55947a910f009cabe7beccbb64c2d7aa599059d6014","serverName":"sitecheck-web-intel","capabilities":["tools"],"serverVersion":"1.0.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-27T14:26:10.568Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":75,"error":null,"detail":{"tools":[{"name":"security_dns_records","description":"DNS records of a domain (A, AAAA, MX, NS, TXT, CNAME, CAA, SOA) resolved live through the public AdGuard DNS JSON resolver (NextDNS as backup). Shows answers as"},{"name":"security_whois_rdap","description":"Domain registration facts via RDAP (IANA bootstrap, then the registry's own server): registration, last change and expiry dates, days left, registrar name, stat"},{"name":"security_ssl_cert_chain","description":"HTTPS certificate chain and cipher audit for a host (port 443) from Qualys SSL Labs' cached report: grade, number of certificates in the chain, trust store, TLS"},{"name":"security_crtsh_transparency","description":"Subdomain names found in public Certificate Transparency logs for a domain (via CertSpotter): unique host names and wildcard names, issuers, latest issue date a"},{"name":"security_ip_geolocation_asn","description":"IPv4 or IPv6 address → covering BGP prefix, origin AS number and holder name, whether the prefix is announced, and a coarse country and map point, all from RIPE"},{"name":"security_security_headers","description":"Checks the live HTTP response headers of a site's home page (one GET, https) for Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, X-F"},{"name":"security_dmarc_spf_dkim","description":"Email authentication DNS records for a domain: DMARC policy (p, sp, pct, rua), SPF record and its all-mechanism, and DKIM public keys for a selector you give or"},{"name":"security_urlhaus_malware","description":"Checks whether a host (domain or IP) is known to abuse.ch URLhaus as a malware distribution host: first seen, number of malware URLs, Spamhaus DBL / SURBL statu"},{"name":"security_phishtank_check","description":"Looks one http or https URL up in the PhishTank phishing database (live checkurl lookup, no key). Returns whether PhishTank has the URL and, if so, its phish id"},{"name":"security_cve_nvd_lookup","description":"One CVE record from the NIST National Vulnerability Database: description, published and last-modified dates, NVD status, primary CVSS score and severity (v4.0,"},{"name":"security_tor_exit_nodes","description":"Checks an IPv4 address against the Tor Project's bulk exit list (about 1,200 active exit IPs). If it is an exit, adds the relays for that address from Onionoo: "},{"name":"security_vpn_proxy_detector","description":"Checks an IPv4 address against the public X4BNet list of commercial VPN provider address ranges (about 11,000 CIDR blocks, refreshed by the list's maintainer). "},{"name":"security_shodan_host_summary","description":"Shodan InternetDB summary for an IPv4 address (free, no key): open TCP ports, host names seen, CPE software identifiers, tags and CVE IDs Shodan associates with"},{"name":"security_censys_exposure","description":"Censys host view for an IPv4 address: the services, ports and protocols Censys has observed on it with their last scan time and detected software, plus autonomo"},{"name":"security_abuseipdb_check","description":"AbuseIPDB reputation for an IPv4 address over the last 90 days: abuse confidence score (0-100), number of abuse reports, last report date, ISP, usage type and c"},{"name":"security_grey_noise_noise","description":"GreyNoise Community lookup for an IPv4 address: whether it was seen mass-scanning the internet recently (noise), whether it is a known benign service (riot), it"},{"name":"security_hibp_breach_check","description":"Lists the data breaches HaveIBeenPwned has recorded for a domain (breach name, breach date, accounts affected, data types exposed, verified flag). It is the pub"},{"name":"security_cisa_known_exploits","description":"CISA's Known Exploited Vulnerabilities catalog (public JSON). With cveId: whether that CVE is on the list, with vendor, product, date added, federal due date, r"},{"name":"security_open_port_scanner","description":"Lists the TCP ports Shodan has seen open on an IPv4 address, from its pre-collected passive scan data (not a live scan: nothing connects to the address now). Th"},{"name":"security_dns_propagation","description":"Asks two independent public DNS resolvers (AdGuard DNS and NextDNS) for the same name and record type right now and reports whether they agree, with each answer"},{"name":"security_reverse_dns_ptr","description":"Reverse DNS (PTR) names for an IPv4 address, and forward-confirmed reverse DNS: whether each PTR name resolves back (A record) to the same address. Up to 3 PTR "},{"name":"security_bgp_prefix_origin","description":"For an IPv4 prefix (e.g. 8.8.8.0/24): the origin AS seen announcing it now across RIPE RIS peers, its RPKI status for that origin (valid, invalid or unknown), r"},{"name":"security_dnssec_validator","description":"DNSSEC check for a domain: whether a DS record exists at the parent zone (the domain is signed), and whether two public validating resolvers (AdGuard DNS, NextD"},{"name":"security_cors_misconfig","description":"Checks how a site's home page answers a cross-origin request from a made-up origin: whether it echoes that origin back, sends a wildcard (*), and whether creden"},{"name":"security_cookie_security","description":"Lists the cookies a site sets on its public home page (one anonymous GET, no login) with their Secure, HttpOnly and SameSite flags, and flags the ones missing a"},{"name":"security_subdomain_takeover","description":"For a subdomain: finds its CNAME, matches the target against the public can-i-take-over-xyz fingerprint list (services such as GitHub Pages, S3, Azure, WordPres"},{"name":"security_robots_security_txt","description":"Reads a site's public robots.txt (crawl rules, sitemaps, AI-crawler rules) and security.txt (RFC 9116: contact, expiry, policy), and says whether security.txt i"},{"name":"security_email_disposable","description":"Checks whether an email address's domain (or a domain you give) is on the community disposable and temporary email blocklist (about 9,900 domains). Only the dom"},{"name":"security_domain_typosquatting","description":"For a brand domain, generates up to 24 lookalike names (letter omission, doubling and swapping, plus .co/.net/.org/.io swaps) and checks which ones have name se"},{"name":"security_asn_peers_upstream","description":"For an autonomous system (e.g. AS13335): how many upstream (transit) and downstream neighbours RIPEstat sees in BGP, the top upstreams ranked by 'power' with th"},{"name":"security_tls_cipher_enum","description":"TLS versions a host accepts (SSL 3, TLS 1.0 and 1.1 flagged as deprecated) and its cipher-suite strength from Qualys SSL Labs' cached report: suite count per pr"},{"name":"security_open_resolver_check","description":"Reports whether Shodan's pre-collected passive scan data shows TCP port 53 (DNS) open on an IPv4 address. It is a passive port fact only: it does not send a que"},{"name":"security_ntp_monlist_audit","description":"Reports whether Shodan's pre-collected passive scan data shows NTP (port 123) seen open on an IPv4 address. Passive and possibly old; the monlist amplification "},{"name":"security_snmp_exposure","description":"Reports whether Shodan's pre-collected passive scan data shows SNMP (UDP port 161) seen open on an IPv4 address. Passive and possibly old; no community string i"},{"name":"security_ssh_banner_audit","description":"From Shodan's pre-collected passive scan data: whether TCP port 22 was seen open on an IPv4 address and any OpenSSH version identified in its software (CPE) lis"},{"name":"security_smb_exposure_test","description":"Checks Shodan's passive scan records for TCP port 445 (SMB) on an IPv4 address. Says whether SMB was seen open and when the record was last refreshed by the hos"},{"name":"security_rdp_exposure_check","description":"Checks Shodan's passive scan records for TCP port 3389 (RDP) on an IPv4 address. Says whether RDP was seen open (not a live test, and the record can be days old"},{"name":"security_spameatingmonkey","description":"Checks an IPv4 mail-sending address against the SpamEatingMonkey DNS blocklist (bl.spameatingmonkey.net) through public DNS. A listed address returns its 127.0."},{"name":"security_barracuda_reputation","description":"Checks an IPv4 mail-sending address against the Barracuda Reputation Block List (b.barracudacentral.org) through public DNS. Listed addresses return a 127.0.0.x"},{"name":"security_spamhaus_zen","description":"Spamhaus blocklist check through Spamhaus's official Data Query Service: an IPv4 address against ZEN (SBL spam sources, CSS snowshoe, XBL exploited/botnet hosts"},{"name":"security_surbl_uri_lookup","description":"Checks a domain against SURBL's multi-list (multi.surbl.org): whether it appears in spam or phishing URI lists. Listed domains return a 127.0.0.x code. Not list"},{"name":"security_openphish_feed","description":"Checks a URL or host against the OpenPhish public phishing feed (about 300 currently active phishing URLs, updated continuously). Returns whether the exact URL "},{"name":"security_threatfox_iocs","description":"Searches abuse.ch ThreatFox for indicators of compromise matching a term (IP, IP:port, domain, URL or file hash): IOC, type, malware family, threat type, confid"},{"name":"security_malbazaar_samples","description":"Looks up a file hash (SHA-256, SHA-1 or MD5) in abuse.ch MalwareBazaar: whether the sample is known, its other hashes, file name, type, size, signature (malware"},{"name":"security_feodotracker_c2","description":"Checks an IPv4 address against the abuse.ch Feodo Tracker botnet C2 blocklist (Emotet, QakBot and similar). A hit returns the port, online status, malware famil"},{"name":"security_sslbl_abuse_certs","description":"Checks a certificate SHA-1 fingerprint (40 hex characters) against the abuse.ch SSL Blacklist of certificates seen on malware botnet C2 servers. A hit returns t"},{"name":"security_ipsum_threat_level","description":"Checks an IPv4 address against IPsum, an aggregate of public blocklists: returns the number of source feeds that list it (its level, 1 to 8) and whether it is l"},{"name":"security_cymru_asn_lookup","description":"Maps an IPv4 address to its origin AS number, the BGP prefix that covers it, the country, the registry and the allocation date, using Team Cymru's public IP-to-"},{"name":"security_blocklist_de","description":"Checks an IPv4 address against the Blocklist.de 'all' list of IPs reported for attacks such as failed logins, SSH and mail abuse (about 24,000 addresses). A hit"},{"name":"security_ciarmy_bad_ips","description":"Checks an IPv4 address against the CI Army (CINS Score) bad-IP list, a collective-intelligence list of addresses that recently showed hostile activity across a "},{"name":"security_talos_ip_blacklist","description":"Cisco Talos reputation for an IPv4 address: threat level (favorable, neutral, poor, untrusted), web reputation score, forward/reverse DNS match, hostname, owner"},{"name":"security_mx_server_test","description":"For a mail domain: lists up to 3 MX hosts with their IPv4 addresses and, from Shodan's pre-collected passive scan data, which SMTP ports (25, 465, 587) were see"},{"name":"security_dkim_key_checker","description":"Reads the DKIM public key published at <selector>._domainkey.<domain>: key type, whether it is revoked (empty p=), decoded key size in bytes and a strength hint"},{"name":"security_bimi_record_audit","description":"Reads a domain's BIMI record (default._bimi.<domain> TXT): whether it is published, the SVG logo URL (l=) and the certificate URL (a=, a VMC or CMC for mailbox "},{"name":"security_mta_sts_validator","description":"Checks MTA-STS for a mail domain: the _mta-sts TXT record (v=STSv1 and id) and the HTTPS policy file (mode enforce, testing or none, the MX patterns and max_age"},{"name":"security_dns_caa_records","description":"Lists the CAA (Certification Authority Authorization) records published on a domain: which CAs may issue certificates (issue), wildcard certificates (issuewild)"},{"name":"security_tls_alpn_detector","description":"Reports which newer HTTP protocols a site advertises: HTTP/3 (h3) and older draft or HTTP/2 alternatives in its Alt-Svc response header, and the Alt-Svc max-age"},{"name":"security_cert_revocation_crl","description":"For a domain's current certificate (taken from public Certificate Transparency data via CertSpotter): reads its CRL Distribution Point, downloads that public CR"},{"name":"security_mitre_attck_matrix","description":"Looks up one MITRE ATT&CK technique (e.g. T1059 or T1059.001) on its official public page: its name, the tactic-level summary text and the page title. Reads one"},{"name":"security_epss_exploit_score","description":"EPSS (Exploit Prediction Scoring System) for one CVE from FIRST's public API: the estimated probability (0 to 1) of exploitation in the next 30 days, its percen"},{"name":"security_cve_details_feed","description":"Vulnerability trend for a vendor (optionally one product) from the NIST NVD: CVEs published in the last N days (default 7, up to 120; a big vendor over a long w"},{"name":"security_jwt_token_inspector","description":"Decodes a JWT you supply (header and payload, base64url JSON) and reports its algorithm, key id, claims, and time checks (exp, nbf, iat). Flags alg none, symmet"},{"name":"security_csp_evaluator_audit","description":"Reads the Content-Security-Policy header of a site's home page and lists weak points: 'unsafe-inline' and 'unsafe-eval' in script sources, bare wildcards, data:"},{"name":"security_referrer_policy_audit","description":"Reads a site's Referrer-Policy header and its <meta name=referrer> tag from the home page, works out the policy a browser would apply, and rates how much of the"},{"name":"security_crossdomain_xml_test","description":"Reads a site's public crossdomain.xml (Adobe Flash) and clientaccesspolicy.xml (Silverlight) if they exist, lists the origins they allow, and flags wildcard gra"},{"name":"search_website_content_crawler","description":"Reads one public web page and returns its title, description and main text as Markdown (headings, links, lists), plus link counts. Reads only the page you name:"},{"name":"search_wayback_cdx","description":"Internet Archive Wayback Machine CDX index: archived snapshots of a URL or domain (timestamp, original URL, MIME type, HTTP status, length) with a link to each "},{"name":"search_google_search","description":"Organic web search results from the Brave Search API (an independent web index, not Google's): rank, title, URL, snippet, site name, page age and language for t"},{"name":"search_google_ads","description":"Google Ads Transparency Center: search advertisers by name or domain (verified name, advertiser ID, country, approximate ad count), or list the ads of an advert"},{"name":"search_wsj_articles","description":"WSJ World News headlines from the public Dow Jones RSS feed (latest items; keyword filter on title/summary). Headlines and short summaries only; full articles a"},{"name":"search_bing_search","description":"Bing web search results (Bing's public RSS search output, no key): result title, URL and snippet, in Bing's ranking order. Shows the first page of results Bing "},{"name":"search_google_news","description":"Google News search (public Google News RSS search feed, no key, English/US edition): headline, publisher, publish time and the Google News link for the newest m"},{"name":"search_pr_newswire","description":"PR Newswire latest news-release list from its public RSS feed (keyword filter on title/summary). Press release headlines and summaries. Public feed, no key. Pri"},{"name":"search_beehiiv_newsletter","description":"Post archive of a beehiiv newsletter (by beehiiv subdomain, e.g. superhuman, or the newsletter's own domain if hosted on beehiiv): newsletter name, total posts,"},{"name":"search_benzinga","description":"Latest Benzinga financial news (the public JSON feed behind benzinga.com): headline, teaser, author, time, URL, tickers, channels and tags. Filter by stock tick"},{"name":"search_markdown_to_pdf_mcp","description":"npm registry search for MCP servers that convert Markdown to PDF (public npm search API, no key): package name, version, description, publisher, last publish da"},{"name":"search_unpaywall","description":"Unpaywall open-access lookup by DOI (free API; it requires a contact e-mail set in UNPAYWALL_EMAIL, not a key): is the paper open access, OA status, best free f"},{"name":"search_reuters_articles","description":"Latest Reuters articles: headline, publication time and link, newest first, optionally matching search words, from the last 1-30 days. Found through Google News"},{"name":"search_fifa_team_rankings","description":"FIFA men's national team world ranking (FIFA public ranking API, no key): position, team, country code, total points, previous points and previous rank for one "},{"name":"search_university_rankings_mega_pack","description":"University rankings side by side from ShanghaiRanking ARWU (rank, national rank, total and six indicator scores) and Times Higher Education World University Ran"},{"name":"search_freightwaves","description":"FreightWaves latest news from its public RSS feed (keyword filter on title/summary/categories). Feed carries only the latest few items. Public feed, no key. Pri"},{"name":"search_crossref","description":"Crossref works search (public REST API, no key): DOI, title, type, container (journal or book), year, authors and link for matching scholarly records. Metadata "},{"name":"search_bbc_news_articles","description":"BBC News top stories from the public BBC RSS feed (latest items; keyword filter on title/summary). Headlines and summaries only, no full article text. Public fe"},{"name":"search_article_extractor","description":"Extracts one article from a public news or blog page: headline (og:title or h1), author, published and modified times, description and the article body as Markd"},{"name":"search_owgr_golf_rankings","description":"Official World Golf Ranking (OWGR public ranking API, no key): current men's position, player name, country, total points, average points and last week's positi"},{"name":"search_techcrunch_articles","description":"TechCrunch latest articles from its public RSS feed (keyword filter on title/summary/tags). Headlines and excerpts only. Public feed, no key. Price: $0.002 in U"},{"name":"search_prnewswire_press_releases","description":"PR Newswire health-category press releases from its public RSS feed (keyword filter on title/summary). Latest items only. Public feed, no key. Price: $0.002 in "},{"name":"search_emedicine_articles","description":"Medscape eMedicine (Medscape Reference) clinical articles by specialty: title, topic category, article id and URL from the public specialty index, filtered by w"},{"name":"search_openprescribing","description":"NHS England primary-care prescribing for a drug (official NHSBSA English Prescribing Dataset, monthly, ~2 months behind; the raw data behind OpenPrescribing.net"},{"name":"search_ft_com_articles","description":"Financial Times headlines from the public FT RSS feeds: international homepage or any section/topic stream (world, markets, companies, technology, opinion, glob"},{"name":"search_wechat_articles","description":"WeChat Official Account (公众号) articles matching a query, from Sogou WeChat search (weixin.sogou.com): title, summary, account name, publish time and link, 10 pe"},{"name":"search_hacker_news","description":"Hacker News story search through the official HN Search API (Algolia, public, no key): title, article URL, author, points, comment count and discussion link. Re"},{"name":"search_drive_com_au_news","description":"Latest Drive.com.au (Australia) articles: headline, publisher, publish time and link, newest first, optionally matching search words, from the last 1-30 days. F"},{"name":"search_gtex_gene_expression","description":"GTEx Portal gene expression (public API v2, no key): median TPM of one gene in human tissues, sorted highest first, with the GENCODE id it was matched to. Uses "},{"name":"search_cnbc","description":"CNBC top news from CNBC's public RSS feed (keyword filter on title/summary). Latest items only. Public feed, no key. Price: $0.002 in USDC per successful call, "},{"name":"search_dappradar_rankings","description":"Top 50 dapps from DappRadar's public rankings page: rank, name, token symbol, chains, market cap, token price, price change, trading volume, unique active walle"},{"name":"search_german_impressum","description":"Reads the Impressum (legal notice required on German websites, §5 TMG/DDG) at the page URL you give: e-mail addresses, phone numbers, postal address lines and t"},{"name":"search_datacite_metadata","description":"DataCite DOI search (public REST API, no key): DOI, title, publication year, resource type, publisher, creators and landing page for datasets, software and othe"},{"name":"search_al_jazeera_articles","description":"Al Jazeera latest articles from its public RSS feed (keyword filter on title/summary/categories). Latest items only. Public feed, no key. Price: $0.002 in USDC "},{"name":"search_defector_articles","description":"Defector articles from its public RSS feed (keyword filter on title/summary/tags). Latest items only; excerpts are as published in the feed. Public feed, no key"}],"toolCount":129,"toolsHash":"2b8cddd34f2c739236ddf55947a910f009cabe7beccbb64c2d7aa599059d6014","serverName":"sitecheck-web-intel","capabilities":["tools"],"serverVersion":"1.0.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-27T06:22:26.964Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":31,"error":null,"detail":{"tools":[{"name":"security_dns_records","description":"DNS records of a domain (A, AAAA, MX, NS, TXT, CNAME, CAA, SOA) resolved live through the public AdGuard DNS JSON resolver (NextDNS as backup). Shows answers as"},{"name":"security_whois_rdap","description":"Domain registration facts via RDAP (IANA bootstrap, then the registry's own server): registration, last change and expiry dates, days left, registrar name, stat"},{"name":"security_ssl_cert_chain","description":"HTTPS certificate chain and cipher audit for a host (port 443) from Qualys SSL Labs' cached report: grade, number of certificates in the chain, trust store, TLS"},{"name":"security_crtsh_transparency","description":"Subdomain names found in public Certificate Transparency logs for a domain (via CertSpotter): unique host names and wildcard names, issuers, latest issue date a"},{"name":"security_ip_geolocation_asn","description":"IPv4 or IPv6 address → covering BGP prefix, origin AS number and holder name, whether the prefix is announced, and a coarse country and map point, all from RIPE"},{"name":"security_security_headers","description":"Checks the live HTTP response headers of a site's home page (one GET, https) for Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, X-F"},{"name":"security_dmarc_spf_dkim","description":"Email authentication DNS records for a domain: DMARC policy (p, sp, pct, rua), SPF record and its all-mechanism, and DKIM public keys for a selector you give or"},{"name":"security_urlhaus_malware","description":"Checks whether a host (domain or IP) is known to abuse.ch URLhaus as a malware distribution host: first seen, number of malware URLs, Spamhaus DBL / SURBL statu"},{"name":"security_phishtank_check","description":"Looks one http or https URL up in the PhishTank phishing database (live checkurl lookup, no key). Returns whether PhishTank has the URL and, if so, its phish id"},{"name":"security_cve_nvd_lookup","description":"One CVE record from the NIST National Vulnerability Database: description, published and last-modified dates, NVD status, primary CVSS score and severity (v4.0,"},{"name":"security_tor_exit_nodes","description":"Checks an IPv4 address against the Tor Project's bulk exit list (about 1,200 active exit IPs). If it is an exit, adds the relays for that address from Onionoo: "},{"name":"security_vpn_proxy_detector","description":"Checks an IPv4 address against the public X4BNet list of commercial VPN provider address ranges (about 11,000 CIDR blocks, refreshed by the list's maintainer). "},{"name":"security_shodan_host_summary","description":"Shodan InternetDB summary for an IPv4 address (free, no key): open TCP ports, host names seen, CPE software identifiers, tags and CVE IDs Shodan associates with"},{"name":"security_censys_exposure","description":"Censys host view for an IPv4 address: the services, ports and protocols Censys has observed on it with their last scan time and detected software, plus autonomo"},{"name":"security_abuseipdb_check","description":"AbuseIPDB reputation for an IPv4 address over the last 90 days: abuse confidence score (0-100), number of abuse reports, last report date, ISP, usage type and c"},{"name":"security_grey_noise_noise","description":"GreyNoise Community lookup for an IPv4 address: whether it was seen mass-scanning the internet recently (noise), whether it is a known benign service (riot), it"},{"name":"security_hibp_breach_check","description":"Lists the data breaches HaveIBeenPwned has recorded for a domain (breach name, breach date, accounts affected, data types exposed, verified flag). It is the pub"},{"name":"security_cisa_known_exploits","description":"CISA's Known Exploited Vulnerabilities catalog (public JSON). With cveId: whether that CVE is on the list, with vendor, product, date added, federal due date, r"},{"name":"security_open_port_scanner","description":"Lists the TCP ports Shodan has seen open on an IPv4 address, from its pre-collected passive scan data (not a live scan: nothing connects to the address now). Th"},{"name":"security_dns_propagation","description":"Asks two independent public DNS resolvers (AdGuard DNS and NextDNS) for the same name and record type right now and reports whether they agree, with each answer"},{"name":"security_reverse_dns_ptr","description":"Reverse DNS (PTR) names for an IPv4 address, and forward-confirmed reverse DNS: whether each PTR name resolves back (A record) to the same address. Up to 3 PTR "},{"name":"security_bgp_prefix_origin","description":"For an IPv4 prefix (e.g. 8.8.8.0/24): the origin AS seen announcing it now across RIPE RIS peers, its RPKI status for that origin (valid, invalid or unknown), r"},{"name":"security_dnssec_validator","description":"DNSSEC check for a domain: whether a DS record exists at the parent zone (the domain is signed), and whether two public validating resolvers (AdGuard DNS, NextD"},{"name":"security_cors_misconfig","description":"Checks how a site's home page answers a cross-origin request from a made-up origin: whether it echoes that origin back, sends a wildcard (*), and whether creden"},{"name":"security_cookie_security","description":"Lists the cookies a site sets on its public home page (one anonymous GET, no login) with their Secure, HttpOnly and SameSite flags, and flags the ones missing a"},{"name":"security_subdomain_takeover","description":"For a subdomain: finds its CNAME, matches the target against the public can-i-take-over-xyz fingerprint list (services such as GitHub Pages, S3, Azure, WordPres"},{"name":"security_robots_security_txt","description":"Reads a site's public robots.txt (crawl rules, sitemaps, AI-crawler rules) and security.txt (RFC 9116: contact, expiry, policy), and says whether security.txt i"},{"name":"security_email_disposable","description":"Checks whether an email address's domain (or a domain you give) is on the community disposable and temporary email blocklist (about 9,900 domains). Only the dom"},{"name":"security_domain_typosquatting","description":"For a brand domain, generates up to 24 lookalike names (letter omission, doubling and swapping, plus .co/.net/.org/.io swaps) and checks which ones have name se"},{"name":"security_asn_peers_upstream","description":"For an autonomous system (e.g. AS13335): how many upstream (transit) and downstream neighbours RIPEstat sees in BGP, the top upstreams ranked by 'power' with th"},{"name":"security_tls_cipher_enum","description":"TLS versions a host accepts (SSL 3, TLS 1.0 and 1.1 flagged as deprecated) and its cipher-suite strength from Qualys SSL Labs' cached report: suite count per pr"},{"name":"security_open_resolver_check","description":"Reports whether Shodan's pre-collected passive scan data shows TCP port 53 (DNS) open on an IPv4 address. It is a passive port fact only: it does not send a que"},{"name":"security_ntp_monlist_audit","description":"Reports whether Shodan's pre-collected passive scan data shows NTP (port 123) seen open on an IPv4 address. Passive and possibly old; the monlist amplification "},{"name":"security_snmp_exposure","description":"Reports whether Shodan's pre-collected passive scan data shows SNMP (UDP port 161) seen open on an IPv4 address. Passive and possibly old; no community string i"},{"name":"security_ssh_banner_audit","description":"From Shodan's pre-collected passive scan data: whether TCP port 22 was seen open on an IPv4 address and any OpenSSH version identified in its software (CPE) lis"},{"name":"security_smb_exposure_test","description":"Checks Shodan's passive scan records for TCP port 445 (SMB) on an IPv4 address. Says whether SMB was seen open and when the record was last refreshed by the hos"},{"name":"security_rdp_exposure_check","description":"Checks Shodan's passive scan records for TCP port 3389 (RDP) on an IPv4 address. Says whether RDP was seen open (not a live test, and the record can be days old"},{"name":"security_spameatingmonkey","description":"Checks an IPv4 mail-sending address against the SpamEatingMonkey DNS blocklist (bl.spameatingmonkey.net) through public DNS. A listed address returns its 127.0."},{"name":"security_barracuda_reputation","description":"Checks an IPv4 mail-sending address against the Barracuda Reputation Block List (b.barracudacentral.org) through public DNS. Listed addresses return a 127.0.0.x"},{"name":"security_spamhaus_zen","description":"Spamhaus blocklist check through Spamhaus's official Data Query Service: an IPv4 address against ZEN (SBL spam sources, CSS snowshoe, XBL exploited/botnet hosts"},{"name":"security_surbl_uri_lookup","description":"Checks a domain against SURBL's multi-list (multi.surbl.org): whether it appears in spam or phishing URI lists. Listed domains return a 127.0.0.x code. Not list"},{"name":"security_openphish_feed","description":"Checks a URL or host against the OpenPhish public phishing feed (about 300 currently active phishing URLs, updated continuously). Returns whether the exact URL "},{"name":"security_threatfox_iocs","description":"Searches abuse.ch ThreatFox for indicators of compromise matching a term (IP, IP:port, domain, URL or file hash): IOC, type, malware family, threat type, confid"},{"name":"security_malbazaar_samples","description":"Looks up a file hash (SHA-256, SHA-1 or MD5) in abuse.ch MalwareBazaar: whether the sample is known, its other hashes, file name, type, size, signature (malware"},{"name":"security_feodotracker_c2","description":"Checks an IPv4 address against the abuse.ch Feodo Tracker botnet C2 blocklist (Emotet, QakBot and similar). A hit returns the port, online status, malware famil"},{"name":"security_sslbl_abuse_certs","description":"Checks a certificate SHA-1 fingerprint (40 hex characters) against the abuse.ch SSL Blacklist of certificates seen on malware botnet C2 servers. A hit returns t"},{"name":"security_ipsum_threat_level","description":"Checks an IPv4 address against IPsum, an aggregate of public blocklists: returns the number of source feeds that list it (its level, 1 to 8) and whether it is l"},{"name":"security_cymru_asn_lookup","description":"Maps an IPv4 address to its origin AS number, the BGP prefix that covers it, the country, the registry and the allocation date, using Team Cymru's public IP-to-"},{"name":"security_blocklist_de","description":"Checks an IPv4 address against the Blocklist.de 'all' list of IPs reported for attacks such as failed logins, SSH and mail abuse (about 24,000 addresses). A hit"},{"name":"security_ciarmy_bad_ips","description":"Checks an IPv4 address against the CI Army (CINS Score) bad-IP list, a collective-intelligence list of addresses that recently showed hostile activity across a "},{"name":"security_talos_ip_blacklist","description":"Cisco Talos reputation for an IPv4 address: threat level (favorable, neutral, poor, untrusted), web reputation score, forward/reverse DNS match, hostname, owner"},{"name":"security_mx_server_test","description":"For a mail domain: lists up to 3 MX hosts with their IPv4 addresses and, from Shodan's pre-collected passive scan data, which SMTP ports (25, 465, 587) were see"},{"name":"security_dkim_key_checker","description":"Reads the DKIM public key published at <selector>._domainkey.<domain>: key type, whether it is revoked (empty p=), decoded key size in bytes and a strength hint"},{"name":"security_bimi_record_audit","description":"Reads a domain's BIMI record (default._bimi.<domain> TXT): whether it is published, the SVG logo URL (l=) and the certificate URL (a=, a VMC or CMC for mailbox "},{"name":"security_mta_sts_validator","description":"Checks MTA-STS for a mail domain: the _mta-sts TXT record (v=STSv1 and id) and the HTTPS policy file (mode enforce, testing or none, the MX patterns and max_age"},{"name":"security_dns_caa_records","description":"Lists the CAA (Certification Authority Authorization) records published on a domain: which CAs may issue certificates (issue), wildcard certificates (issuewild)"},{"name":"security_tls_alpn_detector","description":"Reports which newer HTTP protocols a site advertises: HTTP/3 (h3) and older draft or HTTP/2 alternatives in its Alt-Svc response header, and the Alt-Svc max-age"},{"name":"security_cert_revocation_crl","description":"For a domain's current certificate (taken from public Certificate Transparency data via CertSpotter): reads its CRL Distribution Point, downloads that public CR"},{"name":"security_mitre_attck_matrix","description":"Looks up one MITRE ATT&CK technique (e.g. T1059 or T1059.001) on its official public page: its name, the tactic-level summary text and the page title. Reads one"},{"name":"security_epss_exploit_score","description":"EPSS (Exploit Prediction Scoring System) for one CVE from FIRST's public API: the estimated probability (0 to 1) of exploitation in the next 30 days, its percen"},{"name":"security_cve_details_feed","description":"Vulnerability trend for a vendor (optionally one product) from the NIST NVD: CVEs published in the last N days (default 7, up to 120; a big vendor over a long w"},{"name":"security_jwt_token_inspector","description":"Decodes a JWT you supply (header and payload, base64url JSON) and reports its algorithm, key id, claims, and time checks (exp, nbf, iat). Flags alg none, symmet"},{"name":"security_csp_evaluator_audit","description":"Reads the Content-Security-Policy header of a site's home page and lists weak points: 'unsafe-inline' and 'unsafe-eval' in script sources, bare wildcards, data:"},{"name":"security_referrer_policy_audit","description":"Reads a site's Referrer-Policy header and its <meta name=referrer> tag from the home page, works out the policy a browser would apply, and rates how much of the"},{"name":"security_crossdomain_xml_test","description":"Reads a site's public crossdomain.xml (Adobe Flash) and clientaccesspolicy.xml (Silverlight) if they exist, lists the origins they allow, and flags wildcard gra"},{"name":"search_website_content_crawler","description":"Reads one public web page and returns its title, description and main text as Markdown (headings, links, lists), plus link counts. Reads only the page you name:"},{"name":"search_wayback_cdx","description":"Internet Archive Wayback Machine CDX index: archived snapshots of a URL or domain (timestamp, original URL, MIME type, HTTP status, length) with a link to each "},{"name":"search_google_search","description":"Organic web search results from the Brave Search API (an independent web index, not Google's): rank, title, URL, snippet, site name, page age and language for t"},{"name":"search_google_ads","description":"Google Ads Transparency Center: search advertisers by name or domain (verified name, advertiser ID, country, approximate ad count), or list the ads of an advert"},{"name":"search_wsj_articles","description":"WSJ World News headlines from the public Dow Jones RSS feed (latest items; keyword filter on title/summary). Headlines and short summaries only; full articles a"},{"name":"search_bing_search","description":"Bing web search results (Bing's public RSS search output, no key): result title, URL and snippet, in Bing's ranking order. Shows the first page of results Bing "},{"name":"search_google_news","description":"Google News search (public Google News RSS search feed, no key, English/US edition): headline, publisher, publish time and the Google News link for the newest m"},{"name":"search_pr_newswire","description":"PR Newswire latest news-release list from its public RSS feed (keyword filter on title/summary). Press release headlines and summaries. Public feed, no key. Pri"},{"name":"search_beehiiv_newsletter","description":"Post archive of a beehiiv newsletter (by beehiiv subdomain, e.g. superhuman, or the newsletter's own domain if hosted on beehiiv): newsletter name, total posts,"},{"name":"search_benzinga","description":"Latest Benzinga financial news (the public JSON feed behind benzinga.com): headline, teaser, author, time, URL, tickers, channels and tags. Filter by stock tick"},{"name":"search_markdown_to_pdf_mcp","description":"npm registry search for MCP servers that convert Markdown to PDF (public npm search API, no key): package name, version, description, publisher, last publish da"},{"name":"search_unpaywall","description":"Unpaywall open-access lookup by DOI (free API; it requires a contact e-mail set in UNPAYWALL_EMAIL, not a key): is the paper open access, OA status, best free f"},{"name":"search_reuters_articles","description":"Latest Reuters articles: headline, publication time and link, newest first, optionally matching search words, from the last 1-30 days. Found through Google News"},{"name":"search_fifa_team_rankings","description":"FIFA men's national team world ranking (FIFA public ranking API, no key): position, team, country code, total points, previous points and previous rank for one "},{"name":"search_university_rankings_mega_pack","description":"University rankings side by side from ShanghaiRanking ARWU (rank, national rank, total and six indicator scores) and Times Higher Education World University Ran"},{"name":"search_freightwaves","description":"FreightWaves latest news from its public RSS feed (keyword filter on title/summary/categories). Feed carries only the latest few items. Public feed, no key. Pri"},{"name":"search_crossref","description":"Crossref works search (public REST API, no key): DOI, title, type, container (journal or book), year, authors and link for matching scholarly records. Metadata "},{"name":"search_bbc_news_articles","description":"BBC News top stories from the public BBC RSS feed (latest items; keyword filter on title/summary). Headlines and summaries only, no full article text. Public fe"},{"name":"search_article_extractor","description":"Extracts one article from a public news or blog page: headline (og:title or h1), author, published and modified times, description and the article body as Markd"},{"name":"search_owgr_golf_rankings","description":"Official World Golf Ranking (OWGR public ranking API, no key): current men's position, player name, country, total points, average points and last week's positi"},{"name":"search_techcrunch_articles","description":"TechCrunch latest articles from its public RSS feed (keyword filter on title/summary/tags). Headlines and excerpts only. Public feed, no key. Price: $0.002 in U"},{"name":"search_prnewswire_press_releases","description":"PR Newswire health-category press releases from its public RSS feed (keyword filter on title/summary). Latest items only. Public feed, no key. Price: $0.002 in "},{"name":"search_emedicine_articles","description":"Medscape eMedicine (Medscape Reference) clinical articles by specialty: title, topic category, article id and URL from the public specialty index, filtered by w"},{"name":"search_openprescribing","description":"NHS England primary-care prescribing for a drug (official NHSBSA English Prescribing Dataset, monthly, ~2 months behind; the raw data behind OpenPrescribing.net"},{"name":"search_ft_com_articles","description":"Financial Times headlines from the public FT RSS feeds: international homepage or any section/topic stream (world, markets, companies, technology, opinion, glob"},{"name":"search_wechat_articles","description":"WeChat Official Account (公众号) articles matching a query, from Sogou WeChat search (weixin.sogou.com): title, summary, account name, publish time and link, 10 pe"},{"name":"search_hacker_news","description":"Hacker News story search through the official HN Search API (Algolia, public, no key): title, article URL, author, points, comment count and discussion link. Re"},{"name":"search_drive_com_au_news","description":"Latest Drive.com.au (Australia) articles: headline, publisher, publish time and link, newest first, optionally matching search words, from the last 1-30 days. F"},{"name":"search_gtex_gene_expression","description":"GTEx Portal gene expression (public API v2, no key): median TPM of one gene in human tissues, sorted highest first, with the GENCODE id it was matched to. Uses "},{"name":"search_cnbc","description":"CNBC top news from CNBC's public RSS feed (keyword filter on title/summary). Latest items only. Public feed, no key. Price: $0.002 in USDC per successful call, "},{"name":"search_dappradar_rankings","description":"Top 50 dapps from DappRadar's public rankings page: rank, name, token symbol, chains, market cap, token price, price change, trading volume, unique active walle"},{"name":"search_german_impressum","description":"Reads the Impressum (legal notice required on German websites, §5 TMG/DDG) at the page URL you give: e-mail addresses, phone numbers, postal address lines and t"},{"name":"search_datacite_metadata","description":"DataCite DOI search (public REST API, no key): DOI, title, publication year, resource type, publisher, creators and landing page for datasets, software and othe"},{"name":"search_al_jazeera_articles","description":"Al Jazeera latest articles from its public RSS feed (keyword filter on title/summary/categories). Latest items only. Public feed, no key. Price: $0.002 in USDC "},{"name":"search_defector_articles","description":"Defector articles from its public RSS feed (keyword filter on title/summary/tags). Latest items only; excerpts are as published in the feed. Public feed, no key"}],"toolCount":129,"toolsHash":"2b8cddd34f2c739236ddf55947a910f009cabe7beccbb64c2d7aa599059d6014","serverName":"sitecheck-web-intel","capabilities":["tools"],"serverVersion":"1.0.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-26T22:24:48.882Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":31,"error":null,"detail":{"tools":[{"name":"security_dns_records","description":"DNS records of a domain (A, AAAA, MX, NS, TXT, CNAME, CAA, SOA) resolved live through the public AdGuard DNS JSON resolver (NextDNS as backup). Shows answers as"},{"name":"security_whois_rdap","description":"Domain registration facts via RDAP (IANA bootstrap, then the registry's own server): registration, last change and expiry dates, days left, registrar name, stat"},{"name":"security_ssl_cert_chain","description":"HTTPS certificate chain and cipher audit for a host (port 443) from Qualys SSL Labs' cached report: grade, number of certificates in the chain, trust store, TLS"},{"name":"security_crtsh_transparency","description":"Subdomain names found in public Certificate Transparency logs for a domain (via CertSpotter): unique host names and wildcard names, issuers, latest issue date a"},{"name":"security_ip_geolocation_asn","description":"IPv4 or IPv6 address → covering BGP prefix, origin AS number and holder name, whether the prefix is announced, and a coarse country and map point, all from RIPE"},{"name":"security_security_headers","description":"Checks the live HTTP response headers of a site's home page (one GET, https) for Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, X-F"},{"name":"security_dmarc_spf_dkim","description":"Email authentication DNS records for a domain: DMARC policy (p, sp, pct, rua), SPF record and its all-mechanism, and DKIM public keys for a selector you give or"},{"name":"security_urlhaus_malware","description":"Checks whether a host (domain or IP) is known to abuse.ch URLhaus as a malware distribution host: first seen, number of malware URLs, Spamhaus DBL / SURBL statu"},{"name":"security_phishtank_check","description":"Looks one http or https URL up in the PhishTank phishing database (live checkurl lookup, no key). Returns whether PhishTank has the URL and, if so, its phish id"},{"name":"security_cve_nvd_lookup","description":"One CVE record from the NIST National Vulnerability Database: description, published and last-modified dates, NVD status, primary CVSS score and severity (v4.0,"},{"name":"security_tor_exit_nodes","description":"Checks an IPv4 address against the Tor Project's bulk exit list (about 1,200 active exit IPs). If it is an exit, adds the relays for that address from Onionoo: "},{"name":"security_vpn_proxy_detector","description":"Checks an IPv4 address against the public X4BNet list of commercial VPN provider address ranges (about 11,000 CIDR blocks, refreshed by the list's maintainer). "},{"name":"security_shodan_host_summary","description":"Shodan InternetDB summary for an IPv4 address (free, no key): open TCP ports, host names seen, CPE software identifiers, tags and CVE IDs Shodan associates with"},{"name":"security_censys_exposure","description":"Censys host view for an IPv4 address: the services, ports and protocols Censys has observed on it with their last scan time and detected software, plus autonomo"},{"name":"security_abuseipdb_check","description":"AbuseIPDB reputation for an IPv4 address over the last 90 days: abuse confidence score (0-100), number of abuse reports, last report date, ISP, usage type and c"},{"name":"security_grey_noise_noise","description":"GreyNoise Community lookup for an IPv4 address: whether it was seen mass-scanning the internet recently (noise), whether it is a known benign service (riot), it"},{"name":"security_hibp_breach_check","description":"Lists the data breaches HaveIBeenPwned has recorded for a domain (breach name, breach date, accounts affected, data types exposed, verified flag). It is the pub"},{"name":"security_cisa_known_exploits","description":"CISA's Known Exploited Vulnerabilities catalog (public JSON). With cveId: whether that CVE is on the list, with vendor, product, date added, federal due date, r"},{"name":"security_open_port_scanner","description":"Lists the TCP ports Shodan has seen open on an IPv4 address, from its pre-collected passive scan data (not a live scan: nothing connects to the address now). Th"},{"name":"security_dns_propagation","description":"Asks two independent public DNS resolvers (AdGuard DNS and NextDNS) for the same name and record type right now and reports whether they agree, with each answer"},{"name":"security_reverse_dns_ptr","description":"Reverse DNS (PTR) names for an IPv4 address, and forward-confirmed reverse DNS: whether each PTR name resolves back (A record) to the same address. Up to 3 PTR "},{"name":"security_bgp_prefix_origin","description":"For an IPv4 prefix (e.g. 8.8.8.0/24): the origin AS seen announcing it now across RIPE RIS peers, its RPKI status for that origin (valid, invalid or unknown), r"},{"name":"security_dnssec_validator","description":"DNSSEC check for a domain: whether a DS record exists at the parent zone (the domain is signed), and whether two public validating resolvers (AdGuard DNS, NextD"},{"name":"security_cors_misconfig","description":"Checks how a site's home page answers a cross-origin request from a made-up origin: whether it echoes that origin back, sends a wildcard (*), and whether creden"},{"name":"security_cookie_security","description":"Lists the cookies a site sets on its public home page (one anonymous GET, no login) with their Secure, HttpOnly and SameSite flags, and flags the ones missing a"},{"name":"security_subdomain_takeover","description":"For a subdomain: finds its CNAME, matches the target against the public can-i-take-over-xyz fingerprint list (services such as GitHub Pages, S3, Azure, WordPres"},{"name":"security_robots_security_txt","description":"Reads a site's public robots.txt (crawl rules, sitemaps, AI-crawler rules) and security.txt (RFC 9116: contact, expiry, policy), and says whether security.txt i"},{"name":"security_email_disposable","description":"Checks whether an email address's domain (or a domain you give) is on the community disposable and temporary email blocklist (about 9,900 domains). Only the dom"},{"name":"security_domain_typosquatting","description":"For a brand domain, generates up to 24 lookalike names (letter omission, doubling and swapping, plus .co/.net/.org/.io swaps) and checks which ones have name se"},{"name":"security_asn_peers_upstream","description":"For an autonomous system (e.g. AS13335): how many upstream (transit) and downstream neighbours RIPEstat sees in BGP, the top upstreams ranked by 'power' with th"},{"name":"security_tls_cipher_enum","description":"TLS versions a host accepts (SSL 3, TLS 1.0 and 1.1 flagged as deprecated) and its cipher-suite strength from Qualys SSL Labs' cached report: suite count per pr"},{"name":"security_open_resolver_check","description":"Reports whether Shodan's pre-collected passive scan data shows TCP port 53 (DNS) open on an IPv4 address. It is a passive port fact only: it does not send a que"},{"name":"security_ntp_monlist_audit","description":"Reports whether Shodan's pre-collected passive scan data shows NTP (port 123) seen open on an IPv4 address. Passive and possibly old; the monlist amplification "},{"name":"security_snmp_exposure","description":"Reports whether Shodan's pre-collected passive scan data shows SNMP (UDP port 161) seen open on an IPv4 address. Passive and possibly old; no community string i"},{"name":"security_ssh_banner_audit","description":"From Shodan's pre-collected passive scan data: whether TCP port 22 was seen open on an IPv4 address and any OpenSSH version identified in its software (CPE) lis"},{"name":"security_smb_exposure_test","description":"Checks Shodan's passive scan records for TCP port 445 (SMB) on an IPv4 address. Says whether SMB was seen open and when the record was last refreshed by the hos"},{"name":"security_rdp_exposure_check","description":"Checks Shodan's passive scan records for TCP port 3389 (RDP) on an IPv4 address. Says whether RDP was seen open (not a live test, and the record can be days old"},{"name":"security_spameatingmonkey","description":"Checks an IPv4 mail-sending address against the SpamEatingMonkey DNS blocklist (bl.spameatingmonkey.net) through public DNS. A listed address returns its 127.0."},{"name":"security_barracuda_reputation","description":"Checks an IPv4 mail-sending address against the Barracuda Reputation Block List (b.barracudacentral.org) through public DNS. Listed addresses return a 127.0.0.x"},{"name":"security_spamhaus_zen","description":"Spamhaus blocklist check through Spamhaus's official Data Query Service: an IPv4 address against ZEN (SBL spam sources, CSS snowshoe, XBL exploited/botnet hosts"},{"name":"security_surbl_uri_lookup","description":"Checks a domain against SURBL's multi-list (multi.surbl.org): whether it appears in spam or phishing URI lists. Listed domains return a 127.0.0.x code. Not list"},{"name":"security_openphish_feed","description":"Checks a URL or host against the OpenPhish public phishing feed (about 300 currently active phishing URLs, updated continuously). Returns whether the exact URL "},{"name":"security_threatfox_iocs","description":"Searches abuse.ch ThreatFox for indicators of compromise matching a term (IP, IP:port, domain, URL or file hash): IOC, type, malware family, threat type, confid"},{"name":"security_malbazaar_samples","description":"Looks up a file hash (SHA-256, SHA-1 or MD5) in abuse.ch MalwareBazaar: whether the sample is known, its other hashes, file name, type, size, signature (malware"},{"name":"security_feodotracker_c2","description":"Checks an IPv4 address against the abuse.ch Feodo Tracker botnet C2 blocklist (Emotet, QakBot and similar). A hit returns the port, online status, malware famil"},{"name":"security_sslbl_abuse_certs","description":"Checks a certificate SHA-1 fingerprint (40 hex characters) against the abuse.ch SSL Blacklist of certificates seen on malware botnet C2 servers. A hit returns t"},{"name":"security_ipsum_threat_level","description":"Checks an IPv4 address against IPsum, an aggregate of public blocklists: returns the number of source feeds that list it (its level, 1 to 8) and whether it is l"},{"name":"security_cymru_asn_lookup","description":"Maps an IPv4 address to its origin AS number, the BGP prefix that covers it, the country, the registry and the allocation date, using Team Cymru's public IP-to-"},{"name":"security_blocklist_de","description":"Checks an IPv4 address against the Blocklist.de 'all' list of IPs reported for attacks such as failed logins, SSH and mail abuse (about 24,000 addresses). A hit"},{"name":"security_ciarmy_bad_ips","description":"Checks an IPv4 address against the CI Army (CINS Score) bad-IP list, a collective-intelligence list of addresses that recently showed hostile activity across a "},{"name":"security_talos_ip_blacklist","description":"Cisco Talos reputation for an IPv4 address: threat level (favorable, neutral, poor, untrusted), web reputation score, forward/reverse DNS match, hostname, owner"},{"name":"security_mx_server_test","description":"For a mail domain: lists up to 3 MX hosts with their IPv4 addresses and, from Shodan's pre-collected passive scan data, which SMTP ports (25, 465, 587) were see"},{"name":"security_dkim_key_checker","description":"Reads the DKIM public key published at <selector>._domainkey.<domain>: key type, whether it is revoked (empty p=), decoded key size in bytes and a strength hint"},{"name":"security_bimi_record_audit","description":"Reads a domain's BIMI record (default._bimi.<domain> TXT): whether it is published, the SVG logo URL (l=) and the certificate URL (a=, a VMC or CMC for mailbox "},{"name":"security_mta_sts_validator","description":"Checks MTA-STS for a mail domain: the _mta-sts TXT record (v=STSv1 and id) and the HTTPS policy file (mode enforce, testing or none, the MX patterns and max_age"},{"name":"security_dns_caa_records","description":"Lists the CAA (Certification Authority Authorization) records published on a domain: which CAs may issue certificates (issue), wildcard certificates (issuewild)"},{"name":"security_tls_alpn_detector","description":"Reports which newer HTTP protocols a site advertises: HTTP/3 (h3) and older draft or HTTP/2 alternatives in its Alt-Svc response header, and the Alt-Svc max-age"},{"name":"security_cert_revocation_crl","description":"For a domain's current certificate (taken from public Certificate Transparency data via CertSpotter): reads its CRL Distribution Point, downloads that public CR"},{"name":"security_mitre_attck_matrix","description":"Looks up one MITRE ATT&CK technique (e.g. T1059 or T1059.001) on its official public page: its name, the tactic-level summary text and the page title. Reads one"},{"name":"security_epss_exploit_score","description":"EPSS (Exploit Prediction Scoring System) for one CVE from FIRST's public API: the estimated probability (0 to 1) of exploitation in the next 30 days, its percen"},{"name":"security_cve_details_feed","description":"Vulnerability trend for a vendor (optionally one product) from the NIST NVD: CVEs published in the last N days (default 7, up to 120; a big vendor over a long w"},{"name":"security_jwt_token_inspector","description":"Decodes a JWT you supply (header and payload, base64url JSON) and reports its algorithm, key id, claims, and time checks (exp, nbf, iat). Flags alg none, symmet"},{"name":"security_csp_evaluator_audit","description":"Reads the Content-Security-Policy header of a site's home page and lists weak points: 'unsafe-inline' and 'unsafe-eval' in script sources, bare wildcards, data:"},{"name":"security_referrer_policy_audit","description":"Reads a site's Referrer-Policy header and its <meta name=referrer> tag from the home page, works out the policy a browser would apply, and rates how much of the"},{"name":"security_crossdomain_xml_test","description":"Reads a site's public crossdomain.xml (Adobe Flash) and clientaccesspolicy.xml (Silverlight) if they exist, lists the origins they allow, and flags wildcard gra"},{"name":"search_website_content_crawler","description":"Reads one public web page and returns its title, description and main text as Markdown (headings, links, lists), plus link counts. Reads only the page you name:"},{"name":"search_wayback_cdx","description":"Internet Archive Wayback Machine CDX index: archived snapshots of a URL or domain (timestamp, original URL, MIME type, HTTP status, length) with a link to each "},{"name":"search_google_search","description":"Organic web search results from the Brave Search API (an independent web index, not Google's): rank, title, URL, snippet, site name, page age and language for t"},{"name":"search_google_ads","description":"Google Ads Transparency Center: search advertisers by name or domain (verified name, advertiser ID, country, approximate ad count), or list the ads of an advert"},{"name":"search_wsj_articles","description":"WSJ World News headlines from the public Dow Jones RSS feed (latest items; keyword filter on title/summary). Headlines and short summaries only; full articles a"},{"name":"search_bing_search","description":"Bing web search results (Bing's public RSS search output, no key): result title, URL and snippet, in Bing's ranking order. Shows the first page of results Bing "},{"name":"search_google_news","description":"Google News search (public Google News RSS search feed, no key, English/US edition): headline, publisher, publish time and the Google News link for the newest m"},{"name":"search_pr_newswire","description":"PR Newswire latest news-release list from its public RSS feed (keyword filter on title/summary). Press release headlines and summaries. Public feed, no key. Pri"},{"name":"search_beehiiv_newsletter","description":"Post archive of a beehiiv newsletter (by beehiiv subdomain, e.g. superhuman, or the newsletter's own domain if hosted on beehiiv): newsletter name, total posts,"},{"name":"search_benzinga","description":"Latest Benzinga financial news (the public JSON feed behind benzinga.com): headline, teaser, author, time, URL, tickers, channels and tags. Filter by stock tick"},{"name":"search_markdown_to_pdf_mcp","description":"npm registry search for MCP servers that convert Markdown to PDF (public npm search API, no key): package name, version, description, publisher, last publish da"},{"name":"search_unpaywall","description":"Unpaywall open-access lookup by DOI (free API; it requires a contact e-mail set in UNPAYWALL_EMAIL, not a key): is the paper open access, OA status, best free f"},{"name":"search_reuters_articles","description":"Reuters latest articles from Reuters' public news sitemap (no key): headline, article URL and publication time, newest first. Covers only the most recent items "},{"name":"search_fifa_team_rankings","description":"FIFA men's national team world ranking (FIFA public ranking API, no key): position, team, country code, total points, previous points and previous rank for one "},{"name":"search_university_rankings_mega_pack","description":"University rankings side by side from ShanghaiRanking ARWU (rank, national rank, total and six indicator scores) and Times Higher Education World University Ran"},{"name":"search_freightwaves","description":"FreightWaves latest news from its public RSS feed (keyword filter on title/summary/categories). Feed carries only the latest few items. Public feed, no key. Pri"},{"name":"search_crossref","description":"Crossref works search (public REST API, no key): DOI, title, type, container (journal or book), year, authors and link for matching scholarly records. Metadata "},{"name":"search_bbc_news_articles","description":"BBC News top stories from the public BBC RSS feed (latest items; keyword filter on title/summary). Headlines and summaries only, no full article text. Public fe"},{"name":"search_article_extractor","description":"Extracts one article from a public news or blog page: headline (og:title or h1), author, published and modified times, description and the article body as Markd"},{"name":"search_owgr_golf_rankings","description":"Official World Golf Ranking (OWGR public ranking API, no key): current men's position, player name, country, total points, average points and last week's positi"},{"name":"search_techcrunch_articles","description":"TechCrunch latest articles from its public RSS feed (keyword filter on title/summary/tags). Headlines and excerpts only. Public feed, no key. Price: $0.002 in U"},{"name":"search_prnewswire_press_releases","description":"PR Newswire health-category press releases from its public RSS feed (keyword filter on title/summary). Latest items only. Public feed, no key. Price: $0.002 in "},{"name":"search_emedicine_articles","description":"Medscape eMedicine (Medscape Reference) clinical articles by specialty: title, topic category, article id and URL from the public specialty index, filtered by w"},{"name":"search_openprescribing","description":"NHS England primary-care prescribing for a drug (official NHSBSA English Prescribing Dataset, monthly, ~2 months behind; the raw data behind OpenPrescribing.net"},{"name":"search_ft_com_articles","description":"Financial Times headlines from the public FT RSS feeds: international homepage or any section/topic stream (world, markets, companies, technology, opinion, glob"},{"name":"search_wechat_articles","description":"WeChat Official Account (公众号) articles matching a query, from Sogou WeChat search (weixin.sogou.com): title, summary, account name, publish time and link, 10 pe"},{"name":"search_hacker_news","description":"Hacker News story search through the official HN Search API (Algolia, public, no key): title, article URL, author, points, comment count and discussion link. Re"},{"name":"search_drive_com_au_news","description":"Latest Drive.com.au (Australia) articles: headline, publisher, publish time and link, newest first, optionally matching search words, from the last 1-30 days. F"},{"name":"search_gtex_gene_expression","description":"GTEx Portal gene expression (public API v2, no key): median TPM of one gene in human tissues, sorted highest first, with the GENCODE id it was matched to. Uses "},{"name":"search_cnbc","description":"CNBC top news from CNBC's public RSS feed (keyword filter on title/summary). Latest items only. Public feed, no key. Price: $0.002 in USDC per successful call, "},{"name":"search_dappradar_rankings","description":"Top 50 dapps from DappRadar's public rankings page: rank, name, token symbol, chains, market cap, token price, price change, trading volume, unique active walle"},{"name":"search_german_impressum","description":"Reads the Impressum (legal notice required on German websites, §5 TMG/DDG) at the page URL you give: e-mail addresses, phone numbers, postal address lines and t"},{"name":"search_datacite_metadata","description":"DataCite DOI search (public REST API, no key): DOI, title, publication year, resource type, publisher, creators and landing page for datasets, software and othe"},{"name":"search_al_jazeera_articles","description":"Al Jazeera latest articles from its public RSS feed (keyword filter on title/summary/categories). Latest items only. Public feed, no key. Price: $0.002 in USDC "},{"name":"search_defector_articles","description":"Defector articles from its public RSS feed (keyword filter on title/summary/tags). Latest items only; excerpts are as published in the feed. Public feed, no key"}],"toolCount":129,"toolsHash":"ab265de6597b0ca504846f8d125da2fb3066be38847c1293f94da153dad186f2","serverName":"sitecheck-web-intel","capabilities":["tools"],"serverVersion":"1.0.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-26T15:29:50.385Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":117,"error":null,"detail":{"tools":[{"name":"security_dns_records","description":"DNS records of a domain (A, AAAA, MX, NS, TXT, CNAME, CAA, SOA) resolved live through the public AdGuard DNS JSON resolver (NextDNS as backup). Shows answers as"},{"name":"security_whois_rdap","description":"Domain registration facts via RDAP (IANA bootstrap, then the registry's own server): registration, last change and expiry dates, days left, registrar name, stat"},{"name":"security_ssl_cert_chain","description":"HTTPS certificate chain and cipher audit for a host (port 443) from Qualys SSL Labs' cached report: grade, number of certificates in the chain, trust store, TLS"},{"name":"security_crtsh_transparency","description":"Subdomain names found in public Certificate Transparency logs for a domain (via CertSpotter): unique host names and wildcard names, issuers, latest issue date a"},{"name":"security_ip_geolocation_asn","description":"IPv4 or IPv6 address → covering BGP prefix, origin AS number and holder name, whether the prefix is announced, and a coarse country and map point, all from RIPE"},{"name":"security_security_headers","description":"Checks the live HTTP response headers of a site's home page (one GET, https) for Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, X-F"},{"name":"security_dmarc_spf_dkim","description":"Email authentication DNS records for a domain: DMARC policy (p, sp, pct, rua), SPF record and its all-mechanism, and DKIM public keys for a selector you give or"},{"name":"security_urlhaus_malware","description":"Checks whether a host (domain or IP) is known to abuse.ch URLhaus as a malware distribution host: first seen, number of malware URLs, Spamhaus DBL / SURBL statu"},{"name":"security_phishtank_check","description":"Looks one http or https URL up in the PhishTank phishing database (live checkurl lookup, no key). Returns whether PhishTank has the URL and, if so, its phish id"},{"name":"security_cve_nvd_lookup","description":"One CVE record from the NIST National Vulnerability Database: description, published and last-modified dates, NVD status, primary CVSS score and severity (v4.0,"},{"name":"security_tor_exit_nodes","description":"Checks an IPv4 address against the Tor Project's bulk exit list (about 1,200 active exit IPs). If it is an exit, adds the relays for that address from Onionoo: "},{"name":"security_vpn_proxy_detector","description":"Checks an IPv4 address against the public X4BNet list of commercial VPN provider address ranges (about 11,000 CIDR blocks, refreshed by the list's maintainer). "},{"name":"security_shodan_host_summary","description":"Shodan InternetDB summary for an IPv4 address (free, no key): open TCP ports, host names seen, CPE software identifiers, tags and CVE IDs Shodan associates with"},{"name":"security_censys_exposure","description":"Censys host view for an IPv4 address: the services, ports and protocols Censys has observed on it with their last scan time and detected software, plus autonomo"},{"name":"security_abuseipdb_check","description":"AbuseIPDB reputation for an IPv4 address over the last 90 days: abuse confidence score (0-100), number of abuse reports, last report date, ISP, usage type and c"},{"name":"security_grey_noise_noise","description":"GreyNoise Community lookup for an IPv4 address: whether it was seen mass-scanning the internet recently (noise), whether it is a known benign service (riot), it"},{"name":"security_hibp_breach_check","description":"Lists the data breaches HaveIBeenPwned has recorded for a domain (breach name, breach date, accounts affected, data types exposed, verified flag). It is the pub"},{"name":"security_cisa_known_exploits","description":"CISA's Known Exploited Vulnerabilities catalog (public JSON). With cveId: whether that CVE is on the list, with vendor, product, date added, federal due date, r"},{"name":"security_open_port_scanner","description":"Lists the TCP ports Shodan has seen open on an IPv4 address, from its pre-collected passive scan data (not a live scan: nothing connects to the address now). Th"},{"name":"security_dns_propagation","description":"Asks two independent public DNS resolvers (AdGuard DNS and NextDNS) for the same name and record type right now and reports whether they agree, with each answer"},{"name":"security_reverse_dns_ptr","description":"Reverse DNS (PTR) names for an IPv4 address, and forward-confirmed reverse DNS: whether each PTR name resolves back (A record) to the same address. Up to 3 PTR "},{"name":"security_bgp_prefix_origin","description":"For an IPv4 prefix (e.g. 8.8.8.0/24): the origin AS seen announcing it now across RIPE RIS peers, its RPKI status for that origin (valid, invalid or unknown), r"},{"name":"security_dnssec_validator","description":"DNSSEC check for a domain: whether a DS record exists at the parent zone (the domain is signed), and whether two public validating resolvers (AdGuard DNS, NextD"},{"name":"security_cors_misconfig","description":"Checks how a site's home page answers a cross-origin request from a made-up origin: whether it echoes that origin back, sends a wildcard (*), and whether creden"},{"name":"security_cookie_security","description":"Lists the cookies a site sets on its public home page (one anonymous GET, no login) with their Secure, HttpOnly and SameSite flags, and flags the ones missing a"},{"name":"security_subdomain_takeover","description":"For a subdomain: finds its CNAME, matches the target against the public can-i-take-over-xyz fingerprint list (services such as GitHub Pages, S3, Azure, WordPres"},{"name":"security_robots_security_txt","description":"Reads a site's public robots.txt (crawl rules, sitemaps, AI-crawler rules) and security.txt (RFC 9116: contact, expiry, policy), and says whether security.txt i"},{"name":"security_email_disposable","description":"Checks whether an email address's domain (or a domain you give) is on the community disposable and temporary email blocklist (about 9,900 domains). Only the dom"},{"name":"security_domain_typosquatting","description":"For a brand domain, generates up to 24 lookalike names (letter omission, doubling and swapping, plus .co/.net/.org/.io swaps) and checks which ones have name se"},{"name":"security_asn_peers_upstream","description":"For an autonomous system (e.g. AS13335): how many upstream (transit) and downstream neighbours RIPEstat sees in BGP, the top upstreams ranked by 'power' with th"},{"name":"security_tls_cipher_enum","description":"TLS versions a host accepts (SSL 3, TLS 1.0 and 1.1 flagged as deprecated) and its cipher-suite strength from Qualys SSL Labs' cached report: suite count per pr"},{"name":"security_open_resolver_check","description":"Reports whether Shodan's pre-collected passive scan data shows TCP port 53 (DNS) open on an IPv4 address. It is a passive port fact only: it does not send a que"},{"name":"security_ntp_monlist_audit","description":"Reports whether Shodan's pre-collected passive scan data shows NTP (port 123) seen open on an IPv4 address. Passive and possibly old; the monlist amplification "},{"name":"security_snmp_exposure","description":"Reports whether Shodan's pre-collected passive scan data shows SNMP (UDP port 161) seen open on an IPv4 address. Passive and possibly old; no community string i"},{"name":"security_ssh_banner_audit","description":"From Shodan's pre-collected passive scan data: whether TCP port 22 was seen open on an IPv4 address and any OpenSSH version identified in its software (CPE) lis"},{"name":"security_smb_exposure_test","description":"Checks Shodan's passive scan records for TCP port 445 (SMB) on an IPv4 address. Says whether SMB was seen open and when the record was last refreshed by the hos"},{"name":"security_rdp_exposure_check","description":"Checks Shodan's passive scan records for TCP port 3389 (RDP) on an IPv4 address. Says whether RDP was seen open (not a live test, and the record can be days old"},{"name":"security_spameatingmonkey","description":"Checks an IPv4 mail-sending address against the SpamEatingMonkey DNS blocklist (bl.spameatingmonkey.net) through public DNS. A listed address returns its 127.0."},{"name":"security_barracuda_reputation","description":"Checks an IPv4 mail-sending address against the Barracuda Reputation Block List (b.barracudacentral.org) through public DNS. Listed addresses return a 127.0.0.x"},{"name":"security_spamhaus_zen","description":"Spamhaus blocklist check through Spamhaus's official Data Query Service: an IPv4 address against ZEN (SBL spam sources, CSS snowshoe, XBL exploited/botnet hosts"},{"name":"security_surbl_uri_lookup","description":"Checks a domain against SURBL's multi-list (multi.surbl.org): whether it appears in spam or phishing URI lists. Listed domains return a 127.0.0.x code. Not list"},{"name":"security_openphish_feed","description":"Checks a URL or host against the OpenPhish public phishing feed (about 300 currently active phishing URLs, updated continuously). Returns whether the exact URL "},{"name":"security_threatfox_iocs","description":"Searches abuse.ch ThreatFox for indicators of compromise matching a term (IP, IP:port, domain, URL or file hash): IOC, type, malware family, threat type, confid"},{"name":"security_malbazaar_samples","description":"Looks up a file hash (SHA-256, SHA-1 or MD5) in abuse.ch MalwareBazaar: whether the sample is known, its other hashes, file name, type, size, signature (malware"},{"name":"security_feodotracker_c2","description":"Checks an IPv4 address against the abuse.ch Feodo Tracker botnet C2 blocklist (Emotet, QakBot and similar). A hit returns the port, online status, malware famil"},{"name":"security_sslbl_abuse_certs","description":"Checks a certificate SHA-1 fingerprint (40 hex characters) against the abuse.ch SSL Blacklist of certificates seen on malware botnet C2 servers. A hit returns t"},{"name":"security_ipsum_threat_level","description":"Checks an IPv4 address against IPsum, an aggregate of public blocklists: returns the number of source feeds that list it (its level, 1 to 8) and whether it is l"},{"name":"security_cymru_asn_lookup","description":"Maps an IPv4 address to its origin AS number, the BGP prefix that covers it, the country, the registry and the allocation date, using Team Cymru's public IP-to-"},{"name":"security_blocklist_de","description":"Checks an IPv4 address against the Blocklist.de 'all' list of IPs reported for attacks such as failed logins, SSH and mail abuse (about 24,000 addresses). A hit"},{"name":"security_ciarmy_bad_ips","description":"Checks an IPv4 address against the CI Army (CINS Score) bad-IP list, a collective-intelligence list of addresses that recently showed hostile activity across a "},{"name":"security_talos_ip_blacklist","description":"Cisco Talos reputation for an IPv4 address: threat level (favorable, neutral, poor, untrusted), web reputation score, forward/reverse DNS match, hostname, owner"},{"name":"security_mx_server_test","description":"For a mail domain: lists up to 3 MX hosts with their IPv4 addresses and, from Shodan's pre-collected passive scan data, which SMTP ports (25, 465, 587) were see"},{"name":"security_dkim_key_checker","description":"Reads the DKIM public key published at <selector>._domainkey.<domain>: key type, whether it is revoked (empty p=), decoded key size in bytes and a strength hint"},{"name":"security_bimi_record_audit","description":"Reads a domain's BIMI record (default._bimi.<domain> TXT): whether it is published, the SVG logo URL (l=) and the certificate URL (a=, a VMC or CMC for mailbox "},{"name":"security_mta_sts_validator","description":"Checks MTA-STS for a mail domain: the _mta-sts TXT record (v=STSv1 and id) and the HTTPS policy file (mode enforce, testing or none, the MX patterns and max_age"},{"name":"security_dns_caa_records","description":"Lists the CAA (Certification Authority Authorization) records published on a domain: which CAs may issue certificates (issue), wildcard certificates (issuewild)"},{"name":"security_tls_alpn_detector","description":"Reports which newer HTTP protocols a site advertises: HTTP/3 (h3) and older draft or HTTP/2 alternatives in its Alt-Svc response header, and the Alt-Svc max-age"},{"name":"security_cert_revocation_crl","description":"For a domain's current certificate (taken from public Certificate Transparency data via CertSpotter): reads its CRL Distribution Point, downloads that public CR"},{"name":"security_mitre_attck_matrix","description":"Looks up one MITRE ATT&CK technique (e.g. T1059 or T1059.001) on its official public page: its name, the tactic-level summary text and the page title. Reads one"},{"name":"security_epss_exploit_score","description":"EPSS (Exploit Prediction Scoring System) for one CVE from FIRST's public API: the estimated probability (0 to 1) of exploitation in the next 30 days, its percen"},{"name":"security_cve_details_feed","description":"Vulnerability trend for a vendor (optionally one product) from the NIST NVD: CVEs published in the last N days (default 7, up to 120; a big vendor over a long w"},{"name":"security_jwt_token_inspector","description":"Decodes a JWT you supply (header and payload, base64url JSON) and reports its algorithm, key id, claims, and time checks (exp, nbf, iat). Flags alg none, symmet"},{"name":"security_csp_evaluator_audit","description":"Reads the Content-Security-Policy header of a site's home page and lists weak points: 'unsafe-inline' and 'unsafe-eval' in script sources, bare wildcards, data:"},{"name":"security_referrer_policy_audit","description":"Reads a site's Referrer-Policy header and its <meta name=referrer> tag from the home page, works out the policy a browser would apply, and rates how much of the"},{"name":"security_crossdomain_xml_test","description":"Reads a site's public crossdomain.xml (Adobe Flash) and clientaccesspolicy.xml (Silverlight) if they exist, lists the origins they allow, and flags wildcard gra"},{"name":"search_website_content_crawler","description":"Reads one public web page and returns its title, description and main text as Markdown (headings, links, lists), plus link counts. Reads only the page you name:"},{"name":"search_wayback_cdx","description":"Internet Archive Wayback Machine CDX index: archived snapshots of a URL or domain (timestamp, original URL, MIME type, HTTP status, length) with a link to each "},{"name":"search_google_search","description":"Organic web search results from the Brave Search API (an independent web index, not Google's): rank, title, URL, snippet, site name, page age and language for t"},{"name":"search_google_ads","description":"Google Ads Transparency Center: search advertisers by name or domain (verified name, advertiser ID, country, approximate ad count), or list the ads of an advert"},{"name":"search_wsj_articles","description":"WSJ World News headlines from the public Dow Jones RSS feed (latest items; keyword filter on title/summary). Headlines and short summaries only; full articles a"},{"name":"search_bing_search","description":"Bing web search results (Bing's public RSS search output, no key): result title, URL and snippet, in Bing's ranking order. Shows the first page of results Bing "},{"name":"search_google_news","description":"Google News search (public Google News RSS search feed, no key, English/US edition): headline, publisher, publish time and the Google News link for the newest m"},{"name":"search_pr_newswire","description":"PR Newswire latest news-release list from its public RSS feed (keyword filter on title/summary). Press release headlines and summaries. Public feed, no key. Pri"},{"name":"search_beehiiv_newsletter","description":"Post archive of a beehiiv newsletter (by beehiiv subdomain, e.g. superhuman, or the newsletter's own domain if hosted on beehiiv): newsletter name, total posts,"},{"name":"search_benzinga","description":"Latest Benzinga financial news (the public JSON feed behind benzinga.com): headline, teaser, author, time, URL, tickers, channels and tags. Filter by stock tick"},{"name":"search_markdown_to_pdf_mcp","description":"npm registry search for MCP servers that convert Markdown to PDF (public npm search API, no key): package name, version, description, publisher, last publish da"},{"name":"search_unpaywall","description":"Unpaywall open-access lookup by DOI (free API; it requires a contact e-mail set in UNPAYWALL_EMAIL, not a key): is the paper open access, OA status, best free f"},{"name":"search_reuters_articles","description":"Reuters latest articles from Reuters' public news sitemap (no key): headline, article URL and publication time, newest first. Covers only the most recent items "},{"name":"search_fifa_team_rankings","description":"FIFA men's national team world ranking (FIFA public ranking API, no key): position, team, country code, total points, previous points and previous rank for one "},{"name":"search_university_rankings_mega_pack","description":"University rankings side by side from ShanghaiRanking ARWU (rank, national rank, total and six indicator scores) and Times Higher Education World University Ran"},{"name":"search_freightwaves","description":"FreightWaves latest news from its public RSS feed (keyword filter on title/summary/categories). Feed carries only the latest few items. Public feed, no key. Pri"},{"name":"search_crossref","description":"Crossref works search (public REST API, no key): DOI, title, type, container (journal or book), year, authors and link for matching scholarly records. Metadata "},{"name":"search_bbc_news_articles","description":"BBC News top stories from the public BBC RSS feed (latest items; keyword filter on title/summary). Headlines and summaries only, no full article text. Public fe"},{"name":"search_article_extractor","description":"Extracts one article from a public news or blog page: headline (og:title or h1), author, published and modified times, description and the article body as Markd"},{"name":"search_owgr_golf_rankings","description":"Official World Golf Ranking (OWGR public ranking API, no key): current men's position, player name, country, total points, average points and last week's positi"},{"name":"search_techcrunch_articles","description":"TechCrunch latest articles from its public RSS feed (keyword filter on title/summary/tags). Headlines and excerpts only. Public feed, no key. Price: $0.002 in U"},{"name":"search_prnewswire_press_releases","description":"PR Newswire health-category press releases from its public RSS feed (keyword filter on title/summary). Latest items only. Public feed, no key. Price: $0.002 in "},{"name":"search_emedicine_articles","description":"Medscape eMedicine (Medscape Reference) clinical articles by specialty: title, topic category, article id and URL from the public specialty index, filtered by w"},{"name":"search_openprescribing","description":"NHS England primary-care prescribing for a drug (official NHSBSA English Prescribing Dataset, monthly, ~2 months behind; the raw data behind OpenPrescribing.net"},{"name":"search_ft_com_articles","description":"Financial Times headlines from the public FT RSS feeds: international homepage or any section/topic stream (world, markets, companies, technology, opinion, glob"},{"name":"search_wechat_articles","description":"WeChat Official Account (公众号) articles matching a query, from Sogou WeChat search (weixin.sogou.com): title, summary, account name, publish time and link, 10 pe"},{"name":"search_hacker_news","description":"Hacker News story search through the official HN Search API (Algolia, public, no key): title, article URL, author, points, comment count and discussion link. Re"},{"name":"search_drive_com_au_news","description":"Latest Drive.com.au (Australia) articles: headline, publisher, publish time and link, newest first, optionally matching search words, from the last 1-30 days. F"},{"name":"search_gtex_gene_expression","description":"GTEx Portal gene expression (public API v2, no key): median TPM of one gene in human tissues, sorted highest first, with the GENCODE id it was matched to. Uses "},{"name":"search_cnbc","description":"CNBC top news from CNBC's public RSS feed (keyword filter on title/summary). Latest items only. Public feed, no key. Price: $0.002 in USDC per successful call, "},{"name":"search_dappradar_rankings","description":"Top 50 dapps from DappRadar's public rankings page: rank, name, token symbol, chains, market cap, token price, price change, trading volume, unique active walle"},{"name":"search_german_impressum","description":"Reads the Impressum (legal notice required on German websites, §5 TMG/DDG) at the page URL you give: e-mail addresses, phone numbers, postal address lines and t"},{"name":"search_datacite_metadata","description":"DataCite DOI search (public REST API, no key): DOI, title, publication year, resource type, publisher, creators and landing page for datasets, software and othe"},{"name":"search_al_jazeera_articles","description":"Al Jazeera latest articles from its public RSS feed (keyword filter on title/summary/categories). Latest items only. Public feed, no key. Price: $0.002 in USDC "},{"name":"search_defector_articles","description":"Defector articles from its public RSS feed (keyword filter on title/summary/tags). Latest items only; excerpts are as published in the feed. Public feed, no key"}],"toolCount":129,"toolsHash":"ab265de6597b0ca504846f8d125da2fb3066be38847c1293f94da153dad186f2","serverName":"sitecheck-web-intel","capabilities":["tools"],"serverVersion":"1.0.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-26T08:25:39.609Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":72,"error":null,"detail":{"tools":[{"name":"security_dns_records","description":"DNS records of a domain (A, AAAA, MX, NS, TXT, CNAME, CAA, SOA) resolved live through the public AdGuard DNS JSON resolver (NextDNS as backup). Shows answers as"},{"name":"security_whois_rdap","description":"Domain registration facts via RDAP (IANA bootstrap, then the registry's own server): registration, last change and expiry dates, days left, registrar name, stat"},{"name":"security_ssl_cert_chain","description":"HTTPS certificate chain and cipher audit for a host (port 443) from Qualys SSL Labs' cached report: grade, number of certificates in the chain, trust store, TLS"},{"name":"security_crtsh_transparency","description":"Subdomain names found in public Certificate Transparency logs for a domain (via CertSpotter): unique host names and wildcard names, issuers, latest issue date a"},{"name":"security_ip_geolocation_asn","description":"IPv4 or IPv6 address → covering BGP prefix, origin AS number and holder name, whether the prefix is announced, and a coarse country and map point, all from RIPE"},{"name":"security_security_headers","description":"Checks the live HTTP response headers of a site's home page (one GET, https) for Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, X-F"},{"name":"security_dmarc_spf_dkim","description":"Email authentication DNS records for a domain: DMARC policy (p, sp, pct, rua), SPF record and its all-mechanism, and DKIM public keys for a selector you give or"},{"name":"security_urlhaus_malware","description":"Checks whether a host (domain or IP) is known to abuse.ch URLhaus as a malware distribution host: first seen, number of malware URLs, Spamhaus DBL / SURBL statu"},{"name":"security_phishtank_check","description":"Looks one http or https URL up in the PhishTank phishing database (live checkurl lookup, no key). Returns whether PhishTank has the URL and, if so, its phish id"},{"name":"security_cve_nvd_lookup","description":"One CVE record from the NIST National Vulnerability Database: description, published and last-modified dates, NVD status, primary CVSS score and severity (v4.0,"},{"name":"security_tor_exit_nodes","description":"Checks an IPv4 address against the Tor Project's bulk exit list (about 1,200 active exit IPs). If it is an exit, adds the relays for that address from Onionoo: "},{"name":"security_vpn_proxy_detector","description":"Checks an IPv4 address against the public X4BNet list of commercial VPN provider address ranges (about 11,000 CIDR blocks, refreshed by the list's maintainer). "},{"name":"security_shodan_host_summary","description":"Shodan InternetDB summary for an IPv4 address (free, no key): open TCP ports, host names seen, CPE software identifiers, tags and CVE IDs Shodan associates with"},{"name":"security_censys_exposure","description":"Censys host view for an IPv4 address: the services, ports and protocols Censys has observed on it with their last scan time and detected software, plus autonomo"},{"name":"security_abuseipdb_check","description":"AbuseIPDB reputation for an IPv4 address over the last 90 days: abuse confidence score (0-100), number of abuse reports, last report date, ISP, usage type and c"},{"name":"security_grey_noise_noise","description":"GreyNoise Community lookup for an IPv4 address: whether it was seen mass-scanning the internet recently (noise), whether it is a known benign service (riot), it"},{"name":"security_hibp_breach_check","description":"Lists the data breaches HaveIBeenPwned has recorded for a domain (breach name, breach date, accounts affected, data types exposed, verified flag). It is the pub"},{"name":"security_cisa_known_exploits","description":"CISA's Known Exploited Vulnerabilities catalog (public JSON). With cveId: whether that CVE is on the list, with vendor, product, date added, federal due date, r"},{"name":"security_open_port_scanner","description":"Lists the TCP ports Shodan has seen open on an IPv4 address, from its pre-collected passive scan data (not a live scan: nothing connects to the address now). Th"},{"name":"security_dns_propagation","description":"Asks two independent public DNS resolvers (AdGuard DNS and NextDNS) for the same name and record type right now and reports whether they agree, with each answer"},{"name":"security_reverse_dns_ptr","description":"Reverse DNS (PTR) names for an IPv4 address, and forward-confirmed reverse DNS: whether each PTR name resolves back (A record) to the same address. Up to 3 PTR "},{"name":"security_bgp_prefix_origin","description":"For an IPv4 prefix (e.g. 8.8.8.0/24): the origin AS seen announcing it now across RIPE RIS peers, its RPKI status for that origin (valid, invalid or unknown), r"},{"name":"security_dnssec_validator","description":"DNSSEC check for a domain: whether a DS record exists at the parent zone (the domain is signed), and whether two public validating resolvers (AdGuard DNS, NextD"},{"name":"security_cors_misconfig","description":"Checks how a site's home page answers a cross-origin request from a made-up origin: whether it echoes that origin back, sends a wildcard (*), and whether creden"},{"name":"security_cookie_security","description":"Lists the cookies a site sets on its public home page (one anonymous GET, no login) with their Secure, HttpOnly and SameSite flags, and flags the ones missing a"},{"name":"security_subdomain_takeover","description":"For a subdomain: finds its CNAME, matches the target against the public can-i-take-over-xyz fingerprint list (services such as GitHub Pages, S3, Azure, WordPres"},{"name":"security_robots_security_txt","description":"Reads a site's public robots.txt (crawl rules, sitemaps, AI-crawler rules) and security.txt (RFC 9116: contact, expiry, policy), and says whether security.txt i"},{"name":"security_email_disposable","description":"Checks whether an email address's domain (or a domain you give) is on the community disposable and temporary email blocklist (about 9,900 domains). Only the dom"},{"name":"security_domain_typosquatting","description":"For a brand domain, generates up to 24 lookalike names (letter omission, doubling and swapping, plus .co/.net/.org/.io swaps) and checks which ones have name se"},{"name":"security_asn_peers_upstream","description":"For an autonomous system (e.g. AS13335): how many upstream (transit) and downstream neighbours RIPEstat sees in BGP, the top upstreams ranked by 'power' with th"},{"name":"security_tls_cipher_enum","description":"TLS versions a host accepts (SSL 3, TLS 1.0 and 1.1 flagged as deprecated) and its cipher-suite strength from Qualys SSL Labs' cached report: suite count per pr"},{"name":"security_open_resolver_check","description":"Reports whether Shodan's pre-collected passive scan data shows TCP port 53 (DNS) open on an IPv4 address. It is a passive port fact only: it does not send a que"},{"name":"security_ntp_monlist_audit","description":"Reports whether Shodan's pre-collected passive scan data shows NTP (port 123) seen open on an IPv4 address. Passive and possibly old; the monlist amplification "},{"name":"security_snmp_exposure","description":"Reports whether Shodan's pre-collected passive scan data shows SNMP (UDP port 161) seen open on an IPv4 address. Passive and possibly old; no community string i"},{"name":"security_ssh_banner_audit","description":"From Shodan's pre-collected passive scan data: whether TCP port 22 was seen open on an IPv4 address and any OpenSSH version identified in its software (CPE) lis"},{"name":"security_smb_exposure_test","description":"Checks Shodan's passive scan records for TCP port 445 (SMB) on an IPv4 address. Says whether SMB was seen open and when the record was last refreshed by the hos"},{"name":"security_rdp_exposure_check","description":"Checks Shodan's passive scan records for TCP port 3389 (RDP) on an IPv4 address. Says whether RDP was seen open (not a live test, and the record can be days old"},{"name":"security_spameatingmonkey","description":"Checks an IPv4 mail-sending address against the SpamEatingMonkey DNS blocklist (bl.spameatingmonkey.net) through public DNS. A listed address returns its 127.0."},{"name":"security_barracuda_reputation","description":"Checks an IPv4 mail-sending address against the Barracuda Reputation Block List (b.barracudacentral.org) through public DNS. Listed addresses return a 127.0.0.x"},{"name":"security_spamhaus_zen","description":"Spamhaus blocklist check through Spamhaus's official Data Query Service: an IPv4 address against ZEN (SBL spam sources, CSS snowshoe, XBL exploited/botnet hosts"},{"name":"security_surbl_uri_lookup","description":"Checks a domain against SURBL's multi-list (multi.surbl.org): whether it appears in spam or phishing URI lists. Listed domains return a 127.0.0.x code. Not list"},{"name":"security_openphish_feed","description":"Checks a URL or host against the OpenPhish public phishing feed (about 300 currently active phishing URLs, updated continuously). Returns whether the exact URL "},{"name":"security_threatfox_iocs","description":"Searches abuse.ch ThreatFox for indicators of compromise matching a term (IP, IP:port, domain, URL or file hash): IOC, type, malware family, threat type, confid"},{"name":"security_malbazaar_samples","description":"Looks up a file hash (SHA-256, SHA-1 or MD5) in abuse.ch MalwareBazaar: whether the sample is known, its other hashes, file name, type, size, signature (malware"},{"name":"security_feodotracker_c2","description":"Checks an IPv4 address against the abuse.ch Feodo Tracker botnet C2 blocklist (Emotet, QakBot and similar). A hit returns the port, online status, malware famil"},{"name":"security_sslbl_abuse_certs","description":"Checks a certificate SHA-1 fingerprint (40 hex characters) against the abuse.ch SSL Blacklist of certificates seen on malware botnet C2 servers. A hit returns t"},{"name":"security_ipsum_threat_level","description":"Checks an IPv4 address against IPsum, an aggregate of public blocklists: returns the number of source feeds that list it (its level, 1 to 8) and whether it is l"},{"name":"security_cymru_asn_lookup","description":"Maps an IPv4 address to its origin AS number, the BGP prefix that covers it, the country, the registry and the allocation date, using Team Cymru's public IP-to-"},{"name":"security_blocklist_de","description":"Checks an IPv4 address against the Blocklist.de 'all' list of IPs reported for attacks such as failed logins, SSH and mail abuse (about 24,000 addresses). A hit"},{"name":"security_ciarmy_bad_ips","description":"Checks an IPv4 address against the CI Army (CINS Score) bad-IP list, a collective-intelligence list of addresses that recently showed hostile activity across a "},{"name":"security_talos_ip_blacklist","description":"Cisco Talos reputation for an IPv4 address: threat level (favorable, neutral, poor, untrusted), web reputation score, forward/reverse DNS match, hostname, owner"},{"name":"security_mx_server_test","description":"For a mail domain: lists up to 3 MX hosts with their IPv4 addresses and, from Shodan's pre-collected passive scan data, which SMTP ports (25, 465, 587) were see"},{"name":"security_dkim_key_checker","description":"Reads the DKIM public key published at <selector>._domainkey.<domain>: key type, whether it is revoked (empty p=), decoded key size in bytes and a strength hint"},{"name":"security_bimi_record_audit","description":"Reads a domain's BIMI record (default._bimi.<domain> TXT): whether it is published, the SVG logo URL (l=) and the certificate URL (a=, a VMC or CMC for mailbox "},{"name":"security_mta_sts_validator","description":"Checks MTA-STS for a mail domain: the _mta-sts TXT record (v=STSv1 and id) and the HTTPS policy file (mode enforce, testing or none, the MX patterns and max_age"},{"name":"security_dns_caa_records","description":"Lists the CAA (Certification Authority Authorization) records published on a domain: which CAs may issue certificates (issue), wildcard certificates (issuewild)"},{"name":"security_tls_alpn_detector","description":"Reports which newer HTTP protocols a site advertises: HTTP/3 (h3) and older draft or HTTP/2 alternatives in its Alt-Svc response header, and the Alt-Svc max-age"},{"name":"security_cert_revocation_crl","description":"For a domain's current certificate (taken from public Certificate Transparency data via CertSpotter): reads its CRL Distribution Point, downloads that public CR"},{"name":"security_mitre_attck_matrix","description":"Looks up one MITRE ATT&CK technique (e.g. T1059 or T1059.001) on its official public page: its name, the tactic-level summary text and the page title. Reads one"},{"name":"security_epss_exploit_score","description":"EPSS (Exploit Prediction Scoring System) for one CVE from FIRST's public API: the estimated probability (0 to 1) of exploitation in the next 30 days, its percen"},{"name":"security_cve_details_feed","description":"Vulnerability trend for a vendor (optionally one product) from the NIST NVD: CVEs published in the last N days (default 7, up to 120; a big vendor over a long w"},{"name":"security_jwt_token_inspector","description":"Decodes a JWT you supply (header and payload, base64url JSON) and reports its algorithm, key id, claims, and time checks (exp, nbf, iat). Flags alg none, symmet"},{"name":"security_csp_evaluator_audit","description":"Reads the Content-Security-Policy header of a site's home page and lists weak points: 'unsafe-inline' and 'unsafe-eval' in script sources, bare wildcards, data:"},{"name":"security_referrer_policy_audit","description":"Reads a site's Referrer-Policy header and its <meta name=referrer> tag from the home page, works out the policy a browser would apply, and rates how much of the"},{"name":"security_crossdomain_xml_test","description":"Reads a site's public crossdomain.xml (Adobe Flash) and clientaccesspolicy.xml (Silverlight) if they exist, lists the origins they allow, and flags wildcard gra"},{"name":"search_website_content_crawler","description":"Reads one public web page and returns its title, description and main text as Markdown (headings, links, lists), plus link counts. Reads only the page you name:"},{"name":"search_wayback_cdx","description":"Internet Archive Wayback Machine CDX index: archived snapshots of a URL or domain (timestamp, original URL, MIME type, HTTP status, length) with a link to each "},{"name":"search_google_search","description":"Organic web search results from the Brave Search API (an independent web index, not Google's): rank, title, URL, snippet, site name, page age and language for t"},{"name":"search_google_ads","description":"Google Ads Transparency Center: search advertisers by name or domain (verified name, advertiser ID, country, approximate ad count), or list the ads of an advert"},{"name":"search_wsj_articles","description":"WSJ World News headlines from the public Dow Jones RSS feed (latest items; keyword filter on title/summary). Headlines and short summaries only; full articles a"},{"name":"search_bing_search","description":"Bing web search results (Bing's public RSS search output, no key): result title, URL and snippet, in Bing's ranking order. Shows the first page of results Bing "},{"name":"search_google_news","description":"Google News search (public Google News RSS search feed, no key, English/US edition): headline, publisher, publish time and the Google News link for the newest m"},{"name":"search_pr_newswire","description":"PR Newswire latest news-release list from its public RSS feed (keyword filter on title/summary). Press release headlines and summaries. Public feed, no key. Pri"},{"name":"search_beehiiv_newsletter","description":"Post archive of a beehiiv newsletter (by beehiiv subdomain, e.g. superhuman, or the newsletter's own domain if hosted on beehiiv): newsletter name, total posts,"},{"name":"search_benzinga","description":"Latest Benzinga financial news (the public JSON feed behind benzinga.com): headline, teaser, author, time, URL, tickers, channels and tags. Filter by stock tick"},{"name":"search_markdown_to_pdf_mcp","description":"npm registry search for MCP servers that convert Markdown to PDF (public npm search API, no key): package name, version, description, publisher, last publish da"},{"name":"search_unpaywall","description":"Unpaywall open-access lookup by DOI (free API; it requires a contact e-mail set in UNPAYWALL_EMAIL, not a key): is the paper open access, OA status, best free f"},{"name":"search_reuters_articles","description":"Reuters latest articles from Reuters' public news sitemap (no key): headline, article URL and publication time, newest first. Covers only the most recent items "},{"name":"search_fifa_team_rankings","description":"FIFA men's national team world ranking (FIFA public ranking API, no key): position, team, country code, total points, previous points and previous rank for one "},{"name":"search_university_rankings_mega_pack","description":"University rankings side by side from ShanghaiRanking ARWU (rank, national rank, total and six indicator scores) and Times Higher Education World University Ran"},{"name":"search_freightwaves","description":"FreightWaves latest news from its public RSS feed (keyword filter on title/summary/categories). Feed carries only the latest few items. Public feed, no key. Pri"},{"name":"search_crossref","description":"Crossref works search (public REST API, no key): DOI, title, type, container (journal or book), year, authors and link for matching scholarly records. Metadata "},{"name":"search_bbc_news_articles","description":"BBC News top stories from the public BBC RSS feed (latest items; keyword filter on title/summary). Headlines and summaries only, no full article text. Public fe"},{"name":"search_article_extractor","description":"Extracts one article from a public news or blog page: headline (og:title or h1), author, published and modified times, description and the article body as Markd"},{"name":"search_owgr_golf_rankings","description":"Official World Golf Ranking (OWGR public ranking API, no key): current men's position, player name, country, total points, average points and last week's positi"},{"name":"search_techcrunch_articles","description":"TechCrunch latest articles from its public RSS feed (keyword filter on title/summary/tags). Headlines and excerpts only. Public feed, no key. Price: $0.002 in U"},{"name":"search_prnewswire_press_releases","description":"PR Newswire health-category press releases from its public RSS feed (keyword filter on title/summary). Latest items only. Public feed, no key. Price: $0.002 in "},{"name":"search_emedicine_articles","description":"Medscape eMedicine (Medscape Reference) clinical articles by specialty: title, topic category, article id and URL from the public specialty index, filtered by w"},{"name":"search_openprescribing","description":"NHS England primary-care prescribing for a drug (official NHSBSA English Prescribing Dataset, monthly, ~2 months behind; the raw data behind OpenPrescribing.net"},{"name":"search_ft_com_articles","description":"Financial Times headlines from the public FT RSS feeds: international homepage or any section/topic stream (world, markets, companies, technology, opinion, glob"},{"name":"search_wechat_articles","description":"WeChat Official Account (公众号) articles matching a query, from Sogou WeChat search (weixin.sogou.com): title, summary, account name, publish time and link, 10 pe"},{"name":"search_hacker_news","description":"Hacker News story search through the official HN Search API (Algolia, public, no key): title, article URL, author, points, comment count and discussion link. Re"},{"name":"search_drive_com_au_news","description":"Latest Drive.com.au (Australia) articles: headline, publisher, publish time and link, newest first, optionally matching search words, from the last 1-30 days. F"},{"name":"search_gtex_gene_expression","description":"GTEx Portal gene expression (public API v2, no key): median TPM of one gene in human tissues, sorted highest first, with the GENCODE id it was matched to. Uses "},{"name":"search_cnbc","description":"CNBC top news from CNBC's public RSS feed (keyword filter on title/summary). Latest items only. Public feed, no key. Price: $0.002 in USDC per successful call, "},{"name":"search_dappradar_rankings","description":"Top 50 dapps from DappRadar's public rankings page: rank, name, token symbol, chains, market cap, token price, price change, trading volume, unique active walle"},{"name":"search_german_impressum","description":"Reads the Impressum (legal notice required on German websites, §5 TMG/DDG) at the page URL you give: e-mail addresses, phone numbers, postal address lines and t"},{"name":"search_datacite_metadata","description":"DataCite DOI search (public REST API, no key): DOI, title, publication year, resource type, publisher, creators and landing page for datasets, software and othe"},{"name":"search_al_jazeera_articles","description":"Al Jazeera latest articles from its public RSS feed (keyword filter on title/summary/categories). Latest items only. Public feed, no key. Price: $0.002 in USDC "},{"name":"search_defector_articles","description":"Defector articles from its public RSS feed (keyword filter on title/summary/tags). Latest items only; excerpts are as published in the feed. Public feed, no key"}],"toolCount":129,"toolsHash":"ab265de6597b0ca504846f8d125da2fb3066be38847c1293f94da153dad186f2","serverName":"sitecheck-web-intel","capabilities":["tools"],"serverVersion":"1.0.0","protocolVersion":"2025-06-18"}}],"tools":[{"name":"security_dns_records","description":"DNS records of a domain (A, AAAA, MX, NS, TXT, CNAME, CAA, SOA) resolved live through the public AdGuard DNS JSON resolver (NextDNS as backup). Shows answers as"},{"name":"security_whois_rdap","description":"Domain registration facts via RDAP (IANA bootstrap, then the registry's own server): registration, last change and expiry dates, days left, registrar name, stat"},{"name":"security_ssl_cert_chain","description":"HTTPS certificate chain and cipher audit for a host (port 443) from Qualys SSL Labs' cached report: grade, number of certificates in the chain, trust store, TLS"},{"name":"security_crtsh_transparency","description":"Subdomain names found in public Certificate Transparency logs for a domain (via CertSpotter): unique host names and wildcard names, issuers, latest issue date a"},{"name":"security_ip_geolocation_asn","description":"IPv4 or IPv6 address → covering BGP prefix, origin AS number and holder name, whether the prefix is announced, and a coarse country and map point, all from RIPE"},{"name":"security_security_headers","description":"Checks the live HTTP response headers of a site's home page (one GET, https) for Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, X-F"},{"name":"security_dmarc_spf_dkim","description":"Email authentication DNS records for a domain: DMARC policy (p, sp, pct, rua), SPF record and its all-mechanism, and DKIM public keys for a selector you give or"},{"name":"security_urlhaus_malware","description":"Checks whether a host (domain or IP) is known to abuse.ch URLhaus as a malware distribution host: first seen, number of malware URLs, Spamhaus DBL / SURBL statu"},{"name":"security_phishtank_check","description":"Looks one http or https URL up in the PhishTank phishing database (live checkurl lookup, no key). Returns whether PhishTank has the URL and, if so, its phish id"},{"name":"security_cve_nvd_lookup","description":"One CVE record from the NIST National Vulnerability Database: description, published and last-modified dates, NVD status, primary CVSS score and severity (v4.0,"},{"name":"security_tor_exit_nodes","description":"Checks an IPv4 address against the Tor Project's bulk exit list (about 1,200 active exit IPs). If it is an exit, adds the relays for that address from Onionoo: "},{"name":"security_vpn_proxy_detector","description":"Checks an IPv4 address against the public X4BNet list of commercial VPN provider address ranges (about 11,000 CIDR blocks, refreshed by the list's maintainer). "},{"name":"security_shodan_host_summary","description":"Shodan InternetDB summary for an IPv4 address (free, no key): open TCP ports, host names seen, CPE software identifiers, tags and CVE IDs Shodan associates with"},{"name":"security_censys_exposure","description":"Censys host view for an IPv4 address: the services, ports and protocols Censys has observed on it with their last scan time and detected software, plus autonomo"},{"name":"security_abuseipdb_check","description":"AbuseIPDB reputation for an IPv4 address over the last 90 days: abuse confidence score (0-100), number of abuse reports, last report date, ISP, usage type and c"},{"name":"security_grey_noise_noise","description":"GreyNoise Community lookup for an IPv4 address: whether it was seen mass-scanning the internet recently (noise), whether it is a known benign service (riot), it"},{"name":"security_hibp_breach_check","description":"Lists the data breaches HaveIBeenPwned has recorded for a domain (breach name, breach date, accounts affected, data types exposed, verified flag). It is the pub"},{"name":"security_cisa_known_exploits","description":"CISA's Known Exploited Vulnerabilities catalog (public JSON). With cveId: whether that CVE is on the list, with vendor, product, date added, federal due date, r"},{"name":"security_open_port_scanner","description":"Lists the TCP ports Shodan has seen open on an IPv4 address, from its pre-collected passive scan data (not a live scan: nothing connects to the address now). Th"},{"name":"security_dns_propagation","description":"Asks two independent public DNS resolvers (AdGuard DNS and NextDNS) for the same name and record type right now and reports whether they agree, with each answer"},{"name":"security_reverse_dns_ptr","description":"Reverse DNS (PTR) names for an IPv4 address, and forward-confirmed reverse DNS: whether each PTR name resolves back (A record) to the same address. Up to 3 PTR "},{"name":"security_bgp_prefix_origin","description":"For an IPv4 prefix (e.g. 8.8.8.0/24): the origin AS seen announcing it now across RIPE RIS peers, its RPKI status for that origin (valid, invalid or unknown), r"},{"name":"security_dnssec_validator","description":"DNSSEC check for a domain: whether a DS record exists at the parent zone (the domain is signed), and whether two public validating resolvers (AdGuard DNS, NextD"},{"name":"security_cors_misconfig","description":"Checks how a site's home page answers a cross-origin request from a made-up origin: whether it echoes that origin back, sends a wildcard (*), and whether creden"},{"name":"security_cookie_security","description":"Lists the cookies a site sets on its public home page (one anonymous GET, no login) with their Secure, HttpOnly and SameSite flags, and flags the ones missing a"},{"name":"security_subdomain_takeover","description":"For a subdomain: finds its CNAME, matches the target against the public can-i-take-over-xyz fingerprint list (services such as GitHub Pages, S3, Azure, WordPres"},{"name":"security_robots_security_txt","description":"Reads a site's public robots.txt (crawl rules, sitemaps, AI-crawler rules) and security.txt (RFC 9116: contact, expiry, policy), and says whether security.txt i"},{"name":"security_email_disposable","description":"Checks whether an email address's domain (or a domain you give) is on the community disposable and temporary email blocklist (about 9,900 domains). Only the dom"},{"name":"security_domain_typosquatting","description":"For a brand domain, generates up to 24 lookalike names (letter omission, doubling and swapping, plus .co/.net/.org/.io swaps) and checks which ones have name se"},{"name":"security_asn_peers_upstream","description":"For an autonomous system (e.g. AS13335): how many upstream (transit) and downstream neighbours RIPEstat sees in BGP, the top upstreams ranked by 'power' with th"},{"name":"security_tls_cipher_enum","description":"TLS versions a host accepts (SSL 3, TLS 1.0 and 1.1 flagged as deprecated) and its cipher-suite strength from Qualys SSL Labs' cached report: suite count per pr"},{"name":"security_open_resolver_check","description":"Reports whether Shodan's pre-collected passive scan data shows TCP port 53 (DNS) open on an IPv4 address. It is a passive port fact only: it does not send a que"},{"name":"security_ntp_monlist_audit","description":"Reports whether Shodan's pre-collected passive scan data shows NTP (port 123) seen open on an IPv4 address. Passive and possibly old; the monlist amplification "},{"name":"security_snmp_exposure","description":"Reports whether Shodan's pre-collected passive scan data shows SNMP (UDP port 161) seen open on an IPv4 address. Passive and possibly old; no community string i"},{"name":"security_ssh_banner_audit","description":"From Shodan's pre-collected passive scan data: whether TCP port 22 was seen open on an IPv4 address and any OpenSSH version identified in its software (CPE) lis"},{"name":"security_smb_exposure_test","description":"Checks Shodan's passive scan records for TCP port 445 (SMB) on an IPv4 address. Says whether SMB was seen open and when the record was last refreshed by the hos"},{"name":"security_rdp_exposure_check","description":"Checks Shodan's passive scan records for TCP port 3389 (RDP) on an IPv4 address. Says whether RDP was seen open (not a live test, and the record can be days old"},{"name":"security_spameatingmonkey","description":"Checks an IPv4 mail-sending address against the SpamEatingMonkey DNS blocklist (bl.spameatingmonkey.net) through public DNS. A listed address returns its 127.0."},{"name":"security_barracuda_reputation","description":"Checks an IPv4 mail-sending address against the Barracuda Reputation Block List (b.barracudacentral.org) through public DNS. Listed addresses return a 127.0.0.x"},{"name":"security_spamhaus_zen","description":"Spamhaus blocklist check through Spamhaus's official Data Query Service: an IPv4 address against ZEN (SBL spam sources, CSS snowshoe, XBL exploited/botnet hosts"},{"name":"security_surbl_uri_lookup","description":"Checks a domain against SURBL's multi-list (multi.surbl.org): whether it appears in spam or phishing URI lists. Listed domains return a 127.0.0.x code. Not list"},{"name":"security_openphish_feed","description":"Checks a URL or host against the OpenPhish public phishing feed (about 300 currently active phishing URLs, updated continuously). Returns whether the exact URL "},{"name":"security_threatfox_iocs","description":"Searches abuse.ch ThreatFox for indicators of compromise matching a term (IP, IP:port, domain, URL or file hash): IOC, type, malware family, threat type, confid"},{"name":"security_malbazaar_samples","description":"Looks up a file hash (SHA-256, SHA-1 or MD5) in abuse.ch MalwareBazaar: whether the sample is known, its other hashes, file name, type, size, signature (malware"},{"name":"security_feodotracker_c2","description":"Checks an IPv4 address against the abuse.ch Feodo Tracker botnet C2 blocklist (Emotet, QakBot and similar). A hit returns the port, online status, malware famil"},{"name":"security_sslbl_abuse_certs","description":"Checks a certificate SHA-1 fingerprint (40 hex characters) against the abuse.ch SSL Blacklist of certificates seen on malware botnet C2 servers. A hit returns t"},{"name":"security_ipsum_threat_level","description":"Checks an IPv4 address against IPsum, an aggregate of public blocklists: returns the number of source feeds that list it (its level, 1 to 8) and whether it is l"},{"name":"security_cymru_asn_lookup","description":"Maps an IPv4 address to its origin AS number, the BGP prefix that covers it, the country, the registry and the allocation date, using Team Cymru's public IP-to-"},{"name":"security_blocklist_de","description":"Checks an IPv4 address against the Blocklist.de 'all' list of IPs reported for attacks such as failed logins, SSH and mail abuse (about 24,000 addresses). A hit"},{"name":"security_ciarmy_bad_ips","description":"Checks an IPv4 address against the CI Army (CINS Score) bad-IP list, a collective-intelligence list of addresses that recently showed hostile activity across a "},{"name":"security_talos_ip_blacklist","description":"Cisco Talos reputation for an IPv4 address: threat level (favorable, neutral, poor, untrusted), web reputation score, forward/reverse DNS match, hostname, owner"},{"name":"security_mx_server_test","description":"For a mail domain: lists up to 3 MX hosts with their IPv4 addresses and, from Shodan's pre-collected passive scan data, which SMTP ports (25, 465, 587) were see"},{"name":"security_dkim_key_checker","description":"Reads the DKIM public key published at <selector>._domainkey.<domain>: key type, whether it is revoked (empty p=), decoded key size in bytes and a strength hint"},{"name":"security_bimi_record_audit","description":"Reads a domain's BIMI record (default._bimi.<domain> TXT): whether it is published, the SVG logo URL (l=) and the certificate URL (a=, a VMC or CMC for mailbox "},{"name":"security_mta_sts_validator","description":"Checks MTA-STS for a mail domain: the _mta-sts TXT record (v=STSv1 and id) and the HTTPS policy file (mode enforce, testing or none, the MX patterns and max_age"},{"name":"security_dns_caa_records","description":"Lists the CAA (Certification Authority Authorization) records published on a domain: which CAs may issue certificates (issue), wildcard certificates (issuewild)"},{"name":"security_tls_alpn_detector","description":"Reports which newer HTTP protocols a site advertises: HTTP/3 (h3) and older draft or HTTP/2 alternatives in its Alt-Svc response header, and the Alt-Svc max-age"},{"name":"security_cert_revocation_crl","description":"For a domain's current certificate (taken from public Certificate Transparency data via CertSpotter): reads its CRL Distribution Point, downloads that public CR"},{"name":"security_mitre_attck_matrix","description":"Looks up one MITRE ATT&CK technique (e.g. T1059 or T1059.001) on its official public page: its name, the tactic-level summary text and the page title. Reads one"},{"name":"security_epss_exploit_score","description":"EPSS (Exploit Prediction Scoring System) for one CVE from FIRST's public API: the estimated probability (0 to 1) of exploitation in the next 30 days, its percen"},{"name":"security_cve_details_feed","description":"Vulnerability trend for a vendor (optionally one product) from the NIST NVD: CVEs published in the last N days (default 7, up to 120; a big vendor over a long w"},{"name":"security_jwt_token_inspector","description":"Decodes a JWT you supply (header and payload, base64url JSON) and reports its algorithm, key id, claims, and time checks (exp, nbf, iat). Flags alg none, symmet"},{"name":"security_csp_evaluator_audit","description":"Reads the Content-Security-Policy header of a site's home page and lists weak points: 'unsafe-inline' and 'unsafe-eval' in script sources, bare wildcards, data:"},{"name":"security_referrer_policy_audit","description":"Reads a site's Referrer-Policy header and its <meta name=referrer> tag from the home page, works out the policy a browser would apply, and rates how much of the"},{"name":"security_crossdomain_xml_test","description":"Reads a site's public crossdomain.xml (Adobe Flash) and clientaccesspolicy.xml (Silverlight) if they exist, lists the origins they allow, and flags wildcard gra"},{"name":"search_website_content_crawler","description":"Reads one public web page and returns its title, description and main text as Markdown (headings, links, lists), plus link counts. Reads only the page you name:"},{"name":"search_wayback_cdx","description":"Internet Archive Wayback Machine CDX index: archived snapshots of a URL or domain (timestamp, original URL, MIME type, HTTP status, length) with a link to each "},{"name":"search_google_search","description":"Organic web search results from the Brave Search API (an independent web index, not Google's): rank, title, URL, snippet, site name, page age and language for t"},{"name":"search_google_ads","description":"Google Ads Transparency Center: search advertisers by name or domain (verified name, advertiser ID, country, approximate ad count), or list the ads of an advert"},{"name":"search_wsj_articles","description":"WSJ World News headlines from the public Dow Jones RSS feed (latest items; keyword filter on title/summary). Headlines and short summaries only; full articles a"},{"name":"search_bing_search","description":"Bing web search results (Bing's public RSS search output, no key): result title, URL and snippet, in Bing's ranking order. Shows the first page of results Bing "},{"name":"search_google_news","description":"Google News search (public Google News RSS search feed, no key, English/US edition): headline, publisher, publish time and the Google News link for the newest m"},{"name":"search_pr_newswire","description":"PR Newswire latest news-release list from its public RSS feed (keyword filter on title/summary). Press release headlines and summaries. Public feed, no key. Pri"},{"name":"search_beehiiv_newsletter","description":"Post archive of a beehiiv newsletter (by beehiiv subdomain, e.g. superhuman, or the newsletter's own domain if hosted on beehiiv): newsletter name, total posts,"},{"name":"search_benzinga","description":"Latest Benzinga financial news (the public JSON feed behind benzinga.com): headline, teaser, author, time, URL, tickers, channels and tags. Filter by stock tick"},{"name":"search_markdown_to_pdf_mcp","description":"npm registry search for MCP servers that convert Markdown to PDF (public npm search API, no key): package name, version, description, publisher, last publish da"},{"name":"search_unpaywall","description":"Unpaywall open-access lookup by DOI (free API; it requires a contact e-mail set in UNPAYWALL_EMAIL, not a key): is the paper open access, OA status, best free f"},{"name":"search_reuters_articles","description":"Latest Reuters articles: headline, publication time and link, newest first, optionally matching search words, from the last 1-30 days. Found through Google News"},{"name":"search_fifa_team_rankings","description":"FIFA men's national team world ranking (FIFA public ranking API, no key): position, team, country code, total points, previous points and previous rank for one "},{"name":"search_university_rankings_mega_pack","description":"University rankings side by side from ShanghaiRanking ARWU (rank, national rank, total and six indicator scores) and Times Higher Education World University Ran"},{"name":"search_freightwaves","description":"FreightWaves latest news from its public RSS feed (keyword filter on title/summary/categories). Feed carries only the latest few items. Public feed, no key. Pri"},{"name":"search_crossref","description":"Crossref works search (public REST API, no key): DOI, title, type, container (journal or book), year, authors and link for matching scholarly records. Metadata "},{"name":"search_bbc_news_articles","description":"BBC News top stories from the public BBC RSS feed (latest items; keyword filter on title/summary). Headlines and summaries only, no full article text. Public fe"},{"name":"search_article_extractor","description":"Extracts one article from a public news or blog page: headline (og:title or h1), author, published and modified times, description and the article body as Markd"},{"name":"search_owgr_golf_rankings","description":"Official World Golf Ranking (OWGR public ranking API, no key): current men's position, player name, country, total points, average points and last week's positi"},{"name":"search_techcrunch_articles","description":"TechCrunch latest articles from its public RSS feed (keyword filter on title/summary/tags). Headlines and excerpts only. Public feed, no key. Price: $0.002 in U"},{"name":"search_prnewswire_press_releases","description":"PR Newswire health-category press releases from its public RSS feed (keyword filter on title/summary). Latest items only. Public feed, no key. Price: $0.002 in "},{"name":"search_emedicine_articles","description":"Medscape eMedicine (Medscape Reference) clinical articles by specialty: title, topic category, article id and URL from the public specialty index, filtered by w"},{"name":"search_openprescribing","description":"NHS England primary-care prescribing for a drug (official NHSBSA English Prescribing Dataset, monthly, ~2 months behind; the raw data behind OpenPrescribing.net"},{"name":"search_ft_com_articles","description":"Financial Times headlines from the public FT RSS feeds: international homepage or any section/topic stream (world, markets, companies, technology, opinion, glob"},{"name":"search_wechat_articles","description":"WeChat Official Account (公众号) articles matching a query, from Sogou WeChat search (weixin.sogou.com): title, summary, account name, publish time and link, 10 pe"},{"name":"search_hacker_news","description":"Hacker News story search through the official HN Search API (Algolia, public, no key): title, article URL, author, points, comment count and discussion link. Re"},{"name":"search_drive_com_au_news","description":"Latest Drive.com.au (Australia) articles: headline, publisher, publish time and link, newest first, optionally matching search words, from the last 1-30 days. F"},{"name":"search_gtex_gene_expression","description":"GTEx Portal gene expression (public API v2, no key): median TPM of one gene in human tissues, sorted highest first, with the GENCODE id it was matched to. Uses "},{"name":"search_cnbc","description":"CNBC top news from CNBC's public RSS feed (keyword filter on title/summary). Latest items only. Public feed, no key. Price: $0.002 in USDC per successful call, "},{"name":"search_dappradar_rankings","description":"Top 50 dapps from DappRadar's public rankings page: rank, name, token symbol, chains, market cap, token price, price change, trading volume, unique active walle"},{"name":"search_german_impressum","description":"Reads the Impressum (legal notice required on German websites, §5 TMG/DDG) at the page URL you give: e-mail addresses, phone numbers, postal address lines and t"},{"name":"search_datacite_metadata","description":"DataCite DOI search (public REST API, no key): DOI, title, publication year, resource type, publisher, creators and landing page for datasets, software and othe"},{"name":"search_al_jazeera_articles","description":"Al Jazeera latest articles from its public RSS feed (keyword filter on title/summary/categories). Latest items only. Public feed, no key. Price: $0.002 in USDC "},{"name":"search_defector_articles","description":"Defector articles from its public RSS feed (keyword filter on title/summary/tags). Latest items only; excerpts are as published in the feed. Public feed, no key"}],"package":null,"toolSurface":{"id":"ts_mdjzms3es9xq","endpointId":"ep_b8t8ejzs3avm","hash":"2b8cddd34f2c739236ddf55947a910f009cabe7beccbb64c2d7aa599059d6014","toolCount":129,"serverName":"sitecheck-web-intel","serverVersion":"1.0.0","protocolVersion":"2025-06-18","firstSeenAt":"2026-10-27T06:22:27.003Z","lastSeenAt":"2026-10-28T05:28:26.663Z","observations":4,"toolNames":["security_dns_records","security_whois_rdap","security_ssl_cert_chain","security_crtsh_transparency","security_ip_geolocation_asn","security_security_headers","security_dmarc_spf_dkim","security_urlhaus_malware","security_phishtank_check","security_cve_nvd_lookup","security_tor_exit_nodes","security_vpn_proxy_detector","security_shodan_host_summary","security_censys_exposure","security_abuseipdb_check","security_grey_noise_noise","security_hibp_breach_check","security_cisa_known_exploits","security_open_port_scanner","security_dns_propagation","security_reverse_dns_ptr","security_bgp_prefix_origin","security_dnssec_validator","security_cors_misconfig","security_cookie_security","security_subdomain_takeover","security_robots_security_txt","security_email_disposable","security_domain_typosquatting","security_asn_peers_upstream","security_tls_cipher_enum","security_open_resolver_check","security_ntp_monlist_audit","security_snmp_exposure","security_ssh_banner_audit","security_smb_exposure_test","security_rdp_exposure_check","security_spameatingmonkey","security_barracuda_reputation","security_spamhaus_zen","security_surbl_uri_lookup","security_openphish_feed","security_threatfox_iocs","security_malbazaar_samples","security_feodotracker_c2","security_sslbl_abuse_certs","security_ipsum_threat_level","security_cymru_asn_lookup","security_blocklist_de","security_ciarmy_bad_ips","security_talos_ip_blacklist","security_mx_server_test","security_dkim_key_checker","security_bimi_record_audit","security_mta_sts_validator","security_dns_caa_records","security_tls_alpn_detector","security_cert_revocation_crl","security_mitre_attck_matrix","security_epss_exploit_score","security_cve_details_feed","security_jwt_token_inspector","security_csp_evaluator_audit","security_referrer_policy_audit","security_crossdomain_xml_test","search_website_content_crawler","search_wayback_cdx","search_google_search","search_google_ads","search_wsj_articles","search_bing_search","search_google_news","search_pr_newswire","search_beehiiv_newsletter","search_benzinga","search_markdown_to_pdf_mcp","search_unpaywall","search_reuters_articles","search_fifa_team_rankings","search_university_rankings_mega_pack","search_freightwaves","search_crossref","search_bbc_news_articles","search_article_extractor","search_owgr_golf_rankings","search_techcrunch_articles","search_prnewswire_press_releases","search_emedicine_articles","search_openprescribing","search_ft_com_articles","search_wechat_articles","search_hacker_news","search_drive_com_au_news","search_gtex_gene_expression","search_cnbc","search_dappradar_rankings","search_german_impressum","search_datacite_metadata","search_al_jazeera_articles","search_defector_articles","search_doj_press_releases","search_nyt_articles","search_ap_news_articles","search_usda_market_news","search_dev_to_articles","search_europe_pmc_articles","search_gcaptain_maritime_news","search_figshare_articles","search_pubmed_article_metadata","search_wordpress_articles","search_crossref_academic_paper","search_bingx_markets","search_gdelt_news","search_theintercept_articles","search_shanghai_arwu_rankings","search_press_release_multi_wire","search_news_across_the_web","search_semafor_articles","search_world_rugby_rankings","search_hackernews_items","search_bleacher_report_articles","search_leiden_ranking","search_shanghai_gras_rankings","search_cran_r_packages","seo_linkedin_ad_library","search_wikimedia_commons_image","search_seo_audit_tool","search_shopify_metadata","search_mangadex_manga"],"distinctSurfaces":2},"endpointFacts":[{"id":"ep_b8t8ejzs3avm","url":"https://api.webintel-api.workers.dev/mcp?ref=registry","type":"mcp_streamable_http","factsCheckedAt":"2026-10-27T06:22:27.032Z","auth":{"observedAt":"2026-10-27T06:22:27.046Z","authRequired":false,"scheme":null,"resourceMetadata":null,"authorizationServer":null,"conformance":{"dpop":false,"rfc8414":false,"rfc9728":false,"pkceS256":false,"clientIdMetadataDocument":false,"dynamicClientRegistration":false}},"tls":{"observedAt":"2026-10-27T06:22:27.066Z","protocol":"TLSv1.3","chainValid":true,"chainError":null,"hostMatches":true,"subject":"webintel-api.workers.dev","issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validFrom":"2026-10-19T11:54:19.000Z","validTo":"2027-01-17T11:54:18.000Z","daysToExpiry":81,"sanCount":2,"fingerprint256":"4A:10:A1:94:92:FA:94:BB:BD:BB:F4:8C:A9:9E:9E:11:6F:79:68:CC:2F:21:F1:3D:76:63:51:E2:C4:53:C0:5E"}}]},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"mcp_registry","key":"io.github.bck-stack/sitecheck-web-intel","url":"https://registry.modelcontextprotocol.io/v0/servers/io.github.bck-stack%2Fsitecheck-web-intel","firstSeenAt":"2026-10-26T07:18:52.530Z","fetchedAt":"2026-10-26T07:18:52.530Z","normalizedAt":"2026-10-26T07:18:52.530Z"}]},"firstSeenAt":"2026-10-26T07:18:52.530Z","updatedAt":"2026-10-28T05:33:22.791Z"}