How do I install Dechonet?

Copy the http config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.

Does Dechonet need an API key?

The publisher lists these environment variables: DECHONET_URL, DECHONET_LOCALE, DECHONET_API_KEY, DECHONET_SESSION_COOKIE.

When was Dechonet last checked?

Last checked 2026-10-23. 30 security tools for AI agents: phishing links, exposure maps, DNS, SSL, PQC, history, pivots.

Dechonet MCP server

Power your agent

Add this server

The publisher's own URL. Not a PlugMCP endpoint.

Add to Cursor Add in Claude Add to VS Code Run on PlugMCP

Host a copy with our keys and logs.

Server URL

https://dechonet.com/mcp

Credentials from the publisher

DECHONET_URL — API base URL (default: https://dechonet.com)
DECHONET_LOCALE — Response language: en or ko (default: en)
DECHONET_API_KEY — Optional free API key (dechonet.com account page): own rate limits; required for infrastructure_pivot
DECHONET_SESSION_COOKIE — Optional: your own DechoNet login cookie (dn_acct), only for the signed-in tools (Business-plan Nuclei checks, investigator cases)

The Claude button above opens Claude with the name and URL filled in. You still confirm it there.

shClaude Code

1claude mcp add --transport http com.dechonet-mcp https://dechonet.com/mcp

Run in a terminal.

jsonClaude Desktop

1{2  "mcpServers": {3    "com.dechonet-mcp": {4      "command": "npx",5      "args": [6        "-y",7        "mcp-remote",8        "https://dechonet.com/mcp"9      ]10    }11  }12}

claude_desktop_config.json

Remote · HTTPPublisher installStep-by-step: add this in Claude

Remote URL or a command on your machine? How the two installs differ

Run on PlugMCP

Host a copy with our keys and logs.

A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.

Launch

Server facts

Remote

Transport: http
Version

30 tools

Tools

tools/listVoice mode preview

Tool	What it does
dns_lookup	Query DNS records (A, AAAA, MX, TXT, NS, SOA, CAA) for a domain and validate email-related records, including DNSSEC presence and SPF/DMARC syntax, returning severity-rated diagnostics. Use this for a single authoritative answer about one domain. Use dns_propagation instead when you need to compare
ssl_check	Inspect a host's served TLS/SSL certificate and connection: expiry date, issuer, SAN list, chain integrity, revocation (OCSP, then CRL; unknown when neither answers — not graded unless revoked), TLS version, and HSTS, returning an A+ to F grade weighted by certificate validity (40%), TLS version (25
http_security	Follow a URL's HTTP redirect chain and audit response security headers (CSP, HSTS, X-Frame-Options, COOP, CORP, COEP, Permissions-Policy), grading A+ to F on the six core headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy; COOP/CORP/COEP are reported but
email_auth	Assess a domain's email authentication and deliverability posture: MX records, SPF, DMARC, DKIM (probes 15 common selectors), BIMI, MTA-STS, TLS-RPT, and DANE, plus a blacklist check across all MX hosts, returning a 0-100 deliverability score. Use this for a full sending/receiving readiness review o
port_scan	Probe a host for a fixed set of common TCP ports (HTTP, HTTPS, SSH, FTP, SMTP, DNS, and common databases) and report which are open, the service name, and the response time. BEHAVIOR: this makes an ACTIVE TCP connection to the target. It is non-intrusive — a connect probe only; it does not authentic
dns_propagation	Query one DNS record across 8+ global public resolvers (Google, Cloudflare, Quad9, OpenDNS, and more) simultaneously and report which resolvers return stale versus updated values. Use this after changing a record to confirm worldwide propagation. Use dns_lookup instead for a single authoritative ans
reverse_dns	Resolve the PTR (reverse DNS) record for an IPv4 or IPv6 address and verify forward-confirmed reverse DNS (FCrDNS) by checking that the PTR hostname resolves back to the same IP. Infers the hosting provider from PTR naming patterns. Use this to validate mail-server rDNS or identify a single IP's hos
asn_lookup	Look up Autonomous System (ASN) / BGP information for an IP address or AS number: the network operator, announced prefixes, abuse contact, and a classification (cloud, CDN, ISP, hosting, or enterprise). Use this to identify who runs a network or whether an IP is cloud/CDN-hosted. Use reverse_dns ins
whois_lookup	Retrieve domain registration data via RDAP (with WHOIS fallback): registrar, creation/expiry/update dates, nameservers, and EPP status flags, highlighting risk states such as clientHold and pendingDelete. Use this for ownership, lifecycle, and expiry questions about a registered domain. Use dns_look
subdomain_discovery	Enumerate the subdomains of a domain from Certificate Transparency logs — fully passive (no packets are sent to the target; CT logs are public records of every TLS certificate ever issued). Flags operational-looking names (dev, staging, admin, vpn, legacy) and wildcard certificates, because forgotte
lookalike_domains	Generate the typosquat/lookalike variants of a domain that phishers actually register — homoglyph swaps (l→1, o→0, rn→m), TLD swaps (.com→.co), character omissions, transpositions, repetitions, hyphenations — and check which of them are currently registered (live NS delegation via DoH). Use this to
ip_info	Report information about the caller's own public IP as seen by the server: IPv4/IPv6 address, ISP, ASN, approximate geolocation, and proxy/VPN heuristics. Takes no input — it reflects the egress IP of THIS MCP server's network, which is usually NOT the end user's IP. Use this to discover the server'
email_header_analysis	Parse raw email headers to reconstruct the delivery path (each Received hop in order), extract SPF/DKIM/DMARC authentication results, measure per-hop delays, and flag unencrypted (non-TLS) hops. Use this to diagnose a specific message that was already delivered — spoofing, delays, or where mail was
subnet_calc	Compute IPv4 subnet details from CIDR notation entirely locally — no network call: network and broadcast addresses, usable host range, total usable hosts, subnet mask, and wildcard mask. /31 and /32 are handled per RFC 3021 (point-to-point / single host). Use this for IPv4 address planning. It does
security_scan	One-shot comprehensive audit of a domain, scored 0-100 with an A+ to F grade and a prioritized action list. Five scored areas: the web connection (TLS certificate and HTTP security headers, measured on www when only www has an address), mail spoofing defence (SPF/DKIM/DMARC; a domain that uses no ma
owasp_check	Assess a domain's OWASP posture from EXTERNAL OBSERVATION only: the OWASP Secure Headers Project plus the externally observable OWASP Top 10:2025 subset — A04 Cryptographic Failures (TLS/cert), A02 Security Misconfiguration (header/info leaks), and A03 Software Supply Chain Failures (outdated compon
impersonation_exposure	Assess how exposed a domain is to brand impersonation and phishing, PASSIVELY: live typosquat/lookalike domains (homoglyph, omission, transposition, TLD swap) that actually resolve, operational subdomains (dev/staging/admin) exposed in CT logs, and whether a wildcard certificate exists — returning a
domain_changes	Report what has changed for a domain over time — the security regressions and drift that DechoNet's daily monitoring has recorded across every watch on the domain (SSL grade, headers, DNS, OWASP posture, impersonation exposure, etc.). Use this to answer "what changed on my domain since yesterday/las
domain_history	Show how a domain's (or IPv4 address's) infrastructure has changed over time from DechoNet's stored observations: nameservers, A/AAAA, MX, CNAME, certificate issuer, registrar, RDAP nameservers and status, and for an IP its ASN and PTR — each value with when it was first and last seen. Use this when
infrastructure_pivot	Find other domains DechoNet has seen with the same infrastructure value — a nameserver, IP address, MX host, certificate issuer or registrar — with first and last seen, to map related infrastructure (e.g. other phishing domains on the same rare nameserver). Use it after domain_history or dns_lookup
watch_domain	Start (or reuse) a daily DechoNet watch on a domain so that changes are recorded over time — SSL grade/issuer/expiry, DNS records, HTTP security headers, domain registration, and optionally OWASP posture and impersonation exposure. Use this once when the user cares about a domain beyond a one-off ch
set_expectations	Record what a domain should show from outside and check it now — HSTS or another header present, DMARC enforcing, an issue key no longer reported, an HTTP or TLS grade at or above a level, a certificate with enough days left, a DNS record present, absent or containing a value, HTTPS answering. Decho
verify_expectations	Check expectations from outside now, with fresh reads: either a stored set by id (from set_expectations — its state is updated and an anonymous set is kept another 30 days), or a domain plus a list of checks once, storing nothing. Same checks and outcomes as set_expectations (pass / fail / unknown,
check_before_action	Check the page an agent is about to log in, pay, download from or submit to: whether the address impersonates a brand, how new the domain is, whether DechoNet or a licensed feed has already flagged it, and — opened from Seoul (and Tokyo for Japan-targeted pages) as a phone — what the page turns into
report_page	Report a page to DechoNet: phishing or brand impersonation, a fake payment window (card fields where a payment provider should be), hidden instructions aimed at AI agents, a malicious download, a DechoNet verdict that looks wrong (false_positive) or a danger it missed (missed), an MCP server whose t
golive_check	Check whether a domain is ready to launch or migrate — a go/no-go verdict over five essentials: DNS resolves to an IP, has propagated consistently across global resolvers, SSL/TLS is ready, the site is reachable over HTTPS, and the domain registration is not about to expire. Use this right before fl
pqc_readiness	Check whether a website's public TLS endpoint is ready for post-quantum cryptography: does it complete a TLS 1.3 handshake that offers only the hybrid X25519MLKEM768 key exchange (ML-KEM), and does the organisation's own server provide it or a CDN edge in front of it. Also reports what the certifica
mcp_server_check	Check a remote MCP server from outside before connecting it to an agent: whether it requires authentication (and publishes OAuth protected-resource metadata, RFC 9728), which of its tools act on the world (run commands, write or delete files, send messages, make payments, read secrets), whether its
phishing_link_check	Check the links in a suspicious text message (smishing) or e-mail before anyone taps them. Paste the whole message or a single URL: every link is extracted, followed through URL shorteners to its real destination, and judged on observable signals — domain age from RDAP, impersonation of Korean banks
exposure_map	Map what an organisation exposes to the internet beyond its home page: subdomains from Certificate Transparency logs (plus hosts DechoNet has already observed), each opened once from outside and sorted into developer/ops tools, directory listings, admin screens, VPN/remote-access logins, staging ser

DechoNet MCP Server

dechonet.com · Remote MCP (no install) · Phishing link check · Free web tools · HTTP API · Detection benchmark · Status

Domain security reconnaissance for AI agents via the Model Context Protocol.

30 tools. No API key needed for non-commercial use. Phishing/smishing link checks, exposed admin page checks (admin screens, test servers, dev tools left open), DNS, SSL/TLS, post-quantum TLS readiness, HTTP security headers, email authentication, port scan, DNS propagation, reverse DNS, ASN/BGP, RDAP/WHOIS, subdomain discovery (CT logs), lookalike/typosquat detection, OWASP-mapped observable checks, brand-impersonation exposure, go-live readiness, MCP server checks before you connect one, domain change history — what changed since the last check — infrastructure history and pivots (past nameservers/IPs/issuers, and other domains seen on the same rare infrastructure), and a daily watch you can set from the agent.

Every result comes back interpreted, not just as raw JSON: a status, the key numbers, each issue with severity and confidence, and the concrete action to take. That is what an agent needs to tell a human what to do next.

Part of DechoNet. Every tool here is also a free web tool at dechonet.com — no sign-up — backed by error-fix guides. This package brings the same checks to AI agents.

Zero-install: remote endpoint

No npx, no install. Point any MCP client that speaks Streamable HTTP at:

https://dechonet.com/mcp

Client	How to connect
Claude Code	`claude mcp add --transport http dechonet https://dechonet.com/mcp`
Claude app / Desktop	Listed in the Claude connectors directory: Customize → Connectors, search DechoNet → Connect. Or + Add → Add custom connector with the URL (Free plan: one custom connector)
ChatGPT	chatgpt.com/plugins → + → Add custom MCP server → URL under Connection, no authentication → Create as a plugin (work/school accounts need an admin to allow custom MCP servers)
Cursor	`~/.cursor/mcp.json`: `{"mcpServers":{"dechonet":{"url":"https://dechonet.com/mcp"}}}`
VS Code (Copilot agent mode)	`.mcp.json` at the workspace root: `{"mcpServers":{"dechonet":{"type":"http","url":"https://dechonet.com/mcp"}}}` (in `.vscode/mcp.json` the root key is `servers`)
Gemini CLI	`gemini mcp add --transport http dechonet https://dechonet.com/mcp` (in `settings.json` use `httpUrl`, not `url`)
Codex	`codex mcp add dechonet --url https://dechonet.com/mcp`
Windsurf	`~/.codeium/windsurf/mcp_config.json`: `{"mcpServers":{"dechonet":{"serverUrl":"https://dechonet.com/mcp"}}}`
Any stdio-only client	npm package — see Quick Start below

Step-by-step for each client: dechonet.com/mcp. The remote endpoint also serves 3 curated prompts (audit_domain, monitor_setup, investigate_changes) and 2 reference resources.

Quick Start (stdio, Claude Desktop)

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "dechonet": {
      "command": "npx",
      "args": ["-y", "dechonet-mcp"]
    }
  }
}

Config file location:

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json

Restart Claude Desktop; DechoNet shows up in the chat input's tools menu. (Claude Desktop can also skip the install and add https://dechonet.com/mcp as a custom connector — see the table above.)

Install

# Via npx (no install needed)
npx dechonet-mcp

# Or install globally
npm install -g dechonet-mcp

Command line

The same checks work from a terminal or a CI step — no MCP client needed:

npx dechonet-mcp ssl example.com
npx dechonet-mcp email example.com --json
npx dechonet-mcp scan example.com --fail-on bad   # exit 2 when the overall grade is D or F

Checks: dns, ssl, http, email, port, propagation, rdns, asn, whois, subdomains, lookalike, scan, owasp, golive, pqc, mcp, phishing, exposure, changes, history, impersonation, ip, subnet (or any tool name below). --json prints the structured result, --raw keeps the raw data, --port sets the TLS port. Exit codes: 0 done, 1 the lookup failed, 2 the result reached --fail-on (bad or warn). With no arguments the package runs as the MCP server.

Available Tools

Tool	Description
`phishing_link_check`	Is this link a scam? — paste a text message or URL; follows shorteners, checks domain age, Korean brand impersonation, APK downloads, phishing feeds
`exposure_map`	Admin pages open to the internet? — subdomains from CT, each opened once: admin screens, staging, dev tools, VPN logins, default pages, directory listings (counts; per-host detail for the verified owner on the web report)
`security_scan`	Comprehensive scan — 9 checks in parallel, 0-100 Health Score, A-F grade
`dns_lookup`	DNS records + DNSSEC + SPF/DMARC validation
`ssl_check`	SSL/TLS certificate, chain, expiry, HSTS, CT history, A-F grade
`http_security`	HTTP redirect trace + 10 security headers audit, A-F grade
`email_auth`	SPF, DMARC, DKIM, BIMI, MTA-STS, DANE + blacklist check
`port_scan`	Open TCP ports with service identification
`dns_propagation`	DNS propagation across 6 public resolvers
`reverse_dns`	PTR record + FCrDNS verification
`asn_lookup`	ASN/BGP network identification + abuse contact
`whois_lookup`	RDAP/WHOIS domain registration data
`subdomain_discovery`	Passive subdomain enumeration from CT logs, operational-name flags (dev/staging/admin), wildcard detection
`lookalike_domains`	Typosquat variants that are actually registered — homoglyph, affix (brand-login), TLD swap, keyboard slips — with the domain's own defensive registrations separated out
`owasp_check`	OWASP-mapped checks that can be observed passively (headers, TLS, exposed files), honest about what is out of scope
`impersonation_exposure`	Brand impersonation exposure grade: third-party lookalikes + exposed operational subdomains + wildcard certs

Every tool response ends with a link to the full interactive report on dechonet.com for the human behind the agent.

Example Prompts

Once connected, try asking Claude:

"Audit the security posture of example.com"
"Is the SSL certificate for mysite.com about to expire?"
"Which subdomains of example.com are exposed in CT logs?"
"Are there registered lookalike domains of mybrand.com?"
"How exposed is mybrand.com to impersonation?"
"Is example.com ready to go live?"
"What changed on example.com since the last check?"
"Analyze these email headers: [paste headers]"
"What's the ASN for 8.8.8.8?"

Local SSE Transport

For a self-hosted HTTP/SSE bridge (the hosted remote endpoint above is usually simpler):

npm run start:sse
# Server runs on http://localhost:3100
# SSE endpoint: http://localhost:3100/sse

Development

npm install
npm run build    # TypeScript → build/
npm run dev      # Run with tsx (stdio)
npm run start:sse # Run SSE server

How It Works

The MCP server calls DechoNet's public API (https://dechonet.com/api/util/*) — the same backend as the dechonet.com web tools — and returns structured results with:

Status (ok/warn/bad)
KPIs (key numbers per tool)
Issues with severity (critical/warning/info) and confidence levels
Actionable remediation steps
Raw data (full JSON)

All data comes from public sources (DNS, HTTP headers, SSL certificates, CT logs, RDAP). Passive by design: no active exploitation, and a registered lookalike is reported as a fact to verify, never as an accusation.

Environment Variables

Variable	Default	Description
`DECHONET_URL`	`https://dechonet.com`	API base URL
`DECHONET_LOCALE`	`en`	Response language (`en` or `ko`)
`DECHONET_API_KEY`	—	Optional free API key from your DechoNet account: your own rate-limit bucket, and required for `infrastructure_pivot`
`DECHONET_SESSION_COOKIE`	—	Your own DechoNet login cookie, only for the signed-in tools. Keep it secret
`PORT`	`3100`	SSE server port

Terms of use

Free use (with or without a key) is for non-commercial purposes from November 8, 2026 — personal learning and research, checking your own domains, non-profit work. Using DechoNet inside a paid product, for clients, or regularly for company work needs MCP·API Pro (dechonet.com/pro); until payments open, ask at [email protected]. Full terms: dechonet.com/terms §4.

About DechoNet

DechoNet is a domain security reconnaissance platform — distributed observation, cross-verification. The same diagnostics ship three ways: free web tools, error-fix guides, and this MCP server.

🌐 Web tools (free, no sign-up): https://dechonet.com
📘 Guides (fix common DNS/SSL/HTTP/email errors): https://dechonet.com/guides
🎣 Phishing / smishing link check (opens the link like a Korean phone): https://dechonet.com/util/phishing
🩺 Full domain check (DNS, SSL, headers, email auth, ports, PQC in one score): https://dechonet.com/util/all
🔔 Monitoring (daily re-checks, change history): https://dechonet.com/pro
🛠 HTTP API (same tools, OpenAPI): https://dechonet.com/developers · https://dechonet.com/openapi.json
📏 How results are judged / monthly detection benchmark: https://dechonet.com/methodology · https://dechonet.com/benchmark
🟢 Service status: https://dechonet.com/status
🐦 X: https://x.com/Dechonetwork

MIT licensed. Issues and PRs welcome.

Signed-in tools

These tools appear only when the server has your DechoNet login: set DECHONET_SESSION_COOKIE to your own current cookie as it is sent, e.g. dn_acct=… (or dn_acct=…; dn_ws=… when you work in an agency workspace). Treat it like a password. It is sent only to the exact private endpoints below, never to the public diagnostics, and a public API key does not stand in for it. Without it the server lists the 30 public tools.

Business plan — active checks on domains you own (plans)

Tool	Description
`asm_nuclei_start`	Start a limited active check (Nuclei) on a verified asset from your attack-surface report. Needs current DNS TXT ownership, the exact root URL from that report and `confirm: "asm-nuclei-v1"`
`asm_nuclei_status`	Progress, coverage and sanitized findings. Partial or failed is not a clean result; technology detection is not proof of a vulnerability. Never starts requests
`asm_nuclei_cancel`	Stop new requests and end the job. Requests already sent cannot be recalled

Investigator case spaces — case_kit_search and case_kit_observe work only with a case owner session or an existing case access cookie. Search reads stored, case-scoped page fingerprints; observe re-opens a case target under the same render rules and daily cap. Similar screens and kit candidates never confirm a person or a phishing verdict.

Dechonet

Add this server

Host a copy with our keys and logs.

Server facts

Tools

Questions

How do I install Dechonet?

Does Dechonet need an API key?

What transport does Dechonet use?

When was Dechonet last checked?

Documentation

DechoNet MCP Server

Zero-install: remote endpoint

Quick Start (stdio, Claude Desktop)

Install

Command line

Available Tools

Example Prompts

Local SSE Transport

Development

How It Works

Environment Variables

Terms of use

About DechoNet

Signed-in tools