checker-mcp is a domain security and privacy checker, provided as a local-first MCP server, published by OksigeniaSL, licensed under GPL-3.0-or-later.
Purpose You can have any MCP client scan a domain and return a scored report covering four major areas: certificates, email authentication, DNS and infrastructure, and web security response headers; for any failed check, the report provides plain-language remediation advice.
Main capabilities
- The server runs over stdio and performs DNS-over-HTTPS, HTTP, RDAP, and TLS queries itself; network traffic comes only from the checks themselves.
- Zero telemetry: no analytics, no callbacks, no third-party scoring service in the loop.
- Privacy by default: DNS queries are sent to Cloudflare DoH rather than Google, and reputation checks use Cloudflare's malware/phishing resolver.
- A total of 17 checks, divided into four categories, weighted to calculate a score of 0-100.
- Checks cover: certificates, email authentication (SPF, DMARC, DKIM), DNS and infrastructure (DNSSEC, CAA), and web security response headers.
Three tools
- Scan a domain or URL and return a scored report from live checks.
- List all checks by category and explain why each check matters.
- Explain a single check by id: why it matters and how to fix it if it fails. Use list_checks to get full descriptions of all checks, or explain_check to explain them one by one.
How to use You can run it directly from npm via npx: npx @oksigenia/checker-mcp You can also register it with Claude Code, or add it to any MCP client configuration (suitable for Claude Desktop, Claude Code, or any MCP client). Then you can ask questions such as "Check the security of example.com" or "Explain the dmarc check."
Running with Docker It can be built and run as a container. It speaks MCP over stdio, so attach it to the client's stdin/stdout with -i rather than listening on a port.
Languages Reports support Spanish andEnglish. You can set the default language with the environment variable OKSIGENIA_LANG (es or en), or pass lang in any tool call; the default is English.
Data egress notes The only thing that leaves your machine is the domain you scan, sent to:
- Cloudflare DoH (cloudflare-dns.com) and Cloudflare's security resolver, for DNS and reputation;
- Public RDAP (rdap.org), for registration and WHOIS privacy data;
- The HSTS preload API, for preload status;
- The target site itself (HTTPS), to read its certificate and security response headers. No telemetry, no analytics, no third-party scoring service. Your queries are not stored or transmitted anywhere else.
Development-related Development watch: npm run dev. src/engine.ts: the network engine, language-agnostic, returns i18n keys rather than text; each check has its own fault tolerance, and runChecks never throws exceptions. src/i18n.ts: es/en dictionaries and t(). src/index.ts: the MCP server, which renders engine keys into the requested language and exposes three tools. See CONTRIBUTING.md for the PR process.
Limitations The materials do not provide information such as pricing, fees, the scope of platform compatibility, scan duration, or performance promises.
