DechoNet MCP Server is an MCP (Model Context Protocol) server for the DechoNet domain security reconnaissance platform, designed for AI agents. The repository address is https://github.com/node-man/dechonet-mcp，官方站点为 https://dechonet.com。它把 DechoNet's domain security diagnostic capabilities are integrated into AI agents, providing a total of 25 tools and emphasizing that "every result is interpreted" rather than only returning raw JSON.
Purpose and Positioning This server is used to provide domain security reconnaissance capabilities to AI agents via MCP, covering phishing/smishing link checks, exposed admin page checks (whether admin interfaces, test servers, and legacy development tools are open), DNS, SSL/TLS, post-quantum TLS readiness, HTTP security response headers, email authentication, port scanning, DNS propagation, reverse DNS, ASN/BGP, RDAP/WHOIS, subdomain discovery (CT logs), lookalike/typosquatting detection, OWASP-mapped visible item checks, brand impersonation exposure surface, go-live readiness, domain change history (changes since the last check), infrastructure history and associations (past nameservers/IPs/issuers, and other domains appearing on the same rare infrastructure), and supports daily monitoring set by the agent.
Result Format Every tool returns results with interpretation: status (ok/warn/bad), key metric numbers, each issue with its severity level (critical/warning/info) and confidence, actionable remediation recommendations, and the complete raw JSON. At the end of each tool response, a link to the full interactive report on dechonet.com is provided for the person behind the agent to view.
Access Methods Zero-install remote access: no npx, no installation required; point any MCP client that supports Streamable HTTP to https://dechonet.com/mcp and it works. Claude Desktop / Claude Code can use the command claude mcp add --transport http dechonet https://dechonet.com/mcp；Cursor and other HTTP-capable clients can connect directly. The remote endpoint also provides 3 curated prompts (audit_domain, monitor_setup, investigate_changes) and 2 reference resources. Local stdio method (Claude Desktop): add the configuration to claude_desktop_config.json. Configuration file locations: macOS is ~/Library/Application Support/Claude/claude_desktop_config.json, Windows is %APPDATA%\Claude\claude_desktop_config.json, then restart Claude Desktop, and you will see the DechoNet tool icon in the input area. There is also a local SSE transport method, which can be used for self-hosted HTTP/SSE bridging (the official documentation states that the hosted remote endpoint is usually simpler).
Example Prompts After connecting, you can ask Claude to perform, for example: "Audit the security posture of example.com" "Is the SSL certificate for mysite.com about to expire?" "Which subdomains of example.com are exposed in CT logs?" "Are there registered lookalike domains of mybrand.com?" "How exposed is mybrand.com to impersonation?" "Is example.com ready to go live?" "What changed on example.com since the last check?" "Analyze these email headers: [paste headers]" "What's the ASN for 8.8.8.8?" etc.
Technical Principles and Data Sources The MCP server calls DechoNet's public API (https://dechonet.com/api/util/*），与 The dechonet.com web tools use the same backend and return structured results containing status, KPIs, issues with severity levels and confidence, remediation steps, and complete JSON. All data comes from public sources (DNS, HTTP headers, SSL certificates, CT logs, RDAP). It is passive by design: no active exploitation is performed; registered lookalike domains are reported only as "facts requiring verification," never as accusations.
Authenticated tools and environment variables When the server has your DechoNet login information, authenticated tools appear: you need to set DECHONET_SESSION_COOKIE to your own current cookie and send it as-is, for example dn_acct=... (when working in an organization workspace, dn_acct=...; dn_ws=...). Official guidance says to treat it like a password; it is sent only to the private endpoint specified below, never to public diagnostic interfaces, and a public API key cannot replace it; when it is not set, the server lists 25 public tools. The Business plan provides active checks against your own domains (plans). case_kit_search and case_kit_observe in an Investigator case space are available only with the case owner's session or an existing case access cookie: search reads stored page fingerprints scoped to the case; observe reopens the case target under the same rendering rules and daily limits. Official documentation states that similar pages and kit candidates never confirm a person or a phishing determination.
Usage restrictions and authorization Non-commercial use (with or without a key) is free starting November 8, 2026, including personal learning and research, checking your own domains, and nonprofit work. Using DechoNet in a paid product, for clients, or regularly for company work requires MCP·API Pro (dechonet.com/pro); before payment opens, you can contact support@dechonet.com. Full terms are in dechonet.com/terms §4.
Related resources Web tools (free, no registration required):https://dechonet.com；修复指南：https://dechonet.com/guides；钓鱼/短信钓鱼链接检查：https://dechonet.com/util/phishing；完整域名检查（DNS、SSL、响应头、邮件认证、端口、PQC summarized into one score):https://dechonet.com/util/all；监控（每日复查、变更历史）：https://dechonet.com/pro；HTTP API (including OpenAPI):https://dechonet.com/developers、https://dechonet.com/openapi.json；结果判定方法与每月检测基准：https://dechonet.com/methodology、https://dechonet.com/benchmark；服务状态：https://dechonet.com/status；X：https://x.com/Dechonetwork。项目采用 MIT licensed, issues and PRs welcome.
Regarding billing details, specific prices, and examples of each tool's parameters and return values, official materials are not provided and are not currently available.
