security_scan
Checks five areas at once and returns a grade and the actions that come first.
MODEL CONTEXT PROTOCOL
Give your AI agent 33 security tools in one line
Agents such as Claude, ChatGPT and Cursor call DechoNet's observations directly. A remote server with nothing to install, and an npm package.
Connect in ten seconds
Connect in Claude → Connect in ChatGPT →
Listed in the Claude connectors directory and the ChatGPT apps directory: one click on the listing's Connect button and it works on the web, desktop and mobile apps. For other AI apps, see the tabs below.
Listed in the Claude connectors directory — Customize → Connectors, search DechoNet → Connect · or add this address yourself
https://dechonet.com/mcp?via=claudeTo add it without the directory: + Add → Add custom connector and paste the address above. claude.ai on the web, Desktop and Cowork share the same connectors. The Free plan allows one custom connector.
Terminal · remote, nothing to install
claude mcp add --transport http dechonet https://dechonet.com/mcpEasiest: Connect on DechoNet in the ChatGPT apps directory. To add it yourself: chatgpt.com/plugins → + → Add custom MCP server → paste this address under Connection, no authentication
https://dechonet.com/mcpOn work or school accounts an admin has to allow the app or custom MCP servers first. OpenAI moves this menu often (it was Settings → Apps → Developer mode; as of October 2026 it is the Plugins page) — if it looks different, see OpenAI's "Connect and test your plugin" doc.
~/.cursor/mcp.json · remote
{
"mcpServers": {
"dechonet": {
"url": "https://dechonet.com/mcp"
}
}
}MCP: Add Server → HTTP · Copilot Global
https://dechonet.com/mcpRun MCP: Add Server from the Command Palette, choose HTTP and enter the address above. Use dechonet as the server ID and pick Global → Copilot Global as the destination (saved in ~/.copilot/mcp-config.json). The workspace-root .mcp.json for sharing with a team appears only with the experimental setting chat.mcp.workspaceRootConfig.enabled, and the old .vscode/mcp.json remains only for compatibility. Once connected, ask the chat to use the dechonet tools and approve the tool requests.
Terminal · remote, nothing to install
gemini mcp add --transport http dechonet https://dechonet.com/mcpIn ~/.gemini/settings.json put the address under "httpUrl", not "url" ("url" is read as the older SSE transport).
Terminal · saved to ~/.codex/config.toml
codex mcp add dechonet --url https://dechonet.com/mcpThe CLI, IDE extension and app share this config. Check the connection with /mcp inside Codex.
~/.codeium/windsurf/mcp_config.json · remote
{
"mcpServers": {
"dechonet": {
"serverUrl": "https://dechonet.com/mcp"
}
}
}Windsurf uses the "serverUrl" key. Save, then refresh the MCP list.
claude_desktop_config.json · npm package (stdio)
{
"mcpServers": {
"dechonet": {
"command": "npx",
"args": [
"-y",
"dechonet-mcp"
]
}
}
}For when you need a local install (clients that only run stdio servers, company policy). The npm package calls the same backend as the remote endpoint. In Claude Desktop the connector in the "Claude app" tab is simpler.
Once connected, ask something like "check github.com's security" and the agent usually starts with security_scan.
Each client's setup was checked against its maker's official docs on 2026-10-15, and a daily check flags those docs when they change. If your screen differs, follow the official docs.
API keys
The API and MCP server work without a key. With a key, limits are counted per key instead of per IP (so people sharing an office or cloud IP do not block each other). Send the header "Authorization: Bearer <key>" with requests.
Pre-deploy gate for CI: GET /api/util/gate?url=…&min_ssl=B&min_headers=C — pass=false when HTTPS, certificate grade, days left, chain or security-header grade misses the bar.
From November 8, 2026, free use is for non-commercial purposes only (personal learning and research, checking your own domains, non-profit work). Using it inside a paid product, for clients, or regularly for company work needs MCP·API Pro (before payments open, ask at support@dechonet.com). Terms §4 · MCP·API Pro · Create an account
How an agent works through it
Look deeper where it points
Calls the matching tool next, such as ssl_check or http_security.
watch_domain
Sets a daily watch; next time domain_changes shows only what changed.
Tools 33 read-only observation, except watch_domain, set_expectations and report_page
| Tool | What it does | Group |
|---|---|---|
security_scan | Five questions in one check: an A+ to F grade and what to fix first. | Site checks |
phishing_link_check | Paste a suspicious text; see where each link really goes. | Phishing |
exposure_map | Counts of exposed admin and staging screens (per-host detail on the web, after ownership check) | Site checks |
pqc_readiness | Does the site offer post-quantum key exchange? | Site checks |
domain_changes | Only what changed since the last lookup or watch | Watch & history |
dns_lookup | All DNS records, with SPF, DMARC and DNSSEC checks. | Domain & email |
ssl_check | Certificate, chain and TLS version, read from Seoul. | Site checks |
http_security | Redirect chain and security headers, graded A–F. | Site checks |
email_auth | MX, SPF, DMARC, DKIM and blacklists. | Domain & email |
port_scan | Which common TCP ports answer. | Network |
dns_propagation | The same record on six public resolvers. | Domain & email |
reverse_dns | The PTR name of an IP, and whether it points back. | Network |
asn_lookup | Who owns an IP or network, and its prefixes. | Network |
whois_lookup | Registrar, dates and status of a domain. | Domain & email |
subdomain_discovery | Subdomains found in certificate logs. | Domain & email |
lookalike_domains | Registered lookalikes of your domain name. | Phishing |
ip_info | Your public IP, network and location. | Network |
email_header_analysis | Read the route and auth results in a mail header. | Phishing |
subnet_calc | Network, range and hosts of a CIDR block. | Network |
owasp_check | The OWASP Top 10 items visible from outside. | Site checks |
impersonation_exposure | How exposed your brand is to impersonation. | Phishing |
domain_history | How a domain's or IP's infrastructure changed over time (name servers, addresses, MX, certificate issuer, registrar), each value with when it was first and last seen | Watch & history |
infrastructure_pivot | Other domains on the same name server, IP, MX, certificate issuer or registrar, to map related infrastructure (API key required) | Watch & history |
watch_domain | Sets a watch that rechecks the domain daily | Watch & history |
set_expectations | States what the domain should show from outside, checks it now and every day after (signed receipts) | Watch & history |
verify_expectations | Checks those expectations from outside now — after a change, to see whether it shows yet | Watch & history |
check_before_action | Before logging in or paying: is this page what it claims — impersonation, new domain, flagged before, and where the card entry sits | Phishing |
crypto_check_before_sign | Judges the destination address, the page that asked and the signing request together. Recognises requests that can hand over assets: unlimited token approvals, Permit signatures, setApprovalForAll. | Crypto |
wallet_address_check | One wallet address: chain, checksum, OFAC sanctions listing and DechoNet's record. | Crypto |
crypto_exchange_check | Whether a domain is an official exchange, wallet or dApp address, or one that only uses the name. | Crypto |
report_page | Report a page — phishing, a fake payment window, hidden instructions for AI agents, a malicious download, or a wrong verdict; DechoNet then checks it itself | Phishing |
golive_check | Is a new site ready to launch: DNS, TLS, HTTPS, headers. | Site checks |
mcp_server_check | Before connecting an MCP server: auth, tools that act, poisoned descriptions. | Site checks |
More tools when you sign in
With a Business plan account, these appear in the tool list once your MCP client sends your DechoNet login. They work only on domains whose ownership you verified, and nothing starts until you confirm it.
| Tool | What it does |
|---|---|
asm_nuclei_start | Start an active check (Nuclei, limited request budget) on a verified asset from your attack surface report |
asm_nuclei_status | Read that check's progress, coverage and findings |
asm_nuclei_cancel | Stop the check |
Principles
- Interpretation over raw data: every result carries status, key numbers, issues with confidence, and concrete actions.
- Passive by design: DNS, certificates, CT logs, HTTP headers, RDAP. No exploitation. A registered lookalike is reported as a fact to verify, never as an accusation.
- Cross-verification: independent sources are compared where possible (multiple DNS resolvers, CT logs plus live TLS).
npm: dechonet-mcp GitHub: node-man/dechonet-mcp Smithery: nodeman/dechonet Glama: com.dechonet/mcp MCP Registry: com.dechonet/mcp Same tools on the web Daily monitoring and plans