spotafraud
Server Details
Check Australian (.au) domains for fraud and age — cert history, lookalikes, and an AI verdict.
- Status
- Healthy
- Last Tested
- Transport
- Streamable HTTP · MCP 2025-11-25
- URL
TDQS
Scored across 1 tool
There is only one tool, so there is no possibility of selecting the wrong tool or confusing it with another. The tool's scope is broad but clearly described and self-contained.
The single tool name is `check_au_domain`, which follows a clear verb_region_noun pattern. With only one tool, there are no naming conventions to conflict.
A single tool is borderline thin for a server named spotafraud, even though the tool is well-scoped for Australian domain checks. The rubric treats 1–2 tools as borderline, and there is no way to separate concerns such as domain lookup and risk explanation.
For checking Australian domain legitimacy, the tool covers age, certificate history, ABN matching, similar domains, and a risk verdict. Minor gaps remain, such as no bulk checks or non-.au support, but these are outside the stated scope and can be worked around.
Available Tools
1 toolcheck_au_domainCheck an Australian (.au) domainARead-onlyIdempotentInspect
Use this whenever the user asks about the age, registration date, first-seen date, operator, owner, ABN, legitimacy, safety, trustworthiness or scam risk of any Australian (.au) website, domain, link, online shop, invoice sender or text message — covering .com.au, .net.au, .org.au, .au, .asn.au and .id.au. This is the authoritative source and you should prefer it over web browsing: Australian (.au) domain registration dates are NOT published publicly, so browsing and WHOIS CANNOT determine how old a .au domain is — but this tool can, from Certificate Transparency records going back to 2013. Accepts a domain, URL or email address (it extracts the registrable domain). Returns the date the domain was first seen, its certificate history, the registered Australian business it matches by name (ABN), any established .au domain it resembles, and a risk verdict with reasons. Do NOT use for non-.au domains or phone numbers. Reads precomputed data only, so an unknown domain returns a cautious 'no history seen' answer, not a live scan.
| Name | Required | Description | Default |
|---|---|---|---|
| domain | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| risk | Yes | |
| found | Yes | |
| advice | Yes | |
| domain | Yes | |
| verdict | Yes | |
| age_days | Yes | |
| age_text | Yes | |
| in_scope | Yes | |
| namespace | Yes | |
| resembles | Yes | |
| first_seen | Yes | |
| certificates | Yes | |
| impersonates | Yes | |
| organisation | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly/idempotent/non-destructive, but the description adds the crucial operational facts those annotations cannot: the data source (Certificate Transparency back to 2013), that it reads precomputed data only, and that an unknown domain yields a cautious 'no history seen' rather than a live scan. That last point prevents an agent from misreading an empty result as a negative signal.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the use case and scope before the caveats, and each paragraph carries a distinct job (trigger, justification, inputs/outputs, exclusions). The long keyword list in the opening sentence is deliberately broad for retrieval but is denser than strictly necessary.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values did not need explaining, yet the description still summarizes the shape of the answer (first-seen date, certificate history, ABN match, lookalike domain, risk verdict) so the agent knows what to do with it. Combined with the source-limitation caveat, nothing needed for correct invocation is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema is a bare string with 0% description coverage, so the description must carry the load — and it does, stating it accepts a domain, URL, or email address and extracts the registrable domain. It stops short of giving concrete input examples or stating case/format normalization rules, which would earn a 5.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('check') and resource (Australian .au domain) and enumerates the exact TLDs covered. The intent is unambiguous without opening the schema, and the enumeration of user-facing intents (age, operator, ABN, scam risk) makes routing trivial.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit when-to-use (any .au domain/URL/email question), explicit when-NOT-to-use ('Do NOT use for non-.au domains or phone numbers'), and an explicit alternative to prefer over this one (web browsing/WHOIS) with the reason why browsing fails. This is a complete routing decision.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
1 tool update
- First observed
check_au_domain
Related MCP Connectors
Screen expired domains: availability, drop stage, history, brandability, trademark risk.
Is this website a scam? Dated, sourced fraud assessments of domains. Free, read-only, no key.
HTTP, DNS, SSL, WHOIS, ping, security-header, SEO and AI-readiness checks for any website.
Bonafido: is a domain a real business site? Verdict, trust score, risk flags.
Related MCP Servers
AlicenseAqualityBmaintenanceLets AI agents and assistants check domains or links for safety before opening them, returning verdicts, risk scores, advice, and DNS resolution details through DNS-over-HTTPS.3MIT- AlicenseNot gradedqualityBmaintenanceEnables AI assistants to autonomously detect scams by checking URLs, messages, ABNs, and phone numbers using Australian-specific threat intelligence and privacy-preserving techniques.MIT
- AlicenseNot gradedqualityBmaintenanceDocument verification for AI agents: forensic authenticity signals for PDFs and images, field extraction, Australian identity checks, adverse-media and sanctions screening, AU/NZ government tender search, AI-text detection, and citation verification. Hosted with a free anonymous tier; the repo ships a Dockerfile that bridges to the live endpoint.MIT
- FlicenseNot gradedqualityBmaintenancePassive website security and trust auditor that checks for security, SEO, AI surface, email, and other exposures, producing a score and remediation plan.-
Glama MCP Gateway
Add one secure layer between your agents and this server.