Dechonet-MCP

Exposed Admin Page Check

exposure_map

Read-onlyIdempotent

Map what an organisation exposes to the internet beyond its home page: subdomains from Certificate Transparency logs (plus hosts DechoNet has already observed), each opened once from outside and sorted into developer/ops tools, directory listings, admin screens, VPN/remote-access logins, staging servers, default install pages, login pages and so on — the forgotten assets AI-driven attack tools look for first. Use this when a user wants to know their attack surface or after a breach in their sector. Returns counts per category, a verdict (bad/warn/ok) and what to do. Public view only: the per-host list and a sensitive-file check are shown to the verified domain owner on the web report (DNS TXT), never through this tool. Read-only and passive beyond a single first-page request per host; no logins or path guessing; requires no API key; rate-limited (heavier than other tools — up to ~1 minute).

Input Schema

Name	Required	Description	Default
`domain`	Yes	The organisation's domain (e.g., 'example.co.kr'). Scheme, path and a leading www. are stripped.

Output Schema

Name	Required	Description
`found`	Yes
`counts`	Yes	hosts per category (devtool, api_docs, listing, admin, remote, staging, default_page, login, api, mail, web, …)
`issues`	Yes
`probed`	Yes
`status`	Yes	bad \| warn \| ok \| info
`receipts`	No	Signed observation receipts behind this result, one per lookup: when, from where and under which rules version DechoNet observed it. Each url shows the record and checks its Ed25519 signature.
`reportUrl`	Yes

Schema Changelog

Changes observed during successful MCP inspections.

Changed1 schema field changedOct 15, 2026

addedOutput schema / properties / receipts

Added value: +{
+  "description": "Signed observation receipts behind this result, one per lookup: when, from where and under which rules version DechoNet observed it. Each url shows the record and checks its Ed25519 signature.",
+  "items": {
+    "properties": {
+      "id": {
+        "type": "string"
+      },
+      "tool": {
+        "type": "string"
+      },
+      "url": {
+        "type": "string"
+      }
+    },
+    "required": [
+      "tool",
+      "id",
+      "url"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}

Changed1 schema field changedOct 7, 2026

changedOutput schema / properties / counts / description

Previous value: -"hosts per category (devtool, listing, admin, remote, staging, default_page, login, api, mail, web, …)"New value: +"hosts per category (devtool, api_docs, listing, admin, remote, staging, default_page, login, api, mail, web, …)"

AddedOct 5, 2026

TDQS

A4.4/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the annotations: discloses that it is passive apart from a single first-page request per host, performs no logins or path guessing, needs no API key, is rate-limited and can take up to ~1 minute, and that the per-host list plus sensitive-file check are withheld to the DNS TXT-verified owner. These are exactly the constraints an agent needs before invoking it.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core purpose and the payoff ('the forgotten assets AI-driven attack tools look for first'), and the operational caveats are grouped at the end. The single dense paragraph carries a lot; a slight trim of the category enumeration would improve scannability without losing meaning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return-value explanation is unnecessary, yet the description still signals counts per category, a verdict and remediation guidance. Combined with scope limits, access model and runtime expectations, nothing material is missing for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Only one parameter and schema coverage is 100%, with the schema already documenting the scheme/path/www stripping. The description adds no additional semantics about the domain argument, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb (map) plus a precisely scoped resource: what an org exposes beyond its home page, with enumerated categories (dev/ops tools, admin screens, VPN logins, staging servers). It is clearly distinguishable from siblings like subdomain_discovery, port_scan and security_scan by its combination of CT-log enumeration plus one external fetch per host with categorisation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit trigger conditions are given: 'Use this when a user wants to know their attack surface or after a breach in their sector.' It also states the public-view restriction and where the fuller report lives. It does not name a sibling alternative (e.g., when to prefer subdomain_discovery or port_scan instead), so it stops short of full when/when-not routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Dechonet-MCP tools Inspect

Try in Browser

Shareable, User-Owned Context BackendPeople, applications, and agents read, write, and coordinate together in one context lake. Reach it over MCP, a CLI, a Python SDK, or REST.fulcradynamics.comAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?