Dechonet-MCP

Lookalike Domain Check

lookalike_domains

Read-onlyIdempotent

Generate the typosquat/lookalike variants of a domain that phishers actually register — homoglyph swaps (l→1, o→0, rn→m), TLD swaps (.com→.co), character omissions, transpositions, repetitions, hyphenations — and check which of them are currently registered (live NS delegation via DoH). Use this to assess brand-impersonation and phishing exposure for a domain the user is responsible for. A registered variant is NOT proof of abuse (it may be an unrelated legitimate site) — follow up with whois_lookup on each hit for its owner and registration date. Read-only; requires no API key; rate-limited. Returns generated/checked counts and the registered variants with the technique that produced each.

Input Schema

Name	Required	Description	Default
`domain`	Yes	Domain to protect (e.g., 'example.com'), without scheme or path. Variants of its label and TLD are generated and checked.

Output Schema

Name	Required	Description
`kpis`	No	Key metrics as label/value pairs
`grade`	No	Letter grade (A+ to F) when the tool grades the target
`score`	No	0-100 score when the tool scores the target
`issues`	No	Detected problems, severity-rated
`status`	Yes	Overall verdict, e.g. 'good' \| 'warning' \| 'bad' \| 'info' \| 'unknown'
`actions`	No	Recommended next actions, most important first
`summary`	No	One-paragraph interpretation of the result
`receipts`	No	Signed observation receipts behind this result, one per lookup: when, from where and under which rules version DechoNet observed it. Each url shows the record and checks its Ed25519 signature.
`reportUrl`	Yes	Human-facing interactive report for this exact lookup on dechonet.com
`observation`	No	How much was actually observed and when. A partial observation means some checks did not answer: missing parts are not verified, never clean.

Schema Changelog

Changes observed during successful MCP inspections.

Changed1 schema field changedOct 15, 2026

addedOutput schema / properties / receipts

Added value: +{
+  "description": "Signed observation receipts behind this result, one per lookup: when, from where and under which rules version DechoNet observed it. Each url shows the record and checks its Ed25519 signature.",
+  "items": {
+    "properties": {
+      "id": {
+        "type": "string"
+      },
+      "tool": {
+        "type": "string"
+      },
+      "url": {
+        "type": "string"
+      }
+    },
+    "required": [
+      "tool",
+      "id",
+      "url"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}

Changed1 schema field changedOct 15, 2026

addedOutput schema / properties / observation

Added value: +{
+  "description": "How much was actually observed and when. A partial observation means some checks did not answer: missing parts are not verified, never clean.",
+  "properties": {
+    "ageMinutes": {
+      "type": [
+        "number",
+        "null"
+      ]
+    },
+    "cached": {
+      "type": "boolean"
+    },
+    "observedAt": {
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "state": {
+      "enum": [
+        "complete",
+        "partial",
+        "unknown"
+      ],
+      "type": "string"
+    }
+  },
+  "type": "object"
+}

AddedSep 2, 2026

TDQS

A4.6/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare read-only, idempotent, open-world and non-destructive, and the description adds material context beyond them: no API key required, rate-limited, results derived from live NS delegation via DoH, and the key false-positive caveat that a registered variant is not proof of abuse. That caveat is genuinely important behavior an agent needs.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The core action and technique list are front-loaded and every sentence carries information (techniques, caveat, follow-up, operational notes). It is somewhat dense and long for a one-parameter tool, but there is no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter, read-only tool with an output schema present, the description is more than sufficient: it covers purpose, method, caveats, follow-up, and even summarizes the return payload, which the output schema already handles. Nothing needed to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% for the single parameter, so the schema already documents the domain format and what gets varied. The description's mention that label and TLD variants are generated restates what the schema says, adding no syntax or format detail beyond it. Baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource (generate typosquat/lookalike variants and check which are registered) and enumerates the concrete techniques used. An agent can distinguish it from siblings like dns_lookup or whois_lookup without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says to use it 'to assess brand-impersonation and phishing exposure for a domain the user is responsible for,' and routes follow-up to whois_lookup for each hit. The scope condition (a domain the user owns) plus the named next tool give clear when-to-use context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Dechonet-MCP tools Inspect

Try in Browser

Shareable, User-Owned Context BackendPeople, applications, and agents read, write, and coordinate together in one context lake. Reach it over MCP, a CLI, a Python SDK, or REST.fulcradynamics.comAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?