Skip to main content
Glama

DevX Agent Hub

Domain DNS + email security audit (SPF, DMARC)

domain_email_security_audit
Read-onlyIdempotent

Domain DNS and email-security audit: A/AAAA/NS/MX/TXT/CAA/SOA records, SPF problems, DMARC policy, MTA-STS, BIMI and DNSSEC with prioritized findings and a score. For deliverability checks, phishing/spoof risk and vendor due diligence. $0.003 USDC on Base via x402. Price: $0.003. First call returns the x402 PaymentRequired (no charge); retry with payment in _meta["x402/payment"].

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
domainYes
x402_paymentNoOptional. Base64 x402 v2 PaymentPayload, for clients that cannot set params._meta["x402/payment"]. Omit on the first call to get the exact price.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/non-destructive/openWorld, so the bar is lower; the description adds genuinely new behavior — the x402 payment loop, that the first call is uncharged and returns PaymentRequired, and that the paid retry must carry payment in _meta["x402/payment"]. It stops short of describing failure modes after payment, rate limits, or latency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Dense but front-loaded: capability, use cases, then payment mechanics in the logical call order. The price is stated twice ('$0.003 USDC on Base via x402. Price: $0.003.'), which is redundant padding that could be trimmed.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, and the description does summarize the return (prioritized findings plus a score), plus the payment handshake an agent must perform before getting results. The only real gap is domain input format, which matters for a paid call that would fail or misresolve on a malformed hostname.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The x402_payment parameter is documented in the schema, but the required `domain` parameter has no description anywhere — no format guidance (bare apex vs. subdomain, no scheme/www, 253-char cap). With coverage at 50%, the description should compensate for the undocumented required parameter and does not.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource (DNS and email-security audit of a domain) and enumerates exactly what is checked: A/AAAA/NS/MX/TXT/CAA/SOA, SPF, DMARC, MTA-STS, BIMI, DNSSEC. It also declares the deliverable (prioritized findings and a score), so an agent can distinguish it from every sibling in the list, none of which touch DNS.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives concrete triggering scenarios: deliverability checks, phishing/spoof risk, and vendor due diligence. That is clear when-to-use context, but there are no exclusions or pointers to alternative tools, and no guidance on what a domain with no mail records will yield.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources