TPC Hosting network checks for AI: traceroute, DNS trace, HTTP/3, TTFB, SSL, SMTP, DNS, email. Free.
Scored across 44 tools
Most tools target a clearly distinct resource and action, and the descriptions actively disambiguate the tricky clusters (e.g. email_deliverability_report is explicitly framed as the 'whole email setup in one call' versus the individual spf_check/dkim_check/dmarc_check tools, and dig is framed as a raw query versus dns_lookup). The residual overlaps are mild: dns_lookup vs dig vs dns_trace vs dns_propagation, ssl_check vs ssl_certificate_decoder, and ip_lookup vs asn_lookup/reverse_dns could occasionally be confused, but each has a stated niche.
The dominant pattern is snake_case with a domain noun plus a suffix such as _check, _lookup, _generator, _calculator, _test or _decoder, which is predictable enough to scan. A few outliers break the pattern (dig, traceroute, cron_expression, what_is_my_ip, punycode_convert), but they are readable and few enough not to undermine the convention.
44 tools is heavy for a single server, well above the comfortable 3-15 range. The breadth is partly justified because the server spans several genuine sub-domains (DNS, email authentication, TLS, HTTP performance, generators), and individual tools are not redundant, but the total surface is large enough to strain tool selection.
The surface covers the hosting/site-diagnostics domain thoroughly: DNS resolution and propagation, SPF/DKIM/DMARC/BIMI checks plus SPF and DMARC generators, TLS inspection, HTTP headers/redirects/performance, uptime and subnet math. Gaps are minor: there is no DKIM record generator or key generator to pair with dkim_check, no sitemap generator, and no IP-level whois beyond RDAP domain lookups.
Looks up an AS number (like AS13335) in Team Cymru and RDAP: the network's name, organisation, country, registry and registration dates. An IP address is mapped to the AS that announces it first.
Inputs: query (required).
Two calculations: monthly data transfer and average speed for a website (visitors, pages per visit, page size), or how long a file takes to move at a given connection speed. Decimal units unless MiB, GiB or TiB are given.
Inputs: mode (required), speed, file_size, page_size, +6 more.
Checks a domain's BIMI record and logo (SVG) for brand indicators in email clients.
Inputs: domain (required).
Converts Unix file permissions between octal (755, 4755) and symbolic (rwxr-xr-x) form, shows the chmod command, explains who can read, write and run, and flags risky modes such as 777.
Inputs: mode (required), path.
Reads a classic 5-field cron expression (or @daily, @hourly, @reboot) and returns a plain-English description, the expanded form and the next run times in UTC.
Inputs: expression (required), from, count.
Decodes a pasted PEM certificate signing request (CSR): subject, names, key type and size, signature algorithm, whether the signature verifies, and findings. Private keys are refused.
Inputs: csr (required).
Sends a DNS query like the dig command, to Cloudflare, Google, Quad9 or a nameserver you name, and returns the full answer with flags and sections. Supports many record types, DNSSEC data and TCP.
Inputs: name (required), ns, tcp, type, +4 more.
Looks up and validates a DKIM public key. Give the selector if you know it; otherwise the common selectors are tried.
Inputs: domain (required), selector.
Reads and validates a domain's DMARC record: policy, reporting addresses, alignment and percentage.
Inputs: domain (required).
Builds a DMARC TXT record for _dmarc.: policy, subdomain policy, percentage, report addresses and SPF and DKIM alignment. Returns the record and findings about reporting and policy strength.
Inputs: domain, policy, percent, spf_alignment, +5 more.
Looks up DNS records (A, AAAA, CNAME, MX, NS, TXT, SOA or CAA) for a domain through a public resolver.
Inputs: domain (required), type.
Asks several public resolvers around the world for the same record and reports whether they agree, which shows whether a DNS change has propagated.
Inputs: domain (required), type.
Checks whether a domain is signed with DNSSEC and whether its chain of trust (DS and DNSKEY records) is consistent.
Inputs: domain (required).
Follows a name from the root servers down through the TLD to its authoritative nameservers, like dig +trace, and shows each delegation step.
Inputs: name (required), type, family.
Turns one to three keywords into about 60 domain name ideas (prefixes, suffixes, blends) plus common endings. Ideas only: availability is not checked.
Inputs: keywords (required), include_hyphenated.
Checks whether a mail server IP address or a domain is listed on public DNS blocklists. Give exactly one of ip or domain.
Inputs: ip, domain.
Scores a domain's email setup (MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT, BIMI, blocklists) and lists what to fix. Covers the whole email setup in one call, for a general email health question.
Inputs: domain (required), selector.
Reads the raw headers of an email: the delivery path hop by hop with delays, SPF, DKIM and DMARC results, spam headers and findings. The headers are analysed in memory and are not stored.
Inputs: headers (required).
Finds out who hosts a website: the IP addresses, the network and organisation behind them, the nameservers and any CDN in front.
Inputs: domain (required).
Builds a commented .htaccess file for Apache and LiteSpeed: force HTTPS, www or non-www, 301 redirects, error pages, security headers, caching, compression and IP blocks. Returns the file text and findings.
Inputs: www, hsts, https, domain, +16 more.
Checks whether a site supports HTTP/2 and HTTP/3 (QUIC): ALPN negotiation, the Alt-Svc header and a live QUIC handshake probe.
Inputs: host (required).
Fetches a page and reports its response headers, with a review of the security headers (HSTS, CSP, X-Frame-Options and others) and cookie flags.
Inputs: url (required).
Describes a public IP address: the announced prefix and AS number, the network's name, country, registry and the reverse DNS name.
Inputs: ip (required).
Builds an llms.txt file in the llmstxt.org format from a site name, a summary, details and sections of links. Returns the file text and findings such as duplicate URLs or invalid links.
Inputs: name (required), details, summary, sections, +1 more.
Lists the mail servers (MX records) of a domain with their priorities and checks that they resolve.
Inputs: domain (required).
Converts international domain names between Unicode and Punycode (xn--) one name at a time, up to 20 names, and warns about mixed-script look-alike names.
Inputs: domains (required), direction.
Follows a URL's redirects hop by hop and reports each status code, the final address and problems such as loops, long chains or http-to-https gaps.
Inputs: url (required).
Finds the PTR (reverse DNS) name of an IP address and checks that the name resolves back to the same address (forward-confirmed reverse DNS), which mail servers look for.
Inputs: ip (required).
Builds a robots.txt file: allow everything, block everything or custom Allow and Disallow paths, with sitemap URLs, a crawl delay and switches that block AI crawlers such as GPTBot and ClaudeBot. Returns the file and findings.
Inputs: mode, allow, disallow, sitemaps, +2 more.
Fetches a site's robots.txt and tests whether a given crawler may fetch a given path, following RFC 9309. Also lists the Sitemap lines and parser warnings.
Inputs: url (required), path, user_agent.
Finds a site's XML sitemap (from robots.txt or the usual addresses), then validates it against the sitemaps.org protocol and Google's rules. Reads at most 5 MB; a sitemap index is validated as an index, its child sitemaps are listed but not fetched.
Inputs: url (required), sitemap_url.
Connects to a domain's mail servers (MX) on port 25, says EHLO, tries STARTTLS and reports banners, TLS and reverse DNS. It never sends mail.
Inputs: domain (required).
Reads and validates a domain's SPF record: syntax, the 10-lookup limit, includes and the final policy.
Inputs: domain (required).
Builds an SPF TXT record from a mail setup: sending IPs, mail providers such as Google or Microsoft, the a and mx mechanisms and soft or hard fail. Returns the record, a DNS lookup estimate and findings.
Inputs: a, mx, all, ip4, +4 more.
Decodes a pasted PEM certificate or chain: subject, issuer, validity dates, names, key, signature algorithm, fingerprints, extensions and findings, plus a chain order check. Private keys are refused.
Inputs: certificate (required).
Makes live TLS connections to a host and reports the certificate chain, expiry, protocol versions, cipher strength and common misconfigurations. Ports 443, 8443, 465, 993 and 995.
Inputs: host (required), port.
Works out the network, broadcast, host range, netmask and wildcard for an IPv4 or IPv6 address with a prefix, and can split an IPv4 network into equal smaller subnets.
Inputs: address (required), mask, split.
Traces the network path from the probe server in Germany to a host, showing each hop's address and round-trip times.
Inputs: host (required), family.
Times three requests to a web address from the probe server in Germany: DNS, connect, TLS, time to first byte and download. Results are never cached.
Inputs: url (required).
Turns an uptime percentage such as 99.9 into the downtime it allows per day, week, month, quarter and year, or turns a length of downtime in a period into the uptime percentage.
Inputs: period, sla_percent, downtime_hours, downtime_minutes.
Fetches up to 10 URLs from one site and reports each one's final status code, redirects, content type and X-Robots-Tag. Useful for spot-checking pages listed in a sitemap.
Inputs: urls (required).
Checks whether a website is reachable from Cloudflare's network: DNS first, then one request. Separates 'does not resolve' from 'will not connect' and 'answers with an error'.
Inputs: url (required).
Returns the IP address this request reached the server from, and whether it is IPv4 or IPv6. For desktop clients such as Claude Code or Cursor that is the user's own address; hosted chat apps connect from the provider's servers.
Inputs: no named parameters.
Looks up a domain's registration data over RDAP: registrar, creation, expiry and update dates, status and nameservers. Not every country code TLD publishes RDAP.
Inputs: domain (required).
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
HTTP, DNS, SSL, WHOIS, ping, security-header, SEO and AI-readiness checks for any website.
Free DNS, SPF/DKIM/DMARC, TLS, WHOIS, IP/ASN, blocklist, ping, traceroute and port checks. No key.
Free email checks: 24 blacklists, spoofing grade, redirects, spam test, WHOIS, BIMI, AI readiness.
Free, no-API-key network lookups for AI agents — IP geolocation, DNS, WHOIS, HTTP and SSL/TLS certificate checks, and full domain health reports.
Add one secure layer between your agents and this server.
