Skip to main content
Glama

SiteCheck Web Intel

Security Bimi Record Audit

security_bimi_record_audit
Read-only

Reads a domain's BIMI record (default._bimi. TXT): whether it is published, the SVG logo URL (l=) and the certificate URL (a=, a VMC or CMC for mailbox providers). Checks the v=BIMI1 tag and that the URLs are https. It does not download the logo or validate the certificate. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
domainYesDomain name such as ebay.com (required)

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
logoNo
domainNo
issuesNo
sourceNo
versionNo
checkedAtNo
publishedNo
certificateNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint and openWorldHint, and the description adds context they cannot carry: the exact DNS name queried, the fact that no logo fetch or certificate validation happens, and the billing/auth model ($0.002 USDC per successful call via x402 on Base, Solana or Arc, failures not charged). That is precisely the kind of cost/authorization disclosure an agent needs before invoking a paid, network-dependent tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, front-loaded with the operation and resource, then the checks, then the exclusions and price. Nothing is redundant; even the pricing sentence carries decision-relevant information rather than filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With a named input parameter, an output schema and read-only annotations, the description still covers what an agent would otherwise have to guess: the record location, what is and isn't validated, and the payment model. No meaningful gap remains for calling this tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and there is a single required parameter, so the schema already does the work; the description nonetheless adds real value by revealing the constructed query name (default._bimi.<domain> TXT), which tells the agent how the input is used. Slightly above the baseline-3 case for a fully documented param.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb+resource: 'Reads a domain's BIMI record (default._bimi.<domain> TXT)' and it enumerates exactly what is extracted (published status, l= SVG logo URL, a= certificate URL). An agent can immediately separate this from security_dmarc_spf_dkim, security_dkim_key_checker and security_mta_sts_validator because BIMI is named and scoped.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states the checks performed (v=BIMI1 tag present, URLs are https) and, importantly, the negative scope: 'It does not download the logo or validate the certificate.' That boundary keeps an agent from over-asking. It stops short of explicitly naming an alternative tool for the excluded steps (e.g. cert-chain validation), so not a full 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources