SiteCheck Web Intel

Reads a domain's BIMI record: whether it is published

security_bimi_record_audit

Read-only

Reads a domain's BIMI record (default._bimi. TXT): whether it is published, the SVG logo URL (l=) and the certificate URL (a=, a VMC or CMC for mailbox providers). Checks the v=BIMI1 tag and that the URLs are https. It does not download the logo or validate the certificate. Related tools on this server, for a different need: security_csp_evaluator_audit when you need to read the Content-Security-Policy header of a site's home; security_ntp_monlist_audit when you need reports whether Shodan's pre-collected passive scan data. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "domain": "<domain>"
    },
    "name": "security_bimi_record_audit"
  }
}

Input Schema

Name	Required	Description	Default
`domain`	Yes	Domain name such as ebay.com (required)

Output Schema

Name	Required	Description	Default
`logo`	No
`domain`	No
`issues`	No
`source`	No
`version`	No
`checkedAt`	No
`published`	No
`certificate`	No

Schema Changelog

Changes observed during successful MCP inspections.

First observedOct 23, 2026

TDQS

A4.3/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond readOnlyHint/openWorldHint it discloses the concrete assertions performed (v=BIMI1 tag presence, https on both URLs), the explicit non-behaviors (no logo download, no certificate validation), and the commercial model ($0.002 USDC per successful call via x402 on Base/Solana/Arc, failed calls free). That is exactly the extra context annotations cannot carry.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The core capability and the negatives come first, which is well front-loaded, and the pricing note belongs at the end. However, the sibling-tools sentence is malformed ('when you need reports whether Shodan's pre-collected passive scan data'), which is dead weight in an otherwise tight paragraph.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter read-only check with an output schema, the definition covers what is fetched, what is validated, what is deliberately skipped, and the cost model. The main omissions are failure behavior (e.g. no BIMI record published) and the broken alternative-tool clause.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with one required 'domain' string, so the schema already carries the parameter meaning. The description only implicitly reinforces it via the default._bimi.<domain> notation, adding no format rules (bare domain vs FQDN, IDN handling) beyond the schema example.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb and resource ('Reads a domain's BIMI record') and pins the exact DNS location (default._bimi.<domain> TXT), plus the fields returned (l= logo URL, a= VMC/CMC certificate URL). It also names nearby but distinct tools (security_csp_evaluator_audit, security_ntp_monlist_audit) so an agent can separate it from other security_* auditors.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It routes the agent to alternatives with conditions ('when you need to read the Content-Security-Policy header', 'when you need reports whether Shodan's pre-collected passive scan data') and states scope limits ('does not download the logo or validate the certificate'). It lacks an explicit when-to-use lead-in for this tool and the NTP/Shodan sentence is garbled, so the routing value is slightly reduced.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All SiteCheck Web Intel tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?