SiteCheck Web Intel

DNS records of a domain resolved live through the public

security_dns_records

Read-only

DNS records of a domain (A, AAAA, MX, NS, TXT, CNAME, CAA, SOA) resolved live through the public AdGuard DNS JSON resolver (NextDNS as backup). Shows answers as they resolve now, with TTLs; it does not walk the delegation chain or query the authoritative servers directly. Related tools on this server, for a different need: security_dns_caa_records when you need to list the CAA records published on a domain: which CAs may; security_dns_propagation when you need Asks two independent public DNS resolvers for the same name. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "name": "<name>"
    },
    "name": "security_dns_records"
  }
}

Input Schema

Name	Required	Description	Default
`name`	Yes	Domain name, e.g. example.com (required)
`types`	No	Comma list of record types from A,AAAA,MX,NS,TXT,CNAME,CAA,SOA (default A,AAAA,MX,NS,TXT)

Output Schema

Name	Required	Description	Default
`name`	No
`rcode`	No
`source`	No
`records`	No
`resolver`	No
`checkedAt`	No
`nameservers`	No

Schema Changelog

Changes observed during successful MCP inspections.

First observedOct 23, 2026

TDQS

A4/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint and openWorldHint, so the safety profile is covered; the description earns credit for adding genuinely new context: answers reflect live resolution with TTLs, no delegation-chain walking, and a per-call price with x402 payment rails where failed calls are not charged. It stops short of describing caching/freshness windows or resolver failure fallback behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose is front-loaded and the limitation clause is well placed, but the sibling section contains a broken fragment ('when you need Asks two independent public DNS resolvers for the same name') that reads as truncated text. The pricing sentence is useful but bolted on at the end rather than integrated.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter read tool with a full schema and an output schema, the description covers mechanism, live-resolution semantics, limitations, alternatives, and cost. Only minor gaps remain, such as resolver-failure or fallback behavior when AdGuard and NextDNS disagree.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, including the valid record-type list and the default set, so the baseline is 3. The description restates the same record types without adding syntax, delimiter, or casing semantics for the comma-separated `types` value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource — resolves DNS record types (A, AAAA, MX, NS, TXT, CNAME, CAA, SOA) for a domain — and names the exact mechanism (public AdGuard DNS JSON resolver, NextDNS backup). It explicitly demarcates itself from security_dns_caa_records and security_dns_propagation, so an agent can choose without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit routing guidance to two siblings by stating the condition that selects each ('when you need to list the CAA records…', 'when you need… two independent public DNS resolvers'). It also states a negative condition — it does not walk the delegation chain or hit authoritative servers. The second routing sentence is garbled ('when you need Asks two independent…'), which costs it a point.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All SiteCheck Web Intel tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?