SiteCheck Web Intel

Checks MTA-STS for a mail domain: the _mta-sts TXT record

security_mta_sts_validator

Read-only

Checks MTA-STS for a mail domain: the _mta-sts TXT record (v=STSv1 and id) and the HTTPS policy file (mode enforce, testing or none, the MX patterns and max_age). Reports whether the record and the policy are both present and whether the policy's version is valid. Does not test the mail servers themselves. Related tools on this server, for a different need: security_dnssec_validator when you need DNSSEC check for a domain: whether a DS record exists. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "domain": "<domain>"
    },
    "name": "security_mta_sts_validator"
  }
}

Input Schema

Name	Required	Description	Default
`domain`	Yes	Mail domain such as gmail.com (required)

Output Schema

Name	Required	Description	Default
`domain`	No
`policy`	No
`source`	No
`checkedAt`	No
`dnsRecord`	No
`validPolicy`	No

Schema Changelog

Changes observed during successful MCP inspections.

First observedOct 23, 2026

TDQS

A4.6/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnlyHint and openWorldHint, and the description adds context beyond them: it reports on presence of both record and policy plus version validity, and it discloses the commercial behavior — $0.002 USDC per successful call via x402 (Base, Solana, Arc) with failed calls not charged. Cost and failure-charging semantics are exactly the kind of detail annotations cannot carry.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the checks performed, then the scope exclusion, then the alternative tool, then pricing — a sensible ordering with no filler sentences. It is dense and long for a one-parameter tool, and the pricing clause, while valuable, could be a separate line for scanability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-domain audit tool, everything needed to select and call it correctly is present: what is fetched, what is reported, what is out of scope, the alternative for adjacent needs, and the billing model. An output schema exists, so the description is not obligated to specify return structure, and it still summarizes the key outputs.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is a single required 'domain' parameter at 100% schema description coverage with an example ('gmail.com'), so the schema already does the work. The description adds no format, normalization, or subdomain guidance beyond what the schema states, which lands at the baseline for high coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Names a specific verb and resource ('Checks MTA-STS for a mail domain') and enumerates exactly what is inspected: the _mta-sts TXT record (v=STSv1 and id) and the HTTPS policy file (mode, MX patterns, max_age). It also scopes itself against near neighbors by stating 'Does not test the mail servers themselves', so an agent can separate it from security_mx_server_test.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states the negative case ('Does not test the mail servers themselves') and routes elsewhere with a named sibling: security_dnssec_validator 'when you need DNSSEC check for a domain: whether a DS record exists'. That is an explicit when-not plus an alternative, not merely implied usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All SiteCheck Web Intel tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?