domainintel-mcp
This server provides live domain intelligence and security analysis tools, enabling comprehensive investigation of any domain's registration, DNS, SSL, security posture, and reputation.
WHOIS Lookup – Retrieve registrar info, creation/expiry/updated dates, registrant country, privacy/redaction status, and nameservers.
DNS Records – Resolve A, AAAA, MX, TXT, NS, CNAME, and CAA records; check for SPF/DMARC presence and detect common DNS misconfigurations.
SSL/TLS Certificate Inspection – Examine live TLS certificates for validity, issuer, subject, expiration date, days remaining, protocol/cipher details, and warnings.
HTTP Security Headers Analysis – Fetch and score security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) with actionable recommendations.
Domain Reputation Check – Check domains/IPs against DNS blocklists (DNSBL, Spamhaus) and receive a reputation score along with any active listings.
Subdomain Discovery – Discover subdomains via Certificate Transparency logs (crt.sh) and common-prefix probing, with DNS resolution status for each result.
Full Domain Report – Run all analyzers in parallel (WHOIS, DNS, SSL, security headers, reputation, subdomains) and get a combined report with an overall security score rated A+ to F.
Email Header Analysis – Parse raw email header blocks to extract SPF/DKIM/DMARC results, delivery path with timing, envelope fields, and spoofing flags.
@domainintel/mcp
An MCP server that gives AI agents live domain intelligence: WHOIS, DNS, SSL/TLS, HTTP security headers, reputation, and subdomain discovery for any domain. It is the same analysis engine that powers DomainIntel.app.
Tools
Tool | Returns |
| Registrar, creation/expiry/updated dates, registrant country, privacy status, nameservers |
| A, AAAA, MX, TXT, NS, CNAME, CAA records + SPF/DMARC presence + misconfiguration warnings |
| Validity, issuer, expiration, days remaining, protocol, warnings |
| HSTS, CSP, X-Frame-Options and others, scored with recommendations |
| DNSBL / Spamhaus blocklist checks and a reputation score |
| Subdomains via Certificate Transparency logs and common-prefix probing |
| Every analyzer at once plus an overall A+ to F security score |
| Parses a raw email header block: SPF/DKIM/DMARC results, the Received delivery path with timing, key envelope fields, and a From-vs-Return-Path spoofing flag |
Every tool except analyze_email_headers takes a single domain argument; protocol, www., and paths are stripped automatically. analyze_email_headers takes a headers string (a pasted raw header block) instead.
Related MCP server: mcp-ip2whois
Requirements
Node.js 18 or newer
Install
Claude Code
claude mcp add domainintel -- npx -y @domainintel/mcpClaude Desktop
Add to claude_desktop_config.json (Settings → Developer → Edit Config):
{
"mcpServers": {
"domainintel": {
"command": "npx",
"args": ["-y", "@domainintel/mcp"]
}
}
}Any other MCP client
The server speaks MCP over stdio:
npx -y @domainintel/mcpExample prompts
"Run a full domain report on stripe.com"
"What are the MX records for github.com, and does it have DMARC?"
"Is the SSL certificate for example.org close to expiring?"
Development
Run from source (no build needed):
git clone <repo> && cd domainintel.app
npm install
npm run mcp # node mcp/server.mjsBuilding & publishing
The published package is a single self-contained bundle (the analyzers and all JS dependencies are bundled with esbuild; Node built-ins resolve at runtime).
npm run build:mcp # from repo root -> mcp/dist/server.mjs
cd mcp && npm publish # prepublishOnly rebuilds the bundleLicense
MIT
Available Tools
7 toolsdns_recordsDNS recordsA
Resolves A, AAAA, MX, TXT, NS and CNAME records, plus CAA records, SPF/DMARC presence and common DNS misconfiguration warnings.
| Name | Required | Description | Default |
|---|---|---|---|
| domain | Yes | Domain name to analyze, e.g. "example.com" (protocol, www. and paths are stripped automatically) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It discloses useful behavioral details: automatic stripping of protocol, 'www.', and paths; inclusion of CAA, SPF/DMARC presence checks, and misconfiguration warnings. These add transparency beyond a raw listing. However, it omits potential rate limits or failure behavior for invalid domains, keeping it from a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that front-loads the core capability (record types) and adds supplementary features without redundancy. Every phrase earns its place; no filler or tautology.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one required parameter, no output schema), the description is sufficiently complete. It covers record types, warnings, and input preprocessing. Missing details about return structure or error handling are minor gaps, but overall it provides the essential context for a callable tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only one parameter (domain) with 100% schema coverage. The description adds value by explaining the automatic stripping of protocol/www/paths, which is not obvious from the schema alone. This helps the agent format input correctly. A 4 reflects good additive context beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description specifies the exact DNS record types resolved (A, AAAA, MX, TXT, NS, CNAME, CAA) and additional checks (SPF/DMARC, misconfiguration warnings). The verb 'resolves' is clear and distinguishes it from sibling tools like whois_lookup or ssl_certificate, which focus on different aspects of domain analysis.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not explicitly state when to use this tool versus alternatives. It implies usage for DNS resolution but offers no guidance on exclusions (e.g., if only a specific record type is needed) or comparison with siblings like subdomain_discovery or domain_reputation. A 3 reflects the lack of explicit when/when-not context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
domain_reputationDomain reputationA
Checks the domain/IP against DNS blocklists (DNSBL, Spamhaus) and returns a reputation score and any listings.
| Name | Required | Description | Default |
|---|---|---|---|
| domain | Yes | Domain name to analyze, e.g. "example.com" (protocol, www. and paths are stripped automatically) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description must carry full burden. It describes the check as read-only but does not explicitly state no side effects, nor any limits or required permissions. Adequate but not detailed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence of 20 words, front-loaded with action and result. No unnecessary information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, description lacks details about return format (e.g., reputation score range, listing structure). Simple tool but could benefit from mentioning output structure.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only one parameter 'domain' with 100% schema coverage. Description adds value by noting automatic stripping of protocol, www, and paths, which exceeds schema documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states it checks domain/IP against DNS blocklists and returns reputation score and listings. Uses specific verb 'checks' and resource 'domain/IP against DNS blocklists'. Distinguishes from siblings like dns_records and full_domain_report.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implies usage for checking blocklist reputation, but no explicit when-to-use, when-not-to-use, or alternatives. Siblings are listed but no guidance on trade-offs.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
full_domain_reportFull domain reportA
Runs every analyzer (WHOIS, DNS, SSL, security headers, reputation, subdomains) in parallel and returns a combined report with an overall security score and A+ to F rating.
| Name | Required | Description | Default |
|---|---|---|---|
| domain | Yes | Domain name to analyze, e.g. "example.com" (protocol, www. and paths are stripped automatically) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Mentions parallel execution and output format, but no annotations exist. Does not disclose potential rate limits, timeouts, or destructive nature. Adequate but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence efficiently conveys purpose, scope, and output. No redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Describes output (score and rating) but omits details like inclusion of individual analyzer results. No output schema to compensate, leaving some gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Single parameter with 100% schema coverage. Description adds no meaningful detail beyond the schema's own example and stripping behavior.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the verb 'runs', resource 'every analyzer', and outcome 'combined report with score and rating'. Distinct from sibling tools which are individual analyzers.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implicitly indicates use when comprehensive analysis is desired, but lacks explicit when-to-use or when-not-to-use guidance relative to siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
security_headersHTTP security headersA
Fetches HTTP response headers and scores security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) with recommendations.
| Name | Required | Description | Default |
|---|---|---|---|
| domain | Yes | Domain name to analyze, e.g. "example.com" (protocol, www. and paths are stripped automatically) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It mentions fetching headers and scoring with recommendations but lacks details on error handling, rate limits, or behavior for inaccessible domains. It does list specific headers scored, which is helpful.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no unnecessary words. Every part ('fetches', 'scores', 'with recommendations') adds value. It is appropriately front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one parameter and no output schema, the description covers the core functionality. However, it lacks details on handling of redirects, timeouts, or non-standard ports, which would be useful for context completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the schema already explains domain parameter including stripping protocol/www/paths. The tool description does not add additional parameter semantics beyond what the schema provides, so baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool fetches HTTP response headers and scores specific security headers (HSTS, CSP, etc.) with recommendations, using a specific verb 'fetches' and listing the resources. This distinguishes it from sibling tools like dns_records or whois_lookup.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for security header analysis but does not explicitly state when to use this tool vs alternatives like domain_reputation or full_domain_report. No exclusions or when-not-to-use guidance is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssl_certificateSSL/TLS certificateA
Inspects the live TLS certificate: validity, issuer, subject, expiration, days remaining, protocol/cipher and certificate warnings.
| Name | Required | Description | Default |
|---|---|---|---|
| domain | Yes | Domain name to analyze, e.g. "example.com" (protocol, www. and paths are stripped automatically) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. It describes a read-only inspection operation with no side effects and lists what is returned. It does not mention rate limits or auth needs, but for a simple inspection tool, this is sufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that front-loads the key purpose ('Inspects the live TLS certificate') and lists all relevant output fields. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity (one parameter, no output schema), the description adequately covers the tool's purpose and output. It could mention that the inspection is live and may fail, but the listed attributes provide enough completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the description adds value by explaining that protocol, www., and paths are stripped automatically. This clarifies the expected input format beyond the schema's basic description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool inspects live TLS certificates, listing specific attributes like validity, issuer, expiration, and warnings. This verb+resource structure is distinct from sibling tools (e.g., dns_records, whois_lookup), which focus on other domain aspects.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use for obtaining SSL certificate details, which is clear context. However, it does not explicitly state when not to use it or suggest alternatives, though sibling names provide implicit differentiation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
subdomain_discoverySubdomain discoveryA
Discovers subdomains via Certificate Transparency logs (crt.sh) and common-prefix probing, with DNS resolution status for each.
| Name | Required | Description | Default |
|---|---|---|---|
| domain | Yes | Domain name to analyze, e.g. "example.com" (protocol, www. and paths are stripped automatically) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Despite no annotations, the description discloses the methods (CT logs, common-prefix probing) and that DNS resolution status is included. It does not mention rate limits, data freshness, or potential limitations, but the provided information is fairly transparent for a discovery tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that efficiently conveys the tool's purpose, methods, and output. Every word earns its place with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description provides a vague idea of the return (subdomains with DNS resolution status) but lacks specifics on the output structure or fields. For a simple tool with one parameter, it is adequate but could be more complete by detailing the format or whether it returns a list or map.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter 'domain' is fully described in the schema (100% coverage). The description adds value by explicitly noting that protocol, www, and paths are stripped automatically, which aids the agent in formatting input correctly.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool discovers subdomains using Certificate Transparency logs and common-prefix probing, with DNS resolution status. It distinguishes itself from siblings like dns_records or domain_reputation by focusing on subdomain enumeration specifically.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus siblings. The description only explains what it does, not the context or alternatives. Usage is implied by the name and description, but no when-not-to or comparisons are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
whois_lookupWHOIS lookupB
Registration data for a domain: registrar, creation/expiry/updated dates, registrant country, privacy/redaction status, and name servers.
| Name | Required | Description | Default |
|---|---|---|---|
| domain | Yes | Domain name to analyze, e.g. "example.com" (protocol, www. and paths are stripped automatically) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, and the description does not disclose behavioral traits such as read-only nature, error handling, rate limits, or permissions. It simply describes the output.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that front-loads the purpose ('Registration data for a domain') and lists key output fields. Every word adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite lacking an output schema, the description lists the returned fields, making the tool's output clear. Error cases or format details are omitted, but for a simple lookup the description is fairly complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already provides detailed semantics for the domain parameter (example, stripping of protocol/paths). The description adds no extra parameter information beyond what the schema covers, so a baseline score is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states the tool performs a WHOIS lookup and lists specific data fields (registrar, dates, registrant country, etc.), clearly distinguishing it from sibling tools like dns_records or ssl_certificate.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not provide explicit guidance on when to use this tool versus alternatives (e.g., 'for DNS records use dns_records'). The sibling list is provided but not referenced in the description itself.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
TDQS
Each tool targets a distinct aspect of domain intelligence: DNS records, WHOIS, SSL, security headers, reputation, subdomain discovery, and a combined full report. There is no overlap in purpose; even the full report is a composite meta-tool, not a duplicate.
All tool names follow a consistent pattern: a domain-related noun followed by an operation noun (e.g., whois_lookup, subdomain_discovery, ssl_certificate). The naming is uniformly descriptive and predictable.
With 7 tools, the server covers the essential areas of domain intelligence (DNS, WHOIS, SSL, security headers, reputation, subdomains) without being bloated or sparse. Each tool serves a clear purpose.
The tool surface comprehensively covers domain analysis: DNS record types, WHOIS metadata, SSL certificate inspection, security header evaluation, blocklist reputation, subdomain enumeration, and a summarizing full report. No obvious gaps are present for the stated purpose.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Domain intel for AI agents: RDAP registration, DNS, email deliverability, tech stack.
Remote MCP server: 19 domain-hygiene and email-auth tools (DNS, SPF, DMARC, DKIM, TLS).
Hosted MCP with 91 agent tools: X, domains, SEO, Maps, Trends, Search, YouTube, TikTok, and more.
Hosted MCP server for live public-data APIs and Skills for AI agents.
Related MCP Servers
- AlicenseNot gradedqualityFmaintenanceA simple MCP server that enables AI assistants to perform domain research including availability checking, WHOIS lookups, DNS record retrieval, and finding expired domains without requiring API keys.62MIT

mcp-ip2whoisofficial
AlicenseAqualityCmaintenanceA Model Context Protocol (MCP) server that provides comprehensive WHOIS lookup capabilities using the IP2WHOIS API. This server allows AI agents to query domain registration details, including expiry dates, registrar information, and registrant data.21MIT- AlicenseNot gradedqualityDmaintenanceMCP server for domainagent.dev, enabling AI agents to search, register, deploy, host, and manage domains with USDC payment on Base via x402. Supports static site deployment via Cloudflare Pages and DNS management.19MIT
- AlicenseNot gradedqualityDmaintenanceMCP server providing comprehensive domain intelligence (WHOIS, DNS, SSL, domain age) for due diligence and security audits, with pay-per-call via x402 micropayments.MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/Bishop81/domainintel-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server