Panda Web Security Tools
A read-only MCP server that gives AI clients 6 public-data audit tools for website security, email authentication, AI-search readiness and link/domain health — each running a paid Apify Actor on your own account.
Audit email spoofing risk (
email_domain_security_checker): bulk SPF, DKIM (~40 selectors), DMARC, MX, MTA-STS, TLS-RPT and BIMI checks with A–F grades, spoofability and prioritized fixes.Grade SEO and AI-search readiness (
ai_search_seo_audit): titles, meta, schema/FAQ markup, author/date signals, blocked AI crawlers, llms.txt presence plus SEO and AI-readiness scores, and optional llms.txt drafts.Track page changes over time (
website_change_monitor): stateful diffs against saved snapshots — added/removed text, change percent, price changes, keyword alerts, optional webhook.Detect hidden prompt injection (
hidden_ai_instructions_scanner, free): finds text hidden from humans but read by agents (display:none, off-screen, comments, alt/meta/data attributes, Unicode tricks), classifies severity, optional JS rendering and AI-bot cloaking checks.Check domain registration and expiry (
bulk_domain_whois_expiry): bulk RDAP/WHOIS for registrar, dates, days to expiry, transfer lock, pending delete, nameservers, DNSSEC, with filters for expiring/available.Find dead and redirecting links (
broken_link_checker): crawl start pages, check every unique http(s) link for status, redirects and 404s, with Excel/CSV exports.Cost and safety controls: pay-per-result (empty/failed lookups uncharged),
run_max_charge_usdand item caps per call, read-only toward third-party sites, JSON output withsummary/agentSummarylines.
Panda Web Security Tools
Give Claude, Cursor or any MCP client 6 site, email and agent-safety tools: SPF/DKIM/DMARC audits, AI search and SEO checks, page change monitoring, hidden prompt-injection scans, bulk domain expiry and broken links. Each tool runs one public-data Apify Actor on your own Apify account and is priced per result (the hidden AI instructions scanner is free). Part of the Panda Federation toolkit (36 tools in four focused servers).
Part of Panda Federation
This project is a module of the Panda Federation — public-data tools, MCP servers, and local-first apps in one catalog. See the rest of the work, including books when they publish and the matching free or paid editions of this tool, at the official site.
Related MCP server: intodns-mcp
How to use this
uvx panda-web-security-toolsGet a free Apify token at console.apify.com/settings/integrations (the free plan includes $5 of monthly credit) and install uv.
Add the server to your MCP client: command
uvx, args["panda-web-security-tools"], envAPIFY_TOKEN(Cursor JSON below).Ask in plain words, e.g. "Audit the email security of acme.com and its three competitors and list the DNS fixes." Start with one or two inputs and read the
summary/agentSummaryline before widening.
{"mcpServers": {"panda-web-security-tools": {"command": "uvx", "args": ["panda-web-security-tools"], "env": {"APIFY_TOKEN": "apify_api_YOUR_TOKEN"}}}}For AI agents
Field | Value |
Purpose | Focused MCP server with 6 site, email and agent-safety tools: SPF/DKIM/DMARC audits, AI search and SEO checks, page change monitoring, hidden prompt-injection scans, bulk domain expiry and broken links. |
Use when | A task needs a read-only audit of public DNS, web pages or links: email spoofing risk, AI/SEO readiness, page changes, hidden AI instructions, domain expiry or dead links. |
Do not use when | You need penetration testing or logged-in scans (not offered), or the task is research ( |
Install |
|
Auth |
|
Tools | 6, listed under Tools |
Outputs | JSON rows plus a one-line |
Side effects and cost | Starts Apify runs; pay per result; empty runs are not charged per result; |
Other ways to install
From the umbrella package (same tools):
uvx --from panda-federation-tools panda-web-security-toolsFrom this repo instead of PyPI:
uvx --from git+https://github.com/pandadad0214/panda-web-security-tools panda-web-security-toolsCursor / Claude / VS Code: command uvx, args ["panda-web-security-tools"], env APIFY_TOKEN.
Official MCP Registry name for this stdio package: io.github.pandadad0214/panda-web-security-tools (server.json). That name is separate from the hosted research server io.github.pandadad0214/panda-research-mcp. Registry clients install the PyPI package with uvx panda-web-security-tools. The git command above stays the install path from this repo.
Use with Gemini CLI
Install this repo as a Gemini CLI extension (adds the MCP server plus a short GEMINI.md context file). Needs Gemini CLI, uv, and a free Apify token.
gemini extensions install https://github.com/pandadad0214/panda-web-security-toolsThe extension prompts for APIFY_TOKEN on install and launches the server with uvx panda-web-security-tools. Gallery listing is automatic once this public repo carries the gemini-cli-extension topic and a root gemini-extension.json (crawled daily).
Tools (6)
email_domain_security_checkerai_search_seo_auditwebsite_change_monitorhidden_ai_instructions_scannerbulk_domain_whois_expirybroken_link_checker
Each tool runs one Apify Actor on your account. Empty runs are not charged per result; every call is capped by run_max_charge_usd. Full schemas and prices: umbrella README.
Sibling domain servers
panda-research-tools— Scholarly integrity and papers: citation checks, literature and PubMed search, academic experts, PDF tables, Wayback Machine snapshots.panda-public-funding-tools— US federal money, filings and safety monitors: grants, contracts, SBIR/STTR topics, SEC financials, clinical trials, Federal Register, recalls, VIN decode.panda-leads-tools— Public leads and enrichment: NPI providers, podcasts, local businesses, hiring signals, website enrichment, team pages, topic trends, trucking carriers, IRS nonprofits, building permits, new Florida, Texas and New York businesses, H-1B visa sponsors, EU tenders.
Index / compatibility mega-server: panda-federation-tools (use only when you truly need every tool).
TDQS standard
New tools join this domain only while the count stays in the 3–15 band. Descriptions follow the checklist in the umbrella repo. See tdqs-standard / project docs.
Built by Panda Federation. MIT licensed.
Available Tools
6 toolsai_search_seo_auditAI Search & SEO Audit: GEO, llms.txt & Schema CheckerARead-only
Audit web pages for classic SEO and for AI-search readiness (ChatGPT, Perplexity, Claude, Google AI Overviews): titles, meta, schema/FAQ markup, author/date signals, blocked AI crawlers, llms.txt and ranked fixes, with an SEO score and an AI-readiness score per page. Unlike website_change_monitor (diffs pages over time) and hidden_ai_instructions_scanner (finds concealed prompt-injection text), this grades how discoverable and citable a page is. Use when you need an on-page SEO/GEO audit or an llms.txt draft. Do not use for change tracking (use website_change_monitor) or security scanning (use hidden_ai_instructions_scanner or email_domain_security_checker). Parameters: crawlInternalLinks multiplies pages: each URL can add up to that many same-site pages, and every page is billed, so maxPages/run_max_items is the real cost cap. generateLlmsTxt drafts one llms.txt per site lacking it at no extra charge. Pages that block our crawler are returned unbilled. Returns per item: agentSummary, url, seoScore, aiReadinessScore, title, metaDescription, h1, wordCount, schemaTypes, faqSchema, aiSearchBotsBlocked, aiTrainingBotsBlocked, llmsTxt, sitemapFound, canonical, noindex, crawlerBlocked, fixes.
Behavior: read-only; runs the Apify Actor pandadad0214/ai-search-seo-audit (https://apify.com/pandadad0214/ai-search-seo-audit) on your own Apify account. Price: $0.004 per page audited. Runs that find nothing are not charged per result, and spending is capped per call by run_max_charge_usd (default $0.50). run_max_items (default 50) limits items returned and fills maxPages when you leave it unset, so it also limits what is billed; setting maxPages higher can bill more than is returned. Most calls finish in 5-15 s for a few inputs; large inputs or crawls can take minutes, so raise run_timeout_secs (max 300) or shrink the input after a timeout error. Returns JSON {actor, count, items}; long text output is trimmed to whole items, with all items in structuredContent.
Inputs: urls, maxPages, run_max_items, generateLlmsTxt, +3 more.
broken_link_checkerBroken Link Checker: 404s, Redirects and Dead LinksARead-only
Crawl one or more start pages and check every unique http(s) link for HTTP status, final URL after redirects, a broken flag (status 400+) and a redirected flag, with external links checked by default. Unlike ai_search_seo_audit (page SEO/GEO scoring) and website_change_monitor (content diffs over time), this finds dead and redirecting links. Use when SEO, content or agency teams need a 404 report for a site or page. Do not use to search the web, to crawl a whole large site in one call or to check private or internal addresses (blocked and never billed). Parameters: startUrls (required in practice) are the pages crawled; maxPages is pages followed per host (1 = only the start pages); maxLinks caps checked links and therefore billing; checkExternal=false stays on-site; timeoutSecs is the per-request timeout (default 15). Billed per link that returns an HTTP status; timeouts, DNS failures and robots-skipped targets are free. Returns per item: agentSummary, originalUrl, finalUrl, statusCode, broken, redirected, external, contentType, sourcePage, error; plus LINKS_XLSX (all links plus a Broken sheet)/CSV.
Behavior: read-only; runs the Apify Actor pandadad0214/broken-link-checker (https://apify.com/pandadad0214/broken-link-checker) on your own Apify account. Price: $0.001 per link checked. Runs that find nothing are not charged per result, and spending is capped per call by run_max_charge_usd (default $0.50). run_max_items (default 50) limits items returned and fills maxLinks when you leave it unset, so it also limits what is billed; setting maxLinks higher can bill more than is returned. Most calls finish in 5-15 s for a few inputs; large inputs or crawls can take minutes, so raise run_timeout_secs (max 300) or shrink the input after a timeout error. Returns JSON {actor, count, items}; long text output is trimmed to whole items, with all items in structuredContent.
Inputs: maxLinks, maxPages, startUrls, timeoutSecs, +4 more.
bulk_domain_whois_expiryBulk Domain WHOIS & Expiry Checker (RDAP): Registrar & DatesARead-only
Check many domains at once with official RDAP (WHOIS fallback): registered or available, registrar, created/updated/expiry dates, days to expiry, transfer lock and pending-delete status, nameservers, DNS host and DNSSEC. Unlike email_domain_security_checker (SPF/DKIM/DMARC mail security) and company_website_enricher (site content and contacts), this is registration and expiry data for a domain portfolio. Use when you audit a domain portfolio for renewals, check which names are available, or verify registrar and DNS host for vendors or phishing look-alikes. Do not use for website content, uptime or email-auth checks (use email_domain_security_checker). Parameters: domains accepts URLs (scheme, www and paths stripped; duplicates dropped; up to 10,000); rootDomainOnly (default true) reduces subdomains to the registrable domain; expiringWithinDays sets the expiringSoon flag and only=expiringSoon|available|registered returns (and bills) just that subset; sortBy=expiry puts the soonest renewals first; followRegistrar adds registrant org/country when published but is slower; maxResults caps billed domains. Failed lookups are free. Returns per item: agentSummary, domain, registered, available, registrar, registrarIanaId, createdDate, updatedDate, expiresDate, daysToExpiry, ageYears, expiringSoon, statuses, transferLocked, pendingDelete, nameservers, dnsHost, dnssec, registrantOrg, registrantCountry, abuseEmail, source; plus DOMAINS_XLSX/CSV.
Behavior: read-only; runs the Apify Actor pandadad0214/bulk-domain-whois-expiry (https://apify.com/pandadad0214/bulk-domain-whois-expiry) on your own Apify account. Price: $0.001 per domain checked. Runs that find nothing are not charged per result, and spending is capped per call by run_max_charge_usd (default $0.50). run_max_items (default 50) limits items returned and fills maxResults when you leave it unset, so it also limits what is billed; setting maxResults higher can bill more than is returned. Most calls finish in 5-15 s for a few inputs; large inputs or crawls can take minutes, so raise run_timeout_secs (max 300) or shrink the input after a timeout error. Returns JSON {actor, count, items}; long text output is trimmed to whole items, with all items in structuredContent.
Inputs: only, sortBy, domains, maxResults, +6 more.
email_domain_security_checkerSPF, DKIM & DMARC Checker: Bulk Email Domain Security AuditARead-only
Audit email authentication for a list of domains: SPF, DKIM (about 40 common selectors), DMARC, MX provider, MTA-STS, TLS-RPT and BIMI, graded A-F with spoofing risk and plain-English fixes. Unlike company_website_enricher (firmographics, tech stack, contacts), this only grades mail security posture from public DNS. Use when you need deliverability or spoofing checks, a security prospect list, or a vendor review. Do not use for website SEO or AI-readiness (use ai_search_seo_audit) or for page-level prompt injection (use hidden_ai_instructions_scanner). Parameters: domains accept bare domains, emails or URLs and are normalized and de-duplicated. DKIM is only confirmed when a selector matches; add dkimSelectors you know are in use, otherwise a missing DKIM may be a false negative. Nonexistent or unresolvable domains are returned with a status and not charged. Returns per item: agentSummary, domain, grade, score (0-100), spoofable, mailProvider, spfRecord, spfAll, spfLookups, dmarcRecord, dmarcPolicy, dmarcReporting, dkimSelectorsFound, mtaSts, tlsRpt, bimi, mxHosts, fixes (prioritized), status.
Behavior: read-only; runs the Apify Actor pandadad0214/email-domain-security-checker (https://apify.com/pandadad0214/email-domain-security-checker) on your own Apify account. Price: $0.002 per domain checked. Runs that find nothing are not charged per result, and spending is capped per call by run_max_charge_usd (default $0.50). run_max_items (default 50) limits items returned and fills maxDomains when you leave it unset, so it also limits what is billed; setting maxDomains higher can bill more than is returned. Most calls finish in 5-15 s for a few inputs; large inputs or crawls can take minutes, so raise run_timeout_secs (max 300) or shrink the input after a timeout error. Returns JSON {actor, count, items}; long text output is trimmed to whole items, with all items in structuredContent.
Inputs: domains, maxDomains, dkimSelectors, run_max_items, +2 more.
website_change_monitorWebsite Change Monitor: Page Diffs, Price & Keyword AlertsARead-only
Check a watch list of web pages against snapshots saved by your previous run and report added and removed text, change percent, price changes and keyword appear/disappear alerts, with an optional webhook when something changes. Unlike ai_search_seo_audit (one-time quality audit) and hidden_ai_instructions_scanner (concealed AI-directed text), this is stateful diffing over time. Use when you need to track competitor pricing, terms, product or careers pages on a schedule. Do not use for a one-off page read or audit (use ai_search_seo_audit), or for pages behind a login. Parameters: the first run per monitorName only saves baselines (status 'baseline saved'); reuse the same monitorName for every later run, and use a new name for a separate watch list. cssSelector, ignorePatterns and ignoreNumbersAndDates cut false alarms from banners, counters and timestamps. Below minChangePercent the old snapshot is kept, so small edits accumulate. onlyReportChanges shrinks output but every page checked is still billed; unreachable pages are free. webhookUrl posts outside the Apify run; only set it if you control that endpoint. Returns per item: agentSummary, url, label, status, changed, changePercent, addedCount, removedCount, addedLines, removedLines, prices, priceChanges, keywordsPresent, keywordsAppeared, keywordsDisappeared, titleBefore, titleAfter, previousCheckAt.
Behavior: read-only; runs the Apify Actor pandadad0214/website-change-monitor (https://apify.com/pandadad0214/website-change-monitor) on your own Apify account. Price: $0.0015 per page checked. Runs that find nothing are not charged per result, and spending is capped per call by run_max_charge_usd (default $0.50). run_max_items (default 50) limits items returned and fills maxPages when you leave it unset, so it also limits what is billed; setting maxPages higher can bill more than is returned. Most calls finish in 5-15 s for a few inputs; large inputs or crawls can take minutes, so raise run_timeout_secs (max 300) or shrink the input after a timeout error. Returns JSON {actor, count, items}; long text output is trimmed to whole items, with all items in structuredContent.
Inputs: urls, maxPages, webhookUrl, cssSelector, +9 more.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
TDQS
Scored across 6 tools
Each tool targets a distinct, clearly named concern (SEO/AI readiness, hidden prompt injection, temporal diffs, domain registration, link health, email auth). The descriptions go further and explicitly cross-reference each other ("unlike X..., do not use for Y"), leaving essentially no room for misselection.
All six names are consistent snake_case descriptive noun phrases that clearly state the resource and operation (audit, scanner, monitor, checker, expiry). No mixed conventions or casing appear across the set.
Six tools is a tight, well-scoped set for a web/site diagnostics portfolio, with each tool earning a clear place. It sits at the low end but is comfortably within a reasonable range for the domain.
The surface covers the core read-only audit workflows: on-page SEO, AI-readiness, prompt-injection, change tracking, WHOIS/expiry, broken links, and email auth, all with actionable output. Minor gaps remain (e.g. TLS/security-header checks, uptime/safe-browsing), but they are peripheral and not blocking.
Maintenance
Related MCP Connectors
Security, SEO and AI-visibility scanner for web apps · free scans and focused checks via MCP.
Remote MCP server: 19 domain-hygiene and email-auth tools (DNS, SPF, DMARC, DKIM, TLS).
AI-operated. Free SPF (RFC 7208 count), DMARC, MTA-STS, DMARC rua/ruf readers. Paid audit $29.
Inspect any domain: tech stack, SPF/DKIM/DMARC/MX email health and security posture, for AI agents
Related MCP Servers
- AlicenseAqualityDmaintenanceEmail-deliverability tools for AI agents — 12 MCP tools across email verification, DNSBL across 50 zones, SPF/DKIM/DMARC analysis, spam-trap scoring, domain intelligence, and email finder. Free tier with no credit card.1236 npm1MIT
- AlicenseAqualityBmaintenanceMCP server for IntoDNS.ai providing 36 free tools for DNS, DMARC, SPF, DKIM, BIMI, DNSSEC, MTA-STS, FCrDNS, blacklist and email security checks. Citation-grade report snapshots with content hashes. No API key required.45142 npm2MIT
- AlicenseNot gradedqualityBmaintenanceMCP server for Technical SEO DNS record auditing, SOA expiry health checks, SSL/TLS inspection, and HTTP security header analysis. Enables comprehensive security audits and scoring via 10 tools.MIT
- AlicenseNot gradedqualityBmaintenanceProvides live infrastructure monitoring for AI agents, including domain health checks, MCP server security posture, email blacklists, broken-link scans, and cloud vendor status. No signup or API key needed for public tools.MIT