Related Servers

Most tools target clearly distinct objects (DNS records, TLS handshake, HTTP headers, mail config, a single wallet address, a page an agent is about to visit, an MCP endpoint) and descriptions actively cross-reference siblings to route the agent ('use ssl_check instead', 'use dns_lookup instead'). The remaining ambiguity is concentrated in the graded-score family — security_scan, owasp_check, http_security, ssl_check, golive_check, impersonation_exposure, exposure_map and lookalike_domains/subdomain_discovery overlap in scope, so an agent must read carefully to pick the aggregate versus the per-layer tool.

All names are lower snake_case and domain-vocabulary is stable (dns_lookup, ssl_check, port_scan, whois_lookup), so nothing is unreadable. The pattern is mixed between noun_action (dns_lookup, ssl_check, wallet_address_check, mcp_server_check) and verb_noun (set_expectations, verify_expectations, watch_domain, report_page, check_before_action), plus bare noun_phrases like pqc_readiness and subnet_calc — consistent in style but not in grammar.

33 tools exceeds the range where a set stays comfortably scannable, and the surface is genuinely broad (DNS/TLS/HTTP/email recon, IP and ASN, exposure mapping, phishing and crypto safety, MCP server vetting, watching and expectations). Each tool does have a defined scope, but layered aggregates (security_scan, owasp_check, golive_check, impersonation_exposure, exposure_map) sit on top of primitives that already exist, so a few could be folded or dropped without losing capability.

Coverage across the security-recon lifecycle is strong: current-state lookups, historical timelines, pivots, monitoring/watches, expectation setting and verification, plus agent-safety checks for pages, wallets and MCP servers. Two real gaps: domain_history instructs the agent to use 'rdap_lookup', a tool that does not exist in this set (only whois_lookup), and there is a watch_domain with no unwatch/delete counterpart, leaving a lifecycle dead end.