Dechonet MCP

Full Domain Security Scan

security_scan

Read-onlyIdempotent

Audit a domain's security across web, email, DNS, exposure, and reputation; get a 0-100 score, letter grade, and prioritized actions.

Instructions

One-shot comprehensive audit of a domain, scored 0-100 with an A+ to F grade and a prioritized action list. Five scored areas: the web connection (TLS certificate and HTTP security headers, measured on www when only www has an address), mail spoofing defence (SPF/DKIM/DMARC; a domain that uses no mail is judged only on SPF -all and an enforced DMARC policy), domain registration and DNS, exposure (admin screens, developer tools and the like on hosts named in public certificate logs — counts only), and reputation (DechoNet verdict store and licensed phishing feeds). DNS propagation, reverse DNS and ASN are returned as reference information and not scored. A warning costs a quarter of its area and a critical half; data that could not be read in full is flagged, not charged, and an exposure or reputation lookup that fails is reported as not checked. Call the individual tools (e.g., ssl_check, email_auth, exposure_map) for depth on one area. BEHAVIOR: passive — public lookups and ordinary HTTPS requests only; open ports are NOT scanned (port_scan is the separate, active check). Takes up to about a minute (the exposure lookup). Read-only; requires no API key; rate-limited (it makes multiple backend calls). Returns the score, per-area breakdown, reference areas, top actions, and per-area summaries.

Input Schema

TableJSON Schema

Name	Required	Description	Default
`domain`	Yes	Domain to audit (e.g., 'example.com'). Scheme and path are stripped.

Output Schema

TableJSON Schema

Name	Required	Description
`areas`	Yes	Per-area verdicts of the scored areas (ssl, http, email, rdap, dns, exposure, reputation)
`grade`	Yes	Letter grade A+ to F
`score`	Yes	Health Score 0-100
`actions`	No	Top recommended actions
`receipts`	No	Signed observation receipts behind this result, one per lookup: when, from where and under which rules version DechoNet observed it. Each url shows the record and checks its Ed25519 signature.
`reference`	No	Reference areas, not scored (propagation, reverseDns, asn): the tool status
`reportUrl`	Yes	Human-facing interactive report on dechonet.com

Schema Changelog

Changes observed during successful MCP inspections.

Changed2 schema fields changedv1.6.1Oct 18, 2026

changedOutput schema / properties / areas / description

Previous value: -"Per-area verdicts"New value: +"Per-area verdicts of the scored areas (ssl, http, email, rdap, dns, exposure, reputation)"

addedOutput schema / properties / reference

Added value: +{
+  "description": "Reference areas, not scored (propagation, reverseDns, asn): the tool status",
+  "items": {
+    "additionalProperties": false,
+    "properties": {
+      "area": {
+        "type": "string"
+      },
+      "status": {
+        "type": "string"
+      }
+    },
+    "required": [
+      "area",
+      "status"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}

Changed2 schema fields changedv1.5.14Oct 15, 2026

changedInput schema / properties / domain / description

Previous value: -"Domain to audit end-to-end (e.g., 'example.com'). Scheme and path are stripped. NOTE: the host is also port-scanned, so use only targets you are authorized to test."New value: +"Domain to audit (e.g., 'example.com'). Scheme and path are stripped."

addedOutput schema / properties / receipts

Added value: +{
+  "description": "Signed observation receipts behind this result, one per lookup: when, from where and under which rules version DechoNet observed it. Each url shows the record and checks its Ed25519 signature.",
+  "items": {
+    "additionalProperties": false,
+    "properties": {
+      "id": {
+        "type": "string"
+      },
+      "tool": {
+        "type": "string"
+      },
+      "url": {
+        "type": "string"
+      }
+    },
+    "required": [
+      "tool",
+      "id",
+      "url"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}

Changed1 schema field changedv1.1.0Sep 8, 2026

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "additionalProperties": false,
+  "properties": {
+    "actions": {
+      "description": "Top recommended actions",
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "areas": {
+      "description": "Per-area verdicts",
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "area": {
+            "type": "string"
+          },
+          "verdict": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "area",
+          "verdict"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "grade": {
+      "description": "Letter grade A+ to F",
+      "type": "string"
+    },
+    "reportUrl": {
+      "description": "Human-facing interactive report on dechonet.com",
+      "type": "string"
+    },
+    "score": {
+      "description": "Health Score 0-100",
+      "type": "number"
+    }
+  },
+  "required": [
+    "score",
+    "grade",
+    "areas",
+    "reportUrl"
+  ],
+  "type": "object"
+}

Changed1 schema field changedv1.0.3Jun 17, 2026

changedInput schema / properties / domain / description

Previous value: -"Domain to scan comprehensively (e.g., example.com)"New value: +"Domain to audit end-to-end (e.g., 'example.com'). Scheme and path are stripped. NOTE: the host is also port-scanned, so use only targets you are authorized to test."

First observedv0.1.0Jun 17, 2026

TDQS

A4.4/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, non-destructive and open-world, so the bar is lower; the description still adds substantial unrepeatable context: passive-only (no port scans), the scoring weighting (quarter/half penalties), unreadable data flagged not charged, failed lookups reported as not checked, ~1 minute runtime, no API key, and rate limiting. It stops short of documenting partial-failure retry semantics but covers the operation profile well.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the summary and organized into scoring, behavior and return sections; nearly every sentence carries decision-relevant content. It is dense and on the long side, but the detail on scoring and passivity justifies most of its length.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex, multi-area audit tool the description fully covers scoring, exclusions, failure handling and runtime, and even summarizes returns despite an output schema existing. An agent has everything needed to call it correctly and set expectations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Single parameter at 100% schema coverage, so the schema already documents 'domain' and stripping of scheme/path. The description adds behavioral nuance (www-host measurement) but no parameter-specific syntax or format beyond what the schema provides, matching the baseline-3 rule.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with a specific verb+resource+scope ('One-shot comprehensive audit of a domain') and immediately enumerates the five scored areas. It also names the sibling tools (ssl_check, email_auth, exposure_map) and distinguishes itself from port_scan, so an agent can place it without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly defines when to use it (one-shot comprehensive audit) versus when to go deep on one area ('Call the individual tools... for depth'), and routes the active check to port_scan. Both inclusion and exclusion conditions are stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.