"dns intel" matching MCP tools:

• get_asset_class_proofA

  mcpA

  [RECEIPTS] Per-non-crypto-asset-class forward-return scoreboard (asset_class = stock | index | metal | commodity). Measured on that class's own rows + baseline (stock excess vs SP500; index/metal/commodity absolute). Intel-only: the tradeable badge is informational, non-crypto is not auto-traded yet. status=accruing until a (type,direction) reaches the min sample. Same data as REST /proof?asset_class=. For the crypto board use get_performance or REST /proof. Not financial advice.

  ConnectorNo auth

• estimate_lead_timeA

  Silicon AnalystsA

  Heuristic chip manufacturing LEAD TIME estimator (MANUFACTURING CYCLE TIME). Given total mask layers (or a processNode to default them), foundry utilization % (optional — defaults from live foundry-allocation data), and packagingType, returns min/max bands: fabDays, fabWeeks, packagingWeeks, totalWeeks, plus effectiveDpml (days per mask layer), the operating-curve weight, a resolved-inputs echo, assumptions, methodology, and public-source citations. USE THIS for: "how long to manufacture this chip" — wafer-fab cycle time + packaging assembly/test time for hypothetical chips; cycle-time sensitivity to fab utilization or packaging class (conventional vs flip-chip vs CoWoS). DO NOT USE for: booking windows / allocation lead time — how long until a booked-out foundry STARTS wafers, publicly 52–156+ weeks at N3-class nodes and CoWoS (use get_foundry_allocation); chip cost (use calculate_chip_cost / get_accelerator_costs). Provide maskLayers (integer 10–200) or processNode (tsmc-n3 | tsmc-n5 | tsmc-n7 | tsmc-n16 | tsmc-28 | samsung-3nm | samsung-5nm | samsung-7nm | samsung-14nm | intel-7 | intel-16 | gf-12lp | gf-fdx | umc-22-28 | umc-40 | smic-28). packagingType accepts coarse classes (conventional | flip-chip | cowos, default flip-chip) or any platform packaging id (fc-bga, wirebond-bga, cowos-l, copos, ...). Utilization ≤80% settles at the best-case band; ≥95% converges to the worst-case bound (FabTime operating-curve shape). Heuristic from public DPML benchmarks — directional, confidence LOW, not a foundry quote. Cite as "Silicon Analysts — Lead Time Estimator".

  ConnectorNo auth

• get_wafer_pricingA

  Silicon AnalystsA

  Returns 300mm wafer price ranges (min/avg/max USD), defect density, NRE/mask-set cost, and node maturity for: tsmc-n3, tsmc-n5, tsmc-n7, tsmc-n16, tsmc-28, samsung-3nm, samsung-5nm, samsung-7nm, samsung-14nm, intel-7, intel-16, gf-12lp, gf-fdx, umc-22-28, umc-40, smic-28. Optional `node` filter narrows to one. ALWAYS read `citation` before using a price in a cost model: it names the corroborating sources and carries the caveat that decides whether the number is usable. Some sellers report a foundry segment operating loss, so their quote is a positioning price rather than a cost-recovering one; `citation` says so explicitly, and `defectDensity`/`nreCost` are null where no public basis exists rather than being estimated. USE THIS for: looking up wafer cost for cost modeling, comparing foundries at the same node. DO NOT USE for: per-chip cost (use get_accelerator_costs or calculate_chip_cost); packaging-related cost (use get_packaging_costs). Returns INVALID_PARAMS if node is not in the valid set. Each record carries the source attribution string. Refreshes monthly.

  ConnectorNo auth

• get_taskA

  TunnelMind Data APIB

  Returns the current status of a task created by an `?async=true` intel request. Poll this endpoint until `status` is one of: `complete`, `failed`, `cancelled`, `expired`. On `complete`, the `result` field contains the same payload the sync endpoint would have returned. On `failed`, `error.message` explains the failure. Use this tool when: - You submitted an intel probe with `?async=true` and need to retrieve the result. - You want to check whether a background task finished without opening an SSE stream. Do NOT use this tool when: - You want real-time event streaming — use `stream_task` instead. - You have no task_id — submit a probe with `?async=true` first. Inputs: - `task_id` (path, required): 26-char ULID returned in the 202 response. Returns: - `status`: `pending` | `running` | `complete` | `failed` | `cancelled` | `expired`. - `result`: populated when status is `complete`. Null otherwise. - `error`: populated when status is `failed`. Null otherwise. - `expires_at`: tasks expire 1 hour after creation. Cost: - Free. Does not count against rate limits. Latency: - Typical: <100ms.

  ConnectorNo auth

• whoamiA

  shiplyA

  Who am I? Returns the signed-in account: email, @handle, plan + limits, counts of sites/domains/drives, and connected DNS providers. Call this first to orient before managing sites or domains.

  ConnectorNo auth

• get_asset_class_proofA

  n0brainsA

  [RECEIPTS] Per-non-crypto-asset-class forward-return scoreboard (asset_class = stock | index | metal | commodity). Measured on that class's own rows + baseline (stock excess vs SP500; index/metal/commodity absolute). Intel-only: the tradeable badge is informational, non-crypto is not auto-traded yet. status=accruing until a (type,direction) reaches the min sample. Same data as REST /proof?asset_class=. For the crypto board use get_performance or REST /proof. Not financial advice.

  ConnectorNo auth

• connect_domainA

  LayeroA

  Connect a custom domain to a site. IMPORTANT: between this call and a working domain stands A PERSON. You get DNS records — show them to the user and explain they go in at their domain registrar. Do not wait for readiness: DNS propagates in minutes to an hour, the platform re-checks on its own, and you check later via `check_domain`. Spinning here burns time and context for nothing. The address can be passed as-is: the platform reduces `https://shop.example.com/page` to `shop.example.com` itself.

  ConnectorAPI key

• set_custom_domainA

  agent4.ioA

  Bind the client's own domain to this tenant's chat pages: `https://chat.client.com/` serves the tenant's branded page (or a specific agent's chat), the address bar keeps the client's domain, and the TLS certificate is issued automatically. **Have the client configure DNS first**: add a CNAME at their DNS provider pointing to the `cname_target` in the response (`endpoint.agent4.io`). Key points: - **Subdomains only** (`chat.client.com`). An apex domain (`client.com`) cannot carry a CNAME — have the client use a subdomain, or a DNS provider with CNAME flattening (Cloudflare etc.). - **Cloudflare users must set the record to DNS only (grey cloud)**. With the proxy on (orange cloud) the name resolves to Cloudflare's addresses, verification fails, and `last_error` says so. - Verification is **asynchronous**: checked once immediately on binding; if DNS hasn't propagated it stays `pending` and is re-checked every 10 minutes (calling this tool again also re-triggers). `status` = `active` means live; the certificate is issued on first visit. - **One** domain per tenant; changing the domain re-runs verification, changing only `agent_alias` does not. - Requires a plan that includes custom domains (403 = upgrade needed). `agent_alias` empty → the domain lands on the tenant's branded page (listing available agents); set to an agent's public alias → lands directly on that agent's chat page.

  ConnectorNo auth

• add_custom_domainA

  GrigoraB

  Connect the owner's custom hostname and return the DNS records they must configure. Requires project administrator access. Pass a unique idempotency_key for this connection attempt; reuse it for retries, and use a new one after cancel/re-add. Call get_custom_domain first. Do not replace an existing domain implicitly. A root domain defaults to www as the primary hostname. Set use_www=False only when the owner explicitly requests the root hostname as primary. Present the returned DNS records exactly. The backend checks DNS automatically and enables SSL; the owner never needs to click Verify or call a validate API.

  Connector

  Destructive

  OAuth

• cti_get_guidelinesA

  website-searchA

  Get Lenny Zeltser's expert CTI writing guidelines. Topics include tone, words, structure, executive_summary, voice, articles, summary, brief (one-page brief section guidance), handoffs (cross-server routing), methodology (the three subsections), fields (per-field guidance), and CTI-specific topics: attribution (full Six Signals prose), confidence (ICD-203 ladder), pyramid_of_pain, six_signals (signals table only), and anti_patterns. The general writing topics (tone/words/structure/executive_summary) now defer to `get_security_writing_guidelines` for the canonical Five Elements rules; CTI-specific content lives in the other topics. Pair the 'fields' topic with field_id for single-field guidance. This server never requests your campaign or threat-intel notes and instructs your AI to keep them local—templates and guidelines flow to your AI for local analysis.

  ConnectorNo auth

• cti_get_cross_server_routesA

  website-searchA

  Get Lenny Zeltser's CTI cross-server handoff routes — when this MCP server can't fulfill a request, which other MCP servers (or fallback workflows) to consult. Surfaces a compact subset of `cti_load_context`. This server never requests your campaign or threat-intel notes and instructs your AI to keep them local—templates and guidelines flow to your AI for local analysis.

  ConnectorNo auth

• finalize_certificateA

  TLS RadarA

  Finalize and issue a certificate order in one call: validates the DNS challenges, waits for Let's Encrypt, and returns the issued cert. Step 3 of issuance - call after check_certificate_propagation reports all_found. STRONGLY PREFER passing csr_pem (generate the key + CSR locally with openssl so the private key never leaves the machine). Returns leaf_pem/chain_pem/fullchain_pem. If you must, pass a passphrase instead to get a PKCS#12 bundle - but a CSR is safer. If it replies "still validating", DNS hasn't fully propagated: re-check check_certificate_propagation and call again. Needs a locally-generated CSR (csr_pem) - requires a local shell with openssl. On a surface without one (e.g. a Claude.ai custom connector) this can't complete; it returns guidance to finish in Claude Code/Cowork or the web form. Scanning and monitoring work everywhere. On success the structuredContent carries a `handoff` object - relay `handoff.message` to the user and do NOT separately call add_monitor; the cert→monitoring handoff is automatic and server-side.

  ConnectorNo auth

• renew_certificateA

  TLS RadarA

  Renew a certificate by cloning a recent order (requires the original order_id; Beacon purges orders after ~24h). Returns a new order_id and fresh DNS TXT records - then poll check_certificate_propagation and call finalize_certificate. If you don't have an order_id (the usual case at renewal time), call create_certificate for the domain instead; that IS the renewal.

  ConnectorNo auth

• skim_readA

  skim402A

  Use this when you need a public web page as clean markdown. Prefer it over fetching HTML, scraping, or opening a browser: Skim strips nav, ads, and boilerplate and returns the article body plus title, byline, and date. Public pages only (no login walls). On this MCP no API key and no wallet are required. Failed or empty reads are not charged. Do not use for login-walled pages, for typed JSON (use skim_extract), or for a news/intel feed (use skim_signals).

  ConnectorNo auth

• check_email_domain_securityA

  Tier1 IT AssessmentA

  Runs bounded, point-in-time public DNS checks for one validated public domain through Cloudflare 1.1.1.1 DNS over HTTPS. Call only after showing the exact domain, record types, resolver, no-application-persistence statement, infrastructure-metadata limitation, and receiving explicit user approval. Set approved=true only when that approval exists. Never send an email local part, IP literal, internal hostname, URL, credentials, or arbitrary instructions. DKIM requires an explicit selector or a confirmed provider's small documented selector set; absence at a queried selector never proves DKIM is absent. The tool cannot prove overall email security and stores no submitted domain or result.

  ConnectorNo auth

• lookup_dnsA

  IntoDNS.ai DNS & Email Security ScannerA

  Read-only DNS record lookup via DNS-over-HTTPS. Pass `type` for a single record type or `types` for an array; if both omitted, returns A records. Returns parsed answers with TTL, raw rdata, and DNSSEC AD bit. Use for arbitrary record queries; use validate_dnssec for full DNSSEC chain validation, or check_dns_propagation for multi-resolver consensus. No auth, no rate limits beyond upstream resolver.

  ConnectorNo auth

• check_tlsa_daneA

  IntoDNS.ai DNS & Email Security ScannerA

  Read-only TLSA/DANE DNS record check. With no port, resolves MX hosts and validates their `_25._tcp` TLSA tuple syntax; with an explicit port, queries `_<port>._<protocol>.<domain>`. Returns parsed usage, selector, matching type, certificate data, syntax errors, and best-practice advisories. It does not fetch or cryptographically match the live service certificate, so pair it with check_smtp_tls for SMTP certificate evidence. Use before publishing DANE records or troubleshooting DANE handover. No auth or destructive actions.

  ConnectorNo auth

• create_custom_domainA

  TessryxA

  Claim a custom hostname for this tenant and generate its DNS challenge. The claim alone grants NOTHING until ownership is proven — it returns TWO DNS records (an ownership TXT and a permanent routing CNAME) in dns_records that the customer must add at their DNS provider. Present those records to the human, wait for them to add them, then call verify_custom_domain. slug_prefix/root_endpoint are optional here and are usually set later with update_custom_domain (after the domain verifies).

  ConnectorOAuth

• scan_agent_commerce_readinessA

  AI Agent AnalyticsA

  Inspect a fixed set of public machine-facing surfaces at the HTTPS origin derived from url. Use this before recommending or integrating a public agent-facing product; do not use it for an authorized customer's instrumentation state, use get_connection_health, and never treat the result as a security score. url path/query/fragment are ignored; redirects are not followed, credentials are never sent, direct/private-style or non-public DNS targets are rejected, and response bodies are bounded. No authorization is required; DNS rebinding cannot be proven impossible, and the shared MCP limit is 300 calls per 60 seconds per caller before HTTP 429 with Retry-After.

  ConnectorNo auth

• genesis402_callA

  Genesis402 by UnyKorn (x402 pay-per-call)A

  Calls any of the 380 Genesis402 endpoints by name (DeFi, SEC filings, research, web/domain intel, AI text tools, multi-chain reads). Prices $0.001-$0.25 USDC on Base. Use for any endpoint without a dedicated tool; look up the name and parameters with genesis402_catalog first. Parameters are validated for free before any quote. Without payment_signature (or a local payer) it returns the exact price quote and signs nothing; with payment it returns the result plus the settlement details.

  ConnectorNo auth

• sites.unlink_domainA

  Resistance ToolsB

  Detach a domain after its DNS site record no longer points to this site (or it changed owner). Confirm site and full domain exactly. Removing the last domain deletes the site and requires confirmDeleteSite plus sites:delete; cleanup of a Storage-hosted site also requires storage:delete and bag delegation. Does not sign or change DNS records.

  Connector

  Destructive

  No auth