Free MCP server, no key, no account
Use these tools from an AI agent
Every tool on drwho.me is also callable over the Model Context Protocol, so an agent can run the same checks a person runs by hand.
- Endpoint
- https://drwho.me/mcp/mcp
- Transport
- Streamable HTTP
- Auth
- None
- Rate limit
- 60 tool calls an hour, per address
claude mcp add --transport http drwho https://drwho.me/mcp/mcpMost clients take a config block shaped like this. Check your client's own docs for exactly where it goes.
{
"mcpServers": {
"drwho": { "url": "https://drwho.me/mcp/mcp" }
}
}- dossier_summary
- Run the nine DNS, email-authentication and TLS checks on a domain in parallel and return one graded line per check: DNS records, MX, SPF, DMARC, DKIM, DNSSEC, TLS-RPT, MTA-STS and the TLS certificate.
- dossier_dns
- Fetch a domain's A, AAAA, NS, SOA, CAA and TXT records in one call.
- dossier_mx
- List a domain's MX (mail exchanger) records sorted by priority.
- dossier_spf
- Find and parse a domain's SPF record into its mechanisms.
- dossier_dmarc
- Find and parse the DMARC policy at _dmarc.<domain> into its tags (p, sp, pct, rua, ruf, adkim, aspf).
- dossier_dkim
- Probe a domain for DKIM public keys at <selector>._domainkey.<domain>.
- dossier_dnssec
- Check whether a domain's zone is signed with DNSSEC and validates: DS and DNSKEY records plus the resolver's AD (authenticated data) flag.
- dossier_tlsrpt
- Look up a domain's SMTP TLS Reporting policy at _smtp._tls.<domain>.
- dossier_mta_sts
- Fetch and validate a domain's MTA-STS policy (mode, mx, max_age).
- dossier_tls
- Read the TLS certificate a domain presents on port 443: subject, issuer, validity dates, days remaining, subject alternative names, SHA-256 fingerprint and whether the chain validated.
- dossier_redirects
- Trace the redirect chain from https://<domain>/, one entry per hop with its status code and target, up to 10 hops.
- dossier_headers
- Fetch https://<domain>/ and return every response header, so you can review Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy.
- dossier_cors
- Send a CORS preflight (OPTIONS) to https://<domain>/ and return the access-control-* headers in the answer.
- dossier_web_surface
- Summarise a domain's public web surface: robots.txt, sitemap.xml and the home page's title, description, OpenGraph and Twitter card tags.
- dossier_ai_crawlers
- Report what a domain's robots.txt says to the major AI crawlers (GPTBot, ClaudeBot, Google-Extended, PerplexityBot, CCBot, meta-externalagent): allowed, blocked or unspecified for each.
- dossier_llms_txt
- Check whether a domain publishes an llms.txt, the markdown index some sites provide for AI agents.
- dossier_security_txt
- Check whether a domain publishes /.well-known/security.txt (RFC 9116), the standard way to tell researchers where to report a vulnerability.
- dossier_whois
- Look up a domain's registrar, creation date, expiry date and registry statuses.
- dossier_ct_log
- List subdomains of a domain that appear in Certificate Transparency logs.
- dns_lookup
- Resolve one DNS record type (A, AAAA, MX, TXT, NS, CNAME, SOA, CAA or SRV) for a name and return the raw answers.
- ip_lookup
- Look up an IPv4 or IPv6 address: city, region, country, coordinates, timezone and the network (ASN and organisation) that announces it.
- user_agent_parse
- Parse a User-Agent header into browser, operating system, device and rendering engine.
- base64_encode
- Encode UTF-8 text as base64.
- base64_decode
- Decode base64 to UTF-8 text.
- jwt_decode
- Decode a JSON Web Token's header and payload.
- json_format
- Validate JSON and re-print it with an indent of 2 or 4 spaces, or minified with indent 0.
- url_encode
- Percent-encode text for use in a URL query value or path segment (encodeURIComponent rules: everything except letters, digits and - _ .
- url_decode
- Decode percent-encoded text.
- uuid_generate
- Generate UUIDs.
How this differs from Domain Posture's MCP
This server answers one check at a time, free, with no key. Domain Posture's MCP server runs the full graded audit across all 18 checks and can set up scheduled monitoring — that stays a paid call.