Connect Dechonet and your agent gets 20 tools, among them asn_lookup, dns_lookup, dns_propagation. It answers at https://dechonet.com/mcp over streamable HTTP, and it listed its tools to an anonymous client, so no sign-in was needed for that. Our probes reached it 4 of 4 times since 16 September 2026; the last check, on 21 October 2026, succeeded.
Hosted DechoNet MCP: 20 domain recon tools for AI agents. DNS, SSL, headers, subdomains, changes.
Description as the publisher wrote it.
| Tool | What it does |
|---|---|
asn_lookup | Look up Autonomous System (ASN) / BGP information for an IP address or AS number: the network operator, announced prefixes, abuse contact, and a classification (cloud, CDN, ISP, hosting, or enterprise). Use this to identify who runs a netwo Inputs: query |
dns_lookup | Query DNS records (A, AAAA, MX, TXT, NS, SOA, CAA) for a domain and validate email-related records, including DNSSEC presence and SPF/DMARC syntax, returning severity-rated diagnostics. Use this for a single authoritative answer about one d Inputs: domain |
dns_propagation | Query one DNS record across 8+ global public resolvers (Google, Cloudflare, Quad9, OpenDNS, and more) simultaneously and report which resolvers return stale versus updated values. Use this after changing a record to confirm worldwide propag Inputs: domain, type |
domain_changes | Report what has CHANGED for a domain over time — the security regressions and drift that DechoNet's daily monitoring has recorded across every watch on the domain (SSL grade, headers, DNS, OWASP posture, impersonation exposure, etc.). Use t Inputs: domain |
email_auth | Assess a domain's email authentication and deliverability posture: MX records, SPF, DMARC, DKIM (probes 15 common selectors), BIMI, MTA-STS, TLS-RPT, and DANE, plus a blacklist check across all MX hosts, returning a 0-100 deliverability sco Inputs: domain |
email_header_analysis | Parse raw email headers to reconstruct the delivery path (each Received hop in order), extract SPF/DKIM/DMARC authentication results, measure per-hop delays, and flag unencrypted (non-TLS) hops. Use this to diagnose a specific message that Inputs: headers |
golive_check | Check whether a domain is ready to launch or migrate — a go/no-go verdict over five essentials: DNS resolves to an IP, has propagated consistently across global resolvers, SSL/TLS is ready, the site is reachable over HTTPS, and the domain r Inputs: domain |
http_security | Follow a URL's HTTP redirect chain and audit response security headers (CSP, HSTS, X-Frame-Options, COOP, CORP, COEP, Permissions-Policy), grading A+ to F and flagging information leaks such as server-version disclosure. Use this for HTTP-l Inputs: url |
impersonation_exposure | Assess how exposed a domain is to brand impersonation and phishing, PASSIVELY: live typosquat/lookalike domains (homoglyph, omission, transposition, TLD swap) that actually resolve, operational subdomains (dev/staging/admin) exposed in CT l Inputs: domain |
ip_info | Report information about the caller's own public IP as seen by the server: IPv4/IPv6 address, ISP, ASN, approximate geolocation, and proxy/VPN heuristics. Takes no input — it reflects the egress IP of THIS MCP server's network, which is usu |
lookalike_domains | Generate the typosquat/lookalike variants of a domain that phishers actually register — homoglyph swaps (l→1, o→0, rn→m), TLD swaps (.com→.co), character omissions, transpositions, repetitions, hyphenations — and check which of them are cur Inputs: domain |
owasp_check | Assess a domain's OWASP posture from EXTERNAL OBSERVATION only: the OWASP Secure Headers Project plus the externally observable Top 10 subset — A02 Cryptographic Failures (TLS/cert), A05 Security Misconfiguration (header/info leaks), and A0 Inputs: host |
port_scan | Probe a host for a fixed set of common TCP ports (HTTP, HTTPS, SSH, FTP, SMTP, DNS, and common databases) and report which are open, the service name, and the response time. BEHAVIOR: this makes an ACTIVE TCP connection to the target. It is Inputs: host |
reverse_dns | Resolve the PTR (reverse DNS) record for an IPv4 or IPv6 address and verify forward-confirmed reverse DNS (FCrDNS) by checking that the PTR hostname resolves back to the same IP. Infers the hosting provider from PTR naming patterns. Use thi Inputs: ip |
security_scan | One-shot comprehensive audit of a domain: runs DNS, SSL, HTTP headers, email auth, port scan, DNS propagation, reverse DNS, and ASN/RDAP checks in parallel, then computes a 0-100 Health Score with an A-F grade and a prioritized action list. Inputs: domain |
ssl_check | Inspect a host's served TLS/SSL certificate and connection: expiry date, issuer, SAN list, chain integrity, TLS version, and HSTS, returning an A+ to F grade weighted by certificate validity (40%), TLS version (25%), chain trust (15%), and Inputs: host, port |
subdomain_discovery | Enumerate the subdomains of a domain from Certificate Transparency logs — fully passive (no packets are sent to the target; CT logs are public records of every TLS certificate ever issued). Flags operational-looking names (dev, staging, adm Inputs: domain |
subnet_calc | Compute IPv4 subnet details from CIDR notation entirely locally — no network call: network and broadcast addresses, usable host range, total usable hosts, subnet mask, and wildcard mask. /31 and /32 are handled per RFC 3021 (point-to-point Inputs: cidr |
watch_domain | Start (or reuse) a daily DechoNet watch on a domain so that changes are recorded over time — SSL grade/issuer/expiry, DNS records, HTTP security headers, domain registration, and optionally OWASP posture and impersonation exposure. Use this Inputs: domain, tools |
whois_lookup | Retrieve domain registration data via RDAP (with WHOIS fallback): registrar, creation/expiry/update dates, nameservers, and EPP status flags, highlighting risk states such as clientHold and pendingDelete. Use this for ownership, lifecycle, Inputs: domain |
Every block below points at https://dechonet.com/mcp. Pick your client and copy.
claude mcp add --transport http dechonet https://dechonet.com/mcp
{
"mcpServers": {
"dechonet": {
"command": "npx",
"args": ["-y", "mcp-remote", "https://dechonet.com/mcp"]
}
}
}{
"mcpServers": {
"dechonet": {
"url": "https://dechonet.com/mcp"
}
}
}{
"servers": {
"dechonet": {
"type": "http",
"url": "https://dechonet.com/mcp"
}
}
}{
"context_servers": {
"dechonet": {
"url": "https://dechonet.com/mcp"
}
}
}{
"mcpServers": {
"dechonet": {
"serverUrl": "https://dechonet.com/mcp"
}
}
}{
"mcpServers": {
"dechonet": {
"url": "https://dechonet.com/mcp"
}
}
}name: Dechonet
version: 0.0.1
schema: v1
mcpServers:
- name: Dechonet
type: streamable-http
url: https://dechonet.com/mcp{
"mcpServers": {
"dechonet": {
"httpUrl": "https://dechonet.com/mcp"
}
}
}{
"mcpServers": {
"dechonet": {
"type": "http",
"url": "https://dechonet.com/mcp"
}
}
}{
"mcpServers": {
"dechonet": {
"url": "https://dechonet.com/mcp"
}
}
}goose://extension?url=https%3A%2F%2Fdechonet.com%2Fmcp&type=streamable_http&id=dechonet&name=Dechonet
It answered our last check on 21 October 2026 in 656 ms. Over 4 checks since 16 September 2026 it answered 4. Status here comes from Neuronto's own probes, not from the publisher.
Yes. It is published by dechonet.com and served from dechonet.com, the vendor's own domain: https://dechonet.com/mcp.
20, as returned by the server's own tools/list on 24 September 2026: asn_lookup, dns_lookup, dns_propagation, domain_changes, email_auth, email_header_analysis, golive_check, http_security, and 12 more.
It answered our last check on 21 October 2026 in 656 ms. Over 4 checks since 16 September 2026 it answered 4.
Put the server under mcpServers in ~/.cursor/mcp.json with the URL https://dechonet.com/mcp. The exact JSON is above, with the same setup for Claude Code, Claude Desktop, VS Code, Windsurf, Zed, Gemini CLI and the rest.
It listed its tools to an anonymous client, so reading the tool list needs no key. Individual tools can still ask for credentials in their own inputs.
Publisher: com.dechonet. Endpoint host: dechonet.com. ARD identifier: urn:air:com.dechonet:mcp:mcp.
First indexed 16 September 2026. The tools are exactly what the server returned; nothing on this page
is inferred from its name. Ranking in Neuronto search is never for sale.