BlackVeil DNS & Email Security Scanner

Installation

Wähle die KI-App, die du nutzt, und kopiere die Einstellungen.

3/5 Prüfungen bestanden · Was du fragst, läuft über den Server des Anbieters (dns-mcp.blackveilsecurity.com) · ✓ Befehle geprüft am 13. Nov. 2026

claude mcp add --transport http --scope user dns https://dns-mcp.blackveilsecurity.com/mcp

{
  "mcpServers": {
    "dns": {
      "url": "https://dns-mcp.blackveilsecurity.com/mcp"
    }
  }
}

{
  "servers": {
    "dns": {
      "type": "http",
      "url": "https://dns-mcp.blackveilsecurity.com/mcp"
    }
  }
}

Welche Apps ihn nutzen können

Basierend darauf, wie sich dieser Server verbindet, und auf der eigenen Doku jeder App, geprüft am 10. Nov. 2026.

Verbinden sich über das Internet in

ClaudeChatGPTGooseLM StudioMsty StudioCherry StudioCursorVS Code + GitHub CopilotVisual StudioWindsurf (Devin Desktop)ZedKiroClineContinueJetBrains AI AssistantClaude CodeCodex CLIGemini CLIOpenCodenodecodeWarpLibreChatOpen WebUIRaycast

Alle Apps, mit Vor- und Nachteilen →

Was er kann

Tool-Namen und -Beschreibungen genau so, wie der Server sie am 14. Nov. 2026 gemeldet hat. Geschrieben hat sie der Entwickler, nicht wir; wir zeigen sie als reinen Text.

• get_access_context

  Read the effective authentication context for this request: tier, owner-IP-gate disposition, a keyed pseudonymous principal reference, server version and observation time. Performs no target checks or quota/session/cache/job writes. An unavailable result is not anonymous/free fal

• check_mx

  Look up MX records for a domain. Identifies which mail servers receive inbound email for the domain and which email hosting provider is used (Google Workspace, Microsoft 365, Proofpoint, etc.). Use when asked which email provider hosts inbound mail for a domain, or to see MX reco

• check_spf

  Look up and validate the SPF record for a domain. Lists all IP addresses and third-party senders authorised to send email on behalf of the domain, flags syntax errors, and shows the trust surface (which mail servers are whitelisted). Use when you need to know who is permitted to

• check_dmarc

  Look up and validate a domain's DMARC record: enforcement level (none/quarantine/reject), alignment mode, and aggregate/forensic reporting destinations. Use to find a domain's DMARC enforcement, whether it sends aggregate reports, or whether it is protected against email imperson

• check_dkim

  Look up DKIM records for a domain. Probes common selectors, validates the signing algorithm used for outgoing email (RSA-1024/2048, Ed25519), and reports key strength. Use to verify that outbound email signatures are cryptographically sound. Part of the scan_domain audit.

• check_dnssec

  Check DNSSEC status for a domain. Verifies whether DNS is tamper-proof and protected against cache poisoning and DNS spoofing attacks by validating DNSKEY and DS records. Reports whether DNSSEC is enabled and validating. Part of the scan_domain audit.

• check_ssl

  Check HTTPS/TLS posture: reachability, HSTS, HTTP-to-HTTPS redirect, and certificate issuer, expiry, days remaining and SAN count from public CT logs (the latest LOGGED certificate, which may differ from the one served). TLS protocol versions and cipher suites are not assessed. U

• check_mta_sts

  Check whether a domain enforces SMTP TLS for inbound mail via MTA-STS, protecting against downgrade attacks. Queries _mta-sts. and fetches the policy file, reports mode (enforce/testing/none) and MX coverage. Use to verify whether inbound SMTP is protected against TLS downgrade o

• check_ns

  Audit a domain’s nameserver delegation and redundancy. Identifies the DNS hosting provider and, when the infrastructure probe is available, directly compares parent and child NS sets, verifies authoritative AA responses, and checks required glue addresses. Use to detect stale reg

• check_caa

  Look up CAA records for a domain. Shows which Certificate Authorities are authorized to issue certificates. Part of the scan_domain audit.

• check_bimi

  Check the BIMI record at default._bimi. : validates the logo URL (l=), the presence of mark-certificate authority evidence (a=; a bare URL, so VMC vs CMC is not determined), and the DMARC enforcement prerequisite (p=quarantine/reject) mail clients require. Use to assess brand-log

• check_tlsrpt

  Check whether a domain has SMTP TLS Reporting (TLS-RPT) configured. Queries _smtp._tls. for the v=TLSRPTv1 record and validates its reporting destination (rua= mailto:/https:), flagging a missing record, duplicate records, or an invalid/absent reporting URI. Complements MTA-STS b

• check_http_security

  Audit browser-facing HTTP security headers over HTTPS: Content-Security-Policy (unsafe-inline/unsafe-eval/wildcards), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and COOP/COEP/CORP; also detects CDN/WAF interception. Returns per-header findings fo

• check_dane

  Check DANE/TLSA pinning for SMTP: looks up TLSA records at _25._tcp. for each MX and validates their fields and DNSSEC backing. Records are reported present but UNVERIFIED: there is no port-25 certificate probe, so a pin is never compared to the certificate actually served. Use f

• check_ptr

  Verify forward-confirmed reverse DNS (PTR/FCrDNS) for mail servers. Part of the scan_domain audit.

• check_dane_https

  Verify DANE/TLSA pinning for HTTPS (port 443): looks up TLSA records at _443._tcp. and validates fields and DNSSEC backing. Reported present but UNVERIFIED in every deployment: comparison with the served certificate is withdrawn (the probe cannot observe the origin certificate),

• check_svcb_https

  Validate HTTPS/SVCB records (RFC 9460) for modern transport capability advertisement. Part of the scan_domain audit.

• check_lookalikes

  Detect active typosquat and lookalike/homoglyph domains that impersonate your brand and could be used in phishing. Identifies character-substitution and visual-confusion domains registered by attackers. Distinct from check_shadow_domains (TLD variants with auth gaps) and discover

• check_subdomailing

  Detect SubdoMailing risk: analyzes the SPF include chain for dangling or hijackable subdomains that could let an attacker send email as the domain. Use when you want to know if an SPF include chain can be hijacked through a dangling domain, or to detect subdomain mailing risk hid

• scan_domain

  Run a full DNS and email security audit for one domain across every scan-included check (SPF, DKIM, DMARC, DNSSEC and more); returns an overall score, NIST-aligned letter grade (A+ to F), maturity stage and prioritized findings. Use for a comprehensive audit, overall grade or ema

• batch_scan

  Bulk-scan up to 10 domains in parallel with a full security audit each; returns score, NIST-aligned letter grade (A+ to F) and finding counts per domain. Use to audit several domains at once; use compare_domains for a side-by-side comparison of 2-5 domains. scoringModelVersion (p

• batch_scan_start

  Start a durable asynchronous scan of 1–10 domains. Returns a stable job ID; replaying the same idempotency key with the same principal, normalized inputs, and scoring versions returns the same job.

• batch_scan_status

  Read the owner-scoped status of an asynchronous batch scan.

• batch_scan_findings

  Fetch owner-scoped findings for a completed asynchronous batch scan.

• compare_domains

  Side-by-side security comparison of 2–5 domains. Shows relative scores, category gaps, and unique weaknesses for each domain. Use when comparing your security posture against a competitor, or doing a head-to-head comparison between multiple domains.

• compare_baseline

  Compare a domain's current security configuration against a fixed policy baseline to determine compliance. Use to check whether a domain meets a policy requirement — not for tracking improvement/regression over time (use analyze_drift) and not for comparing multiple domains (use

• check_shadow_domains

  Find alternate TLD variants of a domain (e.g. example.net, example.co) that have weak or missing email authentication and could be used to spoof email. Use when asked about TLD variants with email auth gaps — distinct from check_lookalikes which detects typosquat/homoglyph impers

• check_txt_hygiene

  Audit TXT records for stale entries and SaaS exposure.

• check_mx_reputation

  Check whether the mail server (MX) IP addresses are listed on spam blocklists (Spamhaus, Barracuda, SORBS, and other RBLs). Also verifies reverse DNS for MX hosts. Use when you want to know if your mail server IP is blacklisted, or if your MX is on any blocklist — distinct from c

• check_srv

  Map a domain's DNS-visible service footprint by probing 19 common SRV prefixes (email, calendar, messaging, directory, web) in parallel; returns discovered services and flags insecure advertisements such as plaintext IMAP/POP3/LDAP with no encrypted variant. No match among probed

• check_zone_hygiene

  Audit DNS zone hygiene: identifies sensitive or forgotten subdomains exposed in DNS, stale SOA records, and zone propagation issues. Use to find any sensitive subdomains that should not be publicly visible, or to audit overall DNS zone cleanliness.

• generate

  Generate a DNS/email security remediation artifact. Artifact types: spf_record (build a new SPF record), dmarc_record (create a DMARC policy), dkim_config (DKIM key setup), mta_sts_policy (generate an MTA-STS policy file), fix_plan (prioritized remediation plan for all findings),

• get_domain_rank

  Rank a domain against its country or global cohort using the GSI benchmark corpus. Accepts a domain score (from scan_domain) and optional country/sector; returns a percentile: "scores better than X% of peers". Owner-gate exempt — public cohort data only.

• get_benchmark

  Get industry benchmark data: shows what percentile a domain's security score ranks at within its sector or country cohort, the mean score, and the most common DNS security failures across the industry. Use when asked how a score compares to the industry average, what percentile a

• get_provider_insights

  Get security benchmarks and common configuration issues for a specific email or DNS service-provider cohort (e.g. Google Workspace customers, Microsoft 365 customers). Use when asked how an email service provider compares to competitors on security posture, or to see typical misc

• assess_spoofability

  Compute a composite email spoofability risk score (0-100, higher = more spoofable) from SPF trust surface, DMARC enforcement and DKIM coverage. Returns a risk level (minimal to critical), per-control sub-scores and a plain-language summary. Use when asked how easy it is to spoof

• check_resolver_consistency

  Check DNS consistency across 4 public resolvers.

• explain_finding

  Explain a finding with impact and remediation.

• map_supply_chain

  Map DNS-visible third-party service dependencies for a domain. Correlates SPF, NS, TXT verifications, SRV services, and CAA records to reveal which third-party vendors can send email as the domain, control DNS, or access integrated services. Use when asked to map third-party or s

• analyze_drift

  Measure whether a domain's DNS security posture improved or regressed versus a prior scan snapshot; returns a drift classification (improving/stable/regressing/mixed), score delta, and lists of improvements and regressions. Use for "did our score improve or regress since last tim

• validate_fix

  Re-check a specific security control after applying a fix, to confirm the finding is now resolved. Use only when a fix has already been applied and you want to verify or confirm the remediation was successful — not for initial inspection of a record.

• resolve_spf_chain

  Trace the full SPF include chain for a domain. Recursively resolves all includes, shows lookup count, tree depth, and flags circular includes or exceeding the 10-lookup limit.

• discover_subdomains

  Find subdomains via Certificate Transparency logs to reveal shadow IT and forgotten services. Returns a CT SAMPLE, not an asset inventory: counts are a lower bound, hosts without a logged certificate never appear, and a per-source `coverage` record states what was consulted. `cou

• map_compliance

  Map scan findings to compliance frameworks: NIST 800-177, PCI DSS 4.0, SOC 2, CIS Controls. Shows pass/fail/partial status per control.

• sge_quickscan

  Check whether ONE domain meets the New Zealand Secure Government Email (SGE) requirements due October 2026. Reports seven controls (DMARC p=reject, SPF -all, DKIM, SMTP transport TLS, MTA-STS enforce, TLS-RPT, sub-domain coverage) as satisfied, not satisfied or NOT MEASURED, with

• prioritize_portfolio_leads

  Rank a brand’s portfolio (or an explicit domain set) into prioritized registrar-partner sales leads by product-gap value × severity. Multi-domain, paid. Reuses map_registrar_products per domain, then ranks. Distinct from map_registrar_products (per-domain product mapping) and bat

• simulate_attack_paths

  Analyze current DNS posture and enumerate specific attack paths an adversary could exploit, with severity, feasibility, steps, and mitigations.

• check_dbl

  Check domain reputation against DNS-based Domain Block Lists (Spamhaus DBL, URIBL, SURBL). Returns listing status with decoded return codes.

• check_rbl

  Check MX server IP reputation against 6 DNS-based Real-time Blocklists (SpamCop, UCEProtect, Mailspike, Barracuda, PSBL). Resolves MX hosts to IPs first.

• cymru_asn

  Map domain IPs to Autonomous System Numbers via Team Cymru DNS. Returns ASN, prefix, country, registry, and organization for each IP. Flags high-risk hosting ASNs.

• rdap_lookup

  Fetch domain registration data via RDAP (modern WHOIS replacement). Returns the domain registrar (the company the domain was registered with), registrant contact, creation/expiration dates, EPP status codes, and domain age. Use when asked who registered the domain, who the regist

• check_realtime_threat_feed

  Check a domain against BlackVeil real-time threat intelligence (curated intel-gateway feed). Distinct from DNSBL checks. Operator-deploy only; degrades to info when unprovisioned.

• check_nsec_walkability

  Assess zone walkability risk by analyzing NSEC3PARAM configuration. Detects plain NSEC zones, weak NSEC3 parameters, and opt-out flags.

• check_dnssec_chain

  Walk the full DNSSEC chain of trust from the DNS root down to the target domain, tracing DS/DNSKEY records and algorithm usage at each zone level. Use when asked to trace the chain of trust from the DNS root, or to see the full DNSSEC delegation path step by step.

• check_agent_discovery

  Assess IETF BANDAID agent-discovery DNS records: finds SVCB agent records under _agents, reports whether the discovery zone is DNSSEC-anchored (unsigned means spoofable endpoints), evaluates DANE/TLSA binding trust and checks capability-document integrity (cap / cap-sha256). Read

• check_llms_txt

  Inspect a domain's /llms.txt and /llms-full.txt for links and install commands an AI agent could inherit. Sweeps external link hosts for dangling CNAMEs and deprovisioned-service fingerprints (evidence, not proof it is claimable) and checks npm/PyPI install package names for unre

• check_dnskey_strength

  Audit DNSKEY signing algorithms used for DNSSEC: reports the algorithm in use (RSA/SHA-1, RSA/SHA-256, ECDSA P-256, Ed25519, etc.) and flags deprecated ones (RSA/SHA-1, DSA), independent of whether the chain validates. Use when asked which algorithm signs DNSSEC keys or if deprec

• check_fast_flux

  Detect fast-flux DNS behavior: performs multiple rounds of A/AAAA queries and checks whether IP addresses are rotating rapidly on each DNS query (a sign of botnet or malicious infrastructure). Compares IP answer sets and TTLs across rounds to identify rapidly rotating infrastruct

• check_subdomain_takeover

  Sweep subdomains for dangling CNAMEs pointing at deprovisioned cloud services an attacker could claim (subdomain takeover); detects 16 provider families such as AWS S3/CloudFront, Azure, GCP Storage, Heroku, GitHub Pages, Vercel and Firebase. Use when asked if subdomains point to

• check_authoritative_dns_infra

  Measure a hostname's authoritative DNS posture by querying its nameservers directly over TCP/53 from one vantage: reachability, AA flag, recursion exposure, SOA serial consistency, DNSKEY/RRSIG presence (not validation), IPv4/IPv6 parity. Authenticated callers also get a zone-tra

Basischecksi

Wir prüfen Informationen, die jeder sehen kann; den Code haben wir nicht gelesen. Checks, die nicht zutreffen, werden nicht mitgezählt. · Geprüft am 15. Nov. 2026

• ! Vorsicht

  Entwickler passt zum Repo

  Der Herausgeber (blackveilsecurity.com) ist nicht der Repo-Inhaber (MadaBurns); vielleicht hat jemand anderes ihn eingetragen

• ✓ Bestanden

  Wird noch gepflegt

  Code zuletzt geändert: gestern

• ! Vorsicht

  Hat eine Lizenz

  GitHub konnte die Lizenzart nicht erkennen; öffne die Datei, um nachzusehen

• ✓ Bestanden

  Endpunkt antwortet

  Antwort in 1242 ms (HTTP 200)

• – Nicht zutreffend

  Anmeldung mit OAuth

  Keine Anmeldung nötig

• ✓ Bestanden

  Keine versteckten Anweisungen in Tool-Beschreibungen

  Wir haben 60 Tool-Beschreibungen gelesen und keine versteckten Anweisungen an die KI gefunden

Nutzerbewertungen

Noch keine Bewertungen

Mit Google anmelden, um zu bewerten

Im Vergleich mit anderen in Cybersicherheiti

• Mehr Sterne als 0 % der anderen 1061 Server in dieser Kategorie
• Neuer in der Registry veröffentlicht als 96 % der anderen 1061 Server in dieser Kategorie
• Basischecks gleich gut wie oder besser als bei 16 % der anderen 1061 Server in dieser Kategorie

Verglichen mit allen aktiven Servern dieser Kategorie in der Registry. Sterne zählen nur, wenn dem Herausgeber das Repo gehört.

Andere in derselben Kategorie

Server derselben Kategorie von anderen Entwicklern, sortiert nach Sternen.

So liest du eine Karte:↓ Downloads pro Wochei★ GitHub-SterneiDrei Säulen: Bewertungen · Checks · NutzungiAktualisiert = neueste Version in der Registry veröffentlichti

Robin: AI-Powered Dark Web OSINT

Dark web OSINT over Tor: search onion engines, scrape pages, report with your own model.

von apurvsinghgautam·Wachsend·★ 7984·Aktualisiert vor 43 Tagen

Läuft auf deinem Computer

Installieren

HOL Guard

Local-first AI agent security evidence and approval workflows through HOL Guard's stdio MCP server.

von hashgraph-online·Weit verbreitet·↓ 7083/Wo.·★ 1102·Aktualisiert vor 10 Tagen

Läuft auf deinem Computer

Installieren

SonarQube MCP Server

Analyze code quality and security with SonarQube Server or Cloud directly in AI assistants.

von SonarSource·Wachsend·★ 686·Aktualisiert vor 4 Tagen

Läuft auf deinem Computer

Installieren

README vom Entwickler

claude mcp add --transport http blackveil-dns https://dns-mcp.blackveilsecurity.com/mcp

smithery mcp add MadaBurns/bv-mcp

curl https://dns-mcp.blackveilsecurity.com/health

Endpoint   https://dns-mcp.blackveilsecurity.com/mcp

  82 MCP tools · 7 prompts · 6 resources