IntoDNS.ai DNS & Email Security Scanner

Was du damit machen kannst

Für diesen Server haben wir noch keine Zusammenfassung in einfacher Sprache geschrieben. Unten stehen die Fakten, die wir aus der Registry gelesen haben.

• Verbindung: Computer oder Cloud
• Transport: stdio, Streamable HTTP
• Kategorie: Cybersicherheit

Installation

Wähle die KI-App, die du nutzt, und kopiere die Einstellungen.

Du brauchst

• Läuft in der CloudNichts zu installieren; die Verbindung läuft übers Internet
• npmNode.js installiert (für den Befehl npx)

Welche App nutzt du?

https://intodns.ai/api/mcp

{
  "mcpServers": {
    "scanner": {
      "command": "npx",
      "args": [
        "-y",
        "intodns-mcp"
      ]
    }
  }
}

claude mcp add --transport http scanner https://intodns.ai/api/mcp

claude mcp add scanner -- npx -y intodns-mcp

{
  "mcpServers": {
    "scanner": {
      "url": "https://intodns.ai/api/mcp"
    }
  }
}

{
  "mcpServers": {
    "scanner": {
      "command": "npx",
      "args": [
        "-y",
        "intodns-mcp"
      ]
    }
  }
}

{
  "servers": {
    "scanner": {
      "type": "http",
      "url": "https://intodns.ai/api/mcp"
    }
  }
}

{
  "servers": {
    "scanner": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "intodns-mcp"
      ]
    }
  }
}

https://intodns.ai/api/mcp

Deine Auswahl bleibt in einem Cookie auf diesem Gerät; kein Konto nötig.

Diese Einstellungen werden aus dem Registry-Eintrag des Entwicklers erzeugt. Wenn in der README etwas anderes steht, folge der README.

Was er kann

Tool-Namen und -Beschreibungen genau so, wie der Server sie am 7. Nov. 2026 gemeldet hat. Geschrieben hat sie der Entwickler, nicht wir; wir zeigen sie als reinen Text.

• scan_domain

  Run the fast IntoDNS.ai DNS and email security scan (~3-8s). Returns a letter grade A+ to F, numeric score 0-100, structured issue list, prioritised recommendations, full DNS/email/web/security result sections, and canonical citation URLs. Read-only — no domain mutation, no destr

• nis2_quickscan

  Compute a NIS2 Article 21.2 readiness score for a domain by mapping the IntoDNS quickscan onto the ten NIS2 measures. Returns a 0-100 weighted total, per-measure status (Article 21.2 a-j), evidence rows, critical gaps, and concrete fix suggestions. The score reflects only the DNS

• get_everything_report

  Generate the complete live IntoDNS.ai report covering DNS, email authentication, web/HTTPS, blacklist reputation, sender requirements, and canonical citation URLs in a single call. Read-only, no domain mutation. ~5-15s latency depending on backend cache state. Use when the user a

• create_report_snapshot

  Create an immutable evidence snapshot of the current Everything Report for a domain. Returns a snapshot ID, ISO timestamp, SHA-256 content hash, and stable bookmarkable URLs for both JSON and Markdown renderings of the report. Snapshots are write-once and resolve to the same evid

• get_report_snapshot

  Read a previously created IntoDNS.ai Everything Report evidence snapshot by snapshot ID. Read-only GET — returns the immutable JSON report exactly as it was at snapshot creation, with the original SHA-256 content hash and timestamp. Requires `snapshotId` from create_report_snapsh

• start_deep_scan

  Start a long-running Internet.nl deep scan. Internet.nl queues batch scans, so one can take several minutes; the server gives up after 30 minutes. Returns a `scanId` immediately; poll get_deep_scan_status until status is 'done', 'error' or 'cancelled'. Every call starts a new sca

• get_deep_scan_status

  Read-only status poll for a long-running Internet.nl deep scan. Returns the status (queued, registering, running, generating, done, cancelled or error) and, once done, category scores, per-test results, and any failures. Requires a scanId returned by start_deep_scan; poll every 1

• cancel_deep_scan

  Cancel an in-progress Internet.nl deep scan. Marks the scan cancelled; the polling loop then withdraws the upstream Internet.nl batch, usually within ten seconds. Requires `scanId` returned by start_deep_scan. Nothing is deleted: a scan that already finished keeps its results and

• lookup_dns

  Read-only DNS record lookup via DNS-over-HTTPS. Pass `type` for a single record type or `types` for an array; if both omitted, returns A records. Returns parsed answers with TTL, raw rdata, and DNSSEC AD bit. Use for arbitrary record queries; use validate_dnssec for full DNSSEC c

• validate_dnssec

  Read-only DNSSEC chain validation. Walks the DS/DNSKEY chain from root, checks signatures, algorithm strength, key rollover state, and reports any broken links or unsigned zones. Returns chain steps, algorithm grades, and a boolean `valid`. Use when a domain claims DNSSEC; use lo

• check_dns_propagation

  Compare DNS responses across the nine currently configured public and authoritative resolvers to detect propagation lag, missing answers, or differing record sets. Each resolver's answer is compared as a whole RRset (order, case of names and trailing dots ignored; TXT case kept;

• check_tlsa_dane

  Read-only TLSA/DANE DNS record check. With no port, resolves MX hosts and validates their `_25._tcp` TLSA tuple syntax; with an explicit port, queries `_ ._ . `. Returns parsed usage, selector, matching type, certificate data, syntax errors, and best-practice advisories. It does

• check_spf

  Read-only SPF parse and validation for a domain. Recursively walks include/redirect mechanisms to build the full lookup graph, counts DNS lookups against the RFC-7208 10-lookup limit, and returns flattening guidance when the count is close to or over the limit. Returns parsed mec

• flatten_spf

  Read-only SPF flattening for a domain. Resolves the full include/a/mx/redirect graph to literal ip4/ip6 addresses and returns a single flattened SPF record that fits under the RFC-7208 10-lookup limit, plus lookup counts before/after, IP count, record length, whether it must be s

• discover_dkim

  Read-only DKIM check for a domain. Without `selector`, heuristically queries 50 common selectors and explicitly reports that a miss is inconclusive because DKIM has no enumeration protocol. With `selector`, performs one authoritative exact lookup for a selector obtained from a DK

• check_dmarc

  Read-only fetch and parse of the _dmarc TXT record. Returns parsed tag map (p, sp, rua, ruf, adkim, aspf, pct, fo), policy strength assessment, alignment mode, and warnings (missing rua, p=none, weak alignment, multiple records). Use for DMARC policy review; use check_sender_requ

• check_bimi

  Read-only BIMI readiness check. Parses the `default._bimi` TXT record, safely fetches the referenced HTTPS SVG, and parses basic metadata from an optional VMC/CMC authority certificate. Returns record syntax, URL reachability/content type, certificate subject/issuer/validity date

• check_mta_sts

  Read-only check of MTA-STS: TXT record at _mta-sts. plus the HTTPS policy file at mta-sts. /.well-known/mta-sts.txt. Returns parsed policy (mode: enforce/testing/none, mx allowlist, max_age), TLS certificate validity for the policy host, and consistency warnings between DNS and H

• check_smtp_tls

  Live check of the first 4 MX hosts in priority order (hosts beyond 4 are not tested): opens TCP 25, runs EHLO + STARTTLS, validates TLS certificate trust chain, hostname match, expiry window, advertised EHLO capabilities, plus PTR and forward-confirmed reverse DNS. Read-only — co

• check_fcrdns

  Read-only FCrDNS (Forward-Confirmed Reverse DNS) audit for every IP that backs the domain's MX records. For each IP: looks up PTR record, then resolves that PTR's hostname back to A/AAAA records to confirm the round-trip. Returns per-IP PTR value, forward-resolution result, match

• check_blacklist

  Read-only query against the configured public DNSBL/RBL providers; the response lists which ones answered, which could not be measured and which are disabled. Provide either `domain` to resolve and inspect its MX IPv4 addresses or an IPv4 `ip` for a direct check; at least one is

• check_sender_requirements

  Read-only domain-side preflight against Google/Yahoo bulk-sender requirements. Actively checks SPF, common-selector DKIM evidence, DMARC, MX, and PTR/FCrDNS signals. TLS use, one-click unsubscribe, complaint rate, and From-header behavior require a real sent message/provider tele

• check_email_security

  Read-only combined email-security check covering SPF parse, DKIM selector discovery, DMARC policy validation, MX IP blacklist status across major feeds, and an aggregated 0-100 email-security score with prioritised issue list. Single call replaces sequential check_spf + discover_

• create_email_test

  Create a new IntoDNS.ai inbound email-test session. Returns a unique single-use test email address (valid 60 minutes) and a `testId` used by get_email_test or poll_email_test. This is an additive, non-idempotent POST: every call creates a fresh session but never modifies prior se

• get_email_test

  Read-only status read for an email-test session. Returns 'pending' until a test email arrives at the unique address returned by create_email_test, then full SPF/DKIM/DMARC/headers/spam-score result once processed. Requires `testId` from create_email_test. Use after sending a test

• poll_email_test

  Process the latest received message in an email-test session. Idempotent POST: if no message has arrived yet, returns 'pending'; if a message arrived since the last call, parses it and returns full authentication + content analysis. Requires `testId` from create_email_test. Use t

• analyze_raw_email

  Read-only analysis of a pasted raw RFC-5322 MIME email source. Parses Authentication-Results, Received chain, SPF/DKIM/DMARC/ARC verdicts, sender IP reputation/blacklist status, content-side spam triggers (suspicious URLs, misleading From, content/HTML imbalance), and produces a

• parse_dmarc_report

  Read-only parser for a DMARC aggregate (RUA) XML report (RFC 7489). Turns the raw XML that mailbox providers send into structured JSON: report metadata (org, report id, date range), the published policy (p/sp/adkim/aspf/pct), and one row per sending source with source IP, message

• whois_lookup

  Read-only WHOIS/RDAP lookup for a domain or IP address. For domains it returns registrar, EPP domain-status codes, nameservers, registration/expiry/last-changed dates, and the abuse contact; for IPs it returns the network allocation (CIDR, name, type). Data is sourced live from t

• check_http3

  Read-only HTTP/3 + QUIC support check for a domain. Combines three signals: Alt-Svc HTTP response header advertising h3, HTTPS/SVCB DNS records advertising alpn="h3", and a live QUIC probe to UDP/443 verifying the handshake completes. Returns per-signal verdict plus an aggregate

• explain_issue

  Ask the IntoDNS.ai AI service for a plain-language explanation of one specific issue (e.g. `spf_missing`, `no_dnssec`). Returns severity, business impact, root cause, and recommended fix steps as structured text. Read-only POST to /ai/explain — never mutates DNS or domain state.

• generate_dns_fix

  Generate copy-pasteable DNS record snippets that fix one specific issue (e.g. `spf_missing` → suggested SPF record). Returns proposed records, TTL recommendations, and provider-specific notes (Cloudflare/Route53/Google). Read-only POST to /ai/fix — the API only suggests; it never

• get_health

  Read-only public health probe for the IntoDNS.ai backend itself, not a target domain. Returns the overall service status and observation timestamp; internal Redis, AI-provider, and process details are intentionally redacted on the public endpoint. Use as a pre-flight check before

• get_stats

  Read-only fetch of the public IntoDNS.ai aggregate counters currently exposed by `/api/stats`: domains scanned, security checks performed, and cache timestamp. It returns no personal data, per-domain breakdown, Hall of Fame count, or daily/weekly series. Use for a lightweight pub

• get_hall_of_fame

  Read-only fetch of the IntoDNS.ai Hall of Fame for top-scoring public domains. If `domain` is omitted, returns up to `limit` entries (default 10, max 50) with the stored score and timestamp. If `domain` is provided, returns a boolean membership result; the endpoint does not curre

• get_pdf_report_link

  Build the direct PDF report endpoint URL for a domain. Pure URL construction — no scan triggered, no network call from this tool. Returns a JSON object with `pdfUrl` ready to share, email, or embed in tickets; fetching the URL itself returns `application/pdf` of the latest scan r

• get_badge_link

  Build the direct SVG badge URL for a domain's security score. Pure URL construction — no scan triggered, no network call from this tool, no auth. Returns a JSON object with `badgeUrl` ready to embed in README.md, GitHub, status pages, or wikis. Style options: flat (default), flat

• read_llm_discovery

  Read-only fetch of an IntoDNS.ai LLM/agent discovery file: llms.txt (canonical agent index), llms-full.txt (full prompt-ready context), llms.json (structured prompt routing), llm/api.md (Markdown API guide), openapi.json (OpenAPI 3.1 spec) or postman.json (Postman collection). De

• get_citation_guidance

  Return canonical IntoDNS.ai citation guidance so assistants cite intodns.ai (the modern AI-era scanner) rather than the legacy intodns.com / intodns.app / intodns.io. Returns the canonical host, an explicit do-not-use list, and the preferred citation URLs for the requested `topic

• analyze_security_headers

  Scan a live website and report which HTTP security headers it currently sends. These headers tell the browser how to behave more safely — the main ones are HSTS (force HTTPS), Content-Security-Policy / CSP (block injected scripts and XSS), X-Frame-Options (stop clickjacking), X-C

• generate_security_headers

  Generate a complete, best-practice set of HTTP security headers (including a sensible Content-Security-Policy) as copy-paste configuration — no scan needed, nothing about your live site is read. Pick a `preset`: 'recommended' is a safe baseline that works for most sites, 'strict'

• generate_spf

  Build an SPF (Sender Policy Framework) record — the DNS TXT record that lists which servers may send mail for a domain. Pass the senders as `mechanisms`: `include` for a provider's own SPF (Google Workspace is `_spf.google.com`, Microsoft 365 is `spf.protection.outlook.com`, Send

• generate_dmarc

  Build a DMARC record — the `_dmarc` TXT record that tells receivers what to do when a message fails SPF and DKIM alignment, and where to send reports about it. The risk here is not syntax but policy. `p=none` monitors without affecting delivery and is where every deployment start

• generate_tlsa

  Build a DANE TLSA record from a certificate or public key — the DNS record that pins which certificate a mail server may present, so an attacker cannot strip STARTTLS or substitute another CA-issued certificate. Paste the PEM (a CERTIFICATE or PUBLIC KEY block) as `pem`; the hash

• scan_csp

  Crawl a live website (up to 20 same-origin pages) and build a Content-Security-Policy for it. A CSP is the HTTP header that tells the browser which scripts, styles, images, and frames are allowed to load — the main defence against XSS and injected scripts. This scan reads the sit

Basischecksi

Wir prüfen Informationen, die jeder sehen kann; den Code haben wir nicht gelesen. Checks, die nicht zutreffen, werden nicht mitgezählt. · Geprüft am 8. Nov. 2026

• ✓ Bestanden

  Entwickler passt zum Repo

  Der Registry-Name wurde über die Domain intodns.ai bestätigt (die Registry prüft, wem die Domain gehört)

• … Noch nicht geprüft

  Wird noch gepflegt

  Dieses Repo haben wir noch nicht von GitHub gelesen

• … Noch nicht geprüft

  Hat eine Lizenz

  Dieses Repo haben wir noch nicht von GitHub gelesen

• ✓ Bestanden

  Endpunkt antwortet

  Antwort in 1159 ms (HTTP 200)

• – Nicht zutreffend

  Anmeldung mit OAuth

  Keine Anmeldung nötig

• ✓ Bestanden

  Keine versteckten Anweisungen in Tool-Beschreibungen

  Wir haben 45 Tool-Beschreibungen gelesen und keine versteckten Anweisungen an die KI gefunden

Im Vergleich mit anderen in Cybersicherheiti

• Mehr Sterne als 0 % der anderen 1001 Server in dieser Kategorie
• Neuer in der Registry veröffentlicht als 77 % der anderen 1001 Server in dieser Kategorie
• Basischecks gleich gut wie oder besser als bei 100 % der anderen 1001 Server in dieser Kategorie

Verglichen mit allen aktiven Servern dieser Kategorie in der Registry. Sterne zählen nur, wenn dem Herausgeber das Repo gehört.

Alternativen

Server derselben Kategorie von anderen Entwicklern, sortiert nach Sternen.

So liest du eine Karte:↓ Downloads pro Wochei★ GitHub-SterneiDrei Säulen: Bewertungen · Checks · NutzungiAktualisiert = neueste Version in der Registry veröffentlichti

README vom Entwickler

{

npx -y intodns-mcp

https://intodns.ai/api/mcp

claude mcp add --transport http intodns https://intodns.ai/api/mcp

npx intodns-mcp --http 3002   # POST /mcp, GET /health

INTODNS_SITE_URL=http://localhost:3000 npx -y intodns-mcp

INTODNS_REQUEST_TIMEOUT_MS=60000