Cognita

できること

このサーバーのやさしい解説はまだ書いていません。以下はレジストリから読み取った事実です。

• 接続方法: クラウドで動く
• トランスポート: Streamable HTTP
• カテゴリ: サイバーセキュリティ

インストール

使っているAIアプリを選んで、設定をコピーしてください。

必要なもの

• クラウドで動くインストール不要。インターネット経由でつながります

どのアプリを使っていますか？

https://cognita.fmelo.net/mcp

claude mcp add --transport http cognita https://cognita.fmelo.net/mcp

{
  "mcpServers": {
    "cognita": {
      "url": "https://cognita.fmelo.net/mcp"
    }
  }
}

{
  "servers": {
    "cognita": {
      "type": "http",
      "url": "https://cognita.fmelo.net/mcp"
    }
  }
}

https://cognita.fmelo.net/mcp

選んだアプリは、この端末のCookieに保存されます。アカウントは不要です。

この設定は、作者のレジストリ登録情報から作成しています。READMEと違う場合は、READMEに従ってください。

できること

ツールの名前と説明は、サーバーが2026年11月7日に返したそのままの内容です。書いたのは作者で、私たちではありません。プレーンテキストとして表示しています。

• asn_prefixes

  List the IP prefixes an autonomous system announces (via RIPEstat), with the network holder — the routed footprint of an ASN. Read-only.

• cve_triage

  Prioritise a host's internet-exposed CVEs: takes the CVEs from host_exposure (Shodan InternetDB) and enriches each with CISA KEV (confirmed exploited in the wild) and FIRST EPSS (exploit probability), then ranks them so the ones to patch first come first — KEV entries, then highe

• typosquat_scan

  Generate lookalike variants of a domain (omission, transposition, homoglyph, adjacent-key, hyphenation and TLD-swap typos) and report which ones actually resolve in DNS — the registered lookalikes worth checking for phishing or brand abuse. DNS-only and read-only; never touches t

• email_header_analyzer

  Parse pasted raw email headers: the Received: delivery path with per-hop delays, the SPF/DKIM/DMARC verdicts, the originating IP, and spoofing warnings. Pure parsing — no network.

• dns_propagation

  Ask several independent public resolvers (Google, Cloudflare, DNS.SB, NextDNS) the same record over DNS-over-HTTPS and compare their answers. Returns each resolver's record set and DNS status, whether they all agree, and a note. Agreement is normal; a divergence flags a change st

• email_posture

  Report a domain's modern email-security records beyond SPF/DMARC/DKIM: MTA-STS (DNS record + fetched policy: enforce/testing mode, max_age, MX), TLS-RPT (reporting address) and BIMI (brand logo + VMC), with warnings on what is missing or weak. Read-only DNS plus one GET of the pu

• ct_org_search

  Find the certificates that name an ORGANISATION in Certificate Transparency (via crt.sh) and the distinct registrable domains on them — a link from a company name to its domain footprint, complementing cert_transparency's per-domain view. Passive OSINT, read-only.

• geo_route

  Show the network path from the caller to a target host on a world map: origin (the caller's IP — the user when the agent runs client-side), destination (the target's geolocation), and the great-circle distance. Returns structured endpoints plus a link to an SVG map (the image its

• tls_posture

  Grade a host's transport security A–F in one call, correlating tls_certificate (validity, chain trust, protocol, key/signature), cert_revocation (OCSP/CRL endpoints, must-staple) and hsts_preload_check (browser HSTS preload). Returns the letter grade, a 0–100 score, and the facto

• feodo_c2_check

  Check an IP against abuse.ch's Feodo Tracker botnet command-and-control blocklist (keyless): a hit means the IP is a known C2 server for a malware family (Emotet, Dridex, QakBot, TrickBot, …), with the malware name, port and first-seen date. For a host name the first resolved IP

• dmarc_check

  Fetch and analyse a domain's DMARC record (_dmarc TXT): the policy (none/quarantine/reject) and warnings on a weak or missing policy. Read-only.

• tranco_rank

  Report a domain's popularity on the Tranco research list (keyless): its rank in the top ~1M sites, a band (top-1k/10k/100k/1M or 'unranked'), and how many recent daily lists it appears in. A cheap context signal — a top-1k domain and an unranked one warrant very different scrutin

• rpki_validation

  Validate the BGP route-origin of an IP or prefix against RPKI (via RIPEstat): valid / invalid / unknown for the announcing ASN and covering prefix. 'invalid' means the origin isn't authorised by a ROA (possible hijack or misconfiguration); 'unknown' means no ROA covers the prefix

• cve_lookup

  Look up a CVE in the NVD (NIST National Vulnerability Database): its description, CVSS base score / severity / vector, CWE weakness IDs, publication dates and references. Turns a bare CVE ID (e.g. one from host_exposure) into meaning. Keyless (NVD is rate-limited without a key),

• spoofability

  Judge how easily a domain's mail can be forged by correlating SPF and DMARC into one verdict: 'hardened' (DMARC enforcing), 'partial' (DMARC quarantine) or 'spoofable' (no DMARC or p=none — receivers won't reject forged mail), with an A–F grade and the concrete reasons. The contr

• subdomain_takeover_check

  Check a domain's subdomains (enumerated from Certificate Transparency) for dangling-CNAME takeover risk: a CNAME that delegates to a third-party service (GitHub Pages, S3, Heroku, Azure, Netlify, …) which no longer claims the name. Status is 'vulnerable' (the service's unclaimed-

• tls_certificate

  Inspect the leaf certificate a host serves on a live TLS handshake: subject, issuer, subject-alternative names, validity window and days to expiry, key and signature algorithms, serial, thumbprint, the negotiated TLS protocol/cipher, and the chain with its trust verdict. Compleme

• dns_lookup

  Resolve DNS records for a host name. Returns A, AAAA, MX, TXT, NS, CNAME and SOA by default; pass 'types' to narrow. Read-only.

• dshield_ip_check

  Look up an IP's reputation in the SANS Internet Storm Center (DShield) data (keyless): how many attack reports it has across how many target sensors over the observed window, the network/AS it belongs to, and which ISC threat feeds list it. A high report count is a scanning/attac

• host_exposure

  Report a host's internet-facing exposure from Shodan's InternetDB (keyless): open ports, detected products (CPEs), known CVEs, hostnames and tags. Passive — reads Shodan's own scan data, never touches the target. For a domain the first resolved IP is used (behind a CDN this refle

• scan_site

  Run a passive web-security scan of a URL (via Astur). Returns an A–F grade, a 0–100 score and findings mapped to OWASP WSTG/ASVS. Non-intrusive — no active probing of the target.

• abuse_contact

  Find the abuse-reporting e-mail(s) for an IP (or a host's resolved IP) via RIPEstat's abuse-contact-finder — where to report a scanner or attacker surfaced by ip_reputation. Read-only.

• kev_check

  Check whether a CVE is in CISA's Known Exploited Vulnerabilities (KEV) catalogue — i.e. confirmed exploited in the wild, the strongest 'patch this now' signal. Returns the vendor/product, when it was added, the remediation due date, and whether it's used in known ransomware campa

• reverse_dns

  Reverse-resolve an IP address to its PTR host name(s). Read-only.

• ip_reputation

  Check an IP against GreyNoise's Community data: whether it is internet background 'noise' (a mass scanner) and, if so, GreyNoise's classification — 'malicious', 'benign' (an identified research scanner such as Shodan, Censys or Modat) or 'unknown' — with its name and when it was

• hsts_preload_check

  Check whether a domain is in the browsers' HSTS preload list (via hstspreload.org's keyless status API): the status (preloaded/pending/unknown), whether it was bulk-imported, and the parent domain it may be covered through. Preloaded domains are forced to HTTPS by browsers from t

• disclosure_contacts

  Consolidate where and how to report a security issue for a domain: the owner's own published channel (security_txt — RFC 9116 Contact, Policy, PGP key) and the network operator's registered abuse mailbox (abuse_contact, RIPEstat). Returns both sets of contacts and a clear yes/no

• rdap

  Look up registration data for a domain or IP via RDAP (the modern JSON successor to WHOIS): handle, name, statuses and lifecycle events, plus the raw record. Read-only.

• tor_exit_check

  Check whether an IP is a current Tor exit node, from the Tor Project's public bulk exit list (keyless). Exit traffic is anonymised, so an IP seen in logs may not be the true origin — a useful context signal. For a host name the first resolved IP is used. Read-only.

• robots_sitemap

  Passively read a site's robots.txt and the sitemap it points to. Returns the disallowed paths (often naming admin/staging areas — a recon signal), any declared crawl-delay, the sitemap URL(s), and — for the one sitemap fetched — whether it is a sitemap index, how many entries it

• passive_dns

  Historical DNS resolutions for a domain or IP from Mnemonic's keyless Passive DNS: the answers a name resolved to over time (or the names that pointed at an IP), each with a first/last-seen window and observation count. Surfaces old/rotated infrastructure a live lookup can't. Rea

• ip_blocklist_check

  Check whether an IP sits inside a netblock on a curated keyless reputation list — Spamhaus DROP/EDROP (networks judged hijacked or bad-actor-controlled) and FireHOL level1 (a conservative aggregate of established abuse lists). Returns each list that matched with the matching CIDR

• epss_score

  Get a CVE's EPSS score (FIRST's Exploit Prediction Scoring System): the probability (0–1) it will be exploited in the next 30 days, and its percentile rank among all CVEs. A forward-looking likelihood that complements kev_check's confirmed exploitation. Keyless, read-only.

• spf_expand

  Fully expand a domain's SPF record: follow every include: and redirect= recursively and count the DNS-lookup mechanisms across the WHOLE tree against the RFC 7208 limit of 10 — the real-world failure spf_check misses, where a nested include quietly pushes the total over 10 and th

• asn_relations

  Report an autonomous system's BGP relationships via RIPEstat (keyless): its upstreams (transit providers), downstreams (customers) and peers, from observed AS paths — the neighbour ASNs ordered by how often the relationship is seen. The connectivity map around the network, comple

• spf_check

  Fetch and analyse a domain's SPF record: the parsed DNS-lookup count (RFC 7208 limit is 10), the 'all' qualifier, and warnings on a missing or permissive policy. Read-only.

• wayback_snapshot

  Report the first and most recent captures of a domain in the Internet Archive's Wayback Machine (keyless CDX), with a link to each snapshot — a site-age / history signal (how far back it is archived), complementing wayback_urls (which lists archived URLs). Read-only.

• cert_revocation

  Report the revocation posture of the certificate a host serves: the OCSP responder(s) and CRL distribution point(s) a client could use to check revocation, and whether the certificate is must-staple (TLS-feature status_request, forcing a stapled OCSP response). Reads these straig

• cert_transparency

  Enumerate a domain's subdomains and certificate-issuance history from public Certificate Transparency logs (crt.sh): the names ever certified under it, issuing CAs, and the issuance span. Reveals names even behind a CDN and never touches the target. CT is historical — for a domai

• related_domains

  Find other registrable domains that share a TLS certificate (a common SAN) with the given domain, from Certificate Transparency (crt.sh) — a passive link to sibling properties run on the same certificates. Read-only.

• zone_transfer_check

  Test whether a domain's authoritative name servers allow a DNS zone transfer (AXFR) — a classic misconfiguration that leaks the entire zone (every hostname it holds) to anyone who asks (RFC 5936: AXFR must be limited to authorised secondaries). Returns a per-name-server verdict —

• urlscan_lookup

  Search urlscan.io's public scan database (keyless) for a domain or IP: recent public scans of the site itself (its own pages, not other sites that merely load something from it) with each page's final URL, resolved IP, hosting country/server/ASN, and links to the scan result and

• mx_lookup

  List a domain's mail exchangers (MX), ordered by preference, with each host's resolved IP addresses. Read-only.

• dkim_lookup

  Fetch a domain's DKIM public-key record for a given selector ( ._domainkey. ). The selector comes from an email's DKIM-Signature s= tag or a known default. Read-only.

• investigate

  Run a full reconnaissance sweep of a domain or URL and return a correlated report: web-security grade (via Astur), email-authentication posture (SPF/DMARC), nameservers, MX, registrar, subdomains from Certificate Transparency logs, the resolved IP's exposure (Shodan InternetDB) a

• wayback_urls

  List a domain's historical URLs captured by the Internet Archive Wayback Machine (CDX API, keyless): old endpoints, forgotten paths and files no longer on the live site, across the domain and its subdomains. Passive OSINT — reads the archive, never the target. Read-only.

• blacklist_check

  Check whether a mail server is listed on common email DNS blocklists (DNSBLs). For a domain, its mail (MX) IPs are checked — what matters for email reputation — falling back to the A record when there is no MX; a literal IP is checked directly. Read-only DNS queries.

• ip_reputation_aggregate

  Fold every keyless IP-reputation source into one verdict — clean / suspicious / malicious / unknown: ip_blocklist_check (Spamhaus DROP + FireHOL), ip_reputation (GreyNoise), feodo_c2_check (botnet C2), tor_exit_check and dshield_ip_check (attack telemetry). Returns the verdict, w

• asn_geoip

  Geolocate an IP address (or a host's resolved IP): ASN, network organisation, and approximate city/country. Requires a configured GeoIP database. Read-only.

• security_txt

  Fetch a site's vulnerability-disclosure file (RFC 9116) from /.well-known/security.txt (falling back to /security.txt): the declared security Contact(s), Expires date and whether it has lapsed, PGP Encryption key, Policy/Acknowledgments links, preferred languages, and whether the

• caa_dnssec

  Report a domain's CAA records (which CAs may issue its certificates) and an indicative DNSSEC signal (DNSKEY presence + Authenticated-Data flag — not a full chain validation). Read-only.

基本チェックi

誰でも見られる情報をチェックしており、コードは読んでいません。当てはまらない項目は数に入れていません。 · 2026年11月8日にチェック

• ! 注意

  作者とリポジトリが一致

  レジストリにソースのリポジトリが載っていないため、公開者（fmelo.net）とコードを照合できません

• … 未チェック

  今もメンテナンスされている

  このリポジトリはまだGitHubから読み取っていません

• … 未チェック

  ライセンスがある

  このリポジトリはまだGitHubから読み取っていません

• ✓ 合格

  エンドポイントが応答する

  748ミリ秒で応答（HTTP 200）

• – 対象外

  OAuthでサインイン

  サインイン不要

• ✓ 合格

  ツールの説明に隠れた指示がない

  51件のツールの説明を読み、AIへの隠れた指示は見つかりませんでした

サイバーセキュリティのほかのサーバーとの比較i

• このカテゴリのほかの995件のうち0%よりスターが多い
• このカテゴリのほかの995件のうち65%より最近レジストリに公開
• 基本チェックの結果が、このカテゴリのほかの995件のうち32%と同じかそれ以上

レジストリでこのカテゴリにある有効なすべてのサーバーと比較しています。スターは、公開者がリポジトリの所有者である場合だけ数えます。

代わりの候補

同じカテゴリで、ほかの作者が作ったサーバー。スターの多い順。

カードの見方：★ GitHubスターi3つの柱：レビュー · チェック · 利用状況i更新＝最新バージョンをレジストリに公開した日i

作者のREADME

リポジトリにREADMEが見つかりません