Cognita

它能帮你做什么

我们还没有为它写通俗的介绍。下面是我们从注册中心读取到的事实。

• 连接方式: 在云端运行
• 传输方式: Streamable HTTP
• 分类: 网络安全

安装

选择你使用的 AI 应用，然后复制设置。

你需要

• 在云端运行无需安装任何东西，通过互联网连接

你用的是哪个应用？

https://cognita.fmelo.net/mcp

claude mcp add --transport http cognita https://cognita.fmelo.net/mcp

{
  "mcpServers": {
    "cognita": {
      "url": "https://cognita.fmelo.net/mcp"
    }
  }
}

{
  "servers": {
    "cognita": {
      "type": "http",
      "url": "https://cognita.fmelo.net/mcp"
    }
  }
}

https://cognita.fmelo.net/mcp

你的选择通过 Cookie 保存在这台设备上，无需账户。

这些设置是根据作者在注册中心的条目生成的。如果 README 的写法不同，请以 README 为准。

它能做什么

工具名称和描述与服务器在 2026年11月7日 报告的完全一致。这些内容由作者撰写，不是我们写的；我们以纯文本形式显示。

• asn_prefixes

  List the IP prefixes an autonomous system announces (via RIPEstat), with the network holder — the routed footprint of an ASN. Read-only.

• cve_triage

  Prioritise a host's internet-exposed CVEs: takes the CVEs from host_exposure (Shodan InternetDB) and enriches each with CISA KEV (confirmed exploited in the wild) and FIRST EPSS (exploit probability), then ranks them so the ones to patch first come first — KEV entries, then highe

• typosquat_scan

  Generate lookalike variants of a domain (omission, transposition, homoglyph, adjacent-key, hyphenation and TLD-swap typos) and report which ones actually resolve in DNS — the registered lookalikes worth checking for phishing or brand abuse. DNS-only and read-only; never touches t

• email_header_analyzer

  Parse pasted raw email headers: the Received: delivery path with per-hop delays, the SPF/DKIM/DMARC verdicts, the originating IP, and spoofing warnings. Pure parsing — no network.

• dns_propagation

  Ask several independent public resolvers (Google, Cloudflare, DNS.SB, NextDNS) the same record over DNS-over-HTTPS and compare their answers. Returns each resolver's record set and DNS status, whether they all agree, and a note. Agreement is normal; a divergence flags a change st

• email_posture

  Report a domain's modern email-security records beyond SPF/DMARC/DKIM: MTA-STS (DNS record + fetched policy: enforce/testing mode, max_age, MX), TLS-RPT (reporting address) and BIMI (brand logo + VMC), with warnings on what is missing or weak. Read-only DNS plus one GET of the pu

• ct_org_search

  Find the certificates that name an ORGANISATION in Certificate Transparency (via crt.sh) and the distinct registrable domains on them — a link from a company name to its domain footprint, complementing cert_transparency's per-domain view. Passive OSINT, read-only.

• geo_route

  Show the network path from the caller to a target host on a world map: origin (the caller's IP — the user when the agent runs client-side), destination (the target's geolocation), and the great-circle distance. Returns structured endpoints plus a link to an SVG map (the image its

• tls_posture

  Grade a host's transport security A–F in one call, correlating tls_certificate (validity, chain trust, protocol, key/signature), cert_revocation (OCSP/CRL endpoints, must-staple) and hsts_preload_check (browser HSTS preload). Returns the letter grade, a 0–100 score, and the facto

• feodo_c2_check

  Check an IP against abuse.ch's Feodo Tracker botnet command-and-control blocklist (keyless): a hit means the IP is a known C2 server for a malware family (Emotet, Dridex, QakBot, TrickBot, …), with the malware name, port and first-seen date. For a host name the first resolved IP

• dmarc_check

  Fetch and analyse a domain's DMARC record (_dmarc TXT): the policy (none/quarantine/reject) and warnings on a weak or missing policy. Read-only.

• tranco_rank

  Report a domain's popularity on the Tranco research list (keyless): its rank in the top ~1M sites, a band (top-1k/10k/100k/1M or 'unranked'), and how many recent daily lists it appears in. A cheap context signal — a top-1k domain and an unranked one warrant very different scrutin

• rpki_validation

  Validate the BGP route-origin of an IP or prefix against RPKI (via RIPEstat): valid / invalid / unknown for the announcing ASN and covering prefix. 'invalid' means the origin isn't authorised by a ROA (possible hijack or misconfiguration); 'unknown' means no ROA covers the prefix

• cve_lookup

  Look up a CVE in the NVD (NIST National Vulnerability Database): its description, CVSS base score / severity / vector, CWE weakness IDs, publication dates and references. Turns a bare CVE ID (e.g. one from host_exposure) into meaning. Keyless (NVD is rate-limited without a key),

• spoofability

  Judge how easily a domain's mail can be forged by correlating SPF and DMARC into one verdict: 'hardened' (DMARC enforcing), 'partial' (DMARC quarantine) or 'spoofable' (no DMARC or p=none — receivers won't reject forged mail), with an A–F grade and the concrete reasons. The contr

• subdomain_takeover_check

  Check a domain's subdomains (enumerated from Certificate Transparency) for dangling-CNAME takeover risk: a CNAME that delegates to a third-party service (GitHub Pages, S3, Heroku, Azure, Netlify, …) which no longer claims the name. Status is 'vulnerable' (the service's unclaimed-

• tls_certificate

  Inspect the leaf certificate a host serves on a live TLS handshake: subject, issuer, subject-alternative names, validity window and days to expiry, key and signature algorithms, serial, thumbprint, the negotiated TLS protocol/cipher, and the chain with its trust verdict. Compleme

• dns_lookup

  Resolve DNS records for a host name. Returns A, AAAA, MX, TXT, NS, CNAME and SOA by default; pass 'types' to narrow. Read-only.

• dshield_ip_check

  Look up an IP's reputation in the SANS Internet Storm Center (DShield) data (keyless): how many attack reports it has across how many target sensors over the observed window, the network/AS it belongs to, and which ISC threat feeds list it. A high report count is a scanning/attac

• host_exposure

  Report a host's internet-facing exposure from Shodan's InternetDB (keyless): open ports, detected products (CPEs), known CVEs, hostnames and tags. Passive — reads Shodan's own scan data, never touches the target. For a domain the first resolved IP is used (behind a CDN this refle

• scan_site

  Run a passive web-security scan of a URL (via Astur). Returns an A–F grade, a 0–100 score and findings mapped to OWASP WSTG/ASVS. Non-intrusive — no active probing of the target.

• abuse_contact

  Find the abuse-reporting e-mail(s) for an IP (or a host's resolved IP) via RIPEstat's abuse-contact-finder — where to report a scanner or attacker surfaced by ip_reputation. Read-only.

• kev_check

  Check whether a CVE is in CISA's Known Exploited Vulnerabilities (KEV) catalogue — i.e. confirmed exploited in the wild, the strongest 'patch this now' signal. Returns the vendor/product, when it was added, the remediation due date, and whether it's used in known ransomware campa

• reverse_dns

  Reverse-resolve an IP address to its PTR host name(s). Read-only.

• ip_reputation

  Check an IP against GreyNoise's Community data: whether it is internet background 'noise' (a mass scanner) and, if so, GreyNoise's classification — 'malicious', 'benign' (an identified research scanner such as Shodan, Censys or Modat) or 'unknown' — with its name and when it was

• hsts_preload_check

  Check whether a domain is in the browsers' HSTS preload list (via hstspreload.org's keyless status API): the status (preloaded/pending/unknown), whether it was bulk-imported, and the parent domain it may be covered through. Preloaded domains are forced to HTTPS by browsers from t

• disclosure_contacts

  Consolidate where and how to report a security issue for a domain: the owner's own published channel (security_txt — RFC 9116 Contact, Policy, PGP key) and the network operator's registered abuse mailbox (abuse_contact, RIPEstat). Returns both sets of contacts and a clear yes/no

• rdap

  Look up registration data for a domain or IP via RDAP (the modern JSON successor to WHOIS): handle, name, statuses and lifecycle events, plus the raw record. Read-only.

• tor_exit_check

  Check whether an IP is a current Tor exit node, from the Tor Project's public bulk exit list (keyless). Exit traffic is anonymised, so an IP seen in logs may not be the true origin — a useful context signal. For a host name the first resolved IP is used. Read-only.

• robots_sitemap

  Passively read a site's robots.txt and the sitemap it points to. Returns the disallowed paths (often naming admin/staging areas — a recon signal), any declared crawl-delay, the sitemap URL(s), and — for the one sitemap fetched — whether it is a sitemap index, how many entries it

• passive_dns

  Historical DNS resolutions for a domain or IP from Mnemonic's keyless Passive DNS: the answers a name resolved to over time (or the names that pointed at an IP), each with a first/last-seen window and observation count. Surfaces old/rotated infrastructure a live lookup can't. Rea

• ip_blocklist_check

  Check whether an IP sits inside a netblock on a curated keyless reputation list — Spamhaus DROP/EDROP (networks judged hijacked or bad-actor-controlled) and FireHOL level1 (a conservative aggregate of established abuse lists). Returns each list that matched with the matching CIDR

• epss_score

  Get a CVE's EPSS score (FIRST's Exploit Prediction Scoring System): the probability (0–1) it will be exploited in the next 30 days, and its percentile rank among all CVEs. A forward-looking likelihood that complements kev_check's confirmed exploitation. Keyless, read-only.

• spf_expand

  Fully expand a domain's SPF record: follow every include: and redirect= recursively and count the DNS-lookup mechanisms across the WHOLE tree against the RFC 7208 limit of 10 — the real-world failure spf_check misses, where a nested include quietly pushes the total over 10 and th

• asn_relations

  Report an autonomous system's BGP relationships via RIPEstat (keyless): its upstreams (transit providers), downstreams (customers) and peers, from observed AS paths — the neighbour ASNs ordered by how often the relationship is seen. The connectivity map around the network, comple

• spf_check

  Fetch and analyse a domain's SPF record: the parsed DNS-lookup count (RFC 7208 limit is 10), the 'all' qualifier, and warnings on a missing or permissive policy. Read-only.

• wayback_snapshot

  Report the first and most recent captures of a domain in the Internet Archive's Wayback Machine (keyless CDX), with a link to each snapshot — a site-age / history signal (how far back it is archived), complementing wayback_urls (which lists archived URLs). Read-only.

• cert_revocation

  Report the revocation posture of the certificate a host serves: the OCSP responder(s) and CRL distribution point(s) a client could use to check revocation, and whether the certificate is must-staple (TLS-feature status_request, forcing a stapled OCSP response). Reads these straig

• cert_transparency

  Enumerate a domain's subdomains and certificate-issuance history from public Certificate Transparency logs (crt.sh): the names ever certified under it, issuing CAs, and the issuance span. Reveals names even behind a CDN and never touches the target. CT is historical — for a domai

• related_domains

  Find other registrable domains that share a TLS certificate (a common SAN) with the given domain, from Certificate Transparency (crt.sh) — a passive link to sibling properties run on the same certificates. Read-only.

• zone_transfer_check

  Test whether a domain's authoritative name servers allow a DNS zone transfer (AXFR) — a classic misconfiguration that leaks the entire zone (every hostname it holds) to anyone who asks (RFC 5936: AXFR must be limited to authorised secondaries). Returns a per-name-server verdict —

• urlscan_lookup

  Search urlscan.io's public scan database (keyless) for a domain or IP: recent public scans of the site itself (its own pages, not other sites that merely load something from it) with each page's final URL, resolved IP, hosting country/server/ASN, and links to the scan result and

• mx_lookup

  List a domain's mail exchangers (MX), ordered by preference, with each host's resolved IP addresses. Read-only.

• dkim_lookup

  Fetch a domain's DKIM public-key record for a given selector ( ._domainkey. ). The selector comes from an email's DKIM-Signature s= tag or a known default. Read-only.

• investigate

  Run a full reconnaissance sweep of a domain or URL and return a correlated report: web-security grade (via Astur), email-authentication posture (SPF/DMARC), nameservers, MX, registrar, subdomains from Certificate Transparency logs, the resolved IP's exposure (Shodan InternetDB) a

• wayback_urls

  List a domain's historical URLs captured by the Internet Archive Wayback Machine (CDX API, keyless): old endpoints, forgotten paths and files no longer on the live site, across the domain and its subdomains. Passive OSINT — reads the archive, never the target. Read-only.

• blacklist_check

  Check whether a mail server is listed on common email DNS blocklists (DNSBLs). For a domain, its mail (MX) IPs are checked — what matters for email reputation — falling back to the A record when there is no MX; a literal IP is checked directly. Read-only DNS queries.

• ip_reputation_aggregate

  Fold every keyless IP-reputation source into one verdict — clean / suspicious / malicious / unknown: ip_blocklist_check (Spamhaus DROP + FireHOL), ip_reputation (GreyNoise), feodo_c2_check (botnet C2), tor_exit_check and dshield_ip_check (attack telemetry). Returns the verdict, w

• asn_geoip

  Geolocate an IP address (or a host's resolved IP): ASN, network organisation, and approximate city/country. Requires a configured GeoIP database. Read-only.

• security_txt

  Fetch a site's vulnerability-disclosure file (RFC 9116) from /.well-known/security.txt (falling back to /security.txt): the declared security Contact(s), Expires date and whether it has lapsed, PGP Encryption key, Policy/Acknowledgments links, preferred languages, and whether the

• caa_dnssec

  Report a domain's CAA records (which CAs may issue its certificates) and an indicative DNSSEC signal (DNSKEY presence + Authenticated-Data flag — not a full chain validation). Read-only.

基础检查i

我们检查的是任何人都能看到的信息；我们没有阅读代码。不适用的检查项不计入总数。 · 检查于 2026年11月8日

• ! 注意

  作者与仓库一致

  注册中心没有列出源代码仓库，因此无法将发布者（fmelo.net）与代码对应起来

• … 尚未检查

  仍在维护

  我们还没有从 GitHub 读取这个仓库

• … 尚未检查

  有许可证

  我们还没有从 GitHub 读取这个仓库

• ✓ 通过

  端点有响应

  在 748 毫秒内响应（HTTP 200）

• – 不适用

  使用 OAuth 登录

  无需登录

• ✓ 通过

  工具描述中没有隐藏指令

  已读取 51 个工具描述，未发现针对 AI 的隐藏指令

与“网络安全”中的其他服务器比较i

• 星标数多于此分类中其他 1002 个服务器的 0%
• 发布到注册中心的时间比此分类中其他 1002 个服务器的 65% 更新
• 基础检查结果等于或优于此分类中其他 1002 个服务器的 33%

与注册中心里这个分类中所有活跃的服务器比较。只有当发布者拥有该仓库时，星标数才计入。

替代选择

同一分类中其他作者的服务器，按星标数排序。

如何看卡片：↓ 每周下载量i★ GitHub 星标i三大支柱：评价 · 检查 · 使用情况i更新 = 最新版本发布到注册中心的时间i

作者的 README

仓库中没有找到 README