BlackVeil DNS & Email Security Scanner

Official80 toolsLive

by MadaBurns · TypeScript

DNS and email security scanner with 81 MCP tools for SPF, DMARC, DNSSEC, SSL, and brand audits.

com.blackveilsecurity/dns MCP Server

The com.blackveilsecurity/dns MCP server is a DNS and email security scanner with 79 MCP tools. It supports checks for SPF, DMARC, DNSSEC, SSL, and brand audits, and is designed to work with Claude, Cursor, VS Code, and MCP clients.

🛠️ Key Features

DNS and email security scanning
79 MCP tools (toolCount: 79)
Focus areas include SPF, DMARC, DNSSEC, SSL, and brand audits

🚀 Use Cases

Auditing DNS and email security configuration
Verifying SPF/DMARC alignment and DNSSEC coverage
Reviewing SSL and brand-related security posture

⚡ Developer Benefits

Built for MCP clients (model-context-protocol support)
Integration paths include Streamable HTTP, stdio, and legacy HTTP+SSE
Tooling and topics oriented toward cybersecurity and DNS/email checks

⚠️ Limitations

Source-available licensing (BUSL-1.1)

Topics

agenticaicybersecurityllmmcpsaasai-toolscloudflare-workersdkimdmarcdns-securityemail-securitymcp-servermodel-context-protocolsecurity-scannerspf

Captured live from the server via tools/list.

check_mx

Look up MX records for a domain. Identifies which mail servers receive inbound email for the domain and which email hosting provider is used (Google Workspace, Microsoft 365, Proofpoint, etc.). Use when asked which email provider hosts inbound mail for a domain, or to see MX record configuration. Part of the scan_domain audit.

Parameters3

domain	string	required	Domain to check (e.g., example.com)
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to check (e.g., example.com)"
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain"
  ]
}

check_spf

Look up and validate the SPF record for a domain. Lists all IP addresses and third-party senders authorised to send email on behalf of the domain, flags syntax errors, and shows the trust surface (which mail servers are whitelisted). Use when you need to know who is permitted to send email as a domain. Part of the scan_domain audit.

Parameters3

domain	string	required	Domain to check (e.g., example.com)
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to check (e.g., example.com)"
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain"
  ]
}

check_dmarc

Look up and validate the DMARC record for a domain. Shows the enforcement level (none/quarantine/reject), alignment mode (strict/relaxed), and aggregate/forensic reporting destinations. Use to determine a domain's DMARC enforcement level, whether it sends aggregate reports, or if it is protected against email impersonation — distinct from check_shadow_domains (which checks TLD variants) and assess_spoofability (composite score). Part of the scan_domain audit.

Parameters3

domain	string	required	Domain to check (e.g., example.com)
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to check (e.g., example.com)"
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain"
  ]
}

check_dkim

Look up DKIM records for a domain. Probes common selectors, validates the signing algorithm used for outgoing email (RSA-1024/2048, Ed25519), and reports key strength. Use to verify that outbound email signatures are cryptographically sound. Part of the scan_domain audit.

Parameters4

domain	string	required	Domain to check (e.g., example.com)
selector	string	optional	DKIM selector. Omit to probe common ones.
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to check (e.g., example.com)"
    },
    "selector": {
      "description": "DKIM selector. Omit to probe common ones.",
      "type": "string",
      "maxLength": 63,
      "pattern": "^[a-z0-9]([a-z0-9-]*[a-z0-9])?$"
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain"
  ]
}

check_dnssec

Check DNSSEC status for a domain. Verifies whether DNS is tamper-proof and protected against cache poisoning and DNS spoofing attacks by validating DNSKEY and DS records. Reports whether DNSSEC is enabled and validating. Part of the scan_domain audit.

Parameters3

domain	string	required	Domain to check (e.g., example.com)
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to check (e.g., example.com)"
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain"
  ]
}

check_ssl

Check the HTTPS/TLS posture of a domain: HTTPS reachability, HSTS policy, and HTTP-to-HTTPS redirect. Also returns certificate metadata (issuer, expiry date, days remaining, SAN count) read from public Certificate Transparency logs — this describes the most recently LOGGED certificate, which may differ from the one currently served. Origin TLS protocol support and cipher suites are not assessed; legacy-TLS detection is withdrawn because the probe cannot observe the origin handshake. Use to verify HTTPS/HSTS configuration and certificate issuer/expiry. Part of the scan_domain audit.

Parameters3

domain	string	required	Domain to check (e.g., example.com)
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to check (e.g., example.com)"
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain"
  ]
}

check_mta_sts

Check whether a domain enforces SMTP TLS for inbound mail via MTA-STS, protecting against downgrade attacks. Queries _mta-sts.<domain> and fetches the policy file, reports mode (enforce/testing/none) and MX coverage. Use to verify whether inbound SMTP is protected against TLS downgrade or MITM — distinct from check_dane which uses TLSA pinning. Part of the scan_domain audit.

Parameters3

domain	string	required	Domain to check (e.g., example.com)
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to check (e.g., example.com)"
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain"
  ]
}

check_ns

Audit a domain’s nameserver delegation and redundancy. Identifies the DNS hosting provider and, when the infrastructure probe is available, directly compares parent and child NS sets, verifies authoritative AA responses, and checks required glue addresses. Use to detect stale registrar delegations, lame nameservers, and intermittent resolution risk. Part of the scan_domain audit.

Parameters3

domain	string	required	Domain to check (e.g., example.com)
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to check (e.g., example.com)"
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain"
  ]
}

check_caa

Look up CAA records for a domain. Shows which Certificate Authorities are authorized to issue certificates. Part of the scan_domain audit.

Parameters3

domain	string	required	Domain to check (e.g., example.com)
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to check (e.g., example.com)"
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain"
  ]
}

check_bimi

Check the BIMI brand-logo record at default._bimi.<domain>. Validates the logo URL (l=) and the presence of mark-certificate authority evidence (a=) — the a= tag is a bare URL, so the certificate type (VMC or CMC) is not determined — and verifies the DMARC enforcement prerequisite (p=quarantine/reject) that mail clients require before displaying a BIMI logo. Returns findings for a missing/malformed record or unmet prerequisites. Use to assess brand-indicator readiness in inboxes. Part of the scan_domain audit.

Parameters3

domain	string	required	Domain to check (e.g., example.com)
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to check (e.g., example.com)"
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain"
  ]
}

check_tlsrpt

Check whether a domain has SMTP TLS Reporting (TLS-RPT) configured. Queries _smtp._tls.<domain> for the v=TLSRPTv1 record and validates its reporting destination (rua= mailto:/https:), flagging a missing record, duplicate records, or an invalid/absent reporting URI. Complements MTA-STS by giving visibility into TLS delivery failures. Part of the scan_domain audit.

Parameters3

domain	string	required	Domain to check (e.g., example.com)
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to check (e.g., example.com)"
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain"
  ]
}

check_http_security

Audit a domain's browser-facing HTTP security headers over HTTPS. Inspects Content-Security-Policy (flagging unsafe-inline/unsafe-eval/wildcards), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and the cross-origin isolation headers (COOP/COEP/CORP), and detects CDN/WAF interception. Returns per-header findings for missing or weak protections against XSS, clickjacking, and cross-origin attacks. Part of the scan_domain audit.

Parameters3

domain	string	required	Domain to check (e.g., example.com)
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to check (e.g., example.com)"
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain"
  ]
}

check_dane

Check DANE/TLSA certificate pinning for SMTP at port 25. Resolves the domain's MX hosts and looks up TLSA records at _25._tcp.<mx-host>, verifying whether SMTP mail-server certificates are bound in DNS (DNSSEC-backed protection against CA misissuance and MITM on inbound mail). Use when asked if SMTP connections are protected by DANE/TLSA pinning. For HTTPS DANE at port 443, use check_dane_https instead. Part of the scan_domain audit.

Parameters3

domain	string	required	Domain to check (e.g., example.com)
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to check (e.g., example.com)"
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain"
  ]
}

check_ptr

Verify forward-confirmed reverse DNS (PTR/FCrDNS) for mail servers. Part of the scan_domain audit.

Parameters3

domain	string	required	Domain to check (e.g., example.com)
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to check (e.g., example.com)"
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain"
  ]
}

check_dane_https

Verify DANE certificate pinning for HTTPS connections. Looks up TLSA records at _443._tcp.{domain} (port 443) and validates their syntax, usage/selector/matching-type fields and DNSSEC backing. The record is reported as present but UNVERIFIED in every deployment: comparison against the certificate the host actually serves is currently withdrawn because the operator probe vantage cannot observe the origin certificate (finding metadata notAssessedReason probe_vantage_intercepted when the probe is bound), so a stale pin is NOT detected here. Distinct from check_dane which covers SMTP at port 25. Part of the scan_domain audit.

Parameters3

domain	string	required	Domain to check (e.g., example.com)
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to check (e.g., example.com)"
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain"
  ]
}

check_svcb_https

Validate HTTPS/SVCB records (RFC 9460) for modern transport capability advertisement. Part of the scan_domain audit.

Parameters3

domain	string	required	Domain to check (e.g., example.com)
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to check (e.g., example.com)"
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain"
  ]
}

check_lookalikes

Detect active typosquat and lookalike/homoglyph domains that impersonate your brand and could be used in phishing. Identifies character-substitution and visual-confusion domains registered by attackers. Distinct from check_shadow_domains (TLD variants with auth gaps) and discover_brand_domains (legitimate brand portfolio).

Parameters3

domain	string	required	Domain to check (e.g., example.com)
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to check (e.g., example.com)"
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain"
  ]
}

check_subdomailing

Detect SubdoMailing risk: analyzes the SPF include chain for dangling or hijackable subdomains that could let an attacker send email as the domain. Use when you want to know if an SPF include chain can be hijacked through a dangling domain, or to detect subdomain mailing risk hidden in SPF includes. Part of the scan_domain audit.

Parameters3

domain	string	required	Domain to check (e.g., example.com)
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to check (e.g., example.com)"
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain"
  ]
}

scan_domain

Run a full DNS and email security audit for a single domain. Aggregates every scan-included check in parallel (SPF, DKIM, DMARC, DNSSEC, TLS/SSL, MTA-STS, CAA, BIMI, subdomain takeover, and more) and returns an overall security score, NIST-aligned letter grade (6-band A+/A/B/C/D/F), maturity stage, and prioritized findings. Use for a comprehensive single-domain audit, to get a domain's overall security grade, or to assess email security maturity. Version stamps: 'scoringModelVersion' is the scoring POLICY semver (changes only when weights/thresholds/severities change, so it advances slowly) and is INDEPENDENT of — never comparable to — 'dnsChecksPackageVersion', the @blackveil/dns-checks npm engine-package version, which moves every release; a lower model version is expected, not a version gap. When citing a score, record 'scoringConfigHash' — it identifies the exact scoring configuration that produced the result.

Parameters4

domain	string	required	Domain to check (e.g., example.com)
profile	string	optional	Scoring profile. Default "auto" detects.
force_refresh	boolean	optional	Bypass cache and run a fresh scan. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to check (e.g., example.com)"
    },
    "profile": {
      "description": "Scoring profile. Default \"auto\" detects.",
      "type": "string",
      "enum": [
        "auto",
        "mail_enabled",
        "enterprise_mail",
        "non_mail",
        "web_only",
        "minimal",
        "authoritative_dns_infra"
      ]
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh scan. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain"
  ]
}

batch_scan

Bulk-scan up to 10 domains in parallel. Runs a full security audit on each domain in the list and returns score, NIST-aligned letter grade (6-band A+/A/B/C/D/F), and finding counts per domain. Use when you want to audit multiple domains at once or do a bulk scan of several domains simultaneously — distinct from compare_domains which does a side-by-side analysis of 2–5 domains. Version stamps (hoisted once per batch): 'scoringModelVersion' is the scoring POLICY semver and is INDEPENDENT of 'dnsChecksPackageVersion', the @blackveil/dns-checks npm engine-package version — the model version legitimately lags and the two must not be compared. Record 'scoringConfigHash' when citing scores.

Parameters3

domains	array	required	Domains to scan (max 10 per request)
force_refresh	boolean	optional	Bypass cache and run fresh scans.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domains": {
      "minItems": 1,
      "maxItems": 10,
      "type": "array",
      "items": {
        "type": "string",
        "minLength": 1,
        "maxLength": 253
      },
      "description": "Domains to scan (max 10 per request)"
    },
    "force_refresh": {
      "description": "Bypass cache and run fresh scans.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domains"
  ]
}

batch_scan_start

Start a durable asynchronous scan of 1–10 domains. Returns a stable job ID; replaying the same idempotency key with the same principal, normalized inputs, and scoring versions returns the same job.

Parameters4

domains	array	required	Domains to scan (max 10 per request)
force_refresh	boolean	optional	Bypass cache and run fresh scans.
format	string	optional	Output verbosity. Auto-detected if omitted.
idempotency_key	string	required	Caller-stable replay key for this exact batch request.

Raw schema

{
  "type": "object",
  "properties": {
    "domains": {
      "minItems": 1,
      "maxItems": 10,
      "type": "array",
      "items": {
        "type": "string",
        "minLength": 1,
        "maxLength": 253
      },
      "description": "Domains to scan (max 10 per request)"
    },
    "force_refresh": {
      "description": "Bypass cache and run fresh scans.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    },
    "idempotency_key": {
      "type": "string",
      "minLength": 8,
      "maxLength": 128,
      "description": "Caller-stable replay key for this exact batch request."
    }
  },
  "required": [
    "domains",
    "idempotency_key"
  ]
}

batch_scan_status

Read the owner-scoped status of an asynchronous batch scan.

Parameters2

job_id	string	required	Job ID returned by batch_scan_start.
format	string	optional

Raw schema

{
  "type": "object",
  "properties": {
    "job_id": {
      "type": "string",
      "pattern": "^bs_[a-f0-9]{40}$",
      "description": "Job ID returned by batch_scan_start."
    },
    "format": {
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "job_id"
  ]
}

batch_scan_findings

Fetch owner-scoped findings for a completed asynchronous batch scan.

Parameters2

job_id	string	required	Job ID returned by batch_scan_start.
format	string	optional

Raw schema

{
  "type": "object",
  "properties": {
    "job_id": {
      "type": "string",
      "pattern": "^bs_[a-f0-9]{40}$",
      "description": "Job ID returned by batch_scan_start."
    },
    "format": {
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "job_id"
  ]
}

compare_domains

Side-by-side security comparison of 2–5 domains. Shows relative scores, category gaps, and unique weaknesses for each domain. Use when comparing your security posture against a competitor, or doing a head-to-head comparison between multiple domains.

Parameters3

domains	array	required	Domains to compare (2–5 domains)
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domains": {
      "minItems": 2,
      "maxItems": 5,
      "type": "array",
      "items": {
        "type": "string",
        "minLength": 1,
        "maxLength": 253
      },
      "description": "Domains to compare (2–5 domains)"
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domains"
  ]
}

compare_baseline

Compare a domain's current security configuration against a fixed policy baseline to determine compliance. Use to check whether a domain meets a policy requirement — not for tracking improvement/regression over time (use analyze_drift) and not for comparing multiple domains (use compare_domains).

Parameters4

domain	string	required	Domain to scan and compare.
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.
baseline	object	required	Policy/requirements baseline OBJECT for compliance enforcement — "does this domain meet these required controls?" (grade/score floors, require_* flags, max_*_findings). NOT a prior scan. For drift-over-time vs a previous ScanScore (or the literal "cached"), use analyze_drift instead.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to scan and compare."
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    },
    "baseline": {
      "type": "object",
      "properties": {
        "grade": {
          "description": "Min grade (e.g., \"B+\").",
          "type": "string",
          "enum": [
            "A+",
            "A",
            "B+",
            "B",
            "C+",
            "C",
            "D+",
            "D",
            "F"
          ]
        },
        "score": {
          "description": "Min score (0-100).",
          "type": "number",
          "minimum": 0,
          "maximum": 100
        },
        "require_dmarc_enforce": {
          "description": "Require DMARC enforce.",
          "type": "boolean"
        },
        "require_spf": {
          "description": "Require SPF.",
          "type": "boolean"
        },
        "require_dkim": {
          "description": "Require DKIM.",
          "type": "boolean"
        },
        "require_dnssec": {
          "description": "Require DNSSEC.",
          "type": "boolean"
        },
        "require_mta_sts": {
          "description": "Require MTA-STS.",
          "type": "boolean"
        },
        "require_caa": {
          "description": "Require CAA.",
          "type": "boolean"
        },
        "max_critical_findings": {
          "description": "Max critical findings (default 0).",
          "type": "integer",
          "minimum": 0,
          "maximum": 9007199254740991
        },
        "max_high_findings": {
          "description": "Max high findings allowed.",
          "type": "integer",
          "minimum": 0,
          "maximum": 9007199254740991
        }
      },
      "additionalProperties": {},
      "description": "Policy/requirements baseline OBJECT for compliance enforcement — \"does this domain meet these required controls?\" (grade/score floors, require_* flags, max_*_findings). NOT a prior scan. For drift-over-time vs a previous ScanScore (or the literal \"cached\"), use analyze_drift instead."
    }
  },
  "required": [
    "domain",
    "baseline"
  ]
}

check_shadow_domains

Find alternate TLD variants of a domain (e.g. example.net, example.co) that have weak or missing email authentication and could be used to spoof email. Use when asked about TLD variants with email auth gaps — distinct from check_lookalikes which detects typosquat/homoglyph impersonation domains.

Parameters3

domain	string	required	Domain to check (e.g., example.com)
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to check (e.g., example.com)"
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain"
  ]
}

check_txt_hygiene

Audit TXT records for stale entries and SaaS exposure.

Parameters3

domain	string	required	Domain to check (e.g., example.com)
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to check (e.g., example.com)"
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain"
  ]
}

check_mx_reputation

Check whether the mail server (MX) IP addresses are listed on spam blocklists (Spamhaus, Barracuda, SORBS, and other RBLs). Also verifies reverse DNS for MX hosts. Use when you want to know if your mail server IP is blacklisted, or if your MX is on any blocklist — distinct from check_rbl which checks a specific IP directly.

Parameters3

domain	string	required	Domain to check (e.g., example.com)
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to check (e.g., example.com)"
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain"
  ]
}

check_srv

Map a domain's DNS-visible service footprint by probing 19 common SRV record prefixes (email, calendar, messaging, directory, web) in parallel. Returns discovered services and flags insecure service advertisements — e.g. plaintext IMAP/POP3/LDAP without an encrypted variant. A domain with no matches among the probed prefixes is not proof the domain has no services at all. Use when asked to map DNS-visible services or flag insecure service advertisements.

Parameters3

domain	string	required	Domain to check (e.g., example.com)
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to check (e.g., example.com)"
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain"
  ]
}

check_zone_hygiene

Audit DNS zone hygiene: identifies sensitive or forgotten subdomains exposed in DNS, stale SOA records, and zone propagation issues. Use to find any sensitive subdomains that should not be publicly visible, or to audit overall DNS zone cleanliness.

Parameters3

domain	string	required	Domain to check (e.g., example.com)
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to check (e.g., example.com)"
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain"
  ]
}

generate

Generate a DNS/email security remediation artifact. Artifact types: spf_record (build a new SPF record), dmarc_record (create a DMARC policy), dkim_config (DKIM key setup), mta_sts_policy (generate an MTA-STS policy file), fix_plan (prioritized remediation plan for all findings), or rollout_plan (phased DMARC enforcement timeline). Use when asked to generate or create a record or policy.

Parameters11

artifact	string	required	Which artifact to generate (e.g., "dmarc_record", "fix_plan").
domain	string	required	Domain (e.g., example.com)
include_providers	array	optional	spf_record: providers to include (e.g., ["google"]).
policy	string	optional	dmarc_record: policy (default "reject").
rua_email	string	optional	dmarc_record: report email. Default: dmarc-reports@{domain}.
provider	string	optional	dkim_config: provider (e.g., "google"). Omit for generic.
mx_hosts	array	optional	mta_sts_policy: MX hosts. Omit to detect from DNS.
target_policy	string	optional	rollout_plan: target DMARC policy (default: reject).
timeline	string	optional	rollout_plan: rollout speed (default: standard).
force_refresh	boolean	optional	fix_plan: bypass cache and run a fresh scan.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "artifact": {
      "type": "string",
      "enum": [
        "fix_plan",
        "spf_record",
        "dmarc_record",
        "dkim_config",
        "mta_sts_policy",
        "rollout_plan"
      ],
      "description": "Which artifact to generate (e.g., \"dmarc_record\", \"fix_plan\")."
    },
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain (e.g., example.com)"
    },
    "include_providers": {
      "description": "spf_record: providers to include (e.g., [\"google\"]).",
      "maxItems": 15,
      "type": "array",
      "items": {
        "type": "string",
        "minLength": 1,
        "maxLength": 253,
        "pattern": "^[a-z0-9._-]+$"
      }
    },
    "policy": {
      "description": "dmarc_record: policy (default \"reject\").",
      "type": "string",
      "enum": [
        "none",
        "quarantine",
        "reject"
      ]
    },
    "rua_email": {
      "description": "dmarc_record: report email. Default: dmarc-reports@{domain}.",
      "type": "string",
      "maxLength": 254,
      "pattern": "^[^\\s;,@\\x00-\\x1f\\x7f]+@[^\\s;,@\\x00-\\x1f\\x7f]+\\.[^\\s;,@\\x00-\\x1f\\x7f]+$"
    },
    "provider": {
      "description": "dkim_config: provider (e.g., \"google\"). Omit for generic.",
      "type": "string",
      "maxLength": 100
    },
    "mx_hosts": {
      "description": "mta_sts_policy: MX hosts. Omit to detect from DNS.",
      "maxItems": 20,
      "type": "array",
      "items": {
        "type": "string",
        "minLength": 1,
        "maxLength": 253,
        "pattern": "^[^\\s\\x00-\\x1f\\x7f]*$"
      }
    },
    "target_policy": {
      "description": "rollout_plan: target DMARC policy (default: reject).",
      "type": "string",
      "enum": [
        "quarantine",
        "reject"
      ]
    },
    "timeline": {
      "description": "rollout_plan: rollout speed (default: standard).",
      "type": "string",
      "enum": [
        "aggressive",
        "standard",
        "conservative"
      ]
    },
    "force_refresh": {
      "description": "fix_plan: bypass cache and run a fresh scan.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "artifact",
    "domain"
  ]
}

get_domain_rank

Rank a domain against its country or global cohort using the GSI benchmark corpus. Accepts a domain score (from scan_domain) and optional country/sector; returns a percentile: "scores better than X% of peers". Owner-gate exempt — public cohort data only.

Parameters5

domain	string	required	Domain to rank against its cohort (e.g., example.com)
score	number	required	Domain score (0–100) from scan_domain. Used to compute the cohort percentile.
country	string	optional	ISO 3166-1 alpha-2 country code to use the country cohort (e.g., "NZ"). Omit for global cohort.
sector	string	optional	Sector label (e.g., "finance"). Forwarded to the cohort endpoint; sector filtering is planned for a future release.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to rank against its cohort (e.g., example.com)"
    },
    "score": {
      "type": "number",
      "minimum": 0,
      "maximum": 100,
      "description": "Domain score (0–100) from scan_domain. Used to compute the cohort percentile."
    },
    "country": {
      "description": "ISO 3166-1 alpha-2 country code to use the country cohort (e.g., \"NZ\"). Omit for global cohort.",
      "type": "string",
      "minLength": 2,
      "maxLength": 2
    },
    "sector": {
      "description": "Sector label (e.g., \"finance\"). Forwarded to the cohort endpoint; sector filtering is planned for a future release.",
      "type": "string",
      "minLength": 1,
      "maxLength": 100
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain",
    "score"
  ]
}

get_benchmark

Get industry benchmark data: shows what percentile a domain's security score ranks at within its sector or country cohort, the mean score, and the most common DNS security failures across the industry. Use when asked how a score compares to the industry average, what percentile a score is in, or what the most common security failures are in an industry or sector.

Parameters2

profile	string	optional	Profile to benchmark (default "mail_enabled").
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "profile": {
      "description": "Profile to benchmark (default \"mail_enabled\").",
      "type": "string",
      "enum": [
        "mail_enabled",
        "enterprise_mail",
        "non_mail",
        "web_only",
        "minimal",
        "authoritative_dns_infra"
      ]
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  }
}

get_provider_insights

Get security benchmarks and common configuration issues for a specific email or DNS service-provider cohort (e.g. Google Workspace customers, Microsoft 365 customers). Use when asked how an email service provider compares to competitors on security posture, or to see typical misconfigurations for a named vendor's customers.

Parameters3

provider	string	required	Provider (e.g., "google workspace").
profile	string	optional	Profile (default "mail_enabled").
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "provider": {
      "type": "string",
      "minLength": 1,
      "maxLength": 200,
      "description": "Provider (e.g., \"google workspace\")."
    },
    "profile": {
      "description": "Profile (default \"mail_enabled\").",
      "type": "string",
      "enum": [
        "mail_enabled",
        "enterprise_mail",
        "non_mail",
        "web_only",
        "minimal",
        "authoritative_dns_infra"
      ]
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "provider"
  ]
}

assess_spoofability

Compute a composite email spoofability risk score (0–100, higher = more spoofable) by combining SPF trust surface, DMARC enforcement, and DKIM coverage. Returns a risk level (minimal→critical), per-control sub-scores, and plain-language summary of how easy it would be to spoof email from the domain. Use when asked how easy it is to spoof email from a domain, or for a composite email spoofing risk score.

Parameters3

domain	string	required	Domain to check (e.g., example.com)
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to check (e.g., example.com)"
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain"
  ]
}

check_resolver_consistency

Check DNS consistency across 4 public resolvers.

Parameters3

domain	string	required	Domain to check (e.g., example.com)
record_type	string	optional	Record type. Omit for A/AAAA/MX/TXT/NS.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to check (e.g., example.com)"
    },
    "record_type": {
      "description": "Record type. Omit for A/AAAA/MX/TXT/NS.",
      "type": "string",
      "enum": [
        "A",
        "AAAA",
        "MX",
        "TXT",
        "NS",
        "CNAME",
        "SOA",
        "CAA"
      ]
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain"
  ]
}

explain_finding

Explain a finding with impact and remediation.

Parameters4

checkType	string	required	Check type (e.g., 'SPF', 'DMARC').
status	string	required	Finding severity or status.
details	string	optional	Additional detail from check result.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "checkType": {
      "type": "string",
      "minLength": 1,
      "maxLength": 100,
      "description": "Check type (e.g., 'SPF', 'DMARC')."
    },
    "status": {
      "description": "Finding severity or status.",
      "type": "string",
      "enum": [
        "pass",
        "fail",
        "warning",
        "critical",
        "high",
        "medium",
        "low",
        "info"
      ]
    },
    "details": {
      "description": "Additional detail from check result.",
      "type": "string",
      "maxLength": 2000
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "checkType",
    "status"
  ]
}

map_supply_chain

Map DNS-visible third-party service dependencies for a domain. Correlates SPF, NS, TXT verifications, SRV services, and CAA records to reveal which third-party vendors can send email as the domain, control DNS, or access integrated services. Use when asked to map third-party or supply-chain dependencies — not for listing who can send email (use check_spf for that).

Parameters3

domain	string	required	Domain to check (e.g., example.com)
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to check (e.g., example.com)"
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain"
  ]
}

analyze_drift

Measure whether a domain's DNS security posture improved or regressed by comparing the current state against a prior scan snapshot. Returns a drift classification (improving/stable/regressing/mixed), score delta, and lists of improvements and regressions. Use to answer "did our security score improve or regress since last time?" — distinct from compare_baseline which checks compliance against a fixed policy (not improvement over time).

Parameters4

domain	string	required	Domain to analyze drift for
baseline	string	required	Prior scan reference for drift-over-time analysis: a previous ScanScore JSON STRING, or the literal "cached" to reuse the last cached scan (the default when omitted). NOT a policy/requirements object — for compliance enforcement against required controls, use compare_baseline instead.
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to analyze drift for"
    },
    "baseline": {
      "default": "cached",
      "description": "Prior scan reference for drift-over-time analysis: a previous ScanScore JSON STRING, or the literal \"cached\" to reuse the last cached scan (the default when omitted). NOT a policy/requirements object — for compliance enforcement against required controls, use compare_baseline instead.",
      "type": "string",
      "minLength": 1,
      "maxLength": 50000
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain",
    "baseline"
  ]
}

validate_fix

Re-check a specific security control after applying a fix, to confirm the finding is now resolved. Use only when a fix has already been applied and you want to verify or confirm the remediation was successful — not for initial inspection of a record.

Parameters4

domain	string	required	Domain to validate the fix for
check	string	required	Check name to re-run (e.g., "dmarc", "spf")
expected	string	optional	Expected DNS record value to verify against
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to validate the fix for"
    },
    "check": {
      "description": "Check name to re-run (e.g., \"dmarc\", \"spf\")",
      "type": "string",
      "enum": [
        "spf",
        "dmarc",
        "dkim",
        "dnssec",
        "ssl",
        "mta_sts",
        "ns",
        "caa",
        "bimi",
        "tlsrpt",
        "http_security",
        "dane"
      ]
    },
    "expected": {
      "description": "Expected DNS record value to verify against",
      "type": "string",
      "maxLength": 1000
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain",
    "check"
  ]
}

resolve_spf_chain

Trace the full SPF include chain for a domain. Recursively resolves all includes, shows lookup count, tree depth, and flags circular includes or exceeding the 10-lookup limit.

Parameters3

domain	string	required	Domain to check (e.g., example.com)
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to check (e.g., example.com)"
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain"
  ]
}

discover_subdomains

Find subdomains of a domain using Certificate Transparency logs. Reveals shadow IT, forgotten services, and unauthorized certificate issuance. Returns a CT SAMPLE, not an asset inventory: the count is a lower bound, a host with no publicly-logged certificate never appears, and the result carries a per-source `coverage` record stating what was actually consulted. `countBasis` says whether `totalSubdomains` is the tool’s normal reach (`sample`) or a `floor` from a run whose recall was cut (then `minSubdomainsObserved` is present); `concreteSubdomains` excludes wildcard patterns.

Parameters3

domain	string	required	Domain to check (e.g., example.com)
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to check (e.g., example.com)"
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain"
  ]
}

map_compliance

Map scan findings to compliance frameworks: NIST 800-177, PCI DSS 4.0, SOC 2, CIS Controls. Shows pass/fail/partial status per control.

Parameters3

domain	string	required	Domain to check (e.g., example.com)
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to check (e.g., example.com)"
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain"
  ]
}

sge_quickscan

Answer, for ONE domain, whether it meets the New Zealand Secure Government Email (SGE) requirements agencies must satisfy by October 2026. Reports all seven SGE controls — DMARC p=reject, SPF -all, DKIM, SMTP transport TLS, MTA-STS enforce, TLS-RPT, full sub-domain coverage — each as satisfied, not satisfied, or NOT MEASURED, with the structured evidence behind every verdict. Neither SMTP transport TLS nor sub-domain coverage can be observed from a single domain scan, so a DNS-only result tops out at INDETERMINATE, which is not a pass. Distinct from map_compliance, which maps findings to NIST/PCI/SOC 2/CIS.

Parameters3

domain	string	required	Domain to check (e.g., example.com)
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to check (e.g., example.com)"
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain"
  ]
}

prioritize_portfolio_leads

Rank a brand’s portfolio (or an explicit domain set) into prioritized registrar-partner sales leads by product-gap value × severity. Multi-domain, paid. Reuses map_registrar_products per domain, then ranks. Distinct from map_registrar_products (per-domain product mapping) and batch_scan (raw scores).

Parameters4

domains	array	optional	Explicit domain set to rank (max 10). Ownership bucket = "unknown".
brand	string	optional	Brand seed apex; discovers the portfolio, derives ownership buckets, then ranks the top candidates.
force_refresh	boolean	optional	Bypass cache and run fresh scans.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domains": {
      "description": "Explicit domain set to rank (max 10). Ownership bucket = \"unknown\".",
      "minItems": 1,
      "maxItems": 10,
      "type": "array",
      "items": {
        "type": "string",
        "minLength": 1,
        "maxLength": 253
      }
    },
    "brand": {
      "description": "Brand seed apex; discovers the portfolio, derives ownership buckets, then ranks the top candidates.",
      "type": "string",
      "minLength": 1,
      "maxLength": 253
    },
    "force_refresh": {
      "description": "Bypass cache and run fresh scans.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  }
}

simulate_attack_paths

Analyze current DNS posture and enumerate specific attack paths an adversary could exploit, with severity, feasibility, steps, and mitigations.

Parameters3

domain	string	required	Domain to check (e.g., example.com)
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to check (e.g., example.com)"
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain"
  ]
}

check_dbl

Check domain reputation against DNS-based Domain Block Lists (Spamhaus DBL, URIBL, SURBL). Returns listing status with decoded return codes.

Parameters3

domain	string	required	Domain to check (e.g., example.com)
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to check (e.g., example.com)"
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain"
  ]
}

check_rbl

Check MX server IP reputation against 6 DNS-based Real-time Blocklists (SpamCop, UCEProtect, Mailspike, Barracuda, PSBL). Resolves MX hosts to IPs first.

Parameters3

domain	string	required	Domain to check (e.g., example.com)
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to check (e.g., example.com)"
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain"
  ]
}

cymru_asn

Map domain IPs to Autonomous System Numbers via Team Cymru DNS. Returns ASN, prefix, country, registry, and organization for each IP. Flags high-risk hosting ASNs.

Parameters3

domain	string	required	Domain to check (e.g., example.com)
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to check (e.g., example.com)"
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain"
  ]
}

rdap_lookup

Fetch domain registration data via RDAP (modern WHOIS replacement). Returns the domain registrar (the company the domain was registered with), registrant contact, creation/expiration dates, EPP status codes, and domain age. Use when asked who registered the domain, who the registrar is, or when the registration expires — distinct from check_ns which identifies the DNS nameserver provider.

Parameters3

domain	string	required	Domain to check (e.g., example.com)
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to check (e.g., example.com)"
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain"
  ]
}

check_realtime_threat_feed

Check a domain against BlackVeil real-time threat intelligence (curated intel-gateway feed). Distinct from DNSBL checks. Operator-deploy only; degrades to info when unprovisioned.

Parameters3

domain	string	required	Domain to check (e.g., example.com)
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to check (e.g., example.com)"
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain"
  ]
}

check_nsec_walkability

Assess zone walkability risk by analyzing NSEC3PARAM configuration. Detects plain NSEC zones, weak NSEC3 parameters, and opt-out flags.

Parameters3

domain	string	required	Domain to check (e.g., example.com)
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to check (e.g., example.com)"
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain"
  ]
}

check_dnssec_chain

Walk the full DNSSEC chain of trust from the DNS root down to the target domain, tracing DS/DNSKEY records and algorithm usage at each zone level. Use when asked to trace the chain of trust from the DNS root, or to see the full DNSSEC delegation path step by step.

Parameters3

domain	string	required	Domain to check (e.g., example.com)
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to check (e.g., example.com)"
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain"
  ]
}

check_agent_discovery

Assess the security posture of IETF BANDAID agent-discovery records (draft-mozleywilliams-dnsop-dnsaid). Detects SVCB agent records under _agents/_index._{protocol}._agents, reports whether the discovery zone is DNSSEC-anchored (unsigned = spoofable agent endpoints), evaluates DANE/TLSA binding trust (RFC 6698 §10.1), and checks capability-document integrity (cap / cap-sha256). Read-only; uses Private-Use SVCB param code points pending IANA assignment.

Parameters6

domain	string	required	Domain to check for published agent-discovery records (e.g., example.com).
protocol	string	optional	Scope discovery to a single agent protocol index (_index._{protocol}._agents). Omit to sweep the zone.
name	string	optional	Resolve a single named agent ({name}.{domain}) instead of enumerating the zone.
verify_cap	boolean	optional	Fetch each declared capability document (cap=) over HTTPS via safeFetch and verify it against the cap-sha256 integrity pin. Default false (declaration/existence check only).
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to check for published agent-discovery records (e.g., example.com)."
    },
    "protocol": {
      "description": "Scope discovery to a single agent protocol index (_index._{protocol}._agents). Omit to sweep the zone.",
      "type": "string",
      "enum": [
        "a2a",
        "mcp",
        "https"
      ]
    },
    "name": {
      "description": "Resolve a single named agent ({name}.{domain}) instead of enumerating the zone.",
      "type": "string",
      "minLength": 1,
      "maxLength": 63
    },
    "verify_cap": {
      "description": "Fetch each declared capability document (cap=) over HTTPS via safeFetch and verify it against the cap-sha256 integrity pin. Default false (declaration/existence check only).",
      "type": "boolean"
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain"
  ]
}

check_dnskey_strength

Audit the cryptographic strength of DNSKEY signing algorithms used for DNSSEC. Reports which algorithm is used for DNSSEC signing keys (RSA/SHA-1, RSA/SHA-256, ECDSA P-256, Ed25519, etc.), flags deprecated algorithms (RSA/SHA-1, DSA), independent of whether the DNSSEC chain validates. Use when asked what algorithm is used for DNSSEC signing keys, or if deprecated DNSKEY algorithms are in use. Part of the scan_domain audit.

Parameters3

domain	string	required	Domain to check (e.g., example.com)
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to check (e.g., example.com)"
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain"
  ]
}

check_fast_flux

Detect fast-flux DNS behavior: performs multiple rounds of A/AAAA queries and checks whether IP addresses are rotating rapidly on each DNS query (a sign of botnet or malicious infrastructure). Compares IP answer sets and TTLs across rounds to identify rapidly rotating infrastructure used to hide malicious activity.

Parameters4

domain	string	required	Domain to check (e.g., example.com)
rounds	integer	optional	Number of query rounds (3-5, default 3).
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to check (e.g., example.com)"
    },
    "rounds": {
      "description": "Number of query rounds (3-5, default 3).",
      "type": "integer",
      "minimum": 3,
      "maximum": 5
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain"
  ]
}

check_subdomain_takeover

Sweep subdomains for dangling CNAMEs pointing to deprovisioned cloud services that could be claimed by an attacker (subdomain takeover vulnerabilities). Detects 16 provider families (AWS S3/CloudFront, Azure Front Door/CDN/Blob/App Service, GCP Cloud Storage, Heroku, GitHub Pages, Vercel, Firebase, Shopify, etc.). Use when asked if subdomains are pointing to deprovisioned cloud services. Pair with discover_subdomains to widen the candidate set — note that returns a CT sample, not a full inventory.

Parameters4

domain	string	required	Domain to check (e.g., example.com).
subdomains	array	optional	Optional explicit subdomain list (full FQDNs or short labels). When provided (deduped, capped at 1000), this list is swept instead of the 15-name built-in. Source from Certificate-Transparency enumeration or brand-audit discovery.
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to check (e.g., example.com)."
    },
    "subdomains": {
      "description": "Optional explicit subdomain list (full FQDNs or short labels). When provided (deduped, capped at 1000), this list is swept instead of the 15-name built-in. Source from Certificate-Transparency enumeration or brand-audit discovery.",
      "maxItems": 1000,
      "type": "array",
      "items": {
        "type": "string",
        "minLength": 1,
        "maxLength": 253
      }
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain"
  ]
}

check_authoritative_dns_infra

Check authoritative DNS infrastructure posture for a hostname. Uses BV_INFRA_PROBE when available for raw DNS, routing, RPKI, and vantage-point evidence.

Parameters3

domain	string	required	Domain to check (e.g., example.com)
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to check (e.g., example.com)"
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain"
  ]
}

check_root_server_set

Check the DNS root server set against official root hints, root glue, delegation, serial, and DNSKEY cross-root evidence.

Parameters1

format

string

optional

Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  }
}

discover_brand_domains

Discover all domains that belong to a brand's portfolio by aggregating certificate, DNS, redirect, and mail-policy signals. Use when asked what domains are part of a brand portfolio, or to find all domains related to a brand. Pass the EXACT seed domain verbatim — do NOT normalize or substitute a canonical domain.

Parameters12

domain	string	required	The exact seed domain to expand, scanned verbatim (e.g., example.com). Do NOT normalize, resolve, or substitute a brand's canonical/main domain — pass the literal domain the user named (e.g. pass `clau.de`, not `anthropic.com`). Use `brand_aliases` for related brand labels.
signals	array	optional	Signal modules to invoke. Defaults to all 12 discovery/enrichment signals.
depth	string	optional	Discovery depth. standard is default; deep expands candidate seeding and enrichment fanout.
planner_mode	string	optional	Planner mode for staged discovery fanout. observe emits metrics; enforce applies candidate-backed signal caps.
brand_aliases	array	optional	Optional public brand aliases to seed, such as product or legal-entity labels.
candidate_domains	array	optional	Optional candidate domains supplied by the caller for corroboration.
dkim_selectors	array	optional	Optional DKIM selectors to probe. Defaults to a built-in common-selector list.
min_confidence	number	optional	Drop candidates whose combined confidence falls below this threshold (0-1, default 0.5).
discovery_mode	string	required	Discovery mode. "classic" (default, BSL-licensed) runs the public signal-sweep pipeline. "tiered" layers Tier 0 (tenant-declared portfolio), Tier 1 (infrastructure-graph), and Tier 2 (declared-evidence) lookups in front of the legacy sweep, falling back to Tier 3 (the existing sweep) only on cache miss / very_stale fingerprint / uncovered caller candidates. Tiered mode requires private BlackVeil service bindings — BSL self-hosts should leave this on "classic".
ownership_verified	boolean	optional	Caller attests that the seed domain is owned or authorized for scanning. Required when discovery_mode is "tiered" and the caller is not an enterprise/owner/partner principal. Prevents unauthorized mass reconnaissance via deep tier lookups.
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "The exact seed domain to expand, scanned verbatim (e.g., example.com). Do NOT normalize, resolve, or substitute a brand's canonical/main domain — pass the literal domain the user named (e.g. pass `clau.de`, not `anthropic.com`). Use `brand_aliases` for related brand labels."
    },
    "signals": {
      "description": "Signal modules to invoke. Defaults to all 12 discovery/enrichment signals.",
      "minItems": 1,
      "maxItems": 12,
      "type": "array",
      "items": {
        "type": "string",
        "enum": [
          "san",
          "san_recursive",
          "ns",
          "dmarc_rua",
          "dkim_key_reuse",
          "http_redirect",
          "mx_overlap",
          "txt_verification",
          "mx_platform",
          "spf_include",
          "spf_include_seed",
          "cname_alignment"
        ]
      }
    },
    "depth": {
      "description": "Discovery depth. standard is default; deep expands candidate seeding and enrichment fanout.",
      "type": "string",
      "enum": [
        "standard",
        "deep"
      ]
    },
    "planner_mode": {
      "description": "Planner mode for staged discovery fanout. observe emits metrics; enforce applies candidate-backed signal caps.",
      "type": "string",
      "enum": [
        "off",
        "observe",
        "enforce"
      ]
    },
    "brand_aliases": {
      "description": "Optional public brand aliases to seed, such as product or legal-entity labels.",
      "maxItems": 20,
      "type": "array",
      "items": {
        "type": "string",
        "minLength": 2,
        "maxLength": 64
      }
    },
    "candidate_domains": {
      "description": "Optional candidate domains supplied by the caller for corroboration.",
      "maxItems": 250,
      "type": "array",
      "items": {
        "type": "string",
        "minLength": 1,
        "maxLength": 253
      }
    },
    "dkim_selectors": {
      "description": "Optional DKIM selectors to probe. Defaults to a built-in common-selector list.",
      "maxItems": 50,
      "type": "array",
      "items": {
        "type": "string",
        "minLength": 1,
        "maxLength": 63
      }
    },
    "min_confidence": {
      "description": "Drop candidates whose combined confidence falls below this threshold (0-1, default 0.5).",
      "type": "number",
      "minimum": 0,
      "maximum": 1
    },
    "discovery_mode": {
      "default": "classic",
      "description": "Discovery mode. \"classic\" (default, BSL-licensed) runs the public signal-sweep pipeline. \"tiered\" layers Tier 0 (tenant-declared portfolio), Tier 1 (infrastructure-graph), and Tier 2 (declared-evidence) lookups in front of the legacy sweep, falling back to Tier 3 (the existing sweep) only on cache miss / very_stale fingerprint / uncovered caller candidates. Tiered mode requires private BlackVeil service bindings — BSL self-hosts should leave this on \"classic\".",
      "type": "string",
      "enum": [
        "classic",
        "tiered"
      ]
    },
    "ownership_verified": {
      "description": "Caller attests that the seed domain is owned or authorized for scanning. Required when discovery_mode is \"tiered\" and the caller is not an enterprise/owner/partner principal. Prevents unauthorized mass reconnaissance via deep tier lookups.",
      "type": "boolean"
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain",
    "discovery_mode"
  ]
}

discover_brand_domains_start

Start an async brand-domain discovery for the EXACT seed domain provided (the async sibling of discover_brand_domains, which can run ~24s and time out interactive clients). Same args as discover_brand_domains. Returns { auditId, queuedAt, etaSeconds } immediately; poll with discover_brand_domains_status and fetch ranked candidates with discover_brand_domains_findings once complete.

Parameters12

domain	string	required	The exact seed domain to expand, scanned verbatim (e.g., example.com). Do NOT normalize, resolve, or substitute a brand's canonical/main domain — pass the literal domain the user named (e.g. pass `clau.de`, not `anthropic.com`). Use `brand_aliases` for related brand labels.
signals	array	optional	Signal modules to invoke. Defaults to all 12 discovery/enrichment signals.
depth	string	optional	Discovery depth. standard is default; deep expands candidate seeding and enrichment fanout.
planner_mode	string	optional	Planner mode for staged discovery fanout. observe emits metrics; enforce applies candidate-backed signal caps.
brand_aliases	array	optional	Optional public brand aliases to seed, such as product or legal-entity labels.
candidate_domains	array	optional	Optional candidate domains supplied by the caller for corroboration.
dkim_selectors	array	optional	Optional DKIM selectors to probe. Defaults to a built-in common-selector list.
min_confidence	number	optional	Drop candidates whose combined confidence falls below this threshold (0-1, default 0.5).
discovery_mode	string	required	Discovery mode. "classic" (default, BSL-licensed) runs the public signal-sweep pipeline. "tiered" layers Tier 0 (tenant-declared portfolio), Tier 1 (infrastructure-graph), and Tier 2 (declared-evidence) lookups in front of the legacy sweep, falling back to Tier 3 (the existing sweep) only on cache miss / very_stale fingerprint / uncovered caller candidates. Tiered mode requires private BlackVeil service bindings — BSL self-hosts should leave this on "classic".
ownership_verified	boolean	optional	Caller attests that the seed domain is owned or authorized for scanning. Required when discovery_mode is "tiered" and the caller is not an enterprise/owner/partner principal. Prevents unauthorized mass reconnaissance via deep tier lookups.
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	string	optional	Output verbosity. Auto-detected if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "The exact seed domain to expand, scanned verbatim (e.g., example.com). Do NOT normalize, resolve, or substitute a brand's canonical/main domain — pass the literal domain the user named (e.g. pass `clau.de`, not `anthropic.com`). Use `brand_aliases` for related brand labels."
    },
    "signals": {
      "description": "Signal modules to invoke. Defaults to all 12 discovery/enrichment signals.",
      "minItems": 1,
      "maxItems": 12,
      "type": "array",
      "items": {
        "type": "string",
        "enum": [
          "san",
          "san_recursive",
          "ns",
          "dmarc_rua",
          "dkim_key_reuse",
          "http_redirect",
          "mx_overlap",
          "txt_verification",
          "mx_platform",
          "spf_include",
          "spf_include_seed",
          "cname_alignment"
        ]
      }
    },
    "depth": {
      "description": "Discovery depth. standard is default; deep expands candidate seeding and enrichment fanout.",
      "type": "string",
      "enum": [
        "standard",
        "deep"
      ]
    },
    "planner_mode": {
      "description": "Planner mode for staged discovery fanout. observe emits metrics; enforce applies candidate-backed signal caps.",
      "type": "string",
      "enum": [
        "off",
        "observe",
        "enforce"
      ]
    },
    "brand_aliases": {
      "description": "Optional public brand aliases to seed, such as product or legal-entity labels.",
      "maxItems": 20,
      "type": "array",
      "items": {
        "type": "string",
        "minLength": 2,
        "maxLength": 64
      }
    },
    "candidate_domains": {
      "description": "Optional candidate domains supplied by the caller for corroboration.",
      "maxItems": 250,
      "type": "array",
      "items": {
        "type": "string",
        "minLength": 1,
        "maxLength": 253
      }
    },
    "dkim_selectors": {
      "description": "Optional DKIM selectors to probe. Defaults to a built-in common-selector list.",
      "maxItems": 50,
      "type": "array",
      "items": {
        "type": "string",
        "minLength": 1,
        "maxLength": 63
      }
    },
    "min_confidence": {
      "description": "Drop candidates whose combined confidence falls below this threshold (0-1, default 0.5).",
      "type": "number",
      "minimum": 0,
      "maximum": 1
    },
    "discovery_mode": {
      "default": "classic",
      "description": "Discovery mode. \"classic\" (default, BSL-licensed) runs the public signal-sweep pipeline. \"tiered\" layers Tier 0 (tenant-declared portfolio), Tier 1 (infrastructure-graph), and Tier 2 (declared-evidence) lookups in front of the legacy sweep, falling back to Tier 3 (the existing sweep) only on cache miss / very_stale fingerprint / uncovered caller candidates. Tiered mode requires private BlackVeil service bindings — BSL self-hosts should leave this on \"classic\".",
      "type": "string",
      "enum": [
        "classic",
        "tiered"
      ]
    },
    "ownership_verified": {
      "description": "Caller attests that the seed domain is owned or authorized for scanning. Required when discovery_mode is \"tiered\" and the caller is not an enterprise/owner/partner principal. Prevents unauthorized mass reconnaissance via deep tier lookups.",
      "type": "boolean"
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Output verbosity. Auto-detected if omitted.",
      "type": "string",
      "enum": [
        "full",
        "compact"
      ]
    }
  },
  "required": [
    "domain",
    "discovery_mode"
  ]
}

discover_brand_domains_status

Poll the status of an async brand-domain discovery started with discover_brand_domains_start. Returns status (queued | running | completed | failed) and progress. Owner-scoped — operationIds owned by other principals surface as notFound.

Parameters1

operationId

string

required

Operation ID returned by discover_brand_domains_start.

Raw schema

{
  "type": "object",
  "properties": {
    "operationId": {
      "type": "string",
      "minLength": 1,
      "maxLength": 64,
      "description": "Operation ID returned by discover_brand_domains_start."
    }
  },
  "required": [
    "operationId"
  ]
}

discover_brand_domains_findings

Fetch the ranked candidate domains (the discovery CheckResult) for an async run started with discover_brand_domains_start. Returns notReady while the discovery is still in-flight; the discovery result once complete. Owner-scoped.

Parameters1

operationId

string

required

Operation ID returned by discover_brand_domains_start.

Raw schema

{
  "type": "object",
  "properties": {
    "operationId": {
      "type": "string",
      "minLength": 1,
      "maxLength": 64,
      "description": "Operation ID returned by discover_brand_domains_start."
    }
  },
  "required": [
    "operationId"
  ]
}

brand_audit_single

Run a full brand audit on a single target with optional standard/deep discovery depth, brand aliases, and caller-supplied candidate domains. Discovers brand-related domains, looks up registrar + registrant for each candidate, and classifies each into consolidated, real registrar-sprawl shadowIt, authorized vendor dependency, indeterminate, or impersonation relationships. Gated tier-wide by monthly BRAND_AUDIT_QUOTAS (free/agent=0, developer=50, partner=200, enterprise=500, owner=unlimited).

Parameters11

domain	string	required	Target domain to audit (e.g., apple.com).
force_refresh	boolean	optional	Bypass cache and run a fresh check. Useful after DNS changes.
format	any	optional	Inline output mode. Defaults to "both".
min_confidence	number	optional	Drop candidates whose combined confidence falls below this threshold (0-1, default 0.5).
depth	string	optional	Discovery depth. standard is default; deep expands candidate seeding and enrichment fanout.
planner_mode	string	optional	Planner mode for staged discovery fanout. observe emits metrics; enforce applies candidate-backed signal caps.
brand_aliases	array	optional	Optional public brand aliases to seed, such as product or legal-entity labels.
candidate_domains	array	optional	Optional candidate domains supplied by the caller for corroboration.
view	string	optional	Output view mode. 'registrar_complement' produces a registrar-complement payload; requires enterprise tier. Default 'standard'.
discovery_mode	string	optional	Brand-discovery pipeline mode. classic = legacy sweep; tiered = tenant/graph/evidence wrappers first (BlackVeil-internal).
ownership_verified	boolean	optional	Caller attests that the target domain is owned or authorized for scanning. Required when discovery_mode is "tiered" and the caller is not an enterprise/owner/partner principal.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Target domain to audit (e.g., apple.com)."
    },
    "force_refresh": {
      "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
      "type": "boolean"
    },
    "format": {
      "description": "Inline output mode. Defaults to \"both\".",
      "anyOf": [
        {
          "type": "string",
          "const": "json"
        },
        {
          "type": "string",
          "const": "markdown"
        },
        {
          "type": "string",
          "const": "both"
        }
      ]
    },
    "min_confidence": {
      "description": "Drop candidates whose combined confidence falls below this threshold (0-1, default 0.5).",
      "type": "number",
      "minimum": 0,
      "maximum": 1
    },
    "depth": {
      "description": "Discovery depth. standard is default; deep expands candidate seeding and enrichment fanout.",
      "type": "string",
      "enum": [
        "standard",
        "deep"
      ]
    },
    "planner_mode": {
      "description": "Planner mode for staged discovery fanout. observe emits metrics; enforce applies candidate-backed signal caps.",
      "type": "string",
      "enum": [
        "off",
        "observe",
        "enforce"
      ]
    },
    "brand_aliases": {
      "description": "Optional public brand aliases to seed, such as product or legal-entity labels.",
      "maxItems": 20,
      "type": "array",
      "items": {
        "type": "string",
        "minLength": 2,
        "maxLength": 64
      }
    },
    "candidate_domains": {
      "description": "Optional candidate domains supplied by the caller for corroboration.",
      "maxItems": 250,
      "type": "array",
      "items": {
        "type": "string",
        "minLength": 1,
        "maxLength": 253
      }
    },
    "view": {
      "description": "Output view mode. 'registrar_complement' produces a registrar-complement payload; requires enterprise tier. Default 'standard'.",
      "type": "string",
      "enum": [
        "standard",
        "registrar_complement"
      ]
    },
    "discovery_mode": {
      "description": "Brand-discovery pipeline mode. classic = legacy sweep; tiered = tenant/graph/evidence wrappers first (BlackVeil-internal).",
      "type": "string",
      "enum": [
        "classic",
        "tiered"
      ]
    },
    "ownership_verified": {
      "description": "Caller attests that the target domain is owned or authorized for scanning. Required when discovery_mode is \"tiered\" and the caller is not an enterprise/owner/partner principal.",
      "type": "boolean"
    }
  },
  "required": [
    "domain"
  ]
}

brand_audit_batch_start

Enqueue an async brand audit across up to 50 target domains with optional standard/deep discovery depth, brand aliases, and caller-supplied candidate domains. Returns { auditId, queuedAt, targetCount, etaSeconds } immediately; poll with brand_audit_status and fetch results with brand_audit_get_report once complete. Each target consumes 1 unit of the monthly BRAND_AUDIT_QUOTAS budget.

Parameters10

domains	array	required	Domains to audit (max 50 per batch). Duplicates are merged.
format	any	optional	Inline output mode. Defaults to "both".
min_confidence	number	optional	Drop candidates whose combined confidence falls below this threshold (0-1, default 0.5).
depth	string	optional	Discovery depth. standard is default; deep expands candidate seeding and enrichment fanout.
planner_mode	string	optional	Planner mode for staged discovery fanout. observe emits metrics; enforce applies candidate-backed signal caps.
brand_aliases	array	optional	Optional public brand aliases to seed, such as product or legal-entity labels.
candidate_domains	array	optional	Optional candidate domains supplied by the caller for corroboration.
discovery_mode	string	optional	Brand-discovery pipeline mode. classic = legacy sweep; tiered = tenant/graph/evidence wrappers first (BlackVeil-internal).
ownership_verified	boolean	optional	Caller attests that the target domains are owned or authorized for scanning. Required when discovery_mode is "tiered" and the caller is not an enterprise/owner/partner principal.
view	string	optional	Output view mode. 'registrar_complement' produces a registrar-complement payload; requires enterprise tier. Default 'standard'.

Raw schema

{
  "type": "object",
  "properties": {
    "domains": {
      "minItems": 1,
      "maxItems": 50,
      "type": "array",
      "items": {
        "type": "string",
        "minLength": 1,
        "maxLength": 253
      },
      "description": "Domains to audit (max 50 per batch). Duplicates are merged."
    },
    "format": {
      "description": "Inline output mode. Defaults to \"both\".",
      "anyOf": [
        {
          "type": "string",
          "const": "json"
        },
        {
          "type": "string",
          "const": "markdown"
        },
        {
          "type": "string",
          "const": "both"
        }
      ]
    },
    "min_confidence": {
      "description": "Drop candidates whose combined confidence falls below this threshold (0-1, default 0.5).",
      "type": "number",
      "minimum": 0,
      "maximum": 1
    },
    "depth": {
      "description": "Discovery depth. standard is default; deep expands candidate seeding and enrichment fanout.",
      "type": "string",
      "enum": [
        "standard",
        "deep"
      ]
    },
    "planner_mode": {
      "description": "Planner mode for staged discovery fanout. observe emits metrics; enforce applies candidate-backed signal caps.",
      "type": "string",
      "enum": [
        "off",
        "observe",
        "enforce"
      ]
    },
    "brand_aliases": {
      "description": "Optional public brand aliases to seed, such as product or legal-entity labels.",
      "maxItems": 20,
      "type": "array",
      "items": {
        "type": "string",
        "minLength": 2,
        "maxLength": 64
      }
    },
    "candidate_domains": {
      "description": "Optional candidate domains supplied by the caller for corroboration.",
      "maxItems": 250,
      "type": "array",
      "items": {
        "type": "string",
        "minLength": 1,
        "maxLength": 253
      }
    },
    "discovery_mode": {
      "description": "Brand-discovery pipeline mode. classic = legacy sweep; tiered = tenant/graph/evidence wrappers first (BlackVeil-internal).",
      "type": "string",
      "enum": [
        "classic",
        "tiered"
      ]
    },
    "ownership_verified": {
      "description": "Caller attests that the target domains are owned or authorized for scanning. Required when discovery_mode is \"tiered\" and the caller is not an enterprise/owner/partner principal.",
      "type": "boolean"
    },
    "view": {
      "description": "Output view mode. 'registrar_complement' produces a registrar-complement payload; requires enterprise tier. Default 'standard'.",
      "type": "string",
      "enum": [
        "standard",
        "registrar_complement"
      ]
    }
  },
  "required": [
    "domains"
  ]
}

brand_audit_status

Poll the status of an enqueued brand audit. Returns audit-level status (queued | running | completed | failed), progress 'N/M', and per-target statuses. Owner-scoped — auditIds owned by other principals surface as notFound.

Parameters1

auditId

string

required

Audit ID returned by brand_audit_batch_start.

Raw schema

{
  "type": "object",
  "properties": {
    "auditId": {
      "type": "string",
      "minLength": 1,
      "maxLength": 64,
      "description": "Audit ID returned by brand_audit_batch_start."
    }
  },
  "required": [
    "auditId"
  ]
}

brand_audit_get_report

Fetch the result JSON for a completed brand audit. With `target` set, returns the per-target CheckResult; without, returns the audit-level aggregate. Returns notReady when polling an in-flight audit. When a rendered PDF sidecar exists, metadata includes pdfUrl — an authenticated /reports/ download link (same bearer credential as this call). Completed targets whose PDF is still rendering include pdfPending so callers can poll again.

Parameters2

auditId	string	required	Audit ID returned by brand_audit_batch_start.
target	string	optional	Specific target domain. Omit for audit-level aggregate.

Raw schema

{
  "type": "object",
  "properties": {
    "auditId": {
      "type": "string",
      "minLength": 1,
      "maxLength": 64,
      "description": "Audit ID returned by brand_audit_batch_start."
    },
    "target": {
      "description": "Specific target domain. Omit for audit-level aggregate.",
      "type": "string",
      "minLength": 1,
      "maxLength": 253
    }
  },
  "required": [
    "auditId"
  ]
}

list_brand_audit_watches

Returns the caller's recurring brand-audit watches: watchId, domain, interval, webhook presence, last-run time, and active state. Owner-scoped. Read-only.

Parameters

No parameters.

Raw schema

{
  "type": "object",
  "properties": {}
}

register_brand_audit_watch

Creates a recurring brand-audit watch for a domain on a daily/weekly/monthly cadence. Each run enqueues a fresh brand_audit_batch_start and (when a webhook is configured) POSTs a diff webhook on classification drift. Returns the new watchId. Owner-scoped; per-principal cap of 20 active watches.

Parameters3

domain	string	required	Domain to watch.
interval	string	required	Recurrence interval.
webhook_url	string	optional	Optional webhook URL — POSTed on classification drift. Re-validated for SSRF at both register and delivery time.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "Domain to watch."
    },
    "interval": {
      "type": "string",
      "enum": [
        "daily",
        "weekly",
        "monthly"
      ],
      "description": "Recurrence interval."
    },
    "webhook_url": {
      "description": "Optional webhook URL — POSTed on classification drift. Re-validated for SSRF at both register and delivery time.",
      "type": "string",
      "maxLength": 2048,
      "format": "uri"
    }
  },
  "required": [
    "domain",
    "interval"
  ]
}

delete_brand_audit_watch

Permanently removes a recurring brand-audit watch by watchId. Owner-scoped — a watchId owned by another principal surfaces as notFound. Returns confirmation of deletion.

Parameters1

watchId

string

required

Watch ID returned by register_brand_audit_watch.

Raw schema

{
  "type": "object",
  "properties": {
    "watchId": {
      "type": "string",
      "minLength": 1,
      "maxLength": 64,
      "description": "Watch ID returned by register_brand_audit_watch."
    }
  },
  "required": [
    "watchId"
  ]
}

scan_buckets_start

Start an async cloud-bucket discovery scan for a target domain. Operator-deploy only; degrades to info when unprovisioned. Returns a scanId immediately — poll progress with scan_buckets_status and retrieve results with scan_buckets_findings.

Parameters2

target	string	required
providers	array	optional

Raw schema

{
  "type": "object",
  "properties": {
    "target": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253
    },
    "providers": {
      "maxItems": 8,
      "type": "array",
      "items": {
        "type": "string",
        "maxLength": 32
      }
    }
  },
  "required": [
    "target"
  ],
  "additionalProperties": false
}

scan_buckets_status

Poll the status of a cloud-bucket discovery scan by scanId. Operator-deploy only; degrades to info when unprovisioned. Returns scan status (running | completed | failed) and progress metadata.

Parameters1

scanId

string

required

Raw schema

{
  "type": "object",
  "properties": {
    "scanId": {
      "type": "string",
      "minLength": 1,
      "maxLength": 128
    }
  },
  "required": [
    "scanId"
  ],
  "additionalProperties": false
}

scan_buckets_findings

Retrieve findings from a completed cloud-bucket discovery scan by scanId. Operator-deploy only; degrades to info when unprovisioned. The scanId is required so reads can be owner-scoped; target and provider filters are optional.

Parameters3

scanId	string	required
target	string	optional
providers	array	optional

Raw schema

{
  "type": "object",
  "properties": {
    "scanId": {
      "type": "string",
      "minLength": 1,
      "maxLength": 128
    },
    "target": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253
    },
    "providers": {
      "maxItems": 8,
      "type": "array",
      "items": {
        "type": "string",
        "maxLength": 32
      }
    }
  },
  "required": [
    "scanId"
  ],
  "additionalProperties": false
}

osint_investigate_domain_start

Start an async OSINT investigation for a domain. Operator-deploy only; degrades to info when unprovisioned. Returns an investigationId immediately — poll with osint_investigation_status and retrieve results with osint_investigation_report.

Parameters1

query

string

required

Raw schema

{
  "type": "object",
  "properties": {
    "query": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253
    }
  },
  "required": [
    "query"
  ],
  "additionalProperties": false
}

osint_investigate_infrastructure_start

Start an async deep-infrastructure OSINT investigation for a query (domain, IP, or org). Operator-deploy only; degrades to info when unprovisioned. Returns an investigationId immediately — poll with osint_investigation_status.

Parameters1

query

string

required

Raw schema

{
  "type": "object",
  "properties": {
    "query": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253
    }
  },
  "required": [
    "query"
  ],
  "additionalProperties": false
}

osint_investigate_supply_chain_start

Start an async supply-chain OSINT investigation for a query. Operator-deploy only; degrades to info when unprovisioned. Returns an investigationId immediately — poll with osint_investigation_status.

Parameters1

query

string

required

Raw schema

{
  "type": "object",
  "properties": {
    "query": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253
    }
  },
  "required": [
    "query"
  ],
  "additionalProperties": false
}

osint_investigate_username_start

Start an async OSINT investigation for a username (cross-platform presence, breach correlation). Owner/enterprise tier only — people-centric OSINT is restricted to prevent misuse. Returns an investigationId immediately — poll with osint_investigation_status and retrieve results with osint_investigation_report.

Parameters1

query

string

required

Raw schema

{
  "type": "object",
  "properties": {
    "query": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253
    }
  },
  "required": [
    "query"
  ],
  "additionalProperties": false
}

osint_investigate_email_start

Start an async OSINT investigation for an email address (breach exposure, account correlation). Owner/enterprise tier only — people-centric OSINT is restricted to prevent misuse. Returns an investigationId immediately — poll with osint_investigation_status and retrieve results with osint_investigation_report.

Parameters1

query

string

required

Raw schema

{
  "type": "object",
  "properties": {
    "query": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253
    }
  },
  "required": [
    "query"
  ],
  "additionalProperties": false
}

osint_investigation_status

Poll the status of an OSINT investigation by investigationId. Operator-deploy only; degrades to info when unprovisioned. Returns current status (running | completed | failed) and progress metadata.

Parameters1

investigationId

string

required

Raw schema

{
  "type": "object",
  "properties": {
    "investigationId": {
      "type": "string",
      "minLength": 1,
      "maxLength": 128
    }
  },
  "required": [
    "investigationId"
  ],
  "additionalProperties": false
}

osint_investigation_report

Retrieve the final report of a completed OSINT investigation by investigationId. Operator-deploy only; degrades to info when unprovisioned or not yet complete.

Parameters1

investigationId

string

required

Raw schema

{
  "type": "object",
  "properties": {
    "investigationId": {
      "type": "string",
      "minLength": 1,
      "maxLength": 128
    }
  },
  "required": [
    "investigationId"
  ],
  "additionalProperties": false
}

README.md28 KBView on GitHub

BLACKVEIL DNS

Know where you stand.

Source-available DNS & email security scanner for Claude, Cursor, VS Code, and MCP clients across Streamable HTTP, stdio, and legacy HTTP+SSE.

DNS Security

Try it in 30 seconds

Claude Desktop (one-click install):

Download the Blackveil DNS extension and open it — the current 80-tool surface is available instantly. Verify your download.

Claude Code (one command):

bash

claude mcp add --transport http blackveil-dns https://dns-mcp.blackveilsecurity.com/mcp

Then ask: scan anthropic.com

Smithery (one command):

bash

smithery mcp add MadaBurns/bv-mcp

Verify the endpoint is live:

bash

curl https://dns-mcp.blackveilsecurity.com/health

No install. No API key. One URL for hosted HTTP:

code

Endpoint   https://dns-mcp.blackveilsecurity.com/mcp
Transport  Streamable HTTP · JSON-RPC 2.0
Auth       None required

Transport support:

Streamable HTTP: POST /mcp, GET /mcp, DELETE /mcp
Native stdio: blackveil-dns-mcp CLI from the blackveil-dns npm package
Legacy HTTP+SSE: GET /mcp/sse bootstrap stream plus POST /mcp/messages?sessionId=...

For Streamable HTTP, clients should retain the Mcp-Session-Id returned by initialize and send it on every subsequent request, including notifications. Send the negotiated version in MCP-Protocol-Version; unsupported values are rejected with HTTP 400, while expired or terminated sessions return 404 and require a fresh initialize.

What you get

80 MCP tools with 19 scoring categories — SPF, DMARC, DKIM, DNSSEC, SSL/TLS, MTA-STS, NS, CAA, MX, BIMI, TLS-RPT, subdomain takeover, HTTP security headers, DANE, SVCB/HTTPS, DANE-HTTPS, subdomailing, reverse DNS (PTR/FCrDNS), and DNSKEY strength
Maturity staging — Stage 0-4 classification (Unprotected to Hardened) with score-based capping to prevent inflated labels
Trust surface analysis — detects shared SaaS senders in SPF, both cataloged platforms (Google, M365, SendGrid) and uncataloged hosts identifiable by their spf delegation label, then cross-references DMARC enforcement to determine real exposure
Guided remediation — generate (artifact=fix_plan) produces provider-aware prioritized actions; its record artifacts (spf_record, dmarc_record, dkim_config, mta_sts_policy, rollout_plan) output ready-to-publish records; validate_fix confirms whether a fix was applied successfully
Supply chain mapping — map_supply_chain correlates DNS signals to build a full third-party dependency graph with trust levels and risk signals
Attack path simulation — simulate_attack_paths enumerates specific paths (spoofing, takeover, hijack) with severity, steps, and mitigations
Compliance mapping — map_compliance maps scan findings to NIST 800-177, PCI DSS 4.0, SOC 2, and CIS Controls
Self-tuning scoring — adaptive weights adjust category importance based on patterns seen across scans via Durable Object telemetry
Per-tier analytics — usage tracking by auth tier with operator API for tier summaries, key-level usage, and daily digests
Read-only — checks never modify a target and need no authorization from it. Most are passive lookups over public Cloudflare DNS-over-HTTPS; check_authoritative_dns_infra and check_root_server_set query authoritative and root nameservers directly over TCP/53, and for authenticated callers check_authoritative_dns_infra also tests whether a domain's nameservers refuse a zone transfer (no zone data is retrieved)

Tools

code

  80 MCP tools · 7 prompts · 6 resources

  Email Auth             Infrastructure          Brand & Threats       Meta
 ─────────────          ──────────────          ───────────────       ───────────────
  check_mx              check_dnssec            check_bimi            scan_domain
  check_spf             check_ssl               check_tlsrpt          batch_scan
  check_dmarc           check_ns                check_lookalikes      compare_domains
  check_dkim            check_caa               check_shadow_domains  compare_baseline
  check_mta_sts         check_http_security                           explain_finding
  check_subdomailing    check_dane
  check_mx_reputation   check_dane_https        DNS Hygiene           Remediation
                        check_svcb_https       ─────────────         ───────────────
                        check_ptr               check_txt_hygiene     generate (one tool;
  Intelligence          check_srv                                       artifact=fix_plan,
 ─────────────          check_zone_hygiene                              spf_record,
  get_benchmark         check_resolver_         Discovery               dmarc_record,
  get_domain_rank         consistency          ─────────────           dkim_config,
  get_provider_                                 discover_brand_         mta_sts_policy,
    insights            check_dbl                domains                rollout_plan)
  assess_spoofability   check_rbl               brand_audit_single    validate_fix
  map_supply_chain      cymru_asn               brand_audit_batch_
  analyze_drift         rdap_lookup               start
  resolve_spf_chain     check_nsec_             brand_audit_status
  discover_subdomains     walkability           brand_audit_get_
  map_compliance        check_dnssec_chain        report
  prioritize_portfolio_
    leads
  simulate_attack_paths check_fast_flux         list_brand_audit_watches
  check_agent_discovery check_dnskey_strength
                        check_authoritative_dns_infra
                        check_root_server_set   register_brand_audit_watch
                                                delete_brand_audit_watch

  + check_subdomain_takeover (standalone tool + internal — runs inside scan_domain)
  + check_authoritative_dns_infra and check_root_server_set (authoritative DNS infrastructure profile)
  + discover_brand_domains_start / discover_brand_domains_status / discover_brand_domains_findings
    (async start → poll → fetch sibling of discover_brand_domains, for clients that time out on the ~24s sync call)

  Operator-deploy only (BV_RECON binding; degrade to unprovisioned on self-hosted BUSL deployments):
  + check_realtime_threat_feed   — curated intel-gateway threat feed lookup
  + scan_buckets_start           — async cloud-bucket discovery scan (start → poll → findings)
  + scan_buckets_status          — poll status of a running bucket scan
  + scan_buckets_findings        — retrieve findings for a completed bucket scan
  + osint_investigate_domain_start          — async domain OSINT investigation (start → poll → report)
  + osint_investigate_infrastructure_start  — async deep-infrastructure OSINT (domain, IP, or org)
  + osint_investigate_supply_chain_start    — async supply-chain OSINT investigation
  + osint_investigate_username_start        — async username OSINT (owner/enterprise tier only)
  + osint_investigate_email_start           — async email OSINT (owner/enterprise tier only)
  + osint_investigation_status   — poll status of any running OSINT investigation
  + osint_investigation_report   — retrieve report for a completed OSINT investigation

  Internal-only compatibility surface (withdrawn from public `tools/list`; the three active Microsoft 365 / Entra tools proxy through `BV_WEB` and degrade to unprovisioned without it):
  + query_signins                — query Microsoft Entra sign-in logs for a tenant
  + query_ual                    — DEPRECATED tombstone; valid, authorized calls return query_ual_deprecated with no tenant-data access
  + get_ca_policies              — retrieve Conditional Access policies for an Entra tenant
  + assess_coverage              — assess Conditional Access coverage gaps for an Entra tenant

Tool discovery metadata (`_meta`)

tools/list returns every tool with server-specific discovery metadata under each tool's _meta (the MCP-sanctioned extension point), so a client can group or filter the surface without hard-coding tool names:

group — functional group (email_auth, infrastructure, brand_threats, dns_hygiene, intelligence, remediation, discovery, identity_secops, meta).
tier — scoring tier (core / protective / hardening); absent for non-scoring tools.
scanIncluded — true when the tool runs inside scan_domain's parallel audit.
recommended — present (true) only on the curated starter set (scan_domain, explain_finding, compare_baseline); omitted otherwise. A client facing the full surface can lead with tools.filter(t => t._meta.recommended) to avoid overwhelming an LLM with all tools flat. Every tool is still listed — this is an additive signal, not a filter.

Authoritative DNS infrastructure

check_authoritative_dns_infra measures authoritative DNS infrastructure posture for a hostname over direct DNS-over-TCP/53 from a single vantage, via the BV_INFRA_PROBE service binding: TCP/53 reachability, the authoritative AA flag, recursion exposure, SOA serial consistency across nameservers, DNSKEY/RRSIG presence (not validation), IPv4/IPv6 answer parity, and unsupported-query handling. For authenticated callers only, it also runs a zone-transfer refusal test (first response only — no zone data is ever retrieved) and CHAOS version.bind/id.server disclosure. It does not measure, and reports as inconclusive: UDP/53 reachability, amplification, EDNS large-response/truncation, DNS cookies/RRL, BGP origin, RPKI, route-leak signals, anycast diversity, vantage latency, and RIR/RDAP.

check_root_server_set queries a rotating sample of 3 root servers per call and compares the priming NS set, glue, SOA serials, and cross-root consistency with the embedded official root hints, via BV_INFRA_PROBE.

Self-hosted or local deployments without BV_INFRA_PROBE still return structured partial results. The worker-only mode records the embedded root hints and marks every live-probe capability inconclusive rather than pretending it ran; both tools then withhold their verdict (checkStatus: 'error', excluded from scoring) instead of grading reference data.

Quality & Reliability

The server classifies detected MCP clients by their default response format:

Interactive clients: claude_mobile, claude_code, cursor, vscode, claude_desktop, claude_connector, windsurf (auto-format: compact)
Non-interactive clients: mcp_remote, blackveil_dns_action, bv_claude_dns_proxy, unknown (auto-format: full)

The bv_load_test class identifies internal load/chaos/tranco-scan traffic so it stays out of real-client analytics segments.

The comprehensive chaos suite validates session stability, authentication precedence, format negotiation, and transport-specific edge cases across Streamable HTTP and Legacy SSE for its supported client fixtures. Without an API key it exercises the public/free-tier path; with a valid key exported as BV_API_KEY, it covers Bearer authentication, legacy self-host ?api_key= compatibility, authenticated SSE bootstrap, and authenticated batch behavior.

Run the client/session chaos suite locally: python3 scripts/chaos/chaos-test-clients.py.

Run repeat force-refresh scans to detect production scoring drift:

bash

BV_API_KEY=... python3 scripts/chaos/score-stability-test.py --count 20 --rounds 3 --concurrency 5

The stability harness negotiates MCP protocol 2025-06-18, accepts JSON and Streamable HTTP SSE responses, and exits non-zero on any transport/tool error or score/category drift. Use --from <json-file> with a JSON array of domains for a targeted provider-diversity sweep.

SSOT guardrails are enforced by focused audit tests:

Tool counts and public resource copy are generated from the TOOLS registry, not hand-written — npm run generate:tool-surface rewrites every advertised count, and npm run check:tool-surface fails CI if any drifts. Counts advertised to clients use the public surface (TOOLS minus internal-only tools), so the number in the docs, the badge, the VS Code listing and the resources/read copy is the number tools/list actually returns.
Domain-required validation is derived from each tool input schema.
Scan timeout budgets are resolved from shared runtime config.
WASM tool permissions are generated from MCP tool annotations.
Public quota copy is checked against runtime quota config.

Version stamps in scan output

Every scan_domain / batch_scan result carries three reproducibility stamps. They are three different namespaces — do not compare them to each other, and do not read any of them as the npm package version unless it says so:

Field	What it tracks	How often it moves
`scoringModelVersion`	The scoring policy: category weights, profile weights, grade thresholds, severity penalties, the `passed`/missing-control rule, profile detection.	Only when a change alters scores or grades. Slowly — most releases do not touch it.
`dnsChecksPackageVersion`	The `@blackveil/dns-checks` engine package version bundled by the running build.	Every package release — code, new detections, bug fixes.
`scoringConfigHash`	Fingerprint of the effective scoring configuration that produced this result, including any `SCORING_CONFIG` override.	Whenever the effective config differs.

scoringModelVersion is independent of dnsChecksPackageVersion and is normally lower — for example model 1.10.0 alongside package 1.18.0. That is not a version gap, and it does not mean a consumer's vendored copy scores differently from the hosted service: the package advanced eight minors without changing scoring policy. Reading the model version as the package version has twice triggered a false "engine version gap" investigation, which is why both are now emitted side by side.

When you publish or cite a score, record scoringConfigHash — not either version number. It is the value that identifies the exact scoring configuration behind a result, so two scans carrying the same hash were graded under the same rules.

Status badge

GET /badge/<domain> returns an embeddable SVG — the badge at the top of this README is a live scan of our own domain. It needs no authentication and is subject to the same anonymous rate limits and daily caps as a public scan.

The badge shows the same customer-facing letter scan_domain reports — the NIST-aligned 6-band grade (A+ ≥95, A ≥90, B ≥80, C ≥70, D ≥60, F <60) — so a domain cannot show one grade on its badge and a different one in its report. Two further states are stated rather than papered over:

<grade> partial — the scan was graded, but did not complete every check (a WAF challenge, a timeout, an unreachable host). The hover/aria title gives the exact coverage, e.g. 17 of 19 checks measured. The grade and its colour are unchanged: coverage and posture are different axes.
unknown — the domain could not be measured at all. The badge says so instead of substituting a letter, which would publish a failing grade nobody measured.

See docs/scoring.md for the grade scales and the evidence rules behind them.

Architecture

code

  MCP Client
      │
      │  POST /mcp (JSON-RPC 2.0)
      │
  ┌───▼──────────────────────┐
  │  Cloudflare Worker       │
  │                          │
  │  Hono ─► Origin check    │
  │       ─► Auth            │
  │       ─► Rate limiting   │
  │       ─► Session mgmt    │
  └───┬──────────────────────┘
      │
  ┌───▼──────────────────────┐
  │  Tool Handlers           │
  │  19 scoring categories   │
  └───┬──────────────────────┘
      │
  ┌───▼──────────────────────┐
  │  Generic Scoring Engine  │
  │  Three-tier model        │
  └───┬──────────────────────┘
      │
  ┌───▼──────────────────────┐
  │  Cloudflare DoH          │
  │  DNS-over-HTTPS          │
  └──────────────────────────┘

Generic Scoring Engine: Runtime-agnostic, string-keyed three-tier scoring with configurable weights
Infra Probe Binding: Optional BV_INFRA_PROBE service binding supplies live DNS-over-TCP/53 authoritative DNS and root-server evidence for the authoritative DNS infrastructure profile
WASM Policy Engine: High-performance permission and token checks via bv-wasm-core
Reliable Sessions: Hardened tombstone logic prevents race-condition revival of terminated sessions
Protocol Enforcement: Unsupported MCP versions fail closed; notifications and SSE connections use the same session-validity rules as other post-initialize requests
Bounded Egress: Public CT and target-HTML responses are streamed under byte ceilings before parsing or fingerprinting
Cryptographic Identifiers: Session and brand-report identifiers use Web Crypto randomness
Adaptive Scoring: Durable Object telemetry adjusts weights based on real-world distributions
Client Awareness: Automatic response formatting (compact vs full) based on client User-Agent

Brand-discovery modes (`discover_brand_domains` / `brand_audit_*`)

The discovery_mode argument accepts two values:

classic (the default everywhere this repo runs out-of-the-box) — the public, BUSL-licensed signal-sweep pipeline. Uses only public-internet data sources (DNS, RDAP, CT logs, MX/TXT inspection). This is the only mode supported for self-hosted deployments and the only mode the open test suite covers end-to-end.
tiered — layers a portfolio-aware Tier 0 / infrastructure-graph Tier 1 / declared-evidence Tier 2 pipeline in front of the classic sweep. Tiered mode requires private BlackVeil-internal cross-Worker bindings (BV_INFRA_GRAPH, BV_INTEL_GATEWAY, BV_ENTERPRISE) that are not packaged with the open distribution — they live in BlackVeil's production deploy overlay (.dev/wrangler.deploy.jsonc) and call into proprietary Workers. Self-hosters cannot enable tiered mode without those bindings.

BlackVeil's hosted production at dns-mcp.blackveilsecurity.com flips its runtime default to tiered via the env var BRAND_AUDIT_DISCOVERY_MODE_DEFAULT="tiered" in the private overlay; the public schema default in src/schemas/tool-args.ts stays 'classic' permanently so anyone building from main gets the BUSL-licensed behaviour unchanged. An explicit caller-supplied discovery_mode always wins over the env default.

Client setup

The free tier requires no authentication. Authenticated requests bypass per-IP rate limits and follow your tier's daily quota. Hosted production supports:

Header: Authorization: Bearer <KEY>
Header (alternative): X-API-Key: <KEY> — for clients that cannot set Authorization. If both are sent, Authorization: Bearer wins.
OAuth 2.1: optional authorization-code flow with PKCE, enabled only when operators set ENABLE_OAUTH=true; owner-key consent is separately gated by ENABLE_OWNER_OAUTH=true.

The ?api_key=<KEY> fallback is legacy/self-host compatibility only. BlackVeil hosted production sets REJECT_QUERY_API_KEY=true; clients that cannot send headers should use OAuth or an mcp-remote header bridge.

For full hosted setup examples, stdio usage, OAuth setup, and legacy fallback endpoints, see docs/client-setup.md.

Operator configuration

These settings apply to operators running their own deployment. They are optional — self-hosted (BUSL) deployments fall back to privacy-preserving defaults when they are unset.

Detailed analytics capture

The public /mcp path writes a per-event access log enriched with geolocation and network identity. The write path, PII depth, and retention are operator-controlled:

Binding / var	Type	Purpose
`MCP_ANALYTICS_QUEUE`	Queue	Operator-deploy only. Batches access-log writes off the request path. Absent on self-hosts → inline-insert fallback (no reverse-DNS lookup).
`ANALYTICS_PII_LEVEL`	var	`coarse` (default) \| `standard` \| `full`. Controls access-log PII depth: `coarse` = country/region/ASN + hashed/masked IP; `standard` adds encrypted IP + city; `full` adds lat/long + reverse-DNS (PTR).
`ANALYTICS_RETENTION_DAYS`	var	Access-log retention window in days (default `90`, clamped `1`–`365`). Rows older than the window are pruned by the scheduled handler.
PTR third-party disclosure	—	At `ANALYTICS_PII_LEVEL=full`, caller-IP PTR lookups resolve through the configured DoH chain, whose final fallback is Google Public DNS — an external disclosure of caller-IP-derived queries that operators should weigh before enabling `full`. Per-subject erasure: `POST /internal/analytics/erase?key_hash=…\|ip_hash=…` (strict internal bearer; self-audited).

Internal analytics endpoints

These live under the internal auth gate (/internal/*) and are called by bv-web, not the public surface:

Endpoint	Source	Notes
`GET /internal/analytics/usage?days=&key_hash=`	D1	Precise per-customer usage report.
`GET /internal/analytics/geo?days=`	Analytics Engine	Geographic rollup (country/region/city/ASN) for dashboards.
`GET /internal/analytics/forensics?days=&ip_hash=&key_hash=`	D1	STRICT-gated, operator-only. Returns decrypted client IP + PTR for abuse investigation; every call writes a self-audit row.

Pricing

	Free	Pro	Enterprise
Price	$0	$39/mo	Contact us
Scans/day	25	500	10,000+
Checks/day	Tool-specific limits	Tool-specific limits	Contract limits
Rate limit	50 req/min	None	None
API access	Yes	Yes	Yes
MCP access	Yes	Yes	Yes

Offensive/recon and multi-domain tools (subdomain discovery, attack-path simulation, lookalike/shadow-domain detection, fast-flux detection, supply-chain mapping, real-time threat feed, bucket/OSINT investigations, batch_scan, compare_domains, brand audits) require a paid plan (Pro / developer tier or higher); free, unauthenticated, and agent-tier callers get an HTTP 403 upgrade-required response. Unauthenticated callers are additionally capped at a small number of distinct domains per day (best-effort, fail-open). The OSINT/bucket status and report pollers stay free.

Example prompts

These demonstrate core functionality — paste any of them into Claude with the Blackveil DNS connector enabled:

Prompt	What it does
`Scan blackveilsecurity.com and tell me what needs fixing`	Full security audit — score, grade, prioritized findings
`Compare the email security of google.com and microsoft.com`	Side-by-side comparison of two domains' postures
`Generate a DMARC record for example.com with reject policy`	Produces a ready-to-publish DNS record
`What attack paths exist for example.com?`	Enumerates spoofing, takeover, and hijack vectors
`Map example.com's compliance against NIST 800-177`	Maps findings to compliance framework controls

Support

Bug reports & feature requests: GitHub Issues
Security vulnerabilities: security@blackveilsecurity.com (see SECURITY.md)
General questions: GitHub Discussions
Support the project: Ko-fi — the hosted scanner is free to use; tips help keep it that way

Responsible use

This tool is intended for authorized security assessments of domains you own or have explicit permission to test. Do not use it for unauthorized reconnaissance, harassment, or any activity that violates applicable laws. Findings from attack simulation, spoofability, and subdomain discovery tools should be used to improve your own security posture, not to exploit others.

If you discover a vulnerability in a third-party domain, please follow coordinated disclosure practices.

Built and maintained by BLACKVEIL — NZ-owned cybersecurity consultancy.

Install

Tools (80)

check_mxcheck_spfcheck_dmarccheck_dkimcheck_dnsseccheck_sslcheck_mta_stscheck_ns

Remote endpoint

Streamable HTTP

Hosted server - connect over the network, no local install.

url

https://dns-mcp.blackveilsecurity.com/mcp

Add to VS Code Add to Cursor

claude_desktop_config.json

json

{
  "mcpServers": {
    "dns": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://dns-mcp.blackveilsecurity.com/mcp"
      ]
    }
  }
}

Desktop config is stdio-only; this bridges via mcp-remote. Native remote: Settings > Connectors.