Skip to content

Domain Intelligence

by oti-labs.com · remote · no sign-in to list tools · v1.1.0 · published by com.oti-labs

WHOIS/RDAP, DNS, SSL, live subdomains with IPs, and SPF/DMARC/DKIM for any domain.

Changes · 4
CompareRegistry entry

6 tools: 4 change things and 2 only read.

Scanned Oct 21, 2026

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http domain-intelligence https://oti-labs.com/mcp

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

6 tools

Changes things 4Claude Code: ask
  • dns_recordsDNS records for a domain: A, AAAA, MX, TXT, NS, CAA and SOA, resolved in parallel.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    DNS records for a domain: A, AAAA, MX, TXT, NS, CAA and SOA, resolved in parallel.

    Annotations the server declares

    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: DNS records
  • email_securityEmail authentication for a domain: SPF and DMARC records, and DKIM keys found by probing about 29 common selectors (Google, Microsoft 365, Mailchimp, SendGrid and others).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Email authentication for a domain: SPF and DMARC records, and DKIM keys found by probing about 29 common selectors (Google, Microsoft 365, Mailchimp, SendGrid and others). Custom selectors may not be found.

    Annotations the server declares

    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Email security (SPF, DMARC, DKIM)
  • ssl_certificateThe certificate a domain serves on port 443, from a live TLS handshake: issuer, subject, valid_from, valid_to, days_until_expiry, SANs, signature algorithm and serial number.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    The certificate a domain serves on port 443, from a live TLS handshake: issuer, subject, valid_from, valid_to, days_until_expiry, SANs, signature algorithm and serial number.

    Annotations the server declares

    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: SSL certificate
  • subdomainsSubdomains of a domain from certificate transparency logs, passive DNS and DNS brute force.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Subdomains of a domain from certificate transparency logs, passive DNS and DNS brute force. `live` lists hosts that resolve now, each with its IP; `subdomains` lists every name found, live first; `pools` summarises large shared-infrastructure zones. The first lookup of a domain is a fast snapshot and later ones are fuller; set wait=true to wait for every source (up to about 20 s).

    Annotations the server declares

    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Subdomains
Only reads 2Claude Code: allow
  • domain_lookupFull report on a domain in one call: WHOIS/RDAP registration, DNS records, live SSL certificate, subdomains (live hosts with IPs first) and email authentication (SPF, DMARC, DKIM).No findings

    Why it is in this group

    • The name "domain_lookup" says "lookup": a word for reading.
    Description, as the server wrote it
    Full report on a domain in one call: WHOIS/RDAP registration, DNS records, live SSL certificate, subdomains (live hosts with IPs first) and email authentication (SPF, DMARC, DKIM). Use it to triage a suspicious domain or profile a company's domain. If one section fails it comes back as an object with an `error` field and the rest is unaffected. Set wait=true to wait for every subdomain source (up to about 20 s) instead of the fast first result.

    Annotations the server declares

    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Full domain lookup
  • whois_lookupRegistration data for a domain: registrar, created, updated and expiry dates, nameservers and status.No findings

    Why it is in this group

    • The name "whois_lookup" says "lookup": a word for reading.
    Description, as the server wrote it
    Registration data for a domain: registrar, created, updated and expiry dates, nameservers and status. RDAP first (rdap.org, IANA bootstrap, 22 fallback servers), then port-43 WHOIS for 60+ TLDs. `_source` says which one answered. Use it for domain age, expiry or registrar checks.

    Annotations the server declares

    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: WHOIS / RDAP lookup

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.1.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http domain-intelligence https://oti-labs.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__domain-intelligence__domain_lookup",
      "mcp__domain-intelligence__whois_lookup"
    ],
    "ask": [
      "mcp__domain-intelligence__dns_records",
      "mcp__domain-intelligence__ssl_certificate",
      "mcp__domain-intelligence__subdomains",
      "mcp__domain-intelligence__email_security"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as domain-intelligence. Review it before you use it.