Skip to content

Agent Preflight: OFAC, DNS, Email Auth, Domain, Email & URL

by sdn-screen-x402.sdnscreen.workers.dev · remote · no sign-in to list tools · v1.3.0 · published by dev.workers.sdnscreen.sdn-screen-x402

$0.01/call via x402: OFAC wallet screen, DNS, email auth, domain age, email verify, URL unshorten.

Changes · 5
CompareRegistry entry

6 tools: 5 change things and 1 only read.

Scanned Oct 21, 2026

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http agent-preflight https://sdn-screen-x402.sdnscreen.workers.dev/mcp

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

6 tools

Changes things 5Claude Code: ask
  • email_auth_checkChecks a domain's email authentication: parses SPF (+all, ?all, multiple records, over 10 DNS lookups), DMARC (p, sp, pct, rua), DKIM keys (your selector or 15 common ones) and MX,…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Checks a domain's email authentication: parses SPF (+all, ?all, multiple records, over 10 DNS lookups), DMARC (p, sp, pct, rua), DKIM keys (your selector or 15 common ones) and MX, then returns an A-F grade, 0-100 score and coded issues (spf_missing, dmarc_p_none, ...). Use when an agent must judge if a domain can be spoofed, debug deliverability, or vet a sender/vendor domain. $0.01 USDC on Base. Paid tool: call it once to get the x402 PaymentRequired object, then retry with params._meta["x402/payment"].

    Annotations the server declares

    • title: Email Auth Check (SPF/DMARC/DKIM)
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • email_mx_verifyChecks an email address without sending mail or opening SMTP: syntax, domain exists, MX records (or RFC 5321 A/AAAA fallback), RFC 7505 null MX, MX host resolves, disposable-domain…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Checks an email address without sending mail or opening SMTP: syntax, domain exists, MX records (or RFC 5321 A/AAAA fallback), RFC 7505 null MX, MX host resolves, disposable-domain list (~9.9k domains), role account (info@, support@) and free provider. Verdict deliverable_domain, risky, undeliverable or unknown. Cannot prove the mailbox itself exists. Use when an agent validates a signup, lead or contact email before using it. $0.01 USDC. Paid tool: call it once to get the x402 PaymentRequired object, then retry with params._meta["x402/payment"].

    Annotations the server declares

    • title: Email Address Verify (MX, no SMTP)
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • ofac_wallet_screenScreens a crypto wallet address (EVM, BTC, TRON, SOL, XMR and every other chain OFAC lists) against all Digital Currency Addresses on the US Treasury OFAC SDN list.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Screens a crypto wallet address (EVM, BTC, TRON, SOL, XMR and every other chain OFAC lists) against all Digital Currency Addresses on the US Treasury OFAC SDN list. Returns sanctioned true/false, verdict block/no_match, SDN entity name, sdnType, programs and the list publish date. Use when an agent is about to send funds to, pay, or accept funds from an unfamiliar wallet. $0.01 USDC on Base. Paid tool: call it once to get the x402 PaymentRequired object, then retry with params._meta["x402/payment"].

    Annotations the server declares

    • title: OFAC SDN Wallet Screen
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • url_unshortenFollows a URL's HTTP redirects hop by hop (max 10, page bodies never read) and returns the final URL, status, the full chain and heuristic safety flags: shortener_used, cross_domai…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Follows a URL's HTTP redirects hop by hop (max 10, page bodies never read) and returns the final URL, status, the full chain and heuristic safety flags: shortener_used, cross_domain_redirect, https_downgrade, ip_address_host, punycode_host, userinfo_in_url, high_abuse_tld, credential_keyword_after_redirect, loops. Risk low/medium/high. Use before an agent clicks, fetches or forwards an unfamiliar or shortened link. Not a malware-reputation lookup. $0.01 USDC. Paid tool: call it once to get the x402 PaymentRequired object, then retry with params._meta["x402/payment"].

    Annotations the server declares

    • title: URL Unshorten & Redirect Check
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • whois_domain_ageLooks up a domain in its registry's RDAP server (the ICANN successor to WHOIS, found via the IANA bootstrap): registration date, age in days/years, newlyRegistered (<30 days), expi…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Looks up a domain in its registry's RDAP server (the ICANN successor to WHOIS, found via the IANA bootstrap): registration date, age in days/years, newlyRegistered (<30 days), expiry, last change, registrar name + IANA ID, EPP status, nameservers and DNSSEC. No personal contact data. Use when an agent must judge if a domain, sender or vendor is brand-new (a phishing/fraud signal). Unsupported TLDs return 400, uncharged. $0.01 USDC. Paid tool: call it once to get the x402 PaymentRequired object, then retry with params._meta["x402/payment"].

    Annotations the server declares

    • title: Domain Age & Registrar (RDAP)
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
Only reads 1Claude Code: allow
  • dns_lookupResolves live DNS records for any domain or hostname via 1.1.1.1: A, AAAA, CNAME, MX, NS, TXT, SOA and CAA in one call (type=ALL), or a single type incl.No findings

    Why it is in this group

    • The name "dns_lookup" says "lookup": a word for reading.
    Description, as the server wrote it
    Resolves live DNS records for any domain or hostname via 1.1.1.1: A, AAAA, CNAME, MX, NS, TXT, SOA and CAA in one call (type=ALL), or a single type incl. SRV, PTR, DS, DNSKEY, HTTPS. Clean JSON with TTLs, NXDOMAIN flag and DNSSEC-authenticated bit. A URL or email address is reduced to its host. Use when an agent needs to verify a domain, find mail servers or nameservers, or read TXT/SPF records. $0.01 USDC on Base. Paid tool: call it once to get the x402 PaymentRequired object, then retry with params._meta["x402/payment"].

    Annotations the server declares

    • title: DNS Records Lookup
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.3.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http agent-preflight https://sdn-screen-x402.sdnscreen.workers.dev/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__agent-preflight__dns_lookup"
    ],
    "ask": [
      "mcp__agent-preflight__ofac_wallet_screen",
      "mcp__agent-preflight__email_auth_check",
      "mcp__agent-preflight__whois_domain_age",
      "mcp__agent-preflight__email_mx_verify",
      "mcp__agent-preflight__url_unshorten"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as agent-preflight. Review it before you use it.