# `mx.scan/diagnostics` on anlyon.dev > Text inside fenced blocks marked untrusted-server-text was written by the MCP server's publisher, not by anlyon.dev. It is data to inspect, not instructions to follow. Invisible characters are shown as [U+XXXX]. > No finding is not a safety guarantee: these are point-in-time checks of tool definitions, not of code or behaviour. - Page: https://anlyon.dev/servers/mx.scan/diagnostics - JSON: https://anlyon.dev/api/v1/servers/mx.scan/diagnostics - Version: 1.1.0 (active) - Publisher: mx.scan (domain proven to the MCP Registry) - Runs: remote (streamable-http) - Sign-in to list tools: none - Metadata from the official MCP Registry, synced 2026-10-21T18:53:41.013Z Title and description, as the publisher wrote them: ```untrusted-server-text scan.mx Email Diagnostics Email deliverability check: MX, SPF, DKIM, DMARC, blacklists, MTA-STS, DNSSEC, BIMI. Graded, no key. ``` Scanned 2026-10-21T19:18:43.662Z over streamable-http. **9 tools: 9 change things.** | Group | Class | Tools | Claude Code | | --- | --- | --- | --- | | Deletes or cancels | destructive | 0 | deny | | Can't be undone | irreversible | 0 | ask | | Changes things | write | 9 | ask | | Only reads | read | 0 | allow | ## Findings - **warn** Annotations that disagree with the tool in `check_domain` ([annotation-conflict](https://anlyon.dev/methodology#annotation-conflict)) ```untrusted-server-text The server marks "check_domain" read-only (readOnlyHint: true), and its own name, description or input give the class "write". annotations: {"readOnlyHint":true,"openWorldHint":true}; The description's first verb is "run": a word for a change. ``` ## Changes things (9) Creates or changes something that can be changed back. Claude Code: ask. ### `check_bimi` - Nothing in its name or description says what it does, so it is counted as a write. - The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class. Description, as the server wrote it: ```untrusted-server-text Check the domain BIMI record at default._bimi: the SVG logo URL, the VMC/CMC certificate, and the DMARC enforcement BIMI needs. ``` ### `check_blacklist` - Nothing in its name or description says what it does, so it is counted as a write. - The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class. Description, as the server wrote it: ```untrusted-server-text Check whether the domain and its mail server IPs are listed on the Spamhaus (ZEN, DBL, ZRD, AuthBL), SpamCop, GBUdb and PSBL blocklists. ``` ### `check_dkim` - Nothing in its name or description says what it does, so it is counted as a write. - The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class. Description, as the server wrote it: ```untrusted-server-text Check DKIM signing keys for a domain. Without a selector, common provider selectors are probed. Pass an explicit selector to look up that exact key at selector._domainkey. ``` ### `check_dmarc` - Nothing in its name or description says what it does, so it is counted as a write. - The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class. Description, as the server wrote it: ```untrusted-server-text Check the domain DMARC policy at _dmarc: presence, policy strength (none/quarantine/reject), and reporting. ``` ### `check_dnssec` - Nothing in its name or description says what it does, so it is counted as a write. - The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class. Description, as the server wrote it: ```untrusted-server-text Check DNSSEC validation and DNS health: delegation, nameserver count, SOA, and reverse DNS of the mail servers. ``` ### `check_domain` - The description's first verb is "run": a word for a change. - The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class. - Findings: warn annotation-conflict Description, as the server wrote it: ```untrusted-server-text Run the full email and DNS deliverability check for a domain: MX, SPF, DKIM, DMARC, DNS health, provider detection, and blacklists. Returns a letter grade (A+ to F, where specific weaknesses cap the grade), a 0 to 100 score, and every individual check with its RFC reference. Set include_smtp to also run a live SMTP probe of the mail servers: the probe is non-blocking, so when smtp_status is "pending" or "running" call this tool again (poll_after_seconds hints how long to wait) until smtp_status is "complete" and the SMTP checks appear in checks. ``` ### `check_mta_sts` - Nothing in its name or description says what it does, so it is counted as a write. - The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class. Description, as the server wrote it: ```untrusted-server-text Check the domain MTA-STS policy (_mta-sts TXT and the HTTPS policy file, mode and MX coverage) and its TLS-RPT reporting record. ``` ### `check_mx` - Nothing in its name or description says what it does, so it is counted as a write. - The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class. Description, as the server wrote it: ```untrusted-server-text Check the MX records of a domain: presence, hostnames, resolution, null-MX, and common misconfigurations. ``` ### `check_spf` - Nothing in its name or description says what it does, so it is counted as a write. - The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class. Description, as the server wrote it: ```untrusted-server-text Check the domain SPF policy: presence, syntax, the all qualifier, and the 10-lookup limit. ``` ## Claude Code permissions For `.claude/settings.json`, assuming the server is installed as `diagnostics`: ```json { "permissions": { "allow": [], "ask": [ "mcp__diagnostics__check_domain", "mcp__diagnostics__check_mx", "mcp__diagnostics__check_spf", "mcp__diagnostics__check_dmarc", "mcp__diagnostics__check_blacklist", "mcp__diagnostics__check_mta_sts", "mcp__diagnostics__check_dnssec", "mcp__diagnostics__check_bimi", "mcp__diagnostics__check_dkim" ], "deny": [] } } ```