Skip to content

Cognita

by fmelo.net · remote · no sign-in to list tools · v1.0.34 · published by net.fmelo

Passive OSINT and security recon: DNS, TLS, email posture, IP reputation, CVE/KEV, CT logs.

Final · 1Changes · 32
CompareRegistry entry

51 tools: 1 do something that can't be undone, 32 change things and 18 only read.

Scanned Oct 21, 2026

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http cognita https://cognita.fmelo.net/mcp

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

51 tools

Can't be undone 1Claude Code: ask
  • zone_transfer_checkTest whether a domain's authoritative name servers allow a DNS zone transfer (AXFR) — a classic misconfiguration that leaks the entire zone (every hostname it holds) to anyone who …No findings

    Why it is in this group

    • The name "zone_transfer_check" says "transfer": a word for a change that another call does not undo.
    Description, as the server wrote it
    Test whether a domain's authoritative name servers allow a DNS zone transfer (AXFR) — a classic misconfiguration that leaks the entire zone (every hostname it holds) to anyone who asks (RFC 5936: AXFR must be limited to authorised secondaries). Returns a per-name-server verdict — 'transferred' (leaked — the finding), 'refused'/'notauth' (declined, the safe default), 'timeout'/'unreachable', or 'blocked' (the NS resolved to an internal address and wasn't contacted) — with a sample of the disclosed records. Read-only external check over DNS/TCP; never touches the target's application.
Changes things 32Claude Code: ask
  • asn_geoipGeolocate an IP address (or a host's resolved IP): ASN, network organisation, and approximate city/country.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Geolocate an IP address (or a host's resolved IP): ASN, network organisation, and approximate city/country. Requires a configured GeoIP database. Read-only.
  • asn_relationsReport an autonomous system's BGP relationships via RIPEstat (keyless): its upstreams (transit providers), downstreams (customers) and peers, from observed AS paths — the neighbour…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Report an autonomous system's BGP relationships via RIPEstat (keyless): its upstreams (transit providers), downstreams (customers) and peers, from observed AS paths — the neighbour ASNs ordered by how often the relationship is seen. The connectivity map around the network, complementing asn_prefixes (its routed footprint). Read-only.
  • blacklist_checkCheck whether a mail server is listed on common email DNS blocklists (DNSBLs).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Check whether a mail server is listed on common email DNS blocklists (DNSBLs). For a domain, its mail (MX) IPs are checked — what matters for email reputation — falling back to the A record when there is no MX; a literal IP is checked directly. Read-only DNS queries.
  • caa_dnssecReport a domain's CAA records (which CAs may issue its certificates) and an indicative DNSSEC signal (DNSKEY presence + Authenticated-Data flag — not a full chain validation).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Report a domain's CAA records (which CAs may issue its certificates) and an indicative DNSSEC signal (DNSKEY presence + Authenticated-Data flag — not a full chain validation). Read-only.
  • cert_revocationReport the revocation posture of the certificate a host serves: the OCSP responder(s) and CRL distribution point(s) a client could use to check revocation, and whether the certific…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Report the revocation posture of the certificate a host serves: the OCSP responder(s) and CRL distribution point(s) a client could use to check revocation, and whether the certificate is must-staple (TLS-feature status_request, forcing a stapled OCSP response). Reads these straight from the leaf certificate — it does NOT perform a live OCSP/CRL lookup, so it answers 'can revocation be checked, and how?' not 'is it revoked now?'. Complements tls_certificate. Makes only a benign TLS handshake to the target (no HTTP request); guarded against internal targets.
  • cert_transparencyEnumerate a domain's subdomains and certificate-issuance history from public Certificate Transparency logs (crt.sh): the names ever certified under it, issuing CAs, and the issuanc…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Enumerate a domain's subdomains and certificate-issuance history from public Certificate Transparency logs (crt.sh): the names ever certified under it, issuing CAs, and the issuance span. Reveals names even behind a CDN and never touches the target. CT is historical — for a domain that changed hands, older names belong to a previous owner; pass `since` (the current registration date) to exclude them. Read-only.
  • cve_triagePrioritise a host's internet-exposed CVEs: takes the CVEs from host_exposure (Shodan InternetDB) and enriches each with CISA KEV (confirmed exploited in the wild) and FIRST EPSS (e…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Prioritise a host's internet-exposed CVEs: takes the CVEs from host_exposure (Shodan InternetDB) and enriches each with CISA KEV (confirmed exploited in the wild) and FIRST EPSS (exploit probability), then ranks them so the ones to patch first come first — KEV entries, then highest EPSS. Each CVE gets a priority of critical/high/medium/low. For a host name the first resolved IP is used. Keyless, read-only — one cached KEV fetch and one batched EPSS request cover every CVE.
  • disclosure_contactsConsolidate where and how to report a security issue for a domain: the owner's own published channel (security_txt — RFC 9116 Contact, Policy, PGP key) and the network operator's r…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Consolidate where and how to report a security issue for a domain: the owner's own published channel (security_txt — RFC 9116 Contact, Policy, PGP key) and the network operator's registered abuse mailbox (abuse_contact, RIPEstat). Returns both sets of contacts and a clear yes/no on whether any reporting channel exists. Keyless, read-only.
  • dns_propagationAsk several independent public resolvers (Google, Cloudflare, DNS.SB, NextDNS) the same record over DNS-over-HTTPS and compare their answers.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Ask several independent public resolvers (Google, Cloudflare, DNS.SB, NextDNS) the same record over DNS-over-HTTPS and compare their answers. Returns each resolver's record set and DNS status, whether they all agree, and a note. Agreement is normal; a divergence flags a change still propagating, a stale cache, or split-horizon DNS — except when every resolver got addresses that all sit in one network (geoBalanced, with the shared ASN): that is a CDN/anycast or geo-DNS answering each resolver's location with its nearest edge, which is expected. Reads the resolvers' views — never queries the target host. Supports A/AAAA/CNAME/MX/NS/TXT/SOA/CAA. Read-only.
  • dshield_ip_checkLook up an IP's reputation in the SANS Internet Storm Center (DShield) data (keyless): how many attack reports it has across how many target sensors over the observed window, the n…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Look up an IP's reputation in the SANS Internet Storm Center (DShield) data (keyless): how many attack reports it has across how many target sensors over the observed window, the network/AS it belongs to, and which ISC threat feeds list it. A high report count is a scanning/attacking signal. For a host name the first resolved IP is used. Read-only.
  • email_header_analyzerParse pasted raw email headers: the Received: delivery path with per-hop delays, the SPF/DKIM/DMARC verdicts, the originating IP, and spoofing warnings.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Parse pasted raw email headers: the Received: delivery path with per-hop delays, the SPF/DKIM/DMARC verdicts, the originating IP, and spoofing warnings. Pure parsing — no network.
  • email_postureReport a domain's modern email-security records beyond SPF/DMARC/DKIM: MTA-STS (DNS record + fetched policy: enforce/testing mode, max_age, MX), TLS-RPT (reporting address) and BIM…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Report a domain's modern email-security records beyond SPF/DMARC/DKIM: MTA-STS (DNS record + fetched policy: enforce/testing mode, max_age, MX), TLS-RPT (reporting address) and BIMI (brand logo + VMC), with warnings on what is missing or weak. Read-only DNS plus one GET of the public MTA-STS policy file.
  • feodo_c2_checkCheck an IP against abuse.ch's Feodo Tracker botnet command-and-control blocklist (keyless): a hit means the IP is a known C2 server for a malware family (Emotet, Dridex, QakBot, T…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Check an IP against abuse.ch's Feodo Tracker botnet command-and-control blocklist (keyless): a hit means the IP is a known C2 server for a malware family (Emotet, Dridex, QakBot, TrickBot, …), with the malware name, port and first-seen date. For a host name the first resolved IP is used. Threat-intel about the IP — never touches the target. Read-only.
  • host_exposureReport a host's internet-facing exposure from Shodan's InternetDB (keyless): open ports, detected products (CPEs), known CVEs, hostnames and tags.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Report a host's internet-facing exposure from Shodan's InternetDB (keyless): open ports, detected products (CPEs), known CVEs, hostnames and tags. Passive — reads Shodan's own scan data, never touches the target. For a domain the first resolved IP is used (behind a CDN this reflects the edge, not the origin). Read-only.
  • hsts_preload_checkCheck whether a domain is in the browsers' HSTS preload list (via hstspreload.org's keyless status API): the status (preloaded/pending/unknown), whether it was bulk-imported, and t…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Check whether a domain is in the browsers' HSTS preload list (via hstspreload.org's keyless status API): the status (preloaded/pending/unknown), whether it was bulk-imported, and the parent domain it may be covered through. Preloaded domains are forced to HTTPS by browsers from the very first visit, before any HSTS header is seen — a stronger guarantee than the Strict-Transport-Security header alone. A membership lookup, never a probe of the target. Read-only.
  • investigateRun a full reconnaissance sweep of a domain or URL and return a correlated report: web-security grade (via Astur), email-authentication posture (SPF/DMARC), nameservers, MX, regist…No findings

    Why it is in this group

    • The description's first verb is "run": a word for a change.
    Description, as the server wrote it
    Run a full reconnaissance sweep of a domain or URL and return a correlated report: web-security grade (via Astur), email-authentication posture (SPF/DMARC), nameservers, MX, registrar, subdomains from Certificate Transparency logs, the resolved IP's exposure (Shodan InternetDB) and reputation (GreyNoise), an overall roll-up grade, and prioritised highlights. Pass depth="deep" to also run the heavier OSINT (more calls, slower): RPKI route-origin validity, where to report a security issue (security.txt + the network's abuse mailbox), a dangling-CNAME subdomain-takeover scan, the resolved IP's folded reputation verdict (Spamhaus/FireHOL blocklists, GreyNoise, Feodo C2, Tor, DShield), the transport-security grade (certificate, revocation, HSTS preload) and the exposed CVEs ranked by KEV+EPSS — which can only WORSEN the overall grade (a malicious IP forces F; a D/F TLS posture or a known-exploited CVE floors it), never lift the web grade. Use this for broad 'investigate X' requests; use the granular tools (scan_site, spf_check, …) for specific questions.
  • ip_blocklist_checkCheck whether an IP sits inside a netblock on a curated keyless reputation list — Spamhaus DROP/EDROP (networks judged hijacked or bad-actor-controlled) and FireHOL level1 (a conse…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Check whether an IP sits inside a netblock on a curated keyless reputation list — Spamhaus DROP/EDROP (networks judged hijacked or bad-actor-controlled) and FireHOL level1 (a conservative aggregate of established abuse lists). Returns each list that matched with the matching CIDR and a reference, and which lists were reachable. Different from ip_reputation (GreyNoise scanner telemetry) and blacklist_check (mail DNSBLs): this is 'sits in a known-bad network' reputation. For a host name the first resolved IP is used. Read-only, never contacts the target.
  • ip_reputationCheck an IP against GreyNoise's Community data: whether it is internet background 'noise' (a mass scanner) and, if so, GreyNoise's classification — 'malicious', 'benign' (an identi…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Check an IP against GreyNoise's Community data: whether it is internet background 'noise' (a mass scanner) and, if so, GreyNoise's classification — 'malicious', 'benign' (an identified research scanner such as Shodan, Censys or Modat) or 'unknown' — with its name and when it was last seen. A 'not observed' result means GreyNoise hasn't seen the IP scanning; it is not an endorsement. Often unavailable: GreyNoise's keyless quota is only 25 lookups per week for this whole server, shared by every user — when it is used up the tool says so at once, with when it resets, instead of querying. For a host name, the first resolved IP is used. Read-only.
  • ip_reputation_aggregateFold every keyless IP-reputation source into one verdict — clean / suspicious / malicious / unknown: ip_blocklist_check (Spamhaus DROP + FireHOL), ip_reputation (GreyNoise), feodo_…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Fold every keyless IP-reputation source into one verdict — clean / suspicious / malicious / unknown: ip_blocklist_check (Spamhaus DROP + FireHOL), ip_reputation (GreyNoise), feodo_c2_check (botnet C2), tor_exit_check and dshield_ip_check (attack telemetry). Returns the verdict, which signals fired, and which sources answered or failed. A confirmed-bad listing forces 'malicious'; scanner/attack/Tor signals raise 'suspicious', except a research scanner GreyNoise identifies as benign (Shodan, Censys, Modat…), which is flagged but not treated as hostile; 'unknown' when too few sources answered to vouch for the IP. GreyNoise is often unavailable (a keyless quota of 25 lookups/week shared by the whole server); the verdict then rests on the other five sources and lists GreyNoise under sources failed. For a host name the first resolved IP is used. Keyless, read-only — queries the sources about the IP, never the IP itself.
  • kev_checkCheck whether a CVE is in CISA's Known Exploited Vulnerabilities (KEV) catalogue — i.e.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Check whether a CVE is in CISA's Known Exploited Vulnerabilities (KEV) catalogue — i.e. confirmed exploited in the wild, the strongest 'patch this now' signal. Returns the vendor/product, when it was added, the remediation due date, and whether it's used in known ransomware campaigns. Interprets the CVE IDs host_exposure surfaces. Keyless, read-only.
  • passive_dnsHistorical DNS resolutions for a domain or IP from Mnemonic's keyless Passive DNS: the answers a name resolved to over time (or the names that pointed at an IP), each with a first/…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Historical DNS resolutions for a domain or IP from Mnemonic's keyless Passive DNS: the answers a name resolved to over time (or the names that pointed at an IP), each with a first/last-seen window and observation count. Surfaces old/rotated infrastructure a live lookup can't. Reads the passive-DNS database, never the target. Read-only.
  • rdapLook up registration data for a domain or IP via RDAP (the modern JSON successor to WHOIS): handle, name, statuses and lifecycle events, plus the raw record.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Look up registration data for a domain or IP via RDAP (the modern JSON successor to WHOIS): handle, name, statuses and lifecycle events, plus the raw record. Read-only.
  • reverse_dnsReverse-resolve an IP address to its PTR host name(s).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Reverse-resolve an IP address to its PTR host name(s). Read-only.
  • robots_sitemapPassively read a site's robots.txt and the sitemap it points to.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Passively read a site's robots.txt and the sitemap it points to. Returns the disallowed paths (often naming admin/staging areas — a recon signal), any declared crawl-delay, the sitemap URL(s), and — for the one sitemap fetched — whether it is a sitemap index, how many <loc> entries it holds, and a sample of them. Reads only these two public, owner-published files; it does NOT crawl, guess, or brute-force paths (that active content discovery is scan_site/Astur's job). Read-only.
  • scan_siteRun a passive web-security scan of a URL (via Astur).No findings

    Why it is in this group

    • The description's first verb is "run": a word for a change.
    Description, as the server wrote it
    Run a passive web-security scan of a URL (via Astur). Returns an A–F grade, a 0–100 score and findings mapped to OWASP WSTG/ASVS. Non-intrusive — no active probing of the target.
  • spf_expandFully expand a domain's SPF record: follow every include: and redirect= recursively and count the DNS-lookup mechanisms across the WHOLE tree against the RFC 7208 limit of 10 — the…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Fully expand a domain's SPF record: follow every include: and redirect= recursively and count the DNS-lookup mechanisms across the WHOLE tree against the RFC 7208 limit of 10 — the real-world failure spf_check misses, where a nested include quietly pushes the total over 10 and the record hits permerror. Returns the flattened include tree, the total lookup count, and warnings on excess, loops or void lookups. DNS-only, read-only.
  • spoofabilityJudge how easily a domain's mail can be forged by correlating SPF and DMARC into one verdict: 'hardened' (DMARC enforcing), 'partial' (DMARC quarantine) or 'spoofable' (no DMARC or…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Judge how easily a domain's mail can be forged by correlating SPF and DMARC into one verdict: 'hardened' (DMARC enforcing), 'partial' (DMARC quarantine) or 'spoofable' (no DMARC or p=none — receivers won't reject forged mail), with an A–F grade and the concrete reasons. The controlling factor is DMARC: SPF alone doesn't stop a From: spoof. Read-only DNS.
  • subdomain_takeover_checkCheck a domain's subdomains (enumerated from Certificate Transparency) for dangling-CNAME takeover risk: a CNAME that delegates to a third-party service (GitHub Pages, S3, Heroku, …No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Check a domain's subdomains (enumerated from Certificate Transparency) for dangling-CNAME takeover risk: a CNAME that delegates to a third-party service (GitHub Pages, S3, Heroku, Azure, Netlify, …) which no longer claims the name. Status is 'vulnerable' (the service's unclaimed-page fingerprint was seen), 'dangling' (CNAME to the service but the name no longer resolves), or 'potential' (still resolves, unconfirmed). DNS-first; an HTTP GET runs only for CNAME matches, to confirm the fingerprint.
  • tls_postureGrade a host's transport security A–F in one call, correlating tls_certificate (validity, chain trust, protocol, key/signature), cert_revocation (OCSP/CRL endpoints, must-staple) a…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Grade a host's transport security A–F in one call, correlating tls_certificate (validity, chain trust, protocol, key/signature), cert_revocation (OCSP/CRL endpoints, must-staple) and hsts_preload_check (browser HSTS preload). Returns the letter grade, a 0–100 score, and the factors behind it (expired/weak-key/obsolete-protocol lower it; must-staple and HSTS preload strengthen it). A benign TLS handshake plus a keyless HSTS lookup — no probing. Read-only.
  • tor_exit_checkCheck whether an IP is a current Tor exit node, from the Tor Project's public bulk exit list (keyless).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Check whether an IP is a current Tor exit node, from the Tor Project's public bulk exit list (keyless). Exit traffic is anonymised, so an IP seen in logs may not be the true origin — a useful context signal. For a host name the first resolved IP is used. Read-only.
  • tranco_rankReport a domain's popularity on the Tranco research list (keyless): its rank in the top ~1M sites, a band (top-1k/10k/100k/1M or 'unranked'), and how many recent daily lists it app…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Report a domain's popularity on the Tranco research list (keyless): its rank in the top ~1M sites, a band (top-1k/10k/100k/1M or 'unranked'), and how many recent daily lists it appears in. A cheap context signal — a top-1k domain and an unranked one warrant very different scrutiny, and an unexpectedly unranked lookalike is a phishing tell. Reads Tranco's database, never the target. Read-only.
  • typosquat_scanGenerate lookalike variants of a domain (omission, transposition, homoglyph, adjacent-key, hyphenation and TLD-swap typos) and report which ones actually resolve in DNS — the regis…No findings

    Why it is in this group

    • The description's first verb is "generate": a word for a change.
    Description, as the server wrote it
    Generate lookalike variants of a domain (omission, transposition, homoglyph, adjacent-key, hyphenation and TLD-swap typos) and report which ones actually resolve in DNS — the registered lookalikes worth checking for phishing or brand abuse. DNS-only and read-only; never touches the target. Candidate generation is bounded so the scan stays quick.
Only reads 18Claude Code: allow
  • abuse_contactFind the abuse-reporting e-mail(s) for an IP (or a host's resolved IP) via RIPEstat's abuse-contact-finder — where to report a scanner or attacker surfaced by ip_reputation.No findings

    Why it is in this group

    • The description's first verb is "find": a word for reading.
    Description, as the server wrote it
    Find the abuse-reporting e-mail(s) for an IP (or a host's resolved IP) via RIPEstat's abuse-contact-finder — where to report a scanner or attacker surfaced by ip_reputation. Read-only.
  • asn_prefixesList the IP prefixes an autonomous system announces (via RIPEstat), with the network holder — the routed footprint of an ASN.No findings

    Why it is in this group

    • The description's first verb is "list": a word for reading.
    Description, as the server wrote it
    List the IP prefixes an autonomous system announces (via RIPEstat), with the network holder — the routed footprint of an ASN. Read-only.
  • cve_lookupLook up a CVE in the NVD (NIST National Vulnerability Database): its description, CVSS base score / severity / vector, CWE weakness IDs, publication dates and references.No findings

    Why it is in this group

    • The name "cve_lookup" says "lookup": a word for reading.
    Description, as the server wrote it
    Look up a CVE in the NVD (NIST National Vulnerability Database): its description, CVSS base score / severity / vector, CWE weakness IDs, publication dates and references. Turns a bare CVE ID (e.g. one from host_exposure) into meaning. Keyless (NVD is rate-limited without a key), read-only.
  • dkim_lookupFetch a domain's DKIM public-key record for a given selector (<selector>._domainkey.<domain>).No findings

    Why it is in this group

    • The name "dkim_lookup" says "lookup": a word for reading.
    Description, as the server wrote it
    Fetch a domain's DKIM public-key record for a given selector (<selector>._domainkey.<domain>). The selector comes from an email's DKIM-Signature s= tag or a known default. Read-only.
  • dmarc_checkFetch and analyse a domain's DMARC record (_dmarc TXT): the policy (none/quarantine/reject) and warnings on a weak or missing policy.No findings

    Why it is in this group

    • The description's first verb is "fetch": a word for reading.
    Description, as the server wrote it
    Fetch and analyse a domain's DMARC record (_dmarc TXT): the policy (none/quarantine/reject) and warnings on a weak or missing policy. Read-only.
  • dns_lookupResolve DNS records for a host name.No findings

    Why it is in this group

    • The name "dns_lookup" says "lookup": a word for reading.
    Description, as the server wrote it
    Resolve DNS records for a host name. Returns A, AAAA, MX, TXT, NS, CNAME and SOA by default; pass 'types' to narrow. Read-only.
  • epss_scoreGet a CVE's EPSS score (FIRST's Exploit Prediction Scoring System): the probability (0–1) it will be exploited in the next 30 days, and its percentile rank among all CVEs.No findings

    Why it is in this group

    • The description's first verb is "get": a word for reading.
    Description, as the server wrote it
    Get a CVE's EPSS score (FIRST's Exploit Prediction Scoring System): the probability (0–1) it will be exploited in the next 30 days, and its percentile rank among all CVEs. A forward-looking likelihood that complements kev_check's confirmed exploitation. Keyless, read-only.
  • geo_routeShow the network path from the caller to a target host on a world map: origin (the caller's IP — the user when the agent runs client-side), destination (the target's geolocation), …No findings

    Why it is in this group

    • The description's first verb is "show": a word for reading.
    Description, as the server wrote it
    Show the network path from the caller to a target host on a world map: origin (the caller's IP — the user when the agent runs client-side), destination (the target's geolocation), and the great-circle distance. Returns structured endpoints plus a link to an SVG map (the image itself is for the human, not the model). Makes no connection to the target.
  • mx_lookupList a domain's mail exchangers (MX), ordered by preference, with each host's resolved IP addresses.No findings

    Why it is in this group

    • The name "mx_lookup" says "lookup": a word for reading.
    Description, as the server wrote it
    List a domain's mail exchangers (MX), ordered by preference, with each host's resolved IP addresses. Read-only.
  • rpki_validationValidate the BGP route-origin of an IP or prefix against RPKI (via RIPEstat): valid / invalid / unknown for the announcing ASN and covering prefix.No findings

    Why it is in this group

    • The description's first verb is "validate": a word for reading.
    Description, as the server wrote it
    Validate the BGP route-origin of an IP or prefix against RPKI (via RIPEstat): valid / invalid / unknown for the announcing ASN and covering prefix. 'invalid' means the origin isn't authorised by a ROA (possible hijack or misconfiguration); 'unknown' means no ROA covers the prefix. For a host name the first resolved IP is used. Read-only.
  • security_txtFetch a site's vulnerability-disclosure file (RFC 9116) from /.well-known/security.txt (falling back to /security.txt): the declared security Contact(s), Expires date and whether i…No findings

    Why it is in this group

    • The description's first verb is "fetch": a word for reading.
    Description, as the server wrote it
    Fetch a site's vulnerability-disclosure file (RFC 9116) from /.well-known/security.txt (falling back to /security.txt): the declared security Contact(s), Expires date and whether it has lapsed, PGP Encryption key, Policy/Acknowledgments links, preferred languages, and whether the file is PGP-signed, plus conformance warnings. A read of a public, owner-published file — complements abuse_contact (the RIR's registered mailbox) with the owner's own disclosure channel. Read-only, no probing.
  • spf_checkFetch and analyse a domain's SPF record: the parsed DNS-lookup count (RFC 7208 limit is 10), the 'all' qualifier, and warnings on a missing or permissive policy.No findings

    Why it is in this group

    • The description's first verb is "fetch": a word for reading.
    Description, as the server wrote it
    Fetch and analyse a domain's SPF record: the parsed DNS-lookup count (RFC 7208 limit is 10), the 'all' qualifier, and warnings on a missing or permissive policy. Read-only.
  • tls_certificateInspect the leaf certificate a host serves on a live TLS handshake: subject, issuer, subject-alternative names, validity window and days to expiry, key and signature algorithms, se…No findings

    Why it is in this group

    • The description's first verb is "inspect": a word for reading.
    Description, as the server wrote it
    Inspect the leaf certificate a host serves on a live TLS handshake: subject, issuer, subject-alternative names, validity window and days to expiry, key and signature algorithms, serial, thumbprint, the negotiated TLS protocol/cipher, and the chain with its trust verdict. Complements cert_transparency (historical CT logs) with the certificate presented right now. Makes a benign TLS handshake to the target (no HTTP request); guarded against internal targets.
  • urlscan_lookupSearch urlscan.io's public scan database (keyless) for a domain or IP: recent public scans of the site itself (its own pages, not other sites that merely load something from it) wi…No findings

    Why it is in this group

    • The name "urlscan_lookup" says "lookup": a word for reading.
    Description, as the server wrote it
    Search urlscan.io's public scan database (keyless) for a domain or IP: recent public scans of the site itself (its own pages, not other sites that merely load something from it) with each page's final URL, resolved IP, hosting country/server/ASN, and links to the scan result and its screenshot, plus a roll-up of the related domains urlscan saw serving the pages. Reads urlscan's data, never the target. A caller can pass a raw urlscan field query (e.g. `ip:1.2.3.4`). Read-only.
  • wayback_snapshotReport the first and most recent captures of a domain in the Internet Archive's Wayback Machine (keyless CDX), with a link to each snapshot — a site-age / history signal (how far b…No findings

    Why it is in this group

    • The name "wayback_snapshot" says "snapshot": a word for reading.
    Description, as the server wrote it
    Report the first and most recent captures of a domain in the Internet Archive's Wayback Machine (keyless CDX), with a link to each snapshot — a site-age / history signal (how far back it is archived), complementing wayback_urls (which lists archived URLs). Read-only.
  • wayback_urlsList a domain's historical URLs captured by the Internet Archive Wayback Machine (CDX API, keyless): old endpoints, forgotten paths and files no longer on the live site, across the…No findings

    Why it is in this group

    • The description's first verb is "list": a word for reading.
    Description, as the server wrote it
    List a domain's historical URLs captured by the Internet Archive Wayback Machine (CDX API, keyless): old endpoints, forgotten paths and files no longer on the live site, across the domain and its subdomains. Passive OSINT — reads the archive, never the target. Read-only.

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.0.34. Values in angle brackets are yours to fill in.

claude mcp add --transport http cognita https://cognita.fmelo.net/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__cognita__asn_prefixes",
      "mcp__cognita__ct_org_search",
      "mcp__cognita__geo_route",
      "mcp__cognita__dmarc_check",
      "mcp__cognita__rpki_validation",
      "mcp__cognita__cve_lookup",
      "mcp__cognita__tls_certificate",
      "mcp__cognita__dns_lookup",
      "mcp__cognita__abuse_contact",
      "mcp__cognita__epss_score",
      "mcp__cognita__spf_check",
      "mcp__cognita__wayback_snapshot",
      "mcp__cognita__related_domains",
      "mcp__cognita__urlscan_lookup",
      "mcp__cognita__mx_lookup",
      "mcp__cognita__dkim_lookup",
      "mcp__cognita__wayback_urls",
      "mcp__cognita__security_txt"
    ],
    "ask": [
      "mcp__cognita__cve_triage",
      "mcp__cognita__typosquat_scan",
      "mcp__cognita__email_header_analyzer",
      "mcp__cognita__dns_propagation",
      "mcp__cognita__email_posture",
      "mcp__cognita__tls_posture",
      "mcp__cognita__feodo_c2_check",
      "mcp__cognita__tranco_rank",
      "mcp__cognita__spoofability",
      "mcp__cognita__subdomain_takeover_check",
      "mcp__cognita__dshield_ip_check",
      "mcp__cognita__host_exposure",
      "mcp__cognita__scan_site",
      "mcp__cognita__kev_check",
      "mcp__cognita__reverse_dns",
      "mcp__cognita__ip_reputation",
      "mcp__cognita__hsts_preload_check",
      "mcp__cognita__disclosure_contacts",
      "mcp__cognita__rdap",
      "mcp__cognita__tor_exit_check",
      "mcp__cognita__robots_sitemap",
      "mcp__cognita__passive_dns",
      "mcp__cognita__ip_blocklist_check",
      "mcp__cognita__spf_expand",
      "mcp__cognita__asn_relations",
      "mcp__cognita__cert_revocation",
      "mcp__cognita__cert_transparency",
      "mcp__cognita__zone_transfer_check",
      "mcp__cognita__investigate",
      "mcp__cognita__blacklist_check",
      "mcp__cognita__ip_reputation_aggregate",
      "mcp__cognita__asn_geoip",
      "mcp__cognita__caa_dnssec"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as cognita. Review it before you use it.