net.
by softricks.net · remote · no sign-in to list tools · v1.0.0 · published by net.softricks
Professional DNS diagnostics: 14 tools for DNS, DNSSEC, email security, SSL, and propagation.
19 tools: 12 change things and 7 only read.
Scanned Oct 21, 2026
- Deletes or cancels0Claude Code: deny
- Can't be undone0Claude Code: ask
- Changes things12Claude Code: ask: see these tools
- Only reads7Claude Code: allow: see these tools
No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport sse idig-dns https://mcp.softricks.net/sseTools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
19 tools
Changes things 12Claude Code: ask
blacklist_checkIP blacklist / DNSBL check.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it IP blacklist / DNSBL check. Tests A-record and MX IPs against Spamhaus, Barracuda, SpamCop, SORBS, and more.
diagnoseFull diagnosis combining resolution + DNSSEC.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Full diagnosis combining resolution + DNSSEC. Use first when something is broken.
dnssec_healthDNSSEC health report: key inventory, signature expiry, algorithm assessment, DS at parent, rollover readiness, full chain of trust (Root → TLD → Domain) with chain_intact flag and …No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it DNSSEC health report: key inventory, signature expiry, algorithm assessment, DS at parent, rollover readiness, full chain of trust (Root → TLD → Domain) with chain_intact flag and broken-link identification, warnings, and recommendations.
email_security_auditFull SPF, DKIM, DMARC, and BIMI audit with A-F grade and prioritized fix recommendations.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Full SPF, DKIM, DMARC, and BIMI audit with A-F grade and prioritized fix recommendations.
http_checkHTTP/HTTPS reachability: status codes, redirect chain, HSTS header, HTTP→HTTPS redirect detection.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it HTTP/HTTPS reachability: status codes, redirect chain, HSTS header, HTTP→HTTPS redirect detection.
mx_checkMX health + provider detection: Google Workspace, M365, Proofpoint, Zoho, 35+ providers.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it MX health + provider detection: Google Workspace, M365, Proofpoint, Zoho, 35+ providers.
propagation_checkCheck DNS propagation across 16 global resolvers: Google, Cloudflare, Quad9, China, Korea, Russia.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Check DNS propagation across 16 global resolvers: Google, Cloudflare, Quad9, China, Korea, Russia.
ssl_checkSSL certificate: validity, expiry countdown, domain match, issuer, chain completeness.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it SSL certificate: validity, expiry countdown, domain match, issuer, chain completeness.
subdomain_discoverDiscover subdomains by probing 75 common names plus crt.sh Certificate Transparency logs.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Discover subdomains by probing 75 common names plus crt.sh Certificate Transparency logs. Surfaces exposed dev/staging environments.
ttl_checkTTL advisory: flags dangerous TTLs and gives step-by-step migration lowering plan.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it TTL advisory: flags dangerous TTLs and gives step-by-step migration lowering plan.
zone_axfrAXFR zone transfer vulnerability check.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it AXFR zone transfer vulnerability check. Tests whether any authoritative NS allows public zone transfers (critical misconfiguration).
zone_consistencyCheck all authoritative nameservers return identical answers.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Check all authoritative nameservers return identical answers. Catches lame delegation and SOA mismatches.
Only reads 7Claude Code: allow
dane_validateDANE/TLSA validation: cross-validates TLSA DNS records against the live TLS certificate.No findings
Why it is in this group
- The name "dane_validate" says "validate": a word for reading.
Description, as the server wrote it DANE/TLSA validation: cross-validates TLSA DNS records against the live TLS certificate. Supports all four TLSA usage types.
dns_lookupLook up DNS records for a domain.No findings
Why it is in this group
- The name "dns_lookup" says "lookup": a word for reading.
Description, as the server wrote it Look up DNS records for a domain. Record types: a, aaaa, ns, mx, txt, soa, caa, srv, cname, ds, tlsa, https, svcb, any, all.
dnssec_validateValidate DNSSEC chain of trust.No findings
Why it is in this group
- The name "dnssec_validate" says "validate": a word for reading.
Description, as the server wrote it Validate DNSSEC chain of trust. Returns: secure / insecure / bogus / indeterminate.
domain_statusRegistrar lock and EPP status.No findings
Why it is in this group
- The name "domain_status" says "status": a word for reading.
Description, as the server wrote it Registrar lock and EPP status. Checks transfer lock, delete lock, serverHold, pendingDelete.
geo_lookupGeolocation and hosting: country, city, ISP, ASN, CDN detection, is_hosting flag.No findings
Why it is in this group
- The name "geo_lookup" says "lookup": a word for reading.
Description, as the server wrote it Geolocation and hosting: country, city, ISP, ASN, CDN detection, is_hosting flag.
resolve_checkDNS resolution diagnostics.No findings
Why it is in this group
- The name "resolve_check" says "resolve": a word for reading.
Description, as the server wrote it DNS resolution diagnostics. Returns status: ok / nxdomain / nodata / servfail / refused / timeout / degraded.
whois_lookupParsed WHOIS: registrar, creation/expiry dates, domain age, nameservers, EPP status, DNSSEC status.No findings
Why it is in this group
- The name "whois_lookup" says "lookup": a word for reading.
Description, as the server wrote it Parsed WHOIS: registrar, creation/expiry dates, domain age, nameservers, EPP status, DNSSEC status.
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or untrusted-input or outbound.
- Reads private data0
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write0
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out0
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Install
Pinned to version 1.0.0. Values in angle brackets are yours to fill in.
claude mcp add --transport sse idig-dns https://mcp.softricks.net/sseRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__idig-dns__dns_lookup",
"mcp__idig-dns__dnssec_validate",
"mcp__idig-dns__resolve_check",
"mcp__idig-dns__domain_status",
"mcp__idig-dns__geo_lookup",
"mcp__idig-dns__whois_lookup",
"mcp__idig-dns__dane_validate"
],
"ask": [
"mcp__idig-dns__email_security_audit",
"mcp__idig-dns__dnssec_health",
"mcp__idig-dns__diagnose",
"mcp__idig-dns__propagation_check",
"mcp__idig-dns__mx_check",
"mcp__idig-dns__ttl_check",
"mcp__idig-dns__zone_consistency",
"mcp__idig-dns__ssl_check",
"mcp__idig-dns__subdomain_discover",
"mcp__idig-dns__blacklist_check",
"mcp__idig-dns__http_check",
"mcp__idig-dns__zone_axfr"
],
"deny": []
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as idig-dns. Review it before you use it.