Domain Security MCP Server

domain-security-mcp-server is a TypeScript MCP (Model Context Protocol) server that gives an AI agent —like Claude— 19 read-only tools to audit the email and domain security of any domain: SPF, DKIM, DMARC, MTA-STS, TLS-RPT, BIMI, DNSSEC, CAA, DNS, MX, WHOIS, SSL/TLS, blocklists (DNSBL), DNS propagation and email-header analysis. No API keys — everything runs on public DNS, TLS and WHOIS.

Nothing to clone: claude mcp add domain-security -- npx -y domain-security-mcp-server

It grew out of a connected thread of work: a domain-security guide, then a collection of web tools, and finally this server that exposes the same capability to an agent. The network logic (DNS resolution, SPF/DMARC parsing, validation) lives in a shared core that powers both the ortamarco.me web tools and the MCP server.

Features

• 19 tools with typed output: each tool declares an inputSchema and outputSchema (Zod) and returns SDK-validated structuredContent alongside readable markdown.
• Headline email_auth_audit tool: audits SPF + DKIM + DMARC + MX in one call and returns an A–F grade with prioritised fixes.
• Two transports: stdio for local clients (Claude Desktop / Claude Code / Cursor) and stateless Streamable HTTP for self-hosting behind a reverse proxy (Coolify/Traefik), safe by default: loopback bind, Host and Origin validation and an optional Bearer token.
• No API keys and no side effects: every tool is read-only over public DNS, TLS, WHOIS and HTTPS.
• SSRF protection at connect time: the tools reach hosts the caller chooses, so every connection checks the IP address the socket is about to use. That blocks private and metadata addresses in any spelling —IPv4 wrapped in IPv6 included—, DNS rebinding, and names only an internal resolver knows.
• Tested and published: 48 offline unit tests (SSRF guard, SPF/DMARC/DKIM scoring, HTTP transport), a smoke test that calls all 19 tools on both protocol eras, CI on Node 20, 22 and 24 that boots the package through npx and the Docker image, a 10-question evaluation suite that measures how well an LLM can use it, and published to npm and the official MCP Registry.

Tech stack

• TypeScript (strict, no any, outputSchema on all 19 tools)
• MCP SDK v2 (@modelcontextprotocol/server): serves the 2026-07-28 revision and 2025-era clients from one factory
• Zod 4 for input and output validation
• Express 5 for the stateless HTTP transport
• Node.js (public DNS, DNS-over-HTTPS, TLS/WHOIS sockets, undici with the guard in its lookup, geoip-lite)
• Docker for self-hosted deployment

Repository

View on GitHub → · Package on npm →

Goal

To show, end to end, how a production-grade agentic building block is made: from domain knowledge (email security) to reusable tools, and from there to an MCP server an AI agent can orchestrate — with strict typing, two transports, security and tests.