MODEL CONTEXT PROTOCOL

Give your AI agent 30 security tools in one line

Agents such as Claude and Cursor call DechoNet's observations directly. A remote server with nothing to install, and an npm package.

Listed in the Claude directoryremote /mcpnpm dechonet-mcp 1.6.3

Connect in ten seconds

Connect in Claude →

Listed in the Claude connectors directory: one click on the listing's Connect button and it works in claude.ai on the web, Desktop and the mobile apps. For other AI apps, see the tabs below.

Listed in the Claude connectors directory — Customize → Connectors, search DechoNet → Connect · or add this address yourself

https://dechonet.com/mcp?via=claude

To add it without the directory: + Add → Add custom connector and paste the address above. claude.ai on the web, Desktop and Cowork share the same connectors. The Free plan allows one custom connector.

Open DechoNet in the Claude connectors directory →

Terminal · remote, nothing to install

claude mcp add --transport http dechonet https://dechonet.com/mcp

chatgpt.com/plugins → + → Add custom MCP server → paste this address under Connection, no authentication → Create as a plugin

https://dechonet.com/mcp

On work or school accounts an admin has to allow custom MCP servers first. OpenAI moves this menu often (it was Settings → Apps → Developer mode; as of October 2026 it is the Plugins page) — if it looks different, see OpenAI's "Connect and test your plugin" doc.

~/.cursor/mcp.json · remote

{
  "mcpServers": {
    "dechonet": {
      "url": "https://dechonet.com/mcp"
    }
  }
}

.mcp.json (workspace root) · Copilot agent mode

{
  "mcpServers": {
    "dechonet": {
      "type": "http",
      "url": "https://dechonet.com/mcp"
    }
  }
}

VS Code recommends the workspace-root .mcp.json, which other tools read too. In the VS Code-only .vscode/mcp.json the root key is servers instead of mcpServers. Save, open Copilot Chat in agent mode and turn on dechonet in the tools list.

Terminal · remote, nothing to install

gemini mcp add --transport http dechonet https://dechonet.com/mcp

In ~/.gemini/settings.json put the address under "httpUrl", not "url" ("url" is read as the older SSE transport).

Terminal · saved to ~/.codex/config.toml

codex mcp add dechonet --url https://dechonet.com/mcp

The CLI, IDE extension and app share this config. Check the connection with /mcp inside Codex.

~/.codeium/windsurf/mcp_config.json · remote

{
  "mcpServers": {
    "dechonet": {
      "serverUrl": "https://dechonet.com/mcp"
    }
  }
}

Windsurf uses the "serverUrl" key. Save, then refresh the MCP list.

claude_desktop_config.json · npm package (stdio)

{
  "mcpServers": {
    "dechonet": {
      "command": "npx",
      "args": [
        "-y",
        "dechonet-mcp"
      ]
    }
  }
}

For when you need a local install (clients that only run stdio servers, company policy). The npm package calls the same backend as the remote endpoint. In Claude Desktop the connector in the "Claude app" tab is simpler.

Once connected, ask something like "check github.com's security" and the agent usually starts with security_scan.

Each client's setup was checked against its maker's official docs on 2026-10-15, and a daily check flags those docs when they change. If your screen differs, follow the official docs.

API keys

The API and MCP server work without a key. With a key, limits are counted per key instead of per IP (so people sharing an office or cloud IP do not block each other). Send the header "Authorization: Bearer <key>" with requests.

Pre-deploy gate for CI: GET /api/util/gate?url=…&min_ssl=B&min_headers=C — pass=false when HTTPS, certificate grade, days left, chain or security-header grade misses the bar.

From November 8, 2026, free use is for non-commercial purposes only (personal learning and research, checking your own domains, non-profit work). Using it inside a paid product, for clients, or regularly for company work needs MCP·API Pro (before payments open, ask at support@dechonet.com). Terms §4 · MCP·API Pro · Create an account

How an agent works through it

`security_scan`

Checks five areas at once and returns a grade and the actions that come first.

Look deeper where it points

Calls the matching tool next, such as ssl_check or http_security.

`watch_domain`

Sets a daily watch; next time domain_changes shows only what changed.

Tools 30 read-only observation, except watch_domain, set_expectations and report_page

Tool	What it does	Group
`security_scan`	Five questions in one check: an A+ to F grade and what to fix first.	Site checks
`phishing_link_check`	Paste a suspicious text; see where each link really goes.	Phishing
`exposure_map`	Counts of exposed admin and staging screens (per-host detail on the web, after ownership check)	Site checks
`pqc_readiness`	Does the site offer post-quantum key exchange?	Site checks
`domain_changes`	Only what changed since the last lookup or watch	Watch
`dns_lookup`	All DNS records, with SPF, DMARC and DNSSEC checks.	Domain & email
`ssl_check`	Certificate, chain and TLS version, read from Seoul.	Site checks
`http_security`	Redirect chain and security headers, graded A–F.	Site checks
`email_auth`	MX, SPF, DMARC, DKIM and blacklists.	Domain & email
`port_scan`	Which common TCP ports answer.	Network
`dns_propagation`	The same record on six public resolvers.	Domain & email
`reverse_dns`	The PTR name of an IP, and whether it points back.	Network
`asn_lookup`	Who owns an IP or network, and its prefixes.	Network
`whois_lookup`	Registrar, dates and status of a domain.	Domain & email
`subdomain_discovery`	Subdomains found in certificate logs.	Domain & email
`lookalike_domains`	Registered lookalikes of your domain name.	Phishing
`ip_info`	Your public IP, network and location.	Network
`email_header_analysis`	Read the route and auth results in a mail header.	Phishing
`subnet_calc`	Network, range and hosts of a CIDR block.	Network
`owasp_check`	The OWASP Top 10 items visible from outside.	Site checks
`impersonation_exposure`	How exposed your brand is to impersonation.	Phishing
`domain_history`	Infrastructure History	Watch
`infrastructure_pivot`	Infrastructure Pivot	Watch
`watch_domain`	Sets a watch that rechecks the domain daily	Watch
`set_expectations`	States what the domain should show from outside, checks it now and every day after (signed receipts)	Watch
`verify_expectations`	Checks those expectations from outside now — after a change, to see whether it shows yet	Watch
`check_before_action`	Before logging in or paying: is this page what it claims — impersonation, new domain, flagged before, and where the card entry sits	Watch
`report_page`	Report a page — phishing, a fake payment window, hidden instructions for AI agents, a malicious download, or a wrong verdict; DechoNet then checks it itself	Watch
`golive_check`	Is a new site ready to launch: DNS, TLS, HTTPS, headers.	Site checks
`mcp_server_check`	Before connecting an MCP server: auth, tools that act, poisoned descriptions.	Site checks

More tools when you sign in

With a Business plan account, these appear in the tool list once your MCP client sends your DechoNet login. They work only on domains whose ownership you verified, and nothing starts until you confirm it.

Tool	What it does
`asm_nuclei_start`	Start an active check (Nuclei, limited request budget) on a verified asset from your attack surface report
`asm_nuclei_status`	Read that check's progress, coverage and findings
`asm_nuclei_cancel`	Stop the check

Plans and sign-up →

Principles

Interpretation over raw data: every result carries status, key numbers, issues with confidence, and concrete actions.
Passive by design: DNS, certificates, CT logs, HTTP headers, RDAP. No exploitation. A registered lookalike is reported as a fact to verify, never as an accusation.
Cross-verification: independent sources are compared where possible (multiple DNS resolvers, CT logs plus live TLS).

npm: dechonet-mcp GitHub: node-man/dechonet-mcp Smithery: nodeman/dechonet Glama: com.dechonet/mcp MCP Registry: com.dechonet/mcp Same tools on the web Daily monitoring and plans