net.isitdns/isitdns

Est-ce que net.isitdns/isitdns est sûr ?

Au dernier audit MCP Hub, le serveur MCP « net.isitdns/isitdns » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 6 outils

• check_domain≈ 451 tokens

  Check a domain that is not working: whether the name resolves in public DNS, then the eleven-check audit of its zone, each row ok, warn, fail or skipped with why. DNS only, not HTTP or TLS, and not for one record: dig. Measured from the isitdns edge and its probes, never the caller's network. from moves the recursion, TTL and UDP truncation rows to that region's probe.

  Paramètres, retour & exemple (2)

  Paramètres

  • from · string · optionnel · north-america | europe
    Region of the probe for the recursion, TTL and UDP truncation rows
  • name · string · requis
    The domain to audit. Also as "domain"; a URL is read as its host.

  Exemple d'appel

  {"name": "check_domain", "arguments": {"name": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"api": "texte", "checks": [], "summary": {}, "askAgain": "texte", "receipts": [], "resolves": {}, "generatedAt": "texte"}}

• dig≈ 788 tokens

  Dig one name and type at one board resolver, or at Cloudflare, Google, Quad9 and AdGuard side by side (resolver all): records, flags, rcode, EDE, latency. Not for a whole domain: check_domain. Asked over DoH from the isitdns edge. from moves the question to that region's probe as Do53 over UDP, and follow: true adds the CNAME chain as separate reads with DNSSEC off. A resolver given as an address must be on the board.

  Paramètres, retour & exemple (11)

  Paramètres

  • cd · boolean · optionnel
    Ask the resolver not to validate
  • ecs · string · optionnel
    EDNS Client Subnet, e.g. 192.0.2.0/24
  • from · string · optionnel · north-america | europe
    Ask over Do53/UDP from the probe in this region (no other transport)
  • name · string · requis
    The name, e.g. _dmarc.example.com. Also as "domain"; a URL is read as its host.
  • nsid · boolean · optionnel
    Request NSID (RFC 5001)
  • type · string · optionnel
    Record type, e.g. A, MX, TXT, DS, HTTPS, or TYPE<n>
  • norec · boolean · optionnel
    Clear RD, like dig +norec
  • dnssec · boolean · optionnel
    Set the DO bit and read AD
  • family · string · optionnel · v4 | v6 | both
    Address family for Do53 dials; a DoH request does not choose it
  • follow · boolean · optionnel
    Also walk the CNAME chain from this name, hop by hop, to its addresses
  • resolver · string · optionnel
    A board resolver id (cloudflare, google, quad9, opendns, adguard, cleanbrowsing, controld, quad9-unfiltered, adguard-family, cleanbrowsing-family, adguard-unfiltered, opendns-familyshield, nextdns, cloudflare-malware, cloudflare-family, mullvad-base, dns4eu-protective), its address or host name (8.8.8.8, dns.google), or all for cloudflare, google, quad9, adguard side by side.

  Exemple d'appel

  {"name": "dig", "arguments": {"name": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"api": "texte", "query": {}, "follow": {}, "results": [], "askAgain": "texte", "receipts": [], "agreement": {}}}

• dnssec_chain≈ 516 tokens

  Walk the DNSSEC chain from the root to one answer: DS and DNSKEY at each signed zone cut, key tags, signers, signature windows, and the first link that breaks or goes insecure. Not for one signed record: dig. Read through Cloudflare's resolver over DoH with CD=1 from the isitdns edge, and a key set a break would rest on again through Google's. Signature bytes are not verified, so a clean walk does not prove the answer validates. type (default A) is the record checked at the end, not OPT, RRSIG or a meta type such as ANY.

  Paramètres, retour & exemple (2)

  Paramètres

  • name · string · requis
    The name, e.g. www.example.com. Also as "domain"; a URL is read as its host.
  • type · string · optionnel
    The record type to check at the end of the chain

  Exemple d'appel

  {"name": "dnssec_chain", "arguments": {"name": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"api": "texte", "links": [], "answer": {}, "readAt": "texte", "receipts": [], "firstBreak": {}, "insecureAt": "texte", "signaturesVerified": true}}

• registration≈ 446 tokens

  Read a domain's registration from its registry's RDAP server: each status with what it means for resolution, the registration, expiry and change dates, the nameservers, whether the delegation is signed. Not for what DNS answers: check_domain. Read over HTTPS from the isitdns edge through IANA's RDAP bootstrap, and no contacts are returned. A hostname is read at the name, then each parent down to the registered domain, and each HTTP read is listed with its URL, status and time.

  Paramètres, retour & exemple (1)

  Paramètres

  • domain · string · requis
    The domain or a hostname under it. Also as "name"; a URL is read as its host.

  Exemple d'appel

  {"name": "registration", "arguments": {"domain": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"api": "texte", "reads": [], "domain": "texte", "events": {}, "readAt": "texte", "status": [], "nameservers": [], "delegationSigned": true}}

• sweep_domain≈ 555 tokens

  Sweep a zone's nameservers: the same names and types asked at a sample of its authoritative addresses, reporting disagreements, lame or silent servers, serial and TTL differences, the CAA in effect, and each _acme-challenge TXT or CNAME. Not for a public resolver's answer: dig. Asked with RD=0 over TCP from the isitdns edge or a probe, named on each answer. Every question not asked is listed with why, and an answer past 22,000 bytes is trimmed with counts, the whole sweep at its api: URL. names are labels under domain (@ for domain itself), 16 at most, and types 8 at most.

  Paramètres, retour & exemple (3)

  Paramètres

  • names · array · optionnel
    Labels under domain, "@" for domain itself. Default: @, www, _dmarc, _acme-challenge
  • types · array · optionnel
    Record types. Default: SOA, NS, A, AAAA, MX, TXT, CAA
  • domain · string · requis
    The zone or name to sweep, e.g. example.com. Also as "name"; a URL is read as its host.

  Exemple d'appel

  {"name": "sweep_domain", "arguments": {"domain": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"api": "texte", "zone": "texte", "results": [], "servers": [], "holdback": {}, "receipts": [], "notPrinted": {}, "certReadiness": []}}

• trace≈ 394 tokens

  Trace a delegation from the root to the authority, like dig +trace: each referral and its glue, the one server that answered at each zone cut and any dial that failed, the final answer and its TTLs. Not for every server of a zone: sweep_domain. Each hop is asked with RD=0 over TCP from the isitdns edge or a probe, named on the hop. Give the full host name: the walk ends at the zone that answers for it, and type (default A) is what it asks there.

  Paramètres, retour & exemple (2)

  Paramètres

  • name · string · requis
    The name to walk. Also as "domain"; a URL is read as its host.
  • type · string · optionnel
    Record type for the final question

  Exemple d'appel

  {"name": "trace", "arguments": {"name": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"api": "texte", "trace": {}, "report": {}, "askAgain": "texte", "receipts": []}}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://isitdns.net/mcp