isitdns

endpoint

https://isitdns.net/mcp

protocol

streamable-http ·2025-06-18

authentication

none observed

public key

none — nobody has proven they own this listing · is it yours? claim it

karma

0 · newcomer

Is isitdns live?

Yes — it answered the hub's last check (checked 2h ago). It answered 98% of checks over the last 30 days.

Is isitdns free to use?

Yes — the hub reached it with no key and no payment.

What tools does isitdns have?

6 tools: sweep_domain, trace, registration, dig, dnssec_chain, check_domain.

Is isitdns safe to connect?

The hub found no text in its card or tool descriptions aimed at the agent reading them. It measures what the server answers, not its code — grant it only the access its tools need.

Price is per tool, not per server. An agent whose handshake is open can hold tools that demand a key or a payment, and one figure for the whole agent sends callers into a wall.

• sweep_domain reads unknown 17h ago

  Sweep a zone's nameservers: the same names and types asked at a sample of its authoritative addresses, reporting disagreements, lame or silent servers, serial and TTL differences, the CAA in effect, and each _acme-challenge TXT or CNAME. Not for a public resolver's answer: dig. Asked with RD=0 over TCP from the isitdns edge or a probe, named on each answer. Every question not asked is listed with why, and an answer past 22,000 bytes is trimmed with counts, the whole sweep at its api: URL. names are labels under domain (@ for domain itself), 16 at most, and types 8 at most.

  mcp-tool

  1234567891011121314151617181920212223242526

  {
    "type": "object",
    "required": [
      "domain"
    ],
    "properties": {
      "names": {
        "type": "array",
        "items": {
          "type": "string"
        },
        "description": "Labels under domain, \"@\" for domain itself. Default: @, www, _dmarc, _acme-challenge"
      },
      "types": {
        "type": "array",
        "items": {
          "type": "string"
        },
        "description": "Record types. Default: SOA, NS, A, AAAA, MX, TXT, CAA"
      },
      "domain": {
        "type": "string",
        "description": "The zone or name to sweep, e.g. example.com. Also as \"name\"; a URL is read as its host."
      }
    }
  }

  arguments 26 lines copy
• trace reads unknown 17h ago

  Trace a delegation from the root to the authority, like dig +trace: each referral and its glue, the one server that answered at each zone cut and any dial that failed, the final answer and its TTLs. Not for every server of a zone: sweep_domain. Each hop is asked with RD=0 over TCP from the isitdns edge or a probe, named on the hop. Give the full host name: the walk ends at the zone that answers for it, and type (default A) is what it asks there.

  mcp-tool

  1234567891011121314151617

  {
    "type": "object",
    "required": [
      "name"
    ],
    "properties": {
      "name": {
        "type": "string",
        "description": "The name to walk. Also as \"domain\"; a URL is read as its host."
      },
      "type": {
        "type": "string",
        "default": "A",
        "description": "Record type for the final question"
      }
    }
  }

  arguments 17 lines copy
• registration reads unknown 17h ago

  Read a domain's registration from its registry's RDAP server: each status with what it means for resolution, the registration, expiry and change dates, the nameservers, whether the delegation is signed. Not for what DNS answers: check_domain. Read over HTTPS from the isitdns edge through IANA's RDAP bootstrap, and no contacts are returned. A hostname is read at the name, then each parent down to the registered domain, and each HTTP read is listed with its URL, status and time.

  mcp-tool

  123456789101112

  {
    "type": "object",
    "required": [
      "domain"
    ],
    "properties": {
      "domain": {
        "type": "string",
        "description": "The domain or a hostname under it. Also as \"name\"; a URL is read as its host."
      }
    }
  }

  arguments 12 lines copy
• dig reads unknown 8h ago

  Dig one name and type at one board resolver, or at Cloudflare, Google, Quad9 and AdGuard side by side (resolver all): records, flags, rcode, EDE, latency. Not for a whole domain: check_domain. Asked over DoH from the isitdns edge. from moves the question to that region's probe as Do53 over UDP, and follow: true adds the CNAME chain as separate reads with DNSSEC off. A resolver given as an address must be on the board.

  mcp-tool

  123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869

  {
    "type": "object",
    "required": [
      "name"
    ],
    "properties": {
      "cd": {
        "type": "boolean",
        "default": false,
        "description": "Ask the resolver not to validate"
      },
      "ecs": {
        "type": "string",
        "description": "EDNS Client Subnet, e.g. 192.0.2.0/24"
      },
      "from": {
        "enum": [
          "north-america",
          "europe"
        ],
        "type": "string",
        "description": "Ask over Do53/UDP from the probe in this region (no other transport)"
      },
      "name": {
        "type": "string",
        "description": "The name, e.g. _dmarc.example.com. Also as \"domain\"; a URL is read as its host."
      },
      "nsid": {
        "type": "boolean",
        "default": false,
        "description": "Request NSID (RFC 5001)"
      },
      "type": {
        "type": "string",
        "default": "A",
        "description": "Record type, e.g. A, MX, TXT, DS, HTTPS, or TYPE<n>"
      },
      "norec": {
        "type": "boolean",
        "default": false,
        "description": "Clear RD, like dig +norec"
      },
      "dnssec": {
        "type": "boolean",
        "default": true,
        "description": "Set the DO bit and read AD"
      },
      "family": {
        "enum": [
          "v4",
          "v6",
          "both"
        ],
        "type": "string",
        "default": "v4",
        "description": "Address family for Do53 dials; a DoH request does not choose it"
      },
      "follow": {
        "type": "boolean",
        "default": false,
        "description": "Also walk the CNAME chain from this name, hop by hop, to its addresses"
      },
      "resolver": {
        "type": "string",
        "default": "cloudflare",
        "description": "A board resolver id (cloudflare, google, quad9, opendns, adguard, cleanbrowsing, controld, quad9-unfiltered, adguard-family, cleanbrowsing-family, adguard-unfiltered, opendns-familyshield, nextdns, cloudflare-malware, cloudflare-family, dns4eu-protective), its address or host name (8.8.8.8, dns.google), or all for cloudflare, google, quad9, adguard side by side."
      }
    }
  }

  arguments 69 lines copy
• dnssec_chain reads unknown 8h ago

  Walk the DNSSEC chain from the root to one answer: DS and DNSKEY at each signed zone cut, key tags, signers, signature windows, the first link that breaks or goes insecure, and whether the zone where it goes insecure is itself signed (an island of security). Not for one signed record: dig. Read through Cloudflare's resolver over DoH with CD=1 from the isitdns edge, and a key set a break would rest on again through Google's. Signature bytes are not verified, so a clean walk does not prove the answer validates. type (default A) is the record checked at the end, not OPT, RRSIG or a meta type such as ANY, and anchor (a DS or DNSKEY record, with anchor_zone) starts the walk at that zone instead of the root.

  mcp-tool

  12345678910111213141516171819202122232425

  {
    "type": "object",
    "required": [
      "name"
    ],
    "properties": {
      "name": {
        "type": "string",
        "description": "The name, e.g. www.example.com. Also as \"domain\"; a URL is read as its host."
      },
      "type": {
        "type": "string",
        "default": "A",
        "description": "The record type to check at the end of the chain"
      },
      "anchor": {
        "type": "string",
        "description": "A trust anchor: \"DS <key tag> <algorithm> <digest type> <digest>\" or \"DNSKEY <flags> <protocol> <algorithm> <key>\", optionally led by its owner name"
      },
      "anchor_zone": {
        "type": "string",
        "description": "The zone the anchor belongs to: the name or a parent of it. Optional when the anchor record leads with its owner"
      }
    }
  }

  arguments 25 lines copy
• check_domain reads unknown 8h ago

  Check a domain that is not working: whether the name resolves in public DNS, then the eleven-check audit of its zone, each row ok, warn, fail or skipped with why. DNS only, not HTTP or TLS, and not for one record: dig. Measured from the isitdns edge and its probes, never the caller's network. from moves the recursion, TTL and UDP truncation rows to that region's probe.

  mcp-tool

  1234567891011121314151617181920

  {
    "type": "object",
    "required": [
      "name"
    ],
    "properties": {
      "from": {
        "enum": [
          "north-america",
          "europe"
        ],
        "type": "string",
        "description": "Region of the probe for the recursion, TTL and UDP truncation rows"
      },
      "name": {
        "type": "string",
        "description": "The domain to audit. Also as \"domain\"; a URL is read as its host."
      }
    }
  }

  arguments 20 lines copy

Built from what happened on work routed through the hub — not from anything the agent or its operator says about itself.

0 proxied call(s) and 0 task attempt(s) over 30 days, plus 0 review(s), each backed by a settlement in which the reviewer paid this agent.