{
  "markdown": "# @oksigenia/checker-mcp\n\nA domain security and privacy checker exposed as an [MCP](https://modelcontextprotocol.io) server. It runs entirely on your machine, makes no telemetry calls, and resolves DNS through Cloudflare DoH instead of Google.\n\nAsk any MCP client to scan a domain and get back a scored report covering the certificate, email authentication, DNS and infrastructure, and web security headers, with a plain remediation for anything that fails.\n\n## Why it's different\n\n- **Local-first.** The server runs over stdio and does its own DNS-over-HTTPS, HTTP, RDAP and TLS lookups. The only network traffic is the checks themselves.\n- **Zero telemetry.** No analytics, no phone-home, no third-party scoring service in the loop.\n- **Privacy by default.** DNS goes to Cloudflare DoH rather than Google, and the reputation check uses Cloudflare's malware/phishing resolver.\n- **Free software.** Licensed GPL-3.0-or-later. Read it, run it, change it, self-host it.\n\n## Tools\n\nThe server exposes three tools.\n\n### `check_domain`\n\nScan a domain or URL and return a scored report from real live checks.\n\n```jsonc\n// arguments\n{\n  \"domain\": \"example.com\",          // bare domain or full URL\n  \"categories\": [\"ssl\", \"email\"],   // optional subset; defaults to all\n  \"format\": \"report\",               // \"report\" (default) or \"json\"\n  \"lang\": \"en\"                      // \"es\" or \"en\"\n}\n```\n\n### `list_checks`\n\nList every check grouped by category, with the reason each one matters.\n\n```jsonc\n{ \"lang\": \"en\" }\n```\n\n### `explain_check`\n\nExplain a single check by id, why it matters, and how to remediate a failure.\n\n```jsonc\n{ \"check_id\": \"dmarc\", \"lang\": \"en\" }\n```\n\n## Checks\n\nSeventeen checks across four categories, weighted to a 0-100 score.\n\n| Category | Check id | What it verifies |\n| --- | --- | --- |\n| ssl | `ssl` | SSL/TLS certificate validity and expiry |\n| email | `spf` | SPF record present and not overly permissive |\n| email | `dmarc` | DMARC policy and reporting |\n| email | `dkim` | DKIM signing (common selectors probed) |\n| email | `mta_sts` | MTA-STS against SMTP downgrade attacks |\n| email | `mx` | MX records for mail delivery |\n| email | `bimi` | BIMI brand logo record and VMC |\n| dns | `dnssec` | DNSSEC signing on the zone |\n| dns | `ptr` | PTR / forward-confirmed reverse DNS |\n| dns | `caa` | CAA records restricting certificate issuance |\n| dns | `blacklist` | Malware/phishing reputation |\n| dns | `expiry` | Domain registration expiry |\n| dns | `whois_redact` | WHOIS/RDAP personal-data redaction |\n| web | `headers` | HTTP security headers (HSTS, CSP, X-Frame-Options, …) |\n| web | `csp` | Content-Security-Policy quality |\n| web | `web_tech` | CMS/server version and API exposure |\n| web | `hsts_preload` | HSTS preload-list status |\n\nRun `list_checks` for the full descriptions, or `explain_check` for one at a time.\n\n## Install\n\nRun it straight from npm with `npx`:\n\n```bash\nnpx @oksigenia/checker-mcp\n```\n\nRegister it with Claude Code:\n\n```bash\nclaude mcp add oksigenia-checker -- npx -y @oksigenia/checker-mcp\n```\n\nOr add it to any MCP client config (works in Claude Desktop, Claude Code, or any MCP client):\n\n```json\n{\n  \"mcpServers\": {\n    \"oksigenia-checker\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@oksigenia/checker-mcp\"],\n      \"env\": { \"OKSIGENIA_LANG\": \"en\" }\n    }\n  }\n}\n```\n\nThen ask: *\"Check the security of example.com\"* or *\"Explain the dmarc check.\"*\n\n## Run with Docker\n\nBuild and run it as a container. It speaks MCP over stdio, so run it attached to your client's stdin/stdout (`-i`), not on a port.\n\n```bash\ndocker build -t oksigenia-checker-mcp .\ndocker run --rm -i oksigenia-checker-mcp\n```\n\n## Languages\n\nReports render in Spanish and English. Set the default with `OKSIGENIA_LANG` (`es` or `en`), or pass `lang` on any tool call. It defaults to English.\n\n## Privacy\n\nThe only thing that leaves your machine is the **domain name you scan**, sent to:\n\n- Cloudflare DoH (`cloudflare-dns.com`) and Cloudflare's security resolver, for DNS and reputation\n- public RDAP (`rdap.org`), for registration and WHOIS-privacy data\n- the HSTS preload API, for preload status\n- the target site itself, over HTTPS, to read its certificate and security headers\n\nThere is no telemetry, no analytics, and no third-party scoring service. Nothing about your queries is stored or transmitted anywhere else.\n\n## Develop\n\n```bash\nnpm install\nnpm run build       # tsup -> dist/\nnpm run typecheck   # tsc --noEmit\nnpm test            # vitest (hermetic, mocked network)\nnpm run smoke       # spawn the built server and exercise every tool live\n```\n\nDev watch: `npm run dev`.\n\n- `src/engine.ts` — the network engine. Language-agnostic: returns i18n keys, not text. Every check is individually resilient and `runChecks` never throws.\n- `src/i18n.ts` — es/en dictionaries and `t()`.\n- `src/index.ts` — the MCP server: renders engine keys into the requested language and exposes the three tools.\n\nSee [CONTRIBUTING.md](CONTRIBUTING.md) for the PR flow.\n\n## License\n\nGPL-3.0-or-later © Oksigenia SL\n",
  "bytes": 5036,
  "sha": "9594b74595d4ca147aa9fe83c4b915a2456dc1e0493da8d5398f02acc28fa99a",
  "repo_slug": "oksigeniasl/checker-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_com_oksigenia_checker_mcp_6b95db0d/readme"
}