{
  "markdown": "# Domain authentication check — free API, no key\n\nCheck whether anyone can send email as a domain.\n\n```bash\ncurl \"https://guild.tradeuniquecapital.com/api/check?domain=example.com\"\n```\n\nNo signup, no API key, no account. 20 calls per caller per hour.\n\nIt runs the same engine as the paid audit over one domain and returns what it\nactually found — not a teaser with the findings removed.\n\n## Every check gets a page you can send to someone\n\n```jsonc\n{\n  \"domain\": \"stripe.com\",\n  \"grade\": \"A\",\n  \"report_url\": \"https://guild.tradeuniquecapital.com/r/bad8482e9e93\"\n}\n```\n\nA permanent, shareable page with the verdict, the records found, and what to\nchange — the thing you forward to whoever runs the DNS. Kept 90 days.\n\nA correctly configured domain gets a page saying so, with nothing to buy.\n\n## What it checks\n\n- **SPF**, including the RFC 7208 ten-lookup limit that silently breaks it\n- **DKIM** selectors\n- **DMARC** — and whether it *enforces* or only *monitors*, which is the\n  difference between protection and a report nobody reads\n- **Cross-domain DMARC reporting authorisation** (RFC 7489 §7.1) — the\n  external `rua` authorisation record almost nobody publishes\n- **MX** and **null-MX** (RFC 7505)\n\n## The one rule it follows\n\n**A failed lookup is never reported as a finding.**\n\nIf a DNS query times out, the response says the check was incomplete. It does\nnot say \"no SPF record\". Those mean different things, and only one of them is\na problem with the domain — telling somebody they are unprotected when they\nmay be fine is the worst thing a checker can do.\n\n```jsonc\n{\n  \"domain\": \"example.com\",\n  \"grade\": \"B\",\n  \"checks_completed\": 3,\n  \"checks_total\": 4,\n  \"complete\": false,        // ← treat as unknown, not as a fault\n  \"findings\": { \"...\": \"...\" }\n}\n```\n\n## Install\n\n```bash\npip install httpx     # or use urllib; the client has no hard dependency\n```\n\nThen copy `agpc_domain_check/client.py`, or:\n\n```python\nfrom agpc_domain_check import check\n\nresult = check(\"example.com\")\nprint(result[\"grade\"], result[\"findings\"][\"dmarc\"])\n```\n\nJavaScript is in `examples/check.js` — it is twenty lines and has no\ndependencies.\n\n## MCP server — plug it into any agent\n\nThe API is also an MCP server, so Claude (or anything MCP-capable) can call\nit as a native tool:\n\n```\nhttps://guild.tradeuniquecapital.com/mcp\n```\n\nStreamable HTTP, stateless, no auth, no key. Three tools:\n\n| Tool | What it does |\n|---|---|\n| `check_domain` | The free check, with the shareable report URL |\n| `list_services` | The paid catalogue and order URLs |\n| `partner_program` | The referral terms — what a referred sale pays you |\n\nClaude Code: `claude mcp add --transport http agpc https://guild.tradeuniquecapital.com/mcp`\n\n## Machine-readable\n\n| | |\n|---|---|\n| MCP server | `https://guild.tradeuniquecapital.com/mcp` |\n| OpenAPI 3.1 | `https://guild.tradeuniquecapital.com/openapi.json` |\n| Agent card | `https://guild.tradeuniquecapital.com/.well-known/agent-card.json` |\n| One-fetch summary | `https://guild.tradeuniquecapital.com/.well-known/agents.json` |\n| For LLMs | `https://guild.tradeuniquecapital.com/llms.txt` |\n\nPoint any agent framework at the OpenAPI document and it can call this\nunattended.\n\n## Earn from it\n\nIf you send someone who buys the full audit, you take **25% of the settled\namount — EUR 37.25 per audit**.\n\n```bash\ncurl -X POST https://guild.tradeuniquecapital.com/partners/terms \\\n  -H 'Content-Type: application/json' \\\n  -d '{\"agent_id\":\"your-agent\",\"code\":\"YOURCODE\",\"rate\":0.25}'\n```\n\nThen send people to `https://guild.tradeuniquecapital.com/order?ref=YOURCODE`.\n\n- Up to **25%** is accepted immediately. Above that is **reviewed**, not\n  refused. Above 40% is refused — past that the referral costs more than the\n  work earns.\n- Paid when the order **settles** — the money is in the account, not merely\n  promised.\n- **Reversed if the order is refunded.** You are not paid for our bad debt.\n\nNot paid for: traffic or leads that never pay, refunded orders, and anything\nobtained by deception, spam, unlawful scraping, or access to systems you are\nnot authorised to use.\n\n## What the paid audit adds\n\nUp to five domains in one order, DKIM probed across 34 known provider\nselectors, prioritised remediation with the exact records to publish, and a\nwritten report you can hand to whoever runs the DNS. **EUR 149, one-time.**\n\n## Who runs this\n\nMarko Latinović, a natural person resident in Serbia, in a personal capacity.\nNot a company. There are no customer testimonials, because there are no\ncustomers yet, and inventing them would be the first thing worth distrusting\nabout a security service.\n\nContact: markol@tradeuniquecapital.com\n\n## Licence\n\nMIT for the client code in this repository. The API is free to call within\nthe stated rate limit.\n",
  "bytes": 4767,
  "sha": "d394c9b3d1272d1f4326f77fdb99e409758e3c9b7a746bfa8c4ac59407a2e19c",
  "repo_slug": "markolati85/agpc-domain-check",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_com_tradeuniquecapital_guild_domain_chec_d20ac240/readme"
}