Connect

8 clients · secrets stay placeholders

JSON (mcpServers)Claude CodeCodexOpenCodeCursorVS CodeGemini CLIGoose

{
  "mcpServers": {
    "checks": {
      "type": "http",
      "url": "https://api.orioncmd.com/mcp"
    }
  }
}

claude mcp add --transport http checks https://api.orioncmd.com/mcp

[mcp_servers.checks]
url = "https://api.orioncmd.com/mcp"

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "checks": {
      "type": "remote",
      "url": "https://api.orioncmd.com/mcp",
      "enabled": true
    }
  }
}

{
  "mcpServers": {
    "checks": {
      "type": "http",
      "url": "https://api.orioncmd.com/mcp"
    }
  },
  "deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=checks&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vYXBpLm9yaW9uY21kLmNvbS9tY3AifQ%3D%3D"
}

{
  "servers": {
    "checks": {
      "type": "http",
      "url": "https://api.orioncmd.com/mcp"
    }
  }
}

{
  "mcpServers": {
    "checks": {
      "httpUrl": "https://api.orioncmd.com/mcp"
    }
  }
}

extensions:
  "checks":
    enabled: true
    name: "checks"
    type: streamable_http
    uri: "https://api.orioncmd.com/mcp"
    timeout: 300

Quality 79 / 100good

protocol88 · weight 25

pass
protocol.modernsupports 2026-07-28 (server/discover)
pass
protocol.statelessanswers without a session
pass
protocol.transportstreamable HTTP
warn
protocol.list_ttltools/list declares ttlMs 0, so clients re-fetch it on every use

authorizationn/a · weight 15

n/a
auth.prm, auth.as_metadata, auth.cimdno remote uses OAuth
n/a
auth.secret_in_urlno templated URL

tool hygiene100 · weight 30

pass
tools.descriptionsevery tool has a description
pass
tools.description_lengthdescriptions are concise
pass
tools.schemasevery tool has an object input schema
pass
tools.annotations13 of 13 tools declare readOnlyHint or destructiveHint
pass
tools.directory_hintsevery tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
pass
tools.token_costabout 2,738 tokens to load every tool
pass
tools.api_dumptools are not a one-to-one API dump

stability25 · weight 15

warn
stability.changes16 tool changes in 30 days
fail
stability.rug_pull9 tools kept their name but changed most of their description in 30 days; review before trusting them

dependenciesn/a · weight 15

n/a
deps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI package

13 tools, about 2,738 tokens to load them all · tool set 86d47afe6da9 · tools last changed 2026-10-17 · checked 2026-10-19 10:52 UTC

Tool changes

2026-10-17watch_statusadded
Free. Status of a paid domain watch (created with HTTP POST /v1/watch): items, expiry, last check, current DNS/IOC/claim state, last webhook delivery.
2026-10-17bulk_threat_checkadded
Check up to 100 domains or IPv4 addresses at once against ThreatCluster's high-confidence 30-day IOC feed; each domain is resolved and its IPv4 matched too. IOC only (no ransomware-claim lookups; use threat_check for one domain). Stale feed returns an error and is not charged. Costs $0.50 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.
2026-10-17threat_checkadded
Is this domain known-bad? Resolves the hostname (A/AAAA), matches the name, its parent domains and resolved IPv4 against ThreatCluster's high-confidence 30-day IOC feed (cached, refreshed about hourly), and looks up ransomware leak-site claims naming the domain (commercially reusable sources via Dragons Eye). Returns verdict listed, claimed, listed_and_claimed or no_known_threat with the matching reports. No match is not proof of safety; claims are unverified attacker assertions. Stale feed or source failure returns an error and is not charged. Costs $0.02 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.
2026-10-14full_site_auditadded
Full site audit report for one domain, for client reports, vendor reviews or a pre-launch check. Runs every check (TLS from CT logs + live probe, DNS/DNSSEC/CAA, registration expiry and transfer lock, SPF/DMARC/DKIM/MTA-STS, security headers) plus HTTP->HTTPS redirect, www/apex consistency, RFC 9116 security.txt, robots.txt and sitemap. Returns the A-F grade and score (same weights as domain_grade), an action plan sorted critical > high > medium > low where each item has the exact fix and effort, and every raw section. Use domain_grade for just the letter. Fails (not charged) if 3+ core checks fail. Read-only; about 5-15 s. Costs $2 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.
2026-10-13domain_gradechangeddescription, annotationsmeaning changed
before
Domain security grade A-F for vendor-risk or due-diligence: runs the TLS (CT logs + live probe), DNS (DNSSEC, CAA), registration expiry, email-auth and HTTP security-header checks and returns one letter, a 0-100 score, points per category and the top fixes. Different from site_health, which returns raw cert/DNS/expiry data with no grade.
after · 41% of words in common
Grade a domain's security posture A-F in one call, for vendor-risk or due-diligence checks. Runs the TLS, DNS (DNSSEC, CAA), registration-expiry, email-auth and HTTP-header checks and returns one letter, a 0-100 score, points per category (TLS 25, email 25, headers 20, DNS 15, registration 15) and the top fixes. Use it when you want a verdict; use site_health or the single checks when you need raw data. Unavailable categories are left out of the percentage (partial=true). Read-only; takes about 3-10 s. Costs $0.03 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.
2026-10-13check_security_headerschangeddescription, annotationsmeaning changed
before
HTTP security headers for a site from one live HTTPS request: redirect chain, HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, an A-F grade and findings.
after · 33% of words in common
Check the HTTP security headers of a website with one live HTTPS GET: redirect chain (up to 5 hops), final status, HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and COOP, with a simple A-F header grade and findings. Use it for web-hardening checks; it is not a vulnerability scan. The page body is not read or stored. Costs $0.01 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.
2026-10-13check_email_authchangeddescription, annotationsmeaning changed
before
Email authentication posture for a domain: SPF validity and lookup count, DMARC policy, DKIM on common selectors, MTA-STS mode, TLS-RPT, BIMI, a rough 0-100 score and plain-English fixes. Live DNS.
after · 35% of words in common
Review the email authentication setup of a domain: SPF validity and DNS-lookup count (limit 10), DMARC policy, pct and reporting, DKIM on common selector names, MTA-STS mode, TLS-RPT and BIMI, with a rough 0-100 score and plain-English fixes. Use it before sending mail from a domain or when mail lands in spam. DKIM is only checked on common selectors, so "not found" is not proof DKIM is missing. Live DNS via Cloudflare DoH; read-only, no email is sent. Costs $0.01 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.
2026-10-13site_healthchangeddescription, annotationsmeaning changed
before
Bundle: check_cert + check_dns + check_domain_expiry with a summary, the renewal-stall heuristic and the Let's Encrypt 64-day (2027-02-10) note.
after · 24% of words in common
Run check_cert, check_dns and check_domain_expiry together and return their raw results plus a short summary, the renewal-stall flag and the Let's Encrypt 64-day certificate note (from 2027-02-10). Use it for a full data dump in one call; use domain_grade if you want a single scored A-F answer that also covers email auth and HTTP headers. If one or two sources fail you get partial=true with the rest. Read-only. Costs $0.03 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.
2026-10-13check_domain_expirychangeddescription, annotationsmeaning changed
before
Domain registration expiry via RDAP: registrar, registered/expires dates, days left, status, nameservers.
after · 19% of words in common
Check when a domain registration expires: registrar, registered and expiry dates, days left, EPP status codes and nameservers, from the registry's RDAP server. Use it for renewal risk on the registered domain (not the certificate; use check_cert for that). Some TLDs publish no RDAP service, in which case found=false explains why. Read-only. Costs $0.01 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.
2026-10-13check_dnschangeddescription, annotationsmeaning changed
before
Live DNS via DoH: NS, A/AAAA/CNAME, MX, SPF, DMARC, CAA (tree-climbing), DNSSEC, with plain-English findings.
after · 22% of words in common
Look up the live DNS of a domain: NS, A/AAAA/CNAME, MX, SPF, DMARC, CAA (climbing to the parent zone) and DNSSEC status, with plain-English findings. Use it for a DNS inventory or to debug resolution; use check_email_auth for a deeper SPF/DMARC/DKIM/MTA-STS review. Queries Cloudflare DNS-over-HTTPS (1.1.1.1) at call time; read-only, nothing is stored. Costs $0.01 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.

Showing the latest 10. Full history: list_changes · trend: quality JSON.

Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.

Trust 82 / 100

no-repository

provenance55

liveness99

freshness100

hygiene80

+dns-namespace +website +reachable +uptime-97% +updated-2d-ago -no-repository

Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.

Endpoints

remote	auth	reachable	uptime 30d	p50	protocol	last ok
`https://api.orioncmd.com/mcp` streamable-http	none	yes	97%	356 ms	2026-07-28	2026-10-19

Tools (13)

`bulk_threat_check`read-only	Check up to 100 domains or IPv4 addresses at once against ThreatCluster's high-confidence 30-day IOC feed; each domain is resolved and its IPv4 matched too. IOC only (no ransomware-claim lookups; use threat_check for one domain). Stale feed returns an error and is not charged. Costs $0.50 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.
`check_cert`read-only	Check the TLS certificate of one hostname: issuer, validity dates, days left, % of lifetime used, renewal cadence and a renewal-stall flag, plus a live HTTPS pass/fail probe. Use it when you only need certificate health; use site_health for cert + DNS + expiry together, or domain_grade for a scored A-F result. Certificate details come from public Certificate Transparency logs (Cert Spotter, crt.sh fallback), not from the live connection, so a brand-new cert may not show yet. Read-only; makes one HTTPS request to the host and one CT-log query, usually 1-5 s. Costs $0.01 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.
`check_dns`read-only	Look up the live DNS of a domain: NS, A/AAAA/CNAME, MX, SPF, DMARC, CAA (climbing to the parent zone) and DNSSEC status, with plain-English findings. Use it for a DNS inventory or to debug resolution; use check_email_auth for a deeper SPF/DMARC/DKIM/MTA-STS review. Queries Cloudflare DNS-over-HTTPS (1.1.1.1) at call time; read-only, nothing is stored. Costs $0.01 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.
`check_domain_expiry`read-only	Check when a domain registration expires: registrar, registered and expiry dates, days left, EPP status codes and nameservers, from the registry's RDAP server. Use it for renewal risk on the registered domain (not the certificate; use check_cert for that). Some TLDs publish no RDAP service, in which case found=false explains why. Read-only. Costs $0.01 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.
`check_email_auth`read-only	Review the email authentication setup of a domain: SPF validity and DNS-lookup count (limit 10), DMARC policy, pct and reporting, DKIM on common selector names, MTA-STS mode, TLS-RPT and BIMI, with a rough 0-100 score and plain-English fixes. Use it before sending mail from a domain or when mail lands in spam. DKIM is only checked on common selectors, so "not found" is not proof DKIM is missing. Live DNS via Cloudflare DoH; read-only, no email is sent. Costs $0.01 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.
`check_security_headers`read-only	Check the HTTP security headers of a website with one live HTTPS GET: redirect chain (up to 5 hops), final status, HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and COOP, with a simple A-F header grade and findings. Use it for web-hardening checks; it is not a vulnerability scan. The page body is not read or stored. Costs $0.01 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.
`domain_grade`read-only	Grade a domain's security posture A-F in one call, for vendor-risk or due-diligence checks. Runs the TLS, DNS (DNSSEC, CAA), registration-expiry, email-auth and HTTP-header checks and returns one letter, a 0-100 score, points per category (TLS 25, email 25, headers 20, DNS 15, registration 15) and the top fixes. Use it when you want a verdict; use site_health or the single checks when you need raw data. Unavailable categories are left out of the percentage (partial=true). Read-only; takes about 3-10 s. Costs $0.03 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.
`full_site_audit`read-only	Full site audit report for one domain, for client reports, vendor reviews or a pre-launch check. Runs every check (TLS from CT logs + live probe, DNS/DNSSEC/CAA, registration expiry and transfer lock, SPF/DMARC/DKIM/MTA-STS, security headers) plus HTTP->HTTPS redirect, www/apex consistency, RFC 9116 security.txt, robots.txt and sitemap. Returns the A-F grade and score (same weights as domain_grade), an action plan sorted critical > high > medium > low where each item has the exact fix and effort, and every raw section. Use domain_grade for just the letter. Fails (not charged) if 3+ core checks fail. Read-only; about 5-15 s. Costs $2 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.
`pricing`read-only	Free. Return the price of every paid tool, the payment network (Base) and the receiving address, so you can budget before calling. No input, no network request, no payment.
`site_health`read-only	Run check_cert, check_dns and check_domain_expiry together and return their raw results plus a short summary, the renewal-stall flag and the Let's Encrypt 64-day certificate note (from 2027-02-10). Use it for a full data dump in one call; use domain_grade if you want a single scored A-F answer that also covers email auth and HTTP headers. If one or two sources fail you get partial=true with the rest. Read-only. Costs $0.03 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.
`threat_check`read-only	Is this domain known-bad? Resolves the hostname (A/AAAA), matches the name, its parent domains and resolved IPv4 against ThreatCluster's high-confidence 30-day IOC feed (cached, refreshed about hourly), and looks up ransomware leak-site claims naming the domain (commercially reusable sources via Dragons Eye). Returns verdict listed, claimed, listed_and_claimed or no_known_threat with the matching reports. No match is not proof of safety; claims are unverified attacker assertions. Stale feed or source failure returns an error and is not charged. Costs $0.02 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.
`validate_target`read-only	Free. Check that a domain or URL is well-formed and get the normalized hostname, before calling a paid check. Offline: no network request, no payment. Rejects IP addresses, single-label names and URLs with credentials.
`watch_status`read-only	Free. Status of a paid domain watch (created with HTTP POST /v1/watch): items, expiry, last check, current DNS/IOC/claim state, last webhook delivery.

Schemas: list_tools.

Similar MCP servers

Official server.json

{
  "name": "com.orioncmd.api/checks",
  "icons": [
    {
      "src": "https://api.orioncmd.com/favicon.svg",
      "sizes": [
        "any"
      ],
      "mimeType": "image/svg+xml"
    }
  ],
  "title": "OrionCMD Checks",
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "remotes": [
    {
      "url": "https://api.orioncmd.com/mcp",
      "type": "streamable-http"
    }
  ],
  "version": "1.5.0",
  "websiteUrl": "https://api.orioncmd.com/llms.txt",
  "description": "Domain threat checks, a 30-day domain watch, TLS/DNS/email-auth checks and a $2 site audit (x402)."
}