# HTTPfy network & DNS tools

> Free DNS, SPF/DKIM/DMARC, TLS, WHOIS, IP/ASN, blocklist, ping, traceroute and port checks. No key.

- name: io.httpfy/httpfy
- version: 1.0.0
- connection class: R0 (autonomous)
- trust: 96/100
- quality: 100/100 (new)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/io.httpfy%2Fhttpfy
- tools: https://api.protogrid.dev/v1/servers/io.httpfy%2Fhttpfy/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "httpfy": {
      "type": "http",
      "url": "https://httpfy.io/mcp"
    }
  }
}
```


## Trust

- hygiene: 100
- liveness: 100
- freshness: 100
- provenance: 85
- drivers: +repository +dns-namespace +website +reachable +uptime-100% +updated-3d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 100/100 (new)

### protocol: 100 (weight 25)

- pass `protocol.modern`: supports 2026-07-28 (server/discover)
- pass `protocol.stateless`: answers without a session
- pass `protocol.transport`: streamable HTTP
- pass `protocol.list_ttl`: tool list is cacheable (ttlMs 3600000)

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 100 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 24 of 24 tools declare readOnlyHint or destructiveHint
- pass `tools.directory_hints`: every tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
- pass `tools.token_cost`: about 2,923 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump
- pass `tools.hidden_text`: no hidden text in tool names, descriptions, schemas or annotations

### stability: n/a (weight 15)

- n/a `stability.changes`, `stability.rug_pull`, `stability.new_links`: tool history recorded for 2 of the 7 days needed

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 24, about 2,923 tokens to load them all
- tool set hash: acbce66d88bf69319d2df574779f1ebb
- tools last changed: 2026-11-13T23:48:47.430Z
- badge: [![protogrid quality](https://protogrid.dev/badge/io.httpfy/httpfy.svg)](https://protogrid.dev/servers/io.httpfy/httpfy)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-11-13 `dkim_check` changed (inputSchema)
- 2026-11-13 `certificate_transparency_search` changed (description)
  - before: List certificates logged in Certificate Transparency for a domain (via crt.sh): issuer, validity window and names, with a summary by issuer.
  - after: List certificates logged in Certificate Transparency for a domain (via crt.sh): issuer, validity window and names, with a summary by issuer. Source: crt.sh, with SSLMate Cert Spotter as a fallback when crt.sh is slow (Cert Spotter covers unexpired certificates only).
- 2026-11-13 `bimi_check` changed (description) **meaning changed**
  - before: Check the BIMI record of a domain, whether DMARC meets BIMI requirements, and whether the SVG logo and certificate URLs are reachable and well formed.
  - after: Check the BIMI record of a domain, whether DMARC meets BIMI requirements, the SVG logo (SVG Tiny PS checks) and the VMC/CMC certificate (validity dates, domain coverage, BIMI usage); the certificate chain is not verified.
- 2026-11-13 `mac_vendor_lookup` changed (inputSchema)
- 2026-11-13 `ip_blacklist_check` changed (description, inputSchema)
  - before: Check whether a public IPv4 address is listed on common DNS-based blocklists such as Spamhaus, Barracuda and SpamCop.
  - after: Check whether a public IPv4 address is listed on about 20 DNS-based blocklists such as Barracuda and SpamCop, showing listed, not listed or not checked (with the reason) per list.
- 2026-11-13 `ip_whois` changed (description, inputSchema)
  - before: WHOIS / registry data for a public IPv4 address: ASN, network range, owner organisation and registry.
  - after: Registry data (RDAP) for a public IPv4 or IPv6 address: network range, holder organisation, abuse contact, registry and the announcing ASN.
- 2026-11-13 `traceroute` changed (description, inputSchema)
  - before: Traceroute to a public host from httpfy servers (up to 10 hops). Internal hops of httpfy's own network are masked.
  - after: Traceroute to a public host from httpfy servers (up to 15 hops, one probe per hop; partial results are returned if the time limit is reached). Internal hops of httpfy's own network are masked.
- 2026-11-13 `ping` changed (inputSchema)
- 2026-11-13 `ssl_certificate_check` changed (description)
  - before: Connect to a domain on port 443 and report the certificate chain: subject, issuer, validity dates, days remaining, SANs and chain details.
  - after: Connect to a domain on port 443 and report a validity verdict (valid, expired, hostname mismatch, self-signed, untrusted, with the reason) plus the certificate chain: subject, SANs, issuer, validity dates, days remaining, TLS version and cipher. Revocation is not checked.
- 2026-11-13 `domain_expiry` changed (description)
  - before: Registration and expiry dates of a domain, with the time remaining before it expires.
  - after: Registration and expiry dates of a domain (RDAP, WHOIS fallback), with the time remaining before it expires or how long ago it expired.

Full history: https://api.protogrid.dev/v1/servers/io.httpfy%2Fhttpfy/changes

## Remotes

- https://httpfy.io/mcp (streamable-http, auth none, reachable true, uptime30d 1)

## Packages

_none_

## Tools (24)

- `asn_lookup`: Look up the autonomous system (ASN) for a public IP address, or details for an ASN such as AS15169: name, country, announced prefixes and address counts.
- `bimi_check`: Check the BIMI record of a domain, whether DMARC meets BIMI requirements, the SVG logo (SVG Tiny PS checks) and the VMC/CMC certificate (validity dates, domain coverage, BIMI usage); the certificate chain is not verified.
- `caa_check`: Find the CAA records that apply to a domain (climbing to parent domains per RFC 8659) and list which certificate authorities may issue certificates.
- `certificate_transparency_search`: List certificates logged in Certificate Transparency for a domain (via crt.sh): issuer, validity window and names, with a summary by issuer. Source: crt.sh, with SSLMate Cert Spotter as a fallback when crt.sh is slow (Cert Spotter covers unexpired certificates only).
- `dkim_check`: Check DKIM public keys for a domain. With a selector it checks that selector; without one it probes common selectors. Reports key type and RSA key length and flags weak or revoked keys.
- `dmarc_check`: Find and explain the DMARC record of a domain (policy, pct, rua/ruf, alignment) and flag weaknesses such as p=none or missing external report authorization.
- `dns_lookup`: Look up DNS records of one type (A, AAAA, CNAME, MX, NS, SOA, TXT, SRV) for a domain using public resolvers.
- `dns_propagation_check`: Query a domain's A or NS records on about 30 well-known public resolvers (all queried from httpfy.io's server; anycast resolvers answer from their nearest site) and report each resolver's answer, NXDOMAIN, NODATA or failure, to see whether a DNS change has propagated. CDN and GeoDNS names can legitimately differ between resolvers.
- `dns_report`: Full DNS report for a domain: delegation from the root, every authoritative name server checked individually (reachability, recursion, TCP, consistency), SOA values, MX records and their reverse DNS, SPF, DMARC, DKIM and DNSSEC.
- `dnssec_check`: Inspect a domain's DNSSEC chain from the root down: DS and DNSKEY records per zone, whether each DS matches a published key, signature expiry, and whether validating resolvers (Cloudflare, Google) treat the domain as secure, insecure or bogus. Signatures are judged by those resolvers, not recomputed.
- `domain_expiry`: Registration and expiry dates of a domain (RDAP, WHOIS fallback), with the time remaining before it expires or how long ago it expired.
- `domain_health_report`: Grade a domain A to F across 11 checks (name servers, SOA, DNSSEC, MX, SPF, DMARC, CAA, HTTPS certificate, HTTP to HTTPS redirect, HSTS, IPv6), with a reason and fix for each failed check.
- `domain_whois`: Registration data for a domain via RDAP (port-43 WHOIS as fallback): registrar, dates, status and name servers (personal contact data is redacted by registries).
- `ip_blacklist_check`: Check whether a public IPv4 address is listed on about 20 DNS-based blocklists such as Barracuda and SpamCop, showing listed, not listed or not checked (with the reason) per list.
- `ip_whois`: Registry data (RDAP) for a public IPv4 or IPv6 address: network range, holder organisation, abuse contact, registry and the announcing ASN.
- `mac_vendor_lookup`: Identify the manufacturer registered for a MAC address prefix (OUI) using the IEEE registry.
- `mta_sts_check`: Check MTA-STS (TXT record and the HTTPS policy file, mode and MX patterns) and the TLS-RPT reporting record for a domain.
- `mx_lookup`: List the mail exchanger (MX) records of a domain with their preferences, detect null MX (RFC 7505) and implicit MX, and flag MX targets that are CNAMEs, IP literals or do not resolve.
- `ping`: Ping a public host from httpfy servers (4 ICMP echo requests) and report packet loss and round-trip times. Useful to test reachability from outside your own network.
- `port_check`: Check whether one TCP port on a public host is open, closed or filtered when tested from httpfy servers on the internet.
- `spf_lookup`: Fetch the SPF record of a domain from its authoritative name server and list its mechanisms (ip4, ip6, include, redirect, all).
- `spf_validate`: Validate the SPF record of a domain: RFC 7208 syntax, single-record rule, DNS lookup count across includes and redirect (limit 10, a static estimate), void lookups, include loops and the all mechanism.
- `ssl_certificate_check`: Connect to a domain on port 443 and report a validity verdict (valid, expired, hostname mismatch, self-signed, untrusted, with the reason) plus the certificate chain: subject, SANs, issuer, validity dates, days remaining, TLS version and cipher. Revocation is not checked.
- `traceroute`: Traceroute to a public host from httpfy servers (up to 15 hops, one probe per hop; partial results are returned if the time limit is reached). Internal hops of httpfy's own network are masked.