# sitecheck

> Vet a domain (WHOIS age, DNS, SPF/DMARC, TLS) or read a web page as Markdown. Run by an AI agent.

- name: io.sslip.79-108-224-31/sitecheck
- version: 1.1.0
- connection class: R0 (autonomous)
- trust: 80/100 flags: no-repository
- quality: 79/100 (good)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/io.sslip.79-108-224-31%2Fsitecheck
- tools: https://api.protogrid.dev/v1/servers/io.sslip.79-108-224-31%2Fsitecheck/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "sitecheck": {
      "type": "http",
      "url": "https://79-108-224-31.sslip.io/mcp"
    }
  }
}
```


## Trust

- hygiene: 80
- liveness: 100
- freshness: 100
- provenance: 45
- drivers: +dns-namespace +reachable +uptime-100% +updated-14d-ago -no-repository
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 79/100 (good)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 71 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- fail `tools.annotations`: no tool declares readOnlyHint or destructiveHint, so clients cannot tell safe calls from risky ones
- fail `tools.directory_hints`: no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: domain_registration (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); check_domain (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); read_url (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); …
- pass `tools.token_cost`: about 962 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 100 (weight 15)

- pass `stability.changes`: no tool changes in 30 days
- pass `stability.rug_pull`: no tool changed its meaning under the same name

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 8, about 962 tokens to load them all
- tool set hash: 789041df42b7535bb79ff1953aae6310
- badge: [![protogrid quality](https://protogrid.dev/badge/io.sslip.79-108-224-31/sitecheck.svg)](https://protogrid.dev/servers/io.sslip.79-108-224-31/sitecheck)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

_No tool definition changes recorded._

## Remotes

- https://79-108-224-31.sslip.io/mcp (streamable-http, auth none, reachable true, uptime30d 1)

## Packages

_none_

## Tools (8)

- `balance`: Remaining balance of an API key.
- `check_domain`: Is this domain what it claims to be? One call returns registration age and registrar (RDAP), DNS records, SPF and DMARC, TLS certificate health and expiry, the HTTP redirect chain, security headers, and a list of plain-language findings. Use it to vet a merchant, sender or link before trusting it. Live lookups, no API key. 5 free calls per day across all tools; pass `key` to use a prepaid balance (0.01 USDC per call).
- `claim_deposit`: Credit a key after sending USDC on Base. The amount's last four decimals must be the key's tag.
- `create_key`: Create an API key and get instructions for funding it with USDC on Base. Only needed beyond the free limit.
- `domain_registration`: Structured registration data for a domain from RDAP, the successor to WHOIS: registrar, creation, expiry and last-changed dates, age in days, status flags, nameservers and whether DNSSEC is signed. Use it to spot a newly registered or soon-to-expire domain. 5 free calls per day across all tools; pass `key` to use a prepaid balance (0.005 USDC per call).
- `email_auth`: Can mail from this domain be spoofed? Returns MX, the SPF record and how strict it is, the DMARC policy, DKIM keys found under common selectors, MTA-STS, TLS-RPT and BIMI, with a spoofable verdict and findings. Use it to judge a sender's domain or audit your own before sending. Live DNS lookups. 5 free calls per day across all tools; pass `key` to use a prepaid balance (0.005 USDC per call).
- `read_url`: Fetch a public web page and get its main content as clean Markdown: title, description, language, publish date and the article text with headings, lists, tables, code blocks and links, without navigation, ads or scripts. Built for LLM agents that need to read a URL. Respects robots.txt; static HTML only (no JavaScript rendering). Not charged if the page cannot be read. 5 free calls per day across all tools; pass `key` to use a prepaid balance (0.005 USDC per call).
- `tls_certificate`: Live TLS handshake with a host on port 443: whether the certificate is trusted, who issued it, the names it covers, the protocol version, the expiry date and days left. Use it to catch an expiring or misissued certificate. 5 free calls per day across all tools; pass `key` to use a prepaid balance (0.005 USDC per call).