Connect

8 clients · secrets stay placeholders

JSON (mcpServers)Claude CodeCodexOpenCodeCursorVS CodeGemini CLIGoose

{
  "mcpServers": {
    "tools": {
      "type": "http",
      "url": "https://drwho.me/mcp/mcp"
    }
  }
}

claude mcp add --transport http tools https://drwho.me/mcp/mcp

[mcp_servers.tools]
url = "https://drwho.me/mcp/mcp"

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "tools": {
      "type": "remote",
      "url": "https://drwho.me/mcp/mcp",
      "enabled": true
    }
  }
}

{
  "mcpServers": {
    "tools": {
      "type": "http",
      "url": "https://drwho.me/mcp/mcp"
    }
  },
  "deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=tools&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vZHJ3aG8ubWUvbWNwL21jcCJ9"
}

{
  "servers": {
    "tools": {
      "type": "http",
      "url": "https://drwho.me/mcp/mcp"
    }
  }
}

{
  "mcpServers": {
    "tools": {
      "httpUrl": "https://drwho.me/mcp/mcp"
    }
  }
}

extensions:
  "tools":
    enabled: true
    name: "tools"
    type: streamable_http
    uri: "https://drwho.me/mcp/mcp"
    timeout: 300

Quality 82 / 100good

protocol75 · weight 25

warn
protocol.modernnewest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
n/a
protocol.statelessonly applies to 2026-07-28 servers
pass
protocol.transportstreamable HTTP
n/a
protocol.list_ttlonly applies to 2026-07-28 servers

authorizationn/a · weight 15

n/a
auth.prm, auth.as_metadata, auth.cimdno remote uses OAuth
n/a
auth.secret_in_urlno templated URL

tool hygiene79 · weight 30

pass
tools.descriptionsevery tool has a description
warn
tools.description_length1 tools have descriptions over 1,024 characters, which crowds the context
pass
tools.schemasevery tool has an object input schema
pass
tools.annotations29 of 29 tools declare readOnlyHint or destructiveHint
fail
tools.directory_hintsno tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: dossier_spf (destructiveHint, idempotentHint); dossier_headers (destructiveHint, idempotentHint); json_format (destructiveHint, idempotentHint); …
pass
tools.token_costabout 5,762 tokens to load every tool
pass
tools.api_dumptools are not a one-to-one API dump

stability100 · weight 15

pass
stability.changesno tool changes in 30 days
pass
stability.rug_pullno tool changed its meaning under the same name

dependenciesn/a · weight 15

n/a
deps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI package

29 tools, about 5,762 tokens to load them all · tool set ed99489b7776 · checked 2026-10-20 11:08 UTC

Tool changes

No tool definition changes recorded. A server's first observation is its baseline; later probes record what changes.

Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.

Trust 92 / 100

provenance85

liveness98

freshness85

hygiene100

+repository +dns-namespace +website +reachable +uptime-96% ~updated-33d-ago

Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.

Endpoints

remote	auth	reachable	uptime 30d	p50	protocol	last ok
`https://drwho.me/mcp/mcp` streamable-http	none	yes	96%	1005 ms	2025-11-25	2026-10-20

Tools (29)

`base64_decode`read-only	Decode base64 to UTF-8 text. Accepts the standard and the URL-safe alphabet, with or without padding or line breaks. Fails when the input is not valid base64 or does not decode to text (binary data is not returned). Runs locally.
`base64_encode`read-only	Encode UTF-8 text as base64. Set url_safe for the URL-safe alphabet (- and _ in place of + and /, no padding), as used in JSON Web Tokens. Runs locally. Returns the encoded string.
`dns_lookup`read-only	Resolve one DNS record type (A, AAAA, MX, TXT, NS, CNAME, SOA, CAA or SRV) for a name and return the raw answers. Use for a quick, targeted lookup, including on subdomains and names such as _dmarc.example.com; prefer dossier_dns for a domain's main records in one call. Queries Cloudflare DNS-over-HTTPS. Returns a JSON array of {name, type, TTL, data}; an empty array means the name exists but has no record of that type.
`dossier_ai_crawlers`read-only	Report what a domain's robots.txt says to the major AI crawlers (GPTBot, ClaudeBot, Google-Extended, PerplexityBot, CCBot, meta-externalagent): allowed, blocked or unspecified for each. Use to answer whether a site lets AI models train on or retrieve its content. A missing robots.txt is data, not an error: every crawler is then unspecified. One fetch, 10 s timeout. Returns JSON with a status field: {status:"ok", data, fetchedAt} on success, {status:"not_applicable", reason} when the thing is genuinely absent, {status:"timeout", ms}, or {status:"error", message} when it could not be determined. Treat not_applicable as a finding and error as unknown.
`dossier_cors`read-only	Send a CORS preflight (OPTIONS) to https://<domain>/ and return the access-control-* headers in the answer. Use to check whether a site accepts cross-origin requests from a given origin and method. One request, 5 s timeout. Returns JSON with a status field: {status:"ok", data, fetchedAt} on success, {status:"not_applicable", reason} when the thing is genuinely absent, {status:"timeout", ms}, or {status:"error", message} when it could not be determined. Treat not_applicable as a finding and error as unknown.
`dossier_ct_log`read-only	List subdomains of a domain that appear in Certificate Transparency logs. Use to map what hosts a domain has exposed through the certificates issued for it. Queries crt.sh, then certspotter if crt.sh fails; capped at 100 unique names, 10 s timeout. A name in the log is not proof the host still exists. Returns JSON with a status field: {status:"ok", data, fetchedAt} on success, {status:"not_applicable", reason} when the thing is genuinely absent, {status:"timeout", ms}, or {status:"error", message} when it could not be determined. Treat not_applicable as a finding and error as unknown.
`dossier_dkim`read-only	Probe a domain for DKIM public keys at <selector>._domainkey.<domain>. Pass selectors when you know them; omit to probe a built-in list of common selectors used by large mail providers. A selector not on the list will not be found, so an empty result does not prove the domain has no DKIM. Distinguishes a selector that is absent from one that could not be resolved. Parallel Cloudflare DNS-over-HTTPS TXT queries. Returns JSON with a status field: {status:"ok", data, fetchedAt} on success, {status:"not_applicable", reason} when the thing is genuinely absent, {status:"timeout", ms}, or {status:"error", message} when it could not be determined. Treat not_applicable as a finding and error as unknown.
`dossier_dmarc`read-only	Find and parse the DMARC policy at _dmarc.<domain> into its tags (p, sp, pct, rua, ruf, adkim, aspf). Use to see whether spoofed mail is rejected, quarantined or only reported. Queries Cloudflare DNS-over-HTTPS, 5 s timeout. Returns JSON with a status field: {status:"ok", data, fetchedAt} on success, {status:"not_applicable", reason} when the thing is genuinely absent, {status:"timeout", ms}, or {status:"error", message} when it could not be determined. Treat not_applicable as a finding and error as unknown.
`dossier_dns`read-only	Fetch a domain's A, AAAA, NS, SOA, CAA and TXT records in one call. Use as the first step of a DNS review; prefer dns_lookup for a single record type or for MX, CNAME and SRV. Sends six Cloudflare DNS-over-HTTPS queries in parallel, 5 s timeout each. Returns JSON with a status field: {status:"ok", data, fetchedAt} on success, {status:"not_applicable", reason} when the thing is genuinely absent, {status:"timeout", ms}, or {status:"error", message} when it could not be determined. Treat not_applicable as a finding and error as unknown.
`dossier_dnssec`read-only	Check whether a domain's zone is signed with DNSSEC and validates: DS and DNSKEY records plus the resolver's AD (authenticated data) flag. Queries Cloudflare DNS-over-HTTPS with DO=1, 8 s timeout. Returns JSON with a status field: {status:"ok", data, fetchedAt} on success, {status:"not_applicable", reason} when the thing is genuinely absent, {status:"timeout", ms}, or {status:"error", message} when it could not be determined. Treat not_applicable as a finding and error as unknown.
`dossier_headers`read-only	Fetch https://<domain>/ and return every response header, so you can review Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy. Returns the final URL after redirects and the headers as served. One GET, 5 s timeout. For the redirect hops themselves use dossier_redirects. Returns JSON with a status field: {status:"ok", data, fetchedAt} on success, {status:"not_applicable", reason} when the thing is genuinely absent, {status:"timeout", ms}, or {status:"error", message} when it could not be determined. Treat not_applicable as a finding and error as unknown.
`dossier_llms_txt`read-only	Check whether a domain publishes an llms.txt, the markdown index some sites provide for AI agents. Requires a non-HTML content type and a leading markdown heading, so a catch-all page that answers 200 with HTML does not count. One fetch, 10 s timeout. Returns JSON with a status field: {status:"ok", data, fetchedAt} on success, {status:"not_applicable", reason} when the thing is genuinely absent, {status:"timeout", ms}, or {status:"error", message} when it could not be determined. Treat not_applicable as a finding and error as unknown.
`dossier_mta_sts`read-only	Fetch and validate a domain's MTA-STS policy (mode, mx, max_age). Use to confirm inbound mail to the domain must be delivered over TLS. Resolves the _mta-sts TXT record, then fetches https://mta-sts.<domain>/.well-known/mta-sts.txt, 10 s timeout. Returns JSON with a status field: {status:"ok", data, fetchedAt} on success, {status:"not_applicable", reason} when the thing is genuinely absent, {status:"timeout", ms}, or {status:"error", message} when it could not be determined. Treat not_applicable as a finding and error as unknown.
`dossier_mx`read-only	List a domain's MX (mail exchanger) records sorted by priority. Use to see where a domain's inbound mail goes, or before checking SPF and DMARC. Queries Cloudflare DNS-over-HTTPS, 5 s timeout. Returns JSON with a status field: {status:"ok", data, fetchedAt} on success, {status:"not_applicable", reason} when the thing is genuinely absent, {status:"timeout", ms}, or {status:"error", message} when it could not be determined. Treat not_applicable as a finding and error as unknown.
`dossier_redirects`read-only	Trace the redirect chain from https://<domain>/, one entry per hop with its status code and target, up to 10 hops. Use to debug redirect loops or confirm an HTTP to HTTPS or apex to www redirect. 5 s per hop. Returns JSON with a status field: {status:"ok", data, fetchedAt} on success, {status:"not_applicable", reason} when the thing is genuinely absent, {status:"timeout", ms}, or {status:"error", message} when it could not be determined. Treat not_applicable as a finding and error as unknown.
`dossier_security_txt`read-only	Check whether a domain publishes /.well-known/security.txt (RFC 9116), the standard way to tell researchers where to report a vulnerability. Returns the Contact and Expires fields. Requires a non-HTML content type and a Contact field. One fetch, 10 s timeout. Returns JSON with a status field: {status:"ok", data, fetchedAt} on success, {status:"not_applicable", reason} when the thing is genuinely absent, {status:"timeout", ms}, or {status:"error", message} when it could not be determined. Treat not_applicable as a finding and error as unknown.
`dossier_spf`read-only	Find and parse a domain's SPF record into its mechanisms. Use to check which servers may send mail for a domain, or to debug delivery failures; pair with dossier_dmarc and dossier_dkim for the whole email-authentication picture. Reads TXT records over Cloudflare DNS-over-HTTPS. Reports records that contain v=spf1 but do not start with it (for example behind a hidden byte-order mark) as lookalikes that receivers discard, and treats more than one SPF record as an error, as RFC 7208 requires. Returns JSON with a status field: {status:"ok", data, fetchedAt} on success, {status:"not_applicable", reason} when the thing is genuinely absent, {status:"timeout", ms}, or {status:"error", message} when it could not be determined. Treat not_applicable as a finding and error as unknown.
`dossier_summary`read-only	Run the nine DNS, email-authentication and TLS checks on a domain in parallel and return one graded line per check: DNS records, MX, SPF, DMARC, DKIM, DNSSEC, TLS-RPT, MTA-STS and the TLS certificate. Use it first when asked how a domain is set up or whether its email can be spoofed; then call the single dossier_* tool for any check you need the raw data for. Each line has the check id, its status, a severity (info, low, medium, high, critical) and a one-line reason, graded by the same rules as Domain Posture. It does not return raw records or fix instructions, and it leaves out the nine web and discovery checks; the full 18-check graded report is linked in the result. Returns JSON {domain, checks:[{id, status, severity, reason}], worst}. Returns JSON with a status field: {status:"ok", data, fetchedAt} on success, {status:"not_applicable", reason} when the thing is genuinely absent, {status:"timeout", ms}, or {status:"error", message} when it could not be determined. Treat not_applicable as a finding and error as unknown.
`dossier_tls`read-only	Read the TLS certificate a domain presents on port 443: subject, issuer, validity dates, days remaining, subject alternative names, SHA-256 fingerprint and whether the chain validated. Use to check expiry or a name mismatch. It does not test cipher suites or protocol versions. One TLS handshake from the drwho.me server, 5 s timeout. Returns JSON with a status field: {status:"ok", data, fetchedAt} on success, {status:"not_applicable", reason} when the thing is genuinely absent, {status:"timeout", ms}, or {status:"error", message} when it could not be determined. Treat not_applicable as a finding and error as unknown.
`dossier_tlsrpt`read-only	Look up a domain's SMTP TLS Reporting policy at _smtp._tls.<domain>. Use to confirm the domain receives reports about failed TLS delivery of its inbound mail. Queries Cloudflare DNS-over-HTTPS. Returns JSON with a status field: {status:"ok", data, fetchedAt} on success, {status:"not_applicable", reason} when the thing is genuinely absent, {status:"timeout", ms}, or {status:"error", message} when it could not be determined. Treat not_applicable as a finding and error as unknown.
`dossier_web_surface`read-only	Summarise a domain's public web surface: robots.txt, sitemap.xml and the home page's title, description, OpenGraph and Twitter card tags. Use for a quick SEO or link-preview review. Three parallel HTTPS fetches capped at 64 KB each. Returns JSON with a status field: {status:"ok", data, fetchedAt} on success, {status:"not_applicable", reason} when the thing is genuinely absent, {status:"timeout", ms}, or {status:"error", message} when it could not be determined. Treat not_applicable as a finding and error as unknown.
`dossier_whois`read-only	Look up a domain's registrar, creation date, expiry date and registry statuses. Use for an ownership or expiry check. Tries WHOIS over TCP port 43, then RDAP over HTTPS when the registry refuses; returns not_applicable when neither answers, which is common for some country-code domains. 15 s timeout. Returns JSON with a status field: {status:"ok", data, fetchedAt} on success, {status:"not_applicable", reason} when the thing is genuinely absent, {status:"timeout", ms}, or {status:"error", message} when it could not be determined. Treat not_applicable as a finding and error as unknown.
`ip_lookup`read-only	Look up an IPv4 or IPv6 address: city, region, country, coordinates, timezone and the network (ASN and organisation) that announces it. Use when you need location or ownership context for an address; it does not accept hostnames, so resolve those with dns_lookup first. Data comes from ipinfo.io and location is approximate. Returns JSON {ip, city, region, country, loc, org, timezone}.
`json_format`read-only	Validate JSON and re-print it with an indent of 2 or 4 spaces, or minified with indent 0. Use to check whether a string is valid JSON or to make it readable. Runs locally. Returns the formatted JSON, or the parser's error message.
`jwt_decode`read-only	Decode a JSON Web Token's header and payload. It does NOT verify the signature, so never treat the claims as trusted on the strength of this tool. Use to inspect claims such as exp, iss and aud while debugging. Runs locally; the token is not stored or sent anywhere. Returns JSON {header, payload, signature}.
`url_decode`read-only	Decode percent-encoded text. Fails on a malformed sequence such as a lone % sign. A plus sign is left as a plus; replace it with a space first if the text came from an HTML form. Runs locally.
`url_encode`read-only	Percent-encode text for use in a URL query value or path segment (encodeURIComponent rules: everything except letters, digits and - _ . ! ~ * ' ( ) is encoded). Runs locally. Returns the encoded string.
`user_agent_parse`read-only	Parse a User-Agent header into browser, operating system, device and rendering engine. Use when reading server logs or request headers. Runs locally with no network call. Returns JSON {browser:{name,version}, os:{name,version}, device:{type,vendor,model}, engine:{name}}; unknown fields are empty strings.
`uuid_generate`read-only	Generate UUIDs. Version 4 is fully random. Version 7 starts with a millisecond timestamp, so values sort by creation time, which suits database keys. Runs locally with a cryptographic random source. Returns a JSON array of strings.

Schemas: list_tools.

Similar MCP servers

Official server.json

{
  "name": "me.drwho/tools",
  "title": "drwho.me network and developer tools",
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "remotes": [
    {
      "url": "https://drwho.me/mcp/mcp",
      "type": "streamable-http"
    }
  ],
  "version": "2.0.0",
  "repository": {
    "url": "https://github.com/hikmahtech/drwhome",
    "source": "github"
  },
  "websiteUrl": "https://drwho.me/mcp",
  "description": "29 free tools: DNS, email auth (SPF, DKIM, DMARC), TLS, headers, WHOIS, dev utils."
}