Domain Health MCP server

• check_domain_registrationFree

  Read a domain's public registration record from its registry over RDAP (no WHOIS scraping): registrar, creation, expiry and last-change dates, status locks such as clientTransferProhibited, danger states such as redemption period or hold, and nameservers. Also compares the registry's nameservers with the live zone and checks DNSSEC. Subdomains are checked as their registered domain. Some country-code registries do not publish RDAP; the tool says so.

• check_email_authwrite actionFree

  Explain in plain words whether email from a domain will reach the inbox and whether others can forge it. Checks MX, SPF with every include expanded and counted against the 10-lookup limit, DMARC policy, alignment and report permissions, DKIM keys at about 40 common selectors plus any you name (with key size), BIMI, MTA-STS and TLS-RPT, and the DNS rules Google, Yahoo and Microsoft set for bulk senders. Every finding has a severity, a one-sentence fix and the RFC or provider document behind it. Reads public DNS only.

• check_security_headersFree

  Read the HTTP security headers a domain's homepage sends, as a browser receives them, and grade each: Strict-Transport-Security, Content-Security-Policy, clickjacking protection (X-Frame-Options or CSP frame-ancestors), X-Content-Type-Options, Referrer-Policy and Permissions-Policy, plus whether http:// redirects to https://, cookie flags, and software version disclosure. Only public web servers on ports 80 and 443 are contacted.

• check_sslFree

  Check the HTTPS certificate and TLS setup of a domain on port 443: issuer, expiry date and days left, whether the chain is complete and trusted, whether the certificate matches the name, key type and size, which TLS versions (1.0 to 1.3) the server accepts, and the CAA record that limits who may issue certificates. Checks www as well when given a bare domain. Every finding has a severity, a fix and a citation.

• full_domain_reportwrite actionFree

  Run every Domain Health check on one domain at once (email authentication, SSL and TLS, security headers, registration and DNSSEC) and answer three questions in plain words: will its email land, is its website safe, and is the domain owned well. Returns a score and grade per area, the top fixes across all areas, and every finding with its severity, fix and citation. Takes 5 to 20 seconds.

• –Code scanremote-only server, no package to scann/a
• Live reliabilityremote reachable in 208ms20/20
• Tool poisoning5 tool descriptions checked15/15
• Auth qualityopen endpoint exposes 2 write-action tools with no auth3/15
• Maintenanceno repository listed3/15
• Maintainer identityendpoint served from the registry-verified namespace domain8/10

Safety score

65/100

higher than 20% of 918 Security servers

Tools

5

the typical Security server has 6

Tools that change things

40%

typical: 0%. Fewer write tools means less an agent can break

Uptime

100%

of our recent checks; the typical remote Security server answers 100%

Response time

682 ms

faster than 15% of 550 Security servers

Domain Health: common questions

Is Domain Health MCP server safe?

With care: it is graded C, so read the findings first (65/100). Read the Domain Health safety report

How do I install Domain Health?

It runs remotely at mcp.modernmustardseed.com. Add it to Claude Code, Cursor, VS Code or Claude Desktop with the snippets above, or call it through the mcp.market gateway without installing anything.

Does Domain Health need an API key?

Not as far as the registry entry and our scan can tell: no credentials are declared or required.

Is Domain Health maintained?

The latest release is v1.0.0.

Is Domain Health up?

100% of our last 28 checks got an answer. We check remote servers about four times a day.

What can I use instead of Domain Health?

Servers from other publishers that do the same job: DNS Doctor MCP server, Jikida MCP server and Prodcheck MCP server.

How does Domain Health compare with other Security MCP servers?

safety score 65/100 (higher than 20% of 918 Security servers); tools 5 (the typical Security server has 6); tools that change things 40% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.