Nel Veil MCP server

NEL VEIL MCP — free domain security checks for AI agents

Ask your agent "can someone spoof email from example.com?" and get a real answer in about ten seconds.

NEL VEIL MCP gives any MCP-compatible agent nine tools for checking a domain's public security posture: email spoofing (DMARC/SPF/DKIM), TLS weaknesses, HTTP security headers, publicly exposed files, subdomain-takeover risk, a combined scan, retrieval of an earlier scan, and compliance readiness against a register of 102 global frameworks.

Free. No API key. No signup.

Install

Claude Code — one command:

claude mcp add nel-veil -- npx -y nel-veil-mcp

Any MCP client — add this to your config file:

{
  "mcpServers": {
    "nel-veil": {
      "command": "npx",
      "args": ["-y", "nel-veil-mcp"]
    }
  }
}

Run it directly, to check it works:

npx -y nel-veil-mcp

It prints a ready line to stderr — something like nel-veil-mcp 0.2.1 ready — 9 tools, free passive tier. — and then waits for JSON-RPC on stdin. That is correct: it is a stdio server, not a CLI, and stdout carries the protocol, so nothing else is ever written there.

Requires Node 18 or newer.

30 seconds: is your domain spoofable?

After installing, ask your agent:

Check if example.com can be email-spoofed.

It calls checkemailspoofing. Real output for example.com at the time of writing:

Check if a domain can be email-spoofed — example.com
Score: 100/100 (done)

2 findings:
  [LOW] DMARC has no reporting address (rua/ruf), you have no visibility into spoofing
  [LOW] DKIM key may be 1024-bit (weak), 2048-bit recommended

Free check, built from public information. No port scanning and no exploit testing —
though some checks (well-known path requests, admin-panel reachability) do more than
passive reading; see nelprofessional.com/mcp. Active scanning requires verified domain
ownership and runs only at nelprofessional.com.
More: https://www.nelprofessional.com/mcp

That domain is in good shape. The finding people are most often surprised by is a DMARC policy of p=none — it looks configured, monitors everything, and blocks nothing.

Tools

Each returns a 0–100 score plus specific findings you can act on.

Compliance

checkcompliance maps one passive scan onto a register of 102 frameworks** across Canada, the United States, the EU/EEA, the United Kingdom, Asia-Pacific, Africa and the global standards — citing the specific provision each finding bears on.

Read the coverage field before repeating a score. Every framework reports how many of the scan categories it relies on were actually observed, as 9/16:

Shortened. The full README is on GitHub.