Loading…
Answers the DNS, email-auth, and TLS sections of security questionnaires with dated, signed proof mapped to SOC 2 and ISO 27001.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 1 month ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The domainposture.com MCP server exposes 19 tools, focused primarily on network capabilities. Its published description reads: "Answers the DNS, email-auth, and TLS sections of security questionnaires with dated, signed proof mapped to SOC 2 and ISO 27001". It communicates over Streamable HTTP using the 2025-06-18 protocol revision, and does not require authorization to connect. MCPGrade currently rates domainposture.com F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Cross-tool shadowing" and "Cross-tool shadowing". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check domainposture.com's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add domainposture.com to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://www.domainposture.com/mcp/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
Context lookup: Resolve an IPv4 or IPv6 address to its geolocation, ASN, org name, and city/country. Use when you need network or location context for a raw IP address; prefer dns_lookup or dossier_dn
Context lookup: Resolve a single DNS record type (A, AAAA, MX, TXT, NS, CNAME, SOA, CAA, or SRV) and return the raw answers. Use for quick, targeted lookups of one record type; prefer dossier_dns for
Core dossier check: Fetch a domain's full DNS profile — A, AAAA, NS, SOA, CAA, and TXT records — all in parallel. Use as the first step of a domain audit or when you need a comprehensive DNS snapshot
Core dossier check: Look up a domain's MX (mail exchanger) records and return them sorted ascending by priority. Use when verifying inbound-mail routing or as a precursor to SPF or DMARC checks; prefe
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: ip_lookup
A tool description tries to alter the model’s use of another tool.
address; prefer dns_lookup or dossier_dns for hostname resolution. QueriesRecommendationDescriptions must describe only their own tool.
tool: dns_lookup
A tool description tries to alter the model’s use of another tool.
rd type; prefer dossier_dns for a full multi-type DNS audit in parallel, orRecommendationDescriptions must describe only their own tool.
tool: dossier_dns
A tool description tries to alter the model’s use of another tool.
ne call; prefer dns_lookup for a single record type, or dossier_full for aRecommendationDescriptions must describe only their own tool.
tool: dossier_mx
A tool description tries to alter the model’s use of another tool.
checks; prefer dns_lookup with type=MX if you only need the raw DNS answeRecommendationDescriptions must describe only their own tool.
tool: dossier_spf
A tool description tries to alter the model’s use of another tool.
overage, or use dns_lookup with type=TXT for the raw record only. FetchesRecommendationDescriptions must describe only their own tool.
tool: dossier_dmarc
A tool description tries to alter the model’s use of another tool.
mode; pair with dossier_spf and dossier_dkim for complete email-auth coveraRecommendationDescriptions must describe only their own tool.
tool: dossier_headers
A tool description tries to alter the model’s use of another tool.
ect tracing use dossier_redirects instead. Single GET via fetch, 5 s timeout, capRecommendationDescriptions must describe only their own tool.
tool: dossier_web_surface
A tool description tries to alter the model’s use of another tool.
ct behavior use dossier_redirects. Fetches /, /robots.txt, and /sitemap.xml concuRecommendationDescriptions must describe only their own tool.
tool: dossier_dnssec
A tool description tries to alter the model’s use of another tool.
e chain; prefer dossier_dns for raw record types or dossier_full for the coRecommendationDescriptions must describe only their own tool.
tool: dossier_ct_log
A tool description tries to alter the model’s use of another tool.
mapping; prefer dossier_full when running a complete audit. Queries crt.sh fRecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: dossier_cors
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "dossier_cors"RecommendationScope tools to the minimum needed.
tool: dossier_cors
The description pairs a fetch imperative with a hardcoded external URL, letting the server relocate its real instructions off-metadata and mutate them after review. Fires only when a fetch verb and a URL co-occur, so benign documentation links do not.
faults (origin: https://domainposture.com, method: GET). Single OPTIONS request via fetch,RecommendationDo not direct the model to fetch and act on external URLs; treat linked content as untrusted.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Core dossier check: Retrieve and parse a domain's SPF record, decomposing it into mechanisms and qualifiers. Use to verify email sender policy, debug delivery failures, or check the 10-lookup limit; p
Core dossier check: Retrieve and parse a domain's DMARC policy from its _dmarc.<domain> TXT record, returning all tags. Use to audit email authentication policy, verify the p (policy) and rua (reporti
Core dossier check: Probe a domain's DKIM public keys by querying <selector>._domainkey.<domain> for each selector. Use to verify signing configuration or discover active selectors; supply selectors w
Core dossier check: Fetch and inspect the TLS certificate presented by a domain on port 443, returning chain details and validity period. Use to verify certificate expiry, issuer, Subject Alternative
Core dossier check: Trace the full HTTP redirect chain starting from https://<domain>/, recording each hop's status code and destination URL. Use to debug redirect loops, verify HTTP→HTTPS upgrades, o
Core dossier check: Fetch https://<domain>/ and return all HTTP response headers, with an audit highlighting missing or misconfigured security headers. Use to review CSP, HSTS, X-Frame-Options, X-Cont
Core dossier check: Send a CORS preflight OPTIONS request to https://<domain>/ and return the access-control-* response headers. Use to verify CORS policy for a specific origin-method pair, or to chec
Core dossier check: Snapshot a domain's public web surface: robots.txt, sitemap.xml, and the home-page <head> metadata (title, description, OpenGraph, Twitter cards). Use for SEO audits, content disco
Context lookup: Parse a User-Agent header string into structured browser, OS, device type, and rendering-engine components. Use to identify client capabilities from a raw UA string, e.g. when analysin
Core dossier check: Verify DNSSEC chain-of-trust for a domain (DS, DNSKEY, AD flag). Use to confirm the zone is signed and resolvers accept the chain; prefer dossier_dns for raw record types or dossie
Core dossier check: Fetch and validate a domain's MTA-STS policy (mode, mx, max_age, policy id). Use to confirm inbound SMTP is locked to TLS for this domain. Resolves the _mta-sts TXT record, then fe
Core dossier check: Look up a domain's TLS-RPT (SMTP TLS Reporting) policy. Use to confirm the domain receives reports of SMTP-TLS failures. Resolves _smtp._tls.<domain> TXT via Cloudflare DoH; 5s tim
Core dossier check: Look up the registrar, creation date, expiry date, and registry statuses for a domain. Use for ownership/expiry audit. Queries WHOIS over TCP/43 via the `whoiser` library; 15s time
Core dossier check: Discover subdomains visible in Certificate Transparency logs. Use for attack-surface mapping; prefer dossier_full when running a complete audit. Queries crt.sh first, falls back to
Aggregate dossier check: Run all 10 Domain Dossier checks — dns, mx, spf, dmarc, dkim, tls, redirects, headers, cors, web-surface — in parallel and return all results in a single response. Use when yo