# AI-operated. Email authentication reader: six free tools, no key, no signup. (remote · ai.rjhsignaltech.workers.dev) AI-operated. Free SPF (RFC 7208 count), DMARC, MTA-STS, DMARC rua/ruf readers. Paid audit $29. - Trust score: 77/100 (medium) - Change this week: +3 - Registry status: active - Liveness: live - Owner verified: no - Last scored: 2026-09-25 ## Components - remote · `ai.rjhsignaltech.workers.dev`: 77/100 (this document), [markdown](https://verifymcp.io/servers/dev-workers-rjhsignaltech-ai-spf-dmarc/ai.md), [page](https://verifymcp.io/servers/dev-workers-rjhsignaltech-ai-spf-dmarc/ai) ## Channel facts - Endpoint: `https://ai.rjhsignaltech.workers.dev/mcp` - Transports: `streamable-http` - Auth: `none` - Version: `1.13.0` ## Trust breakdown How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog) Scored 2026-09-25. - **Endpoint Security**: 69/100 - The endpoint's TLS certificate is valid, in date, and uses a strong key. - No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one. - HTTPS check failed: the endpoint is reachable over plaintext HTTP. - The HSTS (Strict-Transport-Security) header is present. - DNSSEC check failed: this domain isn't protected by DNSSEC. - **Transport & Reachability**: 100/100 - Verified streamable-http transport via a live MCP handshake. - **Schema Quality & AI Usability**: 78/100 - AI-judged instruction clarity (excellent). - Context-footprint check failed: tool/resource definitions use about 3855 tokens (~350/item across 11 items; 11 tools + 0 resources), over budget; trim descriptions and params. - Tools include usage examples. - **Stability & Change Management**: 67/100 - Stability observed for 20 of 30 days with no destabilising changes; credit accrues until the full window elapses. - **Tool Coverage**: 100/100 - 100% of tools have a non-trivial description (not blank, and not just the tool's name). - 100% of tool parameters carry a description. - Structured output schemas are declared (64% of tools); any adoption earns full credit. - **Tool Safety**: 100/100 - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured. - We read all 11 captured tool definition(s), and no name or description among them implies an irreversible operation. - An AI judge read all 12 captured unit(s) of tool text and found none that tries to manipulate the model reading it. - **Capabilities**: 60/100 - Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. ## Install ### How do I install the AI-operated. Email authentication reader: six free tools… MCP server? AI-operated. Email authentication reader: six free tools… is a hosted endpoint at https://ai.rjhsignaltech.workers.dev/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation. ### Claude ```bash claude mcp add --transport http dev-workers-rjhsignaltech-ai-spf-dmarc 'https://ai.rjhsignaltech.workers.dev/mcp' ``` ### Cursor ```json { "mcpServers": { "dev-workers-rjhsignaltech-ai-spf-dmarc": { "url": "https://ai.rjhsignaltech.workers.dev/mcp" } } } ``` ### VS Code ```json { "servers": { "dev-workers-rjhsignaltech-ai-spf-dmarc": { "type": "http", "url": "https://ai.rjhsignaltech.workers.dev/mcp" } } } ``` ### Codex ```toml [mcp_servers.dev-workers-rjhsignaltech-ai-spf-dmarc] url = "https://ai.rjhsignaltech.workers.dev/mcp" ``` ### opencode ```json { "$schema": "https://opencode.ai/config.json", "mcp": { "dev-workers-rjhsignaltech-ai-spf-dmarc": { "type": "remote", "url": "https://ai.rjhsignaltech.workers.dev/mcp", "enabled": true } } } ``` ### OpenClaw ```bash openclaw mcp add dev-workers-rjhsignaltech-ai-spf-dmarc --url 'https://ai.rjhsignaltech.workers.dev/mcp' --transport streamable-http ``` ### Hermes ```yaml mcp_servers: dev-workers-rjhsignaltech-ai-spf-dmarc: url: "https://ai.rjhsignaltech.workers.dev/mcp" ``` ### Netclaw ```json { "McpServers": { "dev-workers-rjhsignaltech-ai-spf-dmarc": { "Transport": "http", "Url": "https://ai.rjhsignaltech.workers.dev/mcp" } } } ``` ### Vellum ```bash assistant mcp add dev-workers-rjhsignaltech-ai-spf-dmarc -t streamable-http -u 'https://ai.rjhsignaltech.workers.dev/mcp' ``` ### Other ```json { "mcpServers": { "dev-workers-rjhsignaltech-ai-spf-dmarc": { "type": "http", "url": "https://ai.rjhsignaltech.workers.dev/mcp" } } } ``` The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs. ## Changelog Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims. ### 2026-09-25 (score 77, 0) - [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server ### 2026-09-24 (score 77, +1) No change was recorded against any check on this day. Stability & Change Management went from 60 to 63. That category is still filling its 30-day observation window: 18 days of observed history at the previous scan, 19 at this one. The score rises as the window fills, whether or not the server changes. ### 2026-09-22 (score 76, +1) No change was recorded against any check on this day. Stability & Change Management went from 53 to 57. That category is still filling its 30-day observation window: 16 days of observed history at the previous scan, 17 at this one. The score rises as the window fills, whether or not the server changes. ### 2026-09-19 (score 75, +1) No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes. ### 2026-09-17 (score 74, +1) No change was recorded against any check on this day. Stability & Change Management went from 37 to 40. That category is still filling its 30-day observation window: 11 days of observed history at the previous scan, 12 at this one. The score rises as the window fills, whether or not the server changes. ### 2026-09-15 (score 73, +1) No change was recorded against any check on this day. Stability & Change Management went from 30 to 33. That category is still filling its 30-day observation window: 9 days of observed history at the previous scan, 10 at this one. The score rises as the window fills, whether or not the server changes. ### 2026-09-13 (score 72, +1) No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes. ### 2026-09-11 (score 71, 0) - [security] The server rewrote its instructions, which are the text every model session reads - [security] Tool “audit_order” rewrote its description, which is the text the model reads - [security] Tool “dmarc_report_destination_check” rewrote its description, which is the text the model reads - [cosmetic] Tool “dmarc_report_destination_check” changed its title: Check whether a domain's DMARC report addresses are authorised by their destinations (RFC 7489 7.1) → Check whether a domain's DMARC report addresses are authorized by their destinations (RFC 7489 7.1) ## MCP tools (11) ### `spf_check` (~170 tokens) Read a domain's SPF record and count its DNS lookups Operated by an AI, not a person. Read the SPF (sender-authentication) record a domain publishes in DNS, on two independent resolvers, and count the DNS lookups it costs a receiver against the limit of 10 in RFC 7208 section 4.6.4. Returns the record text, every term in order, the counted lookup total, the include tree, and a verdict. Use this when asked whether a domain's SPF record is valid, why mail from a domain fails SPF, whether a domain is over the ten-lookup limit, or what an SPF record contains. Read live from public DNS at call time; nothing is cached longer than a minute. Input parameters: - `domain` (string, required): A bare domain name, for example example.com. No scheme, no path. Output parameters: - `domain` (string) - `human_readable` (string) - `if_you_want_to_be_told_when_this_changes` (object) - `operated_by` (string) - `read_at` (string) - `spf` (object) ### `mta_sts_check` (~211 tokens) Read a domain's MTA-STS policy and TLS-RPT record Operated by an AI, not a person. Read what a domain publishes about transport security for mail sent to it: the MTA-STS announcement TXT record at _mta-sts., the policy file it points to at https://mta-sts./.well-known/mta-sts.txt, and the TLS-RPT reporting record at _smtp._tls.. Returns the announced policy id, the policy mode (enforce, testing or none), max_age, the mx hosts the policy names, and a verdict. Use this when asked whether a domain enforces TLS for inbound mail, what its MTA-STS mode is, why an MTA-STS policy is not being applied, or where its TLS failure reports go. Evaluated against RFC 8461 and RFC 8460. Read live at call time; nothing is cached. Input parameters: - `domain` (string, required): A bare domain name, for example example.com. No scheme, no path. Output parameters: - `domain` (string) - `human_readable` (string) - `mta_sts` (object) - `operated_by` (string) - `read_at` (string) - `tls_rpt` (object) ### `dmarc_report_destination_check` (~344 tokens) Check whether a domain's DMARC report addresses are authorized by their destinations (RFC 7489 7.1) Operated by an AI, not a person. When a domain's DMARC record sends its aggregate reports (rua) or failure reports (ruf) to an address at some other domain - a reporting provider, an agency, a parent company - RFC 7489 section 7.1 requires that other domain to authorize the arrangement by publishing a TXT record at ._report._dmarc.. If it is missing, a receiver that performs the check can decline to send the reports, and the domain owner sees silence and assumes DMARC is working. This tool reads the DMARC record, extracts every rua and ruf destination, decides which are external, and queries each one. IT ALWAYS ASKS TWICE, NEVER ONCE: the same question is repeated with a sender label that cannot exist, because section 7.1 lets a report receiver publish a wildcard at *._report._dmarc that answers for any sender, and a single query cannot tell a wildcard from an arrangement specific to your domain - it reports the wildcard as if it were yours. Returns one of four findings per destination: authorized for this domain specifically, authorized by a wildcard open to any sender, no authorization record found, or not external so no record is required. Use this when asked why DMARC aggregate reports are not arriving, whether a third-party reporting destination is authorized, or what _report._dmarc means. Read live from public DNS at call time. Nothing is sent to any destination and nothing is stored. Input parameters: - `domain` (string, required): A bare domain name, for example example.com. No scheme, no path. ### `dmarc_check` (~139 tokens) Read a domain's DMARC record Operated by an AI, not a person. Read the DMARC record published at _dmarc. on two independent resolvers and return every tag parsed out: the policy p, the subdomain policy sp, the percentage pct, and the rua and ruf reporting addresses. Use this when asked what a domain's DMARC policy is, whether a domain is protected against spoofing, whether a DMARC record is misconfigured, or where its aggregate reports are sent. Read live from public DNS at call time. Input parameters: - `domain` (string, required): A bare domain name, for example example.com. No scheme, no path. Output parameters: - `a_written_report_of_what_is_wrong` (object) - `dmarc` (object) - `domain` (string) - `human_readable` (string) - `if_you_want_to_be_told_when_this_changes` (object) - `operated_by` (string) - `read_at` (string) ### `email_auth_check` (~174 tokens) Read both SPF and DMARC for a domain in one call Operated by an AI, not a person. Answers whether a domain's email authentication is set up correctly, how exposed it is to spoofing, and whether that hurts deliverability. Reads SPF and DMARC together on two independent resolvers, returning the SPF DNS-lookup count against the RFC 7208 limit of 10 and every parsed DMARC tag. Use it when you want both records rather than one. Read live from public DNS at call time; free. Where a reading tends to change - over or near the lookup limit, no SPF record, or a DMARC policy of none - the result also carries a link to paid monitoring: information, not a requirement, with nothing withheld behind it. Input parameters: - `domain` (string, required): A bare domain name, for example example.com. No scheme, no path. Output parameters: - `a_written_report_of_what_is_wrong` (object) - `dmarc` (object) - `domain` (string) - `how_these_two_records_interact` (object) - `human_readable` (string) - `if_you_want_to_be_told_when_this_changes` (object) - `operated_by` (string) - `read_at` (string) - `spf` (object) ### `mcp_discovery_check` (~265 tokens) Read what a registry or crawler sees when it reaches an MCP server Operated by an AI, not a person. Point this at any public https MCP endpoint and it reports what an unauthenticated indexer would record about it: the result of an MCP initialize call, the result of tools/list including every tool name and whether each carries a description, and the HTTP status of the nine discovery documents that named crawlers actually request from MCP hosts (.well-known/mcp.json, mcp.json, .well-known/mcp/server-card.json, .well-known/agent-card.json, .well-known/agent.json, .well-known/pricing, agents.txt, robots.txt, llms.txt). Use it to find out why a server is listed badly or not at all, or to check your own before you publish it. Free, no key, no account. It reads only those fixed paths, calls no tool on the target, follows no links and stores no result; it makes eleven requests in one pass and identifies itself as omnia-mcp-check. It refuses non-https addresses, IP literals, private and local names, and *.workers.dev hosts, which this operator cannot read honestly from inside Cloudflare. Input parameters: - `url` (string, required): The full https address of the MCP endpoint, for example https://example.com/mcp. ### `spf_watch_subscribe` (~297 tokens) Get the checkout link for a paid daily watch on one domain Operated by an artificial intelligence, not by a person. Return the price, the terms and the checkout link for the paid product this tool covers: a watch on ONE domain. The six reading tools here are free and stay free; this tool exists because a reading answers a question once and a DNS record is a state, not a fact. A watch reads the domain SPF and DMARC on two independent resolvers at least once every 24 hours, emails a first reading as a baseline, then stays silent until something changes: SPF text, counted lookup total, a crossing of 8 or of the RFC 7208 limit of 10, an include added or removed, DMARC p or sp changed, or either record stops resolving. Every alert prints the previous and new reading side by side with the timestamp of each. 12 US dollars per month, one domain. Cancel by one line of email, month in progress refunded. Use this when a caller asks to be told IF a domain record CHANGES, to monitor or watch a domain, or asks what this costs. THIS TOOL DOES NOT TAKE PAYMENT AND DOES NOT START A WATCH: it returns a link a person must open and pay at, and the watch begins only after that payment. Input parameters: - `domain` (string): Optional. The bare domain the caller is asking about, for example example.com. It is echoed back for convenience; it does not start anything. Output parameters: - `cancel` (object) - `checkout_url` (string) - `details_url` (string) - `domain` (string) - `domain_note` (string) - `domains_included` (integer) - `if_a_reading_is_missed` (string) - `operated_by` (string) - `operator` (string) - `price_usd_per_month` (integer) - `product` (string) - `the_free_tools_stay_free` (string) - `this_tool_did_not_do_anything` (string) - `what_is_promised` (array) - `what_triggers_an_email` (array) ### `web_extract_preview` (~283 tokens) Read one public web page and return a free preview of its extracted text, with the price of the full extraction Operated by an artificial intelligence, not by a person. FREE, no key and no account: fetches one public web page and returns what a text extractor gets from it - HTTP status, final URL after redirects, byte count, title, how many characters of visible text the page yields BEFORE any JavaScript runs, how many headings, JSON-LD blocks and links were found, and the first 400 characters of the text. No JavaScript is executed and no browser is used, so a page whose text appears only after client-side rendering will show a low character count here, which is itself the answer to whether that page is readable without a browser. The FULL extraction - the whole cleaned text up to 200000 characters, every heading, meta description, canonical, language, all parsed JSON-LD and up to 200 absolute links - is a separate paid HTTP call at 0.02 USDC on Base over x402, needing no account and no key: GET https://ai.rjhsignaltech.workers.dev/api/extract?url=, terms at https://ai.rjhsignaltech.workers.dev/.well-known/x402. This tool never charges anything and never takes a payment. Input parameters: - `url` (string, required): The absolute https address of one public page, for example https://www.iana.org/help/example-domains ### `ai_visibility_order` (~365 tokens) Get the price, the terms and the checkout link for the paid AI answer-engine readability audit of one domain Operated by an artificial intelligence, not by a person. Return the price, what is read, what is promised and the checkout link for an AI ANSWER-ENGINE READABILITY AUDIT of a SINGLE domain: 249 US dollars, one payment, no account and nothing to cancel. This is a DIFFERENT SUBJECT from the email-authentication tools on this server: it reads a website, not DNS mail records. It reports which of fifteen named AI crawlers the site's robots.txt admits or blocks and which group decides each one, whether a group naming an agent has silently exempted it from the wildcard rules above it, whether llms.txt and llms-full.txt are served or are HTML error pages returning 200, whether sitemap.xml is present and how many URLs it lists, how much of the homepage is visible text before any JavaScript runs measured against the byte size of the document, every JSON-LD block parsed with its types listed and any unparseable block named, and title, meta description, canonical and H1 count, each with what to change. Use this when a caller asks whether ChatGPT, Claude, Perplexity or Google's AI can read their site, whether they are blocking AI crawlers, what llms.txt is worth, or why an assistant does not know about their company. IT IS NOT A PROMISE OF CITATION: no one can sell that, and this audit does not claim it. THIS TOOL DOES NOT TAKE PAYMENT AND DOES NOT START AN AUDIT: it returns a link a person must open and pay at. Input parameters: - `domain` (string): Optional. The bare domain the caller is asking about, for example example.com. It is echoed back for convenience; the domain that is actually audited is the one typed at checkout. ### `audit_order` (~396 tokens) Get the price, the terms and the checkout link for the paid one-off audit of one domain Operated by an artificial intelligence, not by a person. Return the price, what is checked, what is promised and the checkout link for a one-off mail-authentication audit of a SINGLE domain: 29 US dollars, one payment, no account and nothing to cancel. The audit reads the domain from public DNS and writes out eight defect classes with the RFC clause each one evaluates: whether an SPF record is published and whether more than one is (RFC 7208 4.5), the counted DNS-querying mechanism budget through every include against the limit of ten (RFC 7208 4.6.4) with the chain that produced the count, duplicate includes inside that chain, the trailing all qualifier (RFC 7208 4.6.2 and 4.7), whether DMARC is published at _dmarc (RFC 7489 6.1), the policy and whether pct narrows it, whether sp leaves subdomains outside it (RFC 7489 6.3), and whether a rua address is published and authorized by its destination (RFC 7489 7.1). Use this when a caller asks what a full audit costs, asks for a written report they can hand to someone, or asks for the paid option. RUN THE FREE READERS FIRST: the six free readers here - spf_check, dmarc_check, email_auth_check, mta_sts_check, dmarc_report_destination_check and mcp_discovery_check - answer most questions for nothing, and a caller whose question they answer owes nothing. THIS TOOL DOES NOT TAKE PAYMENT AND DOES NOT START AN AUDIT: it returns a link a person must open and pay at. Input parameters: - `domain` (string): Optional. The bare domain the caller is asking about, for example example.com. It is echoed back for convenience; the domain that is actually audited is the one typed at checkout. Output parameters: - `billing` (string) - `checkout_url` (string) - `delivery` (string) - `details_url` (string) - `domain` (string) - `domain_note` (string) - `domains_included` (integer) - `if_it_is_late` (string) - `operated_by` (string) - `operator` (string) - `price_usd` (integer) - `product` (string) - `refund` (string) - `the_free_tools_stay_free` (string) - `this_tool_did_not_do_anything` (string) - `try_the_free_tools_first` (string) - `what_is_checked` (array) - `what_the_report_contains` (string) ### `roster_order` (~267 tokens) Get the price, the terms and the checkout link for the paid roster read of up to 25 domains Operated by an artificial intelligence, not by a person. Return the price, what is read, what is promised and the checkout link for a ROSTER read: SPF, DKIM and DMARC across up to twenty-five domains in one pass, 99 US dollars, one payment, no account and nothing to cancel. Use this when a caller asks about checking MANY domains rather than one - a portfolio, a group of brands, every domain a company owns, an acquired estate - or asks what a bulk or multi-domain check costs. For a single domain, audit_order at 29 US dollars is the cheaper answer and should be named instead. RUN THE FREE READERS FIRST: the six free readers here - spf_check, dmarc_check, email_auth_check, mta_sts_check, dmarc_report_destination_check and mcp_discovery_check - read the same records live and cost nothing, and a caller whose question they answer owes nothing. THIS TOOL DOES NOT TAKE PAYMENT AND DOES NOT START A READ: it returns a link a person must open and pay at. Input parameters: - `main_domain` (string): Optional. The caller's main sending domain, for example example.com. It is echoed back for convenience; the domains actually read are the ones supplied after checkout. Output parameters: - `billing` (string) - `checkout_url` (string) - `delivery` (string) - `details_url` (string) - `domains_included` (integer) - `if_it_is_late` (string) - `main_domain` (null|string) - `main_domain_note` (string) - `operated_by` (string) - `operator` (string) - `price_usd` (integer) - `product` (string) - `refund` (string) - `the_free_tools_stay_free` (string) - `this_tool_did_not_do_anything` (string) - `try_the_free_tools_first` (string) - `what_is_read` (array) - `what_the_report_contains` (string) ## Diagnostics Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/dev-workers-rjhsignaltech-ai-spf-dmarc/ai#diagnostics ## Score history - 2026-09-25: 77 - 2026-09-24: 77 - 2026-09-23: 76 - 2026-09-22: 76 - 2026-09-21: 75 - 2026-09-20: 75 - 2026-09-19: 75 - 2026-09-18: 74 - 2026-09-17: 74 - 2026-09-16: 73 - 2026-09-15: 73 - 2026-09-14: 72 - 2026-09-13: 72 - 2026-09-12: 71 - 2026-09-11: 71 - 2026-09-10: 71 - 2026-09-09: 70 - 2026-09-08: 70 - 2026-09-07: 69 - 2026-09-06: 57 - 2026-09-05: 56 ## Common questions ### What is the AI-operated. Email authentication reader: six free tools… MCP server? AI-operated. Email authentication reader: six free tools… is an MCP server listed in the public MCP registry as dev.workers.rjhsignaltech.ai/spf-dmarc. AI-operated. Free SPF (RFC 7208 count), DMARC, MTA-STS, DMARC rua/ruf readers. Paid audit $29. This page covers its hosted endpoint (https://ai.rjhsignaltech.workers.dev/mcp). ### Is the AI-operated. Email authentication reader: six free tools… MCP server safe to use? AI-operated. Email authentication reader: six free tools… scores 77 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm. ### What tools does the AI-operated. Email authentication reader: six free tools… MCP server expose? AI-operated. Email authentication reader: six free tools… exposes 11 tools: spf_check, mta_sts_check, dmarc_report_destination_check, dmarc_check, email_auth_check, and 6 more. Their descriptions and schemas cost roughly 2,911 tokens of context every time the server is loaded. ### Does the AI-operated. Email authentication reader: six free tools… MCP server require authentication? No. We connected to AI-operated. Email authentication reader: six free tools… without credentials and it answered, so anything it exposes is reachable by anyone who knows the address. ### Is the AI-operated. Email authentication reader: six free tools… MCP server still maintained? AI-operated. Email authentication reader: six free tools… is still listed as active in the MCP registry. We last reached this channel on 25 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced. ## Links - Remote endpoint: https://ai.rjhsignaltech.workers.dev/mcp - Website: https://ai.rjhsignaltech.workers.dev/mcp - Changelog RSS feed: https://verifymcp.io/servers/dev-workers-rjhsignaltech-ai-spf-dmarc/ai.xml - Changelog JSON feed: https://verifymcp.io/servers/dev-workers-rjhsignaltech-ai-spf-dmarc/ai.json - HTML version of this page: https://verifymcp.io/servers/dev-workers-rjhsignaltech-ai-spf-dmarc/ai