# io.domaindrift/domaindrift (remote · domaindrift.io)

Signed internet telemetry, read-only: DNS, TLS, WHOIS, reachability. Every record Ed25519-signed.

- Trust score: 69/100 (medium)
- Change this week: +2
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- remote · `domaindrift.io`: 69/100 (this document), [markdown](https://verifymcp.io/servers/io-domaindrift-domaindrift/domaindrift.md), [page](https://verifymcp.io/servers/io-domaindrift-domaindrift/domaindrift)

## Channel facts

- Endpoint: `https://domaindrift.io/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.17.3`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Endpoint Security**: 63/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation not fully verified: no authorisation is required to call this server, and 5 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe.
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 78/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 553 tokens (~92/item across 6 items; 5 tools + 1 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 73/100
  - Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28.
  - Supports UI / widget rendering.

## Install

### Claude

```bash
claude mcp add --transport http io-domaindrift-domaindrift https://domaindrift.io/mcp
```

### Codex

```toml
[mcp_servers.io-domaindrift-domaindrift]
url = "https://domaindrift.io/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "io-domaindrift-domaindrift": {
      "type": "remote",
      "url": "https://domaindrift.io/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add io-domaindrift-domaindrift --url https://domaindrift.io/mcp --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  io-domaindrift-domaindrift:
    url: "https://domaindrift.io/mcp"
```

### Other

```json
{
  "mcpServers": {
    "io-domaindrift-domaindrift": {
      "type": "http",
      "url": "https://domaindrift.io/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 69, 0)

- [security] The server rewrote its instructions, which are the text every model session reads
- [security] Tool “internet_tape” rewrote its description, which is the text the model reads
- [security] Tool “whats_changed_today” rewrote its description, which is the text the model reads
- [security] Tool “signing_keys” rewrote its description, which is the text the model reads
- [security] Tool “resolve_receipt” rewrote its description, which is the text the model reads
- [functional] Server version: 1.104.0 → 1.124.0

### 2026-08-02 (score 69, +1)

- [functional] Server version: 1.96.2 → 1.104.0

### 2026-08-01 (score 68, 0)

- [functional] Server version: 1.91.0 → 1.96.2

### 2026-07-31 (score 68, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 67, −1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-29 (score 68, +1)

- [functional] Server version: 1.58.0 → 1.74.17

### 2026-07-28 (score 67, 0)

- [functional] Server version: 1.47.0 → 1.58.0

### 2026-07-27 (score 67, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

## MCP tools (5)

### `lookup_domain` (~126 tokens)

Look up one domain

The latest signed observation of one domain: who runs its nameservers, mail, and CDN; certificate issuer and expiry; HTTPS reachability; per-record-type counts; and the Ed25519 receipt pointer. Keyless calls get this reduced preview, throttled to 1 request per 15 seconds per IP under a shared daily ceiling. Connect with a DomainDrift API key in an Authorization: Bearer header to get the complete signed record instead, metered against your account like any API request.

Input parameters:

- `domain` (string, required): Registrable domain name, e.g. "example.com"

### `whats_changed_today` (~74 tokens)

Today's change digest

The daily "what changed on the internet" digest: a ranked top-20 of the most significant DNS, TLS, WHOIS, and infrastructure changes observed across the tracked catalog in the last 24 hours. Public and keyless. The complete change wire with sync cursors is the keyed /v1/changes endpoint.

### `resolve_receipt` (~80 tokens)

Resolve a provenance receipt

Resolve any DomainDrift provenance receipt by id: the public Ed25519 commitment (output hash, signing key, timestamp, chain link) for one observation. Public and keyless. Verify the signing key against /.well-known/domaindrift-keys.json.

Input parameters:

- `id` (string, required): Receipt id, as returned in any signed record or preview

### `internet_tape` (~52 tokens)

The 24-hour tape

The rolling 24-hour aggregate rollup: how many domains changed DNS provider, switched certificate authority, moved mail, went unreachable, and the other tape legs, each with a live count. Public and keyless.

### `signing_keys` (~45 tokens)

Published signing keys

The Ed25519 public keys that sign every DomainDrift observation, with derivation paths and validity windows. Public and keyless. Use these to verify receipts and signed records offline.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/io-domaindrift-domaindrift/domaindrift#diagnostics

## Score history

- 2026-08-03: 69
- 2026-08-02: 69
- 2026-08-01: 68
- 2026-07-31: 68
- 2026-07-30: 67
- 2026-07-29: 68
- 2026-07-28: 67
- 2026-07-27: 67
- 2026-07-26: 66

## Links

- Remote endpoint: https://domaindrift.io/mcp
- Website: https://domaindrift.io/agents
- Changelog RSS feed: https://verifymcp.io/servers/io-domaindrift-domaindrift/domaindrift/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/io-domaindrift-domaindrift/domaindrift/changelog.json
- HTML version of this page: https://verifymcp.io/servers/io-domaindrift-domaindrift/domaindrift