# Cognita (remote · cognita.fmelo.net)

Passive OSINT and security recon: DNS, TLS, email posture, IP reputation, CVE/KEV, CT logs.

- Trust score: 68/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-10-18

## Components

- remote · `cognita.fmelo.net`: 68/100 (this document), [markdown](https://verifymcp.io/servers/net-fmelo-cognita/cognita.md), [page](https://verifymcp.io/servers/net-fmelo-cognita/cognita)

## Channel facts

- Endpoint: `https://cognita.fmelo.net/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.0.34`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-10-18.

- **Endpoint Security**: 66/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation not fully verified: no authorisation is required to call this server, and 51 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe.
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC is configured correctly; the domain's records validate against the full chain to the root.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 78/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 6008 tokens (~117/item across 51 items; 51 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 7/100
  - Stability observed for 2 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 75/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "zone_transfer_check" implies "transfer" and declares no destructiveHint at all, which the MCP spec reads as destructive by default.
  - An AI judge read all 51 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).

## Install

### How do I install the Cognita MCP server?

Cognita is a hosted endpoint at https://cognita.fmelo.net/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http net-fmelo-cognita 'https://cognita.fmelo.net/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "net-fmelo-cognita": {
      "url": "https://cognita.fmelo.net/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "net-fmelo-cognita": {
      "type": "http",
      "url": "https://cognita.fmelo.net/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.net-fmelo-cognita]
url = "https://cognita.fmelo.net/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "net-fmelo-cognita": {
      "type": "remote",
      "url": "https://cognita.fmelo.net/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add net-fmelo-cognita --url 'https://cognita.fmelo.net/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  net-fmelo-cognita:
    url: "https://cognita.fmelo.net/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "net-fmelo-cognita": {
      "Transport": "http",
      "Url": "https://cognita.fmelo.net/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add net-fmelo-cognita -t streamable-http -u 'https://cognita.fmelo.net/mcp'
```

### Other

```json
{
  "mcpServers": {
    "net-fmelo-cognita": {
      "type": "http",
      "url": "https://cognita.fmelo.net/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-10-18 (score 68, +1)

No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-17 (score 67, 0)

- [functional improvement] Stability: unverified → 0.03
- [functional] Server version: 1.0.9786.7221 → 1.0.9786.20433
- [functional] Server version: 1.0.9779.319 → 1.0.9786.7221

### 2026-10-16 (score 67)

First indexed and scored.

## MCP tools (51)

### `asn_prefixes` (~59 tokens)

List the IP prefixes an autonomous system announces (via RIPEstat), with the network holder — the routed footprint of an ASN. Read-only.

Input parameters:

- `asn` (string, required): ASN, e.g. 13335 or AS13335

### `cve_triage` (~157 tokens)

Prioritise a host's internet-exposed CVEs: takes the CVEs from host_exposure (Shodan InternetDB) and enriches each with CISA KEV (confirmed exploited in the wild) and FIRST EPSS (exploit probability), then ranks them so the ones to patch first come first — KEV entries, then highest EPSS. Each CVE gets a priority of critical/high/medium/low. For a host name the first resolved IP is used. Keyless, read-only — one cached KEV fetch and one batched EPSS request cover every CVE.

Input parameters:

- `target` (string, required): IP address or host name, e.g. 1.1.1.1 or example.com

### `typosquat_scan` (~101 tokens)

Generate lookalike variants of a domain (omission, transposition, homoglyph, adjacent-key, hyphenation and TLD-swap typos) and report which ones actually resolve in DNS — the registered lookalikes worth checking for phishing or brand abuse. DNS-only and read-only; never touches the target. Candidate generation is bounded so the scan stays quick.

Input parameters:

- `domain` (string, required): Registrable domain, e.g. example.com

### `email_header_analyzer` (~72 tokens)

Parse pasted raw email headers: the Received: delivery path with per-hop delays, the SPF/DKIM/DMARC verdicts, the originating IP, and spoofing warnings. Pure parsing — no network.

Input parameters:

- `rawHeaders` (string, required): The raw email headers, copied verbatim from the message source.

### `dns_propagation` (~208 tokens)

Ask several independent public resolvers (Google, Cloudflare, DNS.SB, NextDNS) the same record over DNS-over-HTTPS and compare their answers. Returns each resolver's record set and DNS status, whether they all agree, and a note. Agreement is normal; a divergence flags a change still propagating, a stale cache, or split-horizon DNS — except when every resolver got addresses that all sit in one network (geoBalanced, with the shared ASN): that is a CDN/anycast or geo-DNS answering each resolver's location with its nearest edge, which is expected. Reads the resolvers' views — never queries the target host. Supports A/AAAA/CNAME/MX/NS/TXT/SOA/CAA. Read-only.

Input parameters:

- `name` (string, required): Domain, e.g. example.com
- `type` (string): Record type: A (default), AAAA, CNAME, MX, NS, TXT, SOA or CAA.

### `email_posture` (~103 tokens)

Report a domain's modern email-security records beyond SPF/DMARC/DKIM: MTA-STS (DNS record + fetched policy: enforce/testing mode, max_age, MX), TLS-RPT (reporting address) and BIMI (brand logo + VMC), with warnings on what is missing or weak. Read-only DNS plus one GET of the public MTA-STS policy file.

Input parameters:

- `domain` (string, required): Domain, e.g. example.com

### `ct_org_search` (~86 tokens)

Find the certificates that name an ORGANISATION in Certificate Transparency (via crt.sh) and the distinct registrable domains on them — a link from a company name to its domain footprint, complementing cert_transparency's per-domain view. Passive OSINT, read-only.

Input parameters:

- `organization` (string, required): Organisation name as it appears on certificates, e.g. "GitHub, Inc."

### `geo_route` (~102 tokens)

Show the network path from the caller to a target host on a world map: origin (the caller's IP — the user when the agent runs client-side), destination (the target's geolocation), and the great-circle distance. Returns structured endpoints plus a link to an SVG map (the image itself is for the human, not the model). Makes no connection to the target.

Input parameters:

- `host` (string, required): Target host name or IP, e.g. example.com

### `tls_posture` (~155 tokens)

Grade a host's transport security A–F in one call, correlating tls_certificate (validity, chain trust, protocol, key/signature), cert_revocation (OCSP/CRL endpoints, must-staple) and hsts_preload_check (browser HSTS preload). Returns the letter grade, a 0–100 score, and the factors behind it (expired/weak-key/obsolete-protocol lower it; must-staple and HSTS preload strengthen it). A benign TLS handshake plus a keyless HSTS lookup — no probing. Read-only.

Input parameters:

- `host` (string, required): Host name or IP, e.g. example.com
- `port` (integer): TLS port (default 443)

### `feodo_c2_check` (~130 tokens)

Check an IP against abuse.ch's Feodo Tracker botnet command-and-control blocklist (keyless): a hit means the IP is a known C2 server for a malware family (Emotet, Dridex, QakBot, TrickBot, …), with the malware name, port and first-seen date. For a host name the first resolved IP is used. Threat-intel about the IP — never touches the target. Read-only.

Input parameters:

- `target` (string, required): IP address or host name, e.g. 45.83.66.10 or example.com

### `dmarc_check` (~62 tokens)

Fetch and analyse a domain's DMARC record (_dmarc TXT): the policy (none/quarantine/reject) and warnings on a weak or missing policy. Read-only.

Input parameters:

- `domain` (string, required): Domain to query, e.g. example.com

### `tranco_rank` (~129 tokens)

Report a domain's popularity on the Tranco research list (keyless): its rank in the top ~1M sites, a band (top-1k/10k/100k/1M or 'unranked'), and how many recent daily lists it appears in. A cheap context signal — a top-1k domain and an unranked one warrant very different scrutiny, and an unexpectedly unranked lookalike is a phishing tell. Reads Tranco's database, never the target. Read-only.

Input parameters:

- `domain` (string, required): Domain, e.g. example.com

### `rpki_validation` (~131 tokens)

Validate the BGP route-origin of an IP or prefix against RPKI (via RIPEstat): valid / invalid / unknown for the announcing ASN and covering prefix. 'invalid' means the origin isn't authorised by a ROA (possible hijack or misconfiguration); 'unknown' means no ROA covers the prefix. For a host name the first resolved IP is used. Read-only.

Input parameters:

- `target` (string, required): IP address, CIDR prefix, or host name — e.g. 193.0.6.139, 193.0.0.0/21 or example.com

### `cve_lookup` (~105 tokens)

Look up a CVE in the NVD (NIST National Vulnerability Database): its description, CVSS base score / severity / vector, CWE weakness IDs, publication dates and references. Turns a bare CVE ID (e.g. one from host_exposure) into meaning. Keyless (NVD is rate-limited without a key), read-only.

Input parameters:

- `cve` (string, required): CVE ID, e.g. CVE-2021-44228

### `spoofability` (~115 tokens)

Judge how easily a domain's mail can be forged by correlating SPF and DMARC into one verdict: 'hardened' (DMARC enforcing), 'partial' (DMARC quarantine) or 'spoofable' (no DMARC or p=none — receivers won't reject forged mail), with an A–F grade and the concrete reasons. The controlling factor is DMARC: SPF alone doesn't stop a From: spoof. Read-only DNS.

Input parameters:

- `domain` (string, required): Domain to check, e.g. example.com

### `subdomain_takeover_check` (~144 tokens)

Check a domain's subdomains (enumerated from Certificate Transparency) for dangling-CNAME takeover risk: a CNAME that delegates to a third-party service (GitHub Pages, S3, Heroku, Azure, Netlify, …) which no longer claims the name. Status is 'vulnerable' (the service's unclaimed-page fingerprint was seen), 'dangling' (CNAME to the service but the name no longer resolves), or 'potential' (still resolves, unconfirmed). DNS-first; an HTTP GET runs only for CNAME matches, to confirm the fingerprint.

Input parameters:

- `domain` (string, required): Domain, e.g. example.com

### `tls_certificate` (~128 tokens)

Inspect the leaf certificate a host serves on a live TLS handshake: subject, issuer, subject-alternative names, validity window and days to expiry, key and signature algorithms, serial, thumbprint, the negotiated TLS protocol/cipher, and the chain with its trust verdict. Complements cert_transparency (historical CT logs) with the certificate presented right now. Makes a benign TLS handshake to the target (no HTTP request); guarded against internal targets.

Input parameters:

- `host` (string, required): Host name or IP, e.g. example.com
- `port` (integer): TLS port (default 443)

### `dns_lookup` (~105 tokens)

Resolve DNS records for a host name. Returns A, AAAA, MX, TXT, NS, CNAME and SOA by default; pass 'types' to narrow. Read-only.

Input parameters:

- `name` (string, required): Host name to query, e.g. example.com
- `types` (array|null): Optional record types to query (A, AAAA, MX, TXT, NS, CNAME, SOA, PTR, CAA). Omit for the common set.

### `dshield_ip_check` (~117 tokens)

Look up an IP's reputation in the SANS Internet Storm Center (DShield) data (keyless): how many attack reports it has across how many target sensors over the observed window, the network/AS it belongs to, and which ISC threat feeds list it. A high report count is a scanning/attacking signal. For a host name the first resolved IP is used. Read-only.

Input parameters:

- `target` (string, required): IP address or host name, e.g. 45.83.66.10 or example.com

### `host_exposure` (~112 tokens)

Report a host's internet-facing exposure from Shodan's InternetDB (keyless): open ports, detected products (CPEs), known CVEs, hostnames and tags. Passive — reads Shodan's own scan data, never touches the target. For a domain the first resolved IP is used (behind a CDN this reflects the edge, not the origin). Read-only.

Input parameters:

- `target` (string, required): IP address or host name, e.g. 1.1.1.1 or example.com

### `scan_site` (~82 tokens)

Run a passive web-security scan of a URL (via Astur). Returns an A–F grade, a 0–100 score and findings mapped to OWASP WSTG/ASVS. Non-intrusive — no active probing of the target.

Input parameters:

- `url` (string, required): Absolute http(s) URL to scan, e.g. https://example.com

### `abuse_contact` (~81 tokens)

Find the abuse-reporting e-mail(s) for an IP (or a host's resolved IP) via RIPEstat's abuse-contact-finder — where to report a scanner or attacker surfaced by ip_reputation. Read-only.

Input parameters:

- `target` (string, required): IP address or host name, e.g. 45.83.66.10 or example.com

### `kev_check` (~113 tokens)

Check whether a CVE is in CISA's Known Exploited Vulnerabilities (KEV) catalogue — i.e. confirmed exploited in the wild, the strongest 'patch this now' signal. Returns the vendor/product, when it was added, the remediation due date, and whether it's used in known ransomware campaigns. Interprets the CVE IDs host_exposure surfaces. Keyless, read-only.

Input parameters:

- `cve` (string, required): CVE ID, e.g. CVE-2021-44228

### `reverse_dns` (~49 tokens)

Reverse-resolve an IP address to its PTR host name(s). Read-only.

Input parameters:

- `ip` (string, required): IPv4 or IPv6 address, e.g. 8.8.8.8

### `ip_reputation` (~193 tokens)

Check an IP against GreyNoise's Community data: whether it is internet background 'noise' (a mass scanner) and, if so, GreyNoise's classification — 'malicious', 'benign' (an identified research scanner such as Shodan, Censys or Modat) or 'unknown' — with its name and when it was last seen. A 'not observed' result means GreyNoise hasn't seen the IP scanning; it is not an endorsement. Often unavailable: GreyNoise's keyless quota is only 25 lookups per week for this whole server, shared by every user — when it is used up the tool says so at once, with when it resets, instead of querying. For a host name, the first resolved IP is used. Read-only.

Input parameters:

- `target` (string, required): IP address or host name, e.g. 45.83.66.10 or example.com

### `hsts_preload_check` (~128 tokens)

Check whether a domain is in the browsers' HSTS preload list (via hstspreload.org's keyless status API): the status (preloaded/pending/unknown), whether it was bulk-imported, and the parent domain it may be covered through. Preloaded domains are forced to HTTPS by browsers from the very first visit, before any HSTS header is seen — a stronger guarantee than the Strict-Transport-Security header alone. A membership lookup, never a probe of the target. Read-only.

Input parameters:

- `domain` (string, required): Domain, e.g. example.com

### `disclosure_contacts` (~97 tokens)

Consolidate where and how to report a security issue for a domain: the owner's own published channel (security_txt — RFC 9116 Contact, Policy, PGP key) and the network operator's registered abuse mailbox (abuse_contact, RIPEstat). Returns both sets of contacts and a clear yes/no on whether any reporting channel exists. Keyless, read-only.

Input parameters:

- `domain` (string, required): Domain, e.g. example.com

### `rdap` (~74 tokens)

Look up registration data for a domain or IP via RDAP (the modern JSON successor to WHOIS): handle, name, statuses and lifecycle events, plus the raw record. Read-only.

Input parameters:

- `query` (string, required): Domain or IP to look up, e.g. example.com or 192.0.2.1

### `tor_exit_check` (~98 tokens)

Check whether an IP is a current Tor exit node, from the Tor Project's public bulk exit list (keyless). Exit traffic is anonymised, so an IP seen in logs may not be the true origin — a useful context signal. For a host name the first resolved IP is used. Read-only.

Input parameters:

- `target` (string, required): IP address or host name, e.g. 171.25.193.25 or example.com

### `robots_sitemap` (~134 tokens)

Passively read a site's robots.txt and the sitemap it points to. Returns the disallowed paths (often naming admin/staging areas — a recon signal), any declared crawl-delay, the sitemap URL(s), and — for the one sitemap fetched — whether it is a sitemap index, how many <loc> entries it holds, and a sample of them. Reads only these two public, owner-published files; it does NOT crawl, guess, or brute-force paths (that active content discovery is scan_site/Astur's job). Read-only.

Input parameters:

- `domain` (string, required): Domain or URL, e.g. example.com

### `passive_dns` (~107 tokens)

Historical DNS resolutions for a domain or IP from Mnemonic's keyless Passive DNS: the answers a name resolved to over time (or the names that pointed at an IP), each with a first/last-seen window and observation count. Surfaces old/rotated infrastructure a live lookup can't. Reads the passive-DNS database, never the target. Read-only.

Input parameters:

- `query` (string, required): Domain or IP, e.g. example.com or 1.2.3.4

### `ip_blocklist_check` (~159 tokens)

Check whether an IP sits inside a netblock on a curated keyless reputation list — Spamhaus DROP/EDROP (networks judged hijacked or bad-actor-controlled) and FireHOL level1 (a conservative aggregate of established abuse lists). Returns each list that matched with the matching CIDR and a reference, and which lists were reachable. Different from ip_reputation (GreyNoise scanner telemetry) and blacklist_check (mail DNSBLs): this is 'sits in a known-bad network' reputation. For a host name the first resolved IP is used. Read-only, never contacts the target.

Input parameters:

- `target` (string, required): IP address or host name, e.g. 185.220.101.1 or example.com

### `epss_score` (~95 tokens)

Get a CVE's EPSS score (FIRST's Exploit Prediction Scoring System): the probability (0–1) it will be exploited in the next 30 days, and its percentile rank among all CVEs. A forward-looking likelihood that complements kev_check's confirmed exploitation. Keyless, read-only.

Input parameters:

- `cve` (string, required): CVE ID, e.g. CVE-2021-44228

### `spf_expand` (~119 tokens)

Fully expand a domain's SPF record: follow every include: and redirect= recursively and count the DNS-lookup mechanisms across the WHOLE tree against the RFC 7208 limit of 10 — the real-world failure spf_check misses, where a nested include quietly pushes the total over 10 and the record hits permerror. Returns the flattened include tree, the total lookup count, and warnings on excess, loops or void lookups. DNS-only, read-only.

Input parameters:

- `domain` (string, required): Domain to query, e.g. example.com

### `asn_relations` (~101 tokens)

Report an autonomous system's BGP relationships via RIPEstat (keyless): its upstreams (transit providers), downstreams (customers) and peers, from observed AS paths — the neighbour ASNs ordered by how often the relationship is seen. The connectivity map around the network, complementing asn_prefixes (its routed footprint). Read-only.

Input parameters:

- `asn` (string, required): ASN, e.g. 13335 or AS13335

### `spf_check` (~69 tokens)

Fetch and analyse a domain's SPF record: the parsed DNS-lookup count (RFC 7208 limit is 10), the 'all' qualifier, and warnings on a missing or permissive policy. Read-only.

Input parameters:

- `domain` (string, required): Domain to query, e.g. example.com

### `wayback_snapshot` (~82 tokens)

Report the first and most recent captures of a domain in the Internet Archive's Wayback Machine (keyless CDX), with a link to each snapshot — a site-age / history signal (how far back it is archived), complementing wayback_urls (which lists archived URLs). Read-only.

Input parameters:

- `domain` (string, required): Domain, e.g. example.com

### `cert_revocation` (~162 tokens)

Report the revocation posture of the certificate a host serves: the OCSP responder(s) and CRL distribution point(s) a client could use to check revocation, and whether the certificate is must-staple (TLS-feature status_request, forcing a stapled OCSP response). Reads these straight from the leaf certificate — it does NOT perform a live OCSP/CRL lookup, so it answers 'can revocation be checked, and how?' not 'is it revoked now?'. Complements tls_certificate. Makes only a benign TLS handshake to the target (no HTTP request); guarded against internal targets.

Input parameters:

- `host` (string, required): Host name or IP, e.g. example.com
- `port` (integer): TLS port (default 443)

### `cert_transparency` (~174 tokens)

Enumerate a domain's subdomains and certificate-issuance history from public Certificate Transparency logs (crt.sh): the names ever certified under it, issuing CAs, and the issuance span. Reveals names even behind a CDN and never touches the target. CT is historical — for a domain that changed hands, older names belong to a previous owner; pass `since` (the current registration date) to exclude them. Read-only.

Input parameters:

- `domain` (string, required): Domain, e.g. example.com
- `since` (string|null): Optional cutoff date: a year (2026), year-month (2026-01) or full ISO date (2026-01-26). When set, only names last certified on or after it are returned — use the domain's registration date to exclud…

### `related_domains` (~65 tokens)

Find other registrable domains that share a TLS certificate (a common SAN) with the given domain, from Certificate Transparency (crt.sh) — a passive link to sibling properties run on the same certificates. Read-only.

Input parameters:

- `domain` (string, required): Domain, e.g. example.com

### `zone_transfer_check` (~158 tokens)

Test whether a domain's authoritative name servers allow a DNS zone transfer (AXFR) — a classic misconfiguration that leaks the entire zone (every hostname it holds) to anyone who asks (RFC 5936: AXFR must be limited to authorised secondaries). Returns a per-name-server verdict — 'transferred' (leaked — the finding), 'refused'/'notauth' (declined, the safe default), 'timeout'/'unreachable', or 'blocked' (the NS resolved to an internal address and wasn't contacted) — with a sample of the disclosed records. Read-only external check over DNS/TCP; never touches the target's application.

Input parameters:

- `domain` (string, required): Domain, e.g. example.com

### `urlscan_lookup` (~161 tokens)

Search urlscan.io's public scan database (keyless) for a domain or IP: recent public scans of the site itself (its own pages, not other sites that merely load something from it) with each page's final URL, resolved IP, hosting country/server/ASN, and links to the scan result and its screenshot, plus a roll-up of the related domains urlscan saw serving the pages. Reads urlscan's data, never the target. A caller can pass a raw urlscan field query (e.g. `ip:1.2.3.4`). Read-only.

Input parameters:

- `target` (string, required): Domain to search, e.g. example.com (or a raw urlscan query like ip:1.2.3.4)

### `mx_lookup` (~49 tokens)

List a domain's mail exchangers (MX), ordered by preference, with each host's resolved IP addresses. Read-only.

Input parameters:

- `domain` (string, required): Domain to query, e.g. example.com

### `dkim_lookup` (~91 tokens)

Fetch a domain's DKIM public-key record for a given selector (<selector>._domainkey.<domain>). The selector comes from an email's DKIM-Signature s= tag or a known default. Read-only.

Input parameters:

- `domain` (string, required): Domain to query, e.g. example.com
- `selector` (string, required): DKIM selector, e.g. 'google' or 'selector1'

### `investigate` (~329 tokens)

Run a full reconnaissance sweep of a domain or URL and return a correlated report: web-security grade (via Astur), email-authentication posture (SPF/DMARC), nameservers, MX, registrar, subdomains from Certificate Transparency logs, the resolved IP's exposure (Shodan InternetDB) and reputation (GreyNoise), an overall roll-up grade, and prioritised highlights. Pass depth="deep" to also run the heavier OSINT (more calls, slower): RPKI route-origin validity, where to report a security issue (security.txt + the network's abuse mailbox), a dangling-CNAME subdomain-takeover scan, the resolved IP's folded reputation verdict (Spamhaus/FireHOL blocklists, GreyNoise, Feodo C2, Tor, DShield), the transport-security grade (certificate, revocation, HSTS preload) and the exposed CVEs ranked by KEV+EPSS — which can only WORSEN the overall grade (a malicious IP forces F; a D/F TLS posture or a known-exploited CVE floors it), never lift the web grade. Use this for broad 'investigate X' requests; use the granular tools (scan_site, spf_check, …) for specific questions.

Input parameters:

- `depth` (string): Depth: "standard" (default) for the quick correlation, or "deep" to add RPKI, disclosure contacts, subdomain takeover, IP reputation verdict, TLS posture and CVE ranking.
- `target` (string, required): Domain or URL to investigate, e.g. example.com or https://example.com

### `wayback_urls` (~87 tokens)

List a domain's historical URLs captured by the Internet Archive Wayback Machine (CDX API, keyless): old endpoints, forgotten paths and files no longer on the live site, across the domain and its subdomains. Passive OSINT — reads the archive, never the target. Read-only.

Input parameters:

- `domain` (string, required): Domain, e.g. example.com (subdomains are included)

### `blacklist_check` (~109 tokens)

Check whether a mail server is listed on common email DNS blocklists (DNSBLs). For a domain, its mail (MX) IPs are checked — what matters for email reputation — falling back to the A record when there is no MX; a literal IP is checked directly. Read-only DNS queries.

Input parameters:

- `target` (string, required): IP address or domain to check, e.g. 192.0.2.1 or example.com (a domain is checked at its MX mail IPs)

### `ip_reputation_aggregate` (~249 tokens)

Fold every keyless IP-reputation source into one verdict — clean / suspicious / malicious / unknown: ip_blocklist_check (Spamhaus DROP + FireHOL), ip_reputation (GreyNoise), feodo_c2_check (botnet C2), tor_exit_check and dshield_ip_check (attack telemetry). Returns the verdict, which signals fired, and which sources answered or failed. A confirmed-bad listing forces 'malicious'; scanner/attack/Tor signals raise 'suspicious', except a research scanner GreyNoise identifies as benign (Shodan, Censys, Modat…), which is flagged but not treated as hostile; 'unknown' when too few sources answered to vouch for the IP. GreyNoise is often unavailable (a keyless quota of 25 lookups/week shared by the whole server); the verdict then rests on the other five sources and lists GreyNoise under sources failed. For a host name the first resolved IP is used. Keyless, read-only — queries the sources about the IP, never the IP itself.

Input parameters:

- `target` (string, required): IP address or host name, e.g. 45.83.66.10 or example.com

### `asn_geoip` (~72 tokens)

Geolocate an IP address (or a host's resolved IP): ASN, network organisation, and approximate city/country. Requires a configured GeoIP database. Read-only.

Input parameters:

- `target` (string, required): IP address or host name, e.g. 8.8.8.8 or example.com

### `security_txt` (~132 tokens)

Fetch a site's vulnerability-disclosure file (RFC 9116) from /.well-known/security.txt (falling back to /security.txt): the declared security Contact(s), Expires date and whether it has lapsed, PGP Encryption key, Policy/Acknowledgments links, preferred languages, and whether the file is PGP-signed, plus conformance warnings. A read of a public, owner-published file — complements abuse_contact (the RIR's registered mailbox) with the owner's own disclosure channel. Read-only, no probing.

Input parameters:

- `domain` (string, required): Domain or URL, e.g. example.com

### `caa_dnssec` (~68 tokens)

Report a domain's CAA records (which CAs may issue its certificates) and an indicative DNSSEC signal (DNSKEY presence + Authenticated-Data flag — not a full chain validation). Read-only.

Input parameters:

- `domain` (string, required): Domain to query, e.g. example.com

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/net-fmelo-cognita/cognita#diagnostics

## Score history

- 2026-10-18: 68
- 2026-10-17: 67
- 2026-10-16: 67

## Common questions

### What is the Cognita MCP server?

Cognita is an MCP server listed in the public MCP registry as net.fmelo/cognita. Passive OSINT and security recon: DNS, TLS, email posture, IP reputation, CVE/KEV, CT logs. This page covers its hosted endpoint (https://cognita.fmelo.net/mcp).

### Is the Cognita MCP server safe to use?

Cognita scores 68 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Cognita MCP server expose?

Cognita exposes 51 tools: asn_prefixes, cve_triage, typosquat_scan, email_header_analyzer, dns_propagation, and 46 more. Their descriptions and schemas cost roughly 6,008 tokens of context every time the server is loaded.

### Does the Cognita MCP server require authentication?

No. We connected to Cognita without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

### Is the Cognita MCP server still maintained?

Cognita is still listed as active in the MCP registry. We last reached this channel on 18 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://cognita.fmelo.net/mcp
- Website: https://fmelo.net/
- Changelog RSS feed: https://verifymcp.io/servers/net-fmelo-cognita/cognita.xml
- Changelog JSON feed: https://verifymcp.io/servers/net-fmelo-cognita/cognita.json
- HTML version of this page: https://verifymcp.io/servers/net-fmelo-cognita/cognita