# io.github.venomseven/nslookup (remote · mcp.nslookup.io)

DNS lookups, health reports, SSL certs, security scans, GEO scoring, uptime checks

- Trust score: 67/100 (medium)
- Change this week: +2
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-04

## Components

- remote · `mcp.nslookup.io`: 67/100 (this document), [markdown](https://verifymcp.io/servers/venomseven-nslookup/mcp.md), [page](https://verifymcp.io/servers/venomseven-nslookup/mcp)
- npm · `@nslookup-io/mcp-server`: 66/100, [markdown](https://verifymcp.io/servers/venomseven-nslookup/nslookup-io-mcp-server.md), [page](https://verifymcp.io/servers/venomseven-nslookup/nslookup-io-mcp-server)

## Channel facts

- Endpoint: `https://mcp.nslookup.io/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.6.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-04.

- **Endpoint Security**: 54/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation not fully verified: no authorisation is required to call this server, and 23 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe.
  - HTTPS not yet verified: we couldn't determine whether a plaintext access path exists.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC is configured correctly; the domain's records validate against the full chain to the root.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 79/100
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 2303 tokens (~100/item across 23 items; 23 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 30/100
  - Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add --transport http venomseven-nslookup https://mcp.nslookup.io/mcp
```

### Codex

```toml
[mcp_servers.venomseven-nslookup]
url = "https://mcp.nslookup.io/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "venomseven-nslookup": {
      "type": "remote",
      "url": "https://mcp.nslookup.io/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add venomseven-nslookup --url https://mcp.nslookup.io/mcp --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  venomseven-nslookup:
    url: "https://mcp.nslookup.io/mcp"
```

### Other

```json
{
  "mcpServers": {
    "venomseven-nslookup": {
      "type": "http",
      "url": "https://mcp.nslookup.io/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-04 (score 67, +1)

No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-02 (score 66, +1)

No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-31 (score 65, −1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 66, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-28 (score 65, +1)

No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-27 (score 64, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-26 (score 63)

First indexed and scored.

## MCP tools (23)

### `dns_lookup` (~91 tokens)

Look up all common DNS records (A, AAAA, NS, MX, TXT, CNAME, SOA) for a domain. Returns results from a specified DNS server.

Input parameters:

- `domain` (string, required): Domain name to look up (e.g. example.com)
- `server` (string): DNS server to query. Default: cloudflare. Use 'authoritative' for the domain's own nameservers.

### `dns_record` (~147 tokens)

Look up a specific DNS record type for a domain. Supports 53 record types including A, AAAA, MX, TXT, CNAME, SOA, PTR, CAA, SRV, DNSKEY, DS, TLSA, HTTPS, SPF, and more.

Input parameters:

- `domain` (string, required): Domain name (or IP address for PTR lookups) to query (e.g. example.com)
- `server` (string): DNS server to query. Default: cloudflare. Use 'authoritative' for the domain's own nameservers.
- `type` (string, required): DNS record type (e.g. A, MX, TXT, CNAME, SPF, HTTPS, DNSKEY)

### `dns_propagation` (~100 tokens)

Check DNS propagation for a domain across 18+ global DNS servers (Cloudflare, Google, Quad9, OpenDNS, regional servers, and authoritative nameservers). Shows if DNS changes have propagated worldwide.

Input parameters:

- `domain` (string, required): Domain name to check propagation for (e.g. example.com)
- `recordType` (string, required): DNS record type to check (e.g. A, AAAA, MX, NS, TXT, CNAME)

### `webservers` (~64 tokens)

Get the IP addresses (both IPv4 and IPv6) for a domain by looking up A and AAAA records. Also returns the punycode and unicode domain representations.

Input parameters:

- `domain` (string, required): Domain name to look up IP addresses for (e.g. example.com)

### `ssl_certificate` (~65 tokens)

Check the SSL/TLS certificate for a domain. Returns issuer, expiry date, days until expiry, certificate chain validity, cipher strength, SAN domains, fingerprint, and TLS protocol version.

Input parameters:

- `domain` (string, required): Domain name to check SSL certificate for (e.g. github.com)

### `bimi_vmc` (~75 tokens)

Check BIMI (Brand Indicators for Message Identification) and VMC (Verified Mark Certificate) for a domain. Returns BIMI DNS record status, VMC certificate details, logo URL, trademark info, and expiry.

Input parameters:

- `domain` (string, required): Domain name to check BIMI/VMC for (e.g. google.com)

### `security_scan` (~76 tokens)

Run a security scan on a domain to detect DNS misconfigurations, missing SPF/DKIM/DMARC records, cookie security issues, and other web security vulnerabilities. Returns findings with severity levels (critical, high, medium, low, info).

Input parameters:

- `domain` (string, required): Domain name to security scan (e.g. example.com)

### `uptime_check` (~88 tokens)

Perform a one-time HTTP uptime check on a URL from a single location. Returns whether the site is up or down, HTTP status code, and response time in milliseconds. For multi-location checks, use uptime_check_multi instead.

Input parameters:

- `timeout` (number): Timeout in milliseconds (default: 10000)
- `url` (string, required): Full URL to check (e.g. https://github.com)

### `uptime_check_multi` (~89 tokens)

Check if a website is up or down from 7 global locations simultaneously: Amsterdam, Sydney, London, Frankfurt, Delhi, Warsaw, and South Carolina. Returns status, response time, and HTTP status code for each location.

Input parameters:

- `timeout` (number): Timeout in milliseconds (default: 30000)
- `url` (string, required): Full URL to check (e.g. https://github.com)

### `dns_health` (~136 tokens)

Run a comprehensive DNS health audit on a domain — 39 checks across 7 categories: DNSSEC (chain of trust, algorithms, validation), MX & email (PTR, MTA-STS, redundancy), DNS hygiene (SPF conflicts, wildcards, apex CNAME), TTL & SOA configuration, nameserver setup (diversity, lame delegation, EDNS0), CAA certificates, and operational maturity (security.txt, abuse mailbox). Returns an overall severity-weighted score (0–100) plus per-category scores.

Input parameters:

- `domain` (string, required): Domain name to check DNS health for (e.g. example.com)

### `geo_checker` (~93 tokens)

Check a domain's GEO (Generative Engine Optimization) score — how well the site is optimized for AI search engines like ChatGPT, Gemini, Claude, and Perplexity. Returns three scores (Technical Readiness, Entity Readiness, Answer Readiness), AI crawler access status, structured data analysis, and prioritized recommendations.

Input parameters:

- `domain` (string, required): Domain name to check GEO score for (e.g. github.com)

### `rdap_lookup` (~158 tokens)

Look up registration data (RDAP — the successor to WHOIS) for an IP address, AS number, or domain name. The query type is detected automatically. Returns the owning organization, network range/CIDR, RIR (ARIN, RIPE, APNIC, LACNIC, AFRINIC), country, status, registration/last-changed dates, nameservers, and abuse/registrant contacts, plus the raw RDAP JSON.

Input parameters:

- `query` (string, required): What to look up: an IPv4/IPv6 address (e.g. 8.8.8.8), an AS number (e.g. AS13335 or 13335), or a domain name (e.g. example.com)

### `hosting_report` (~94 tokens)

Find out who hosts a website. Returns the hosting provider, IP/ASN/network owner, server location, DNS/nameserver provider, CDN or proxy detection (Cloudflare, Fastly, etc.), SSL certificate issuer, and mail servers/provider for a domain in one combined report.

Input parameters:

- `domain` (string, required): Domain or URL to build a hosting report for (e.g. github.com). URLs are normalized to a bare hostname.

### `domain_scanner` (~71 tokens)

Scan a domain's email security posture: SPF, DKIM, DMARC, and BIMI configuration. Returns per-indicator scores and detected issues so you can see how well the domain is protected against spoofing and phishing.

Input parameters:

- `domain` (string, required): Domain name to scan (e.g. example.com)

### `dns_change_review` (~187 tokens)

Review proposed DNS changes BEFORE applying them. Compares a domain's current public DNS with a proposed future state, returns a diff, deterministic rule-based findings (SPF/DMARC/MX/CAA/DNSSEC pitfalls, dangling records, mail breakage, etc.) with suggested fixes, and an overall 0-100 risk score. Stateless — nothing is stored.

Input parameters:

- `domain` (string, required): Domain whose current public DNS will be compared against the proposed records (e.g. example.com)
- `records` (required): The proposed (future) DNS state: either BIND zone-file text or an array of {type, name?, value, ttl?, priority?} records. This is the COMPLETE desired state for the zone — records present now but omi…
- `server` (string): DNS server to use when fetching the current records. Default: cloudflare.

### `bimi_check` (~95 tokens)

Check only the BIMI (Brand Indicators for Message Identification) DNS record for a domain — faster than bimi_vmc because it skips the VMC certificate download and validation. Returns the BIMI record at default._bimi.<domain>, logo URL, and authority (VMC) URL if declared.

Input parameters:

- `domain` (string, required): Domain name to check the BIMI record for (e.g. easydmarc.com)

### `status_page` (~127 tokens)

Read a public status page hosted on nslookup.io status pages. Returns the page name, overall status, per-component status and uptime, and active incidents/maintenance. Look up by slug (pages served at hosted.nslookup.io/<slug>) or by the custom domain the page is served on. Provide exactly one of slug or domain.

Input parameters:

- `domain` (string): Custom domain the status page is served on (e.g. status.acme.com)
- `slug` (string): Status page slug (e.g. 'nslookup-io' for hosted.nslookup.io/nslookup-io)

### `my_overview` (~73 tokens)

Get an account health snapshot for your NsLookup.io monitoring: an aggregated 0-100 health score with per-subsystem breakdown (uptime, SSL, DNS, propagation, VMC, WHOIS) plus your current product limits/quota. Requires sign-in to your NsLookup.io account (or an API token).

### `my_monitors` (~66 tokens)

List all monitors in your NsLookup.io account across every type — uptime, API, DNS, WHOIS, DNS propagation, SSL certificates, and BIMI/VMC — with their configuration and latest known state. Requires sign-in to your NsLookup.io account (or an API token).

### `my_incidents` (~113 tokens)

List incidents from your NsLookup.io monitoring (downtime, SSL expiry, DNS changes, propagation issues, VMC problems) — open ones by default, or the full recent history — plus a per-status/per-source summary. Requires sign-in to your NsLookup.io account (or an API token).

Input parameters:

- `limit` (integer): Maximum incidents to return (default 20)
- `status` (string): 'open' (default) = unresolved incidents (triggered or acknowledged); 'all' = include resolved history

### `my_uptime_history` (~113 tokens)

Get uptime and response-time history for one of your NsLookup.io uptime monitors: availability stats plus hourly buckets over the requested window. Identify the monitor by id or by URL. Requires sign-in to your NsLookup.io account (or an API token).

Input parameters:

- `hours` (integer): History window in hours (default 24)
- `monitorId` (integer): Monitor id (from my_monitors)
- `url` (string): Monitor URL to match instead of an id (e.g. https://example.com)

### `my_dns_changes` (~82 tokens)

List recent DNS changes detected on your monitored domains, each with its DNS Change Review risk assessment (0-100 risk score, severity counts, added/removed/modified record counts), plus the latest risk per monitor. Requires sign-in to your NsLookup.io account (or an API token).

Input parameters:

- `limit` (integer): Maximum reviews to return (default 10)

### `my_certificates` (~67 tokens)

Get an SSL certificate expiry overview for your monitored domains: per-alert-level counts (ok / warning / critical / expired) and every certificate sorted by soonest expiry, highlighting the ones expiring within 30 days. Requires sign-in to your NsLookup.io account (or an API token).

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/venomseven-nslookup/mcp#diagnostics

## Score history

- 2026-08-04: 67
- 2026-08-03: 66
- 2026-08-02: 66
- 2026-08-01: 65
- 2026-07-31: 65
- 2026-07-30: 66
- 2026-07-29: 65
- 2026-07-28: 65
- 2026-07-27: 64
- 2026-07-26: 63

## Links

- Remote endpoint: https://mcp.nslookup.io/mcp
- Repository: https://github.com/NsLookup-io/nslookup-mcp
- Changelog RSS feed: https://verifymcp.io/servers/venomseven-nslookup/mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/venomseven-nslookup/mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/venomseven-nslookup/mcp