FernTool Network Tools MCP Server

Convert a Unix timestamp (seconds, milliseconds, microseconds or nanoseconds, auto-detected) to a readable date, or a date/time string (e.g. 2026-12-25 09:00, read in the given time zone unless it has its own offset) to a Unix timestamp. Also returns weekday, ISO week and how long ago or until.

Convert a time between time zones with daylight saving applied (you cannot do this reliably yourself). from/to accept IANA zones (Africa/Johannesburg), common abbreviations (SAST, EST, PST, GMT, CET, IST=India, CST=US Central) or big cities. Omit time for now. Returns each local date, time, UTC offset, abbreviation, hour difference and whether it is the next/previous day.

Check whether a DNS change has spread: asks the domain's own authoritative name server (when reachable) and 8 big public resolvers (Cloudflare, Google, OpenDNS, AdGuard, NextDNS, Control D, CleanBrowsing, AliDNS) over DoH, marks which are up to date, and gives the remaining cache time (TTL) of stale answers.

Resolve DNS records for a domain via Cloudflare 1.1.1.1 DNS-over-HTTPS. Types: A, AAAA, MX, TXT, NS, CNAME, SOA (default: all).

Is this website legit or a scam? Follows the URL (redirects included) and returns plain-language warning signs: domain age from RDAP (scam shops are usually days or weeks old), look-alike brand names (banks, SARS, couriers, Takealot, PayPal, Apple…), risky domain endings and scam words, look-alike letters, HTTPS, whether the domain receives email and has DMARC. verdict: no_signs, mostly_ok, caution or likely_scam. Warning signs only; not a malware scan.

Is a website down? Resolves its DNS and loads the URL once (10 s timeout) from FernTool's Cloudflare edge, then returns verdict (up/down), reason (ok, blocked_bot, page_not_found, server_error, timeout, tls, dns_nxdomain...), HTTP status, response time, final URL after redirects and server country/network. One vantage point only; results cached 30 s.

Is this email real or fake? Paste the raw headers of an email (Gmail Show original, Outlook View message details). Returns who really sent it (From, Reply-To, Return-Path), the SPF/DKIM/DMARC results recorded by the receiving provider, look-alike or fake sender names (banks, SARS, couriers, free-mail accounts posing as companies), every Received hop with delays, the sending server IP with country/network, and a verdict: verified, unverified or suspicious. Nothing is stored.

Look up 1-100 IPv4/IPv6 addresses at once. Each result has version, scope, country, timezone, ASN, network owner and flags (is_tor, is_datacenter, provider).

Exactly count words, characters (with and without spaces), sentences and paragraphs in a text, with reading/speaking time and the most repeated words. Use this instead of estimating counts yourself.

Get the exact current date and time (you cannot know it otherwise). Returns Unix seconds and milliseconds, ISO 8601 in UTC and in the requested IANA time zone, weekday, ISO week and day of year.

Exact calendar maths. With end: days between two dates (plus weeks, months+days, weekdays Mon-Fri, weekend days). With add_days/add_weeks/add_months/add_years (negative to subtract): the resulting date and weekday; business_days=true skips weekends. Use this instead of counting days yourself.

Can someone fake (spoof) email from a domain? Reads SPF (counts the 10 DNS-lookup limit, follows includes), DMARC (policy, pct, reports, inherited from the parent domain) and DKIM keys (common selectors, or the one given), detects the email provider from MX, and returns a plain verdict (protected / partial / unprotected) plus the exact TXT records to add.

Estimate token count and USD API cost of a text across major AI models (OpenAI GPT, Anthropic Claude, Google Gemini), and whether it fits each context window. Token counts are approximate. Pass text, or tokens directly.

Build one valid SPF TXT record for a domain from the services that send its email (e.g. microsoft365, google, mailchimp, sendgrid, website). Optionally reads the domain's current SPF record and MX first (keeps unknown entries, warns about services it would drop), adds extra IPs/includes, and counts DNS lookups live against the 10-lookup limit. Returns the record, DNS name, lookup count, notes and a starter DMARC record. Service ids: microsoft365, google, zoho, proton, fastmail, icloud, mimecast_za, mimecast, website, mx, shopify, mailchimp, mandrill, brevo, mailerlite, constantcontact, campaignmonitor, mailjet, sendpulse, sendgrid, mailgun, amazonses, postmark, zendesk, freshdesk, helpscout, salesforce.

Return the public IP address (and ISP, ASN, location, timezone) of the caller as seen by FernTool. Note: for remote agents this is the IP of the machine calling the MCP server.

Validate an IPv4/IPv6 address and return its version, scope (public/private/loopback/...), country, ASN and network owner (DB-IP Lite + IPtoASN data).

Create a static QR code (never expires) for a URL, Wi-Fi string (WIFI:T:WPA;S:name;P:pass;;), mailto:, tel: or any text up to 2000 characters. Returns an SVG string plus a ferntool.com image URL that renders the same code.

Fairly pick random winners from a list, shuffle a list, or split people into random even teams, using a cryptographically secure generator (you cannot choose fairly at random yourself). Use for giveaways, raffles, "who goes first", random order or team splits. An item listed twice has twice the chance unless dedupe=true.

Fair, cryptographically secure random integers (you cannot produce real randomness yourself). min and max are inclusive. unique=true for no repeats (raffles, lotto, picking winners). For a coin flip use min 0, max 1; for dice use min 1, max 6.

Reverse DNS (PTR) lookup for an IPv4/IPv6 address, with forward-confirmation check.

Live status of AI services (ChatGPT/OpenAI, Claude, Gemini API, GitHub Copilot, Perplexity, Cohere) read from their official status pages, cached ~60s. level is up, degraded, down or unknown.

IPv4/IPv6 CIDR subnet calculator: network, netmask, wildcard, broadcast, first/last usable host, total and usable addresses, block type. Optional split lists the smaller subnets (e.g. the /64s in a /48).

Where does a link really go? Follows a URL (short links like bit.ly, tracking links, QR code links) hop by hop without a browser: every redirect with status code (301/302/307/308/meta refresh), final URL and page title, plus warning signs (ends on a different site, domain registered < 30 days ago, punycode look-alike name, bare IP, no HTTPS, loops, long chains) and a copy of the final URL with tracking parameters removed. Does not scan pages for malware. Max 10 hops; cached 60 s.

Check whether a string is a valid IPv4 or IPv6 address and classify it.

WHOIS via RDAP for a domain (registrar, created/expiry dates, status, nameservers, DNSSEC), an IP address (network name, range, owner org, country, abuse contact) or an ASN like AS13335.