Cognita MCP Server

Geolocate an IP address (or a host's resolved IP): ASN, network organisation, and approximate city/country. Requires a configured GeoIP database. Read-only.

List the IP prefixes an autonomous system announces (via RIPEstat), with the network holder — the routed footprint of an ASN. Read-only.

Report an autonomous system's BGP relationships via RIPEstat (keyless): its upstreams (transit providers), downstreams (customers) and peers, from observed AS paths — the neighbour ASNs ordered by how often the relationship is seen. The connectivity map around the network, complementing asn_prefixes (its routed footprint). Read-only.

Report the revocation posture of the certificate a host serves: the OCSP responder(s) and CRL distribution point(s) a client could use to check revocation, and whether the certificate is must-staple (TLS-feature status_request, forcing a stapled OCSP response). Reads these straight from the leaf certificate — it does NOT perform a live OCSP/CRL lookup, so it answers 'can revocation be checked, and how?' not 'is it revoked now?'. Complements tls_certificate. Makes only a benign TLS handshake to the target (no HTTP request); guarded against internal targets.

Enumerate a domain's subdomains and certificate-issuance history from public Certificate Transparency logs (crt.sh): the names ever certified under it, issuing CAs, and the issuance span. Reveals names even behind a CDN and never touches the target. CT is historical — for a domain that changed hands, older names belong to a previous owner; pass `since` (the current registration date) to exclude them. Read-only.

Look up a CVE in the NVD (NIST National Vulnerability Database): its description, CVSS base score / severity / vector, CWE weakness IDs, publication dates and references. Turns a bare CVE ID (e.g. one from host_exposure) into meaning. Keyless (NVD is rate-limited without a key), read-only.

Prioritise a host's internet-exposed CVEs: takes the CVEs from host_exposure (Shodan InternetDB) and enriches each with CISA KEV (confirmed exploited in the wild) and FIRST EPSS (exploit probability), then ranks them so the ones to patch first come first — KEV entries, then highest EPSS. Each CVE gets a priority of critical/high/medium/low. For a host name the first resolved IP is used. Keyless, read-only — one cached KEV fetch and one batched EPSS request cover every CVE.

Resolve DNS records for a host name. Returns A, AAAA, MX, TXT, NS, CNAME and SOA by default; pass 'types' to narrow. Read-only.

Ask several independent public resolvers (Google, Cloudflare, DNS.SB, NextDNS) the same record over DNS-over-HTTPS and compare their answers. Returns each resolver's record set and DNS status, whether they all agree, and a note. Agreement is normal; a divergence flags a change still propagating, a stale cache, or split-horizon DNS — except when every resolver got addresses that all sit in one network (geoBalanced, with the shared ASN): that is a CDN/anycast or geo-DNS answering each resolver's location with its nearest edge, which is expected. Reads the resolvers' views — never queries the target host. Supports A/AAAA/CNAME/MX/NS/TXT/SOA/CAA. Read-only.

Parse pasted raw email headers: the Received: delivery path with per-hop delays, the SPF/DKIM/DMARC verdicts, the originating IP, and spoofing warnings. Pure parsing — no network.

Report a domain's modern email-security records beyond SPF/DMARC/DKIM: MTA-STS (DNS record + fetched policy: enforce/testing mode, max_age, MX), TLS-RPT (reporting address) and BIMI (brand logo + VMC), with warnings on what is missing or weak. Read-only DNS plus one GET of the public MTA-STS policy file.

Check an IP against GreyNoise's Community data: whether it is internet background 'noise' (a mass scanner) and, if so, GreyNoise's classification — 'malicious', 'benign' (an identified research scanner such as Shodan, Censys or Modat) or 'unknown' — with its name and when it was last seen. A 'not observed' result means GreyNoise hasn't seen the IP scanning; it is not an endorsement. Often unavailable: GreyNoise's keyless quota is only 25 lookups per week for this whole server, shared by every user — when it is used up the tool says so at once, with when it resets, instead of querying. For a host name, the first resolved IP is used. Read-only.

Fold every keyless IP-reputation source into one verdict — clean / suspicious / malicious / unknown: ip_blocklist_check (Spamhaus DROP + FireHOL), ip_reputation (GreyNoise), feodo_c2_check (botnet C2), tor_exit_check and dshield_ip_check (attack telemetry). Returns the verdict, which signals fired, and which sources answered or failed. A confirmed-bad listing forces 'malicious'; scanner/attack/Tor signals raise 'suspicious', except a research scanner GreyNoise identifies as benign (Shodan, Censys, Modat…), which is flagged but not treated as hostile; 'unknown' when too few sources answered to vouch for the IP. GreyNoise is often unavailable (a keyless quota of 25 lookups/week shared by the whole server); the verdict then rests on the other five sources and lists GreyNoise under sources failed. For a host name the first resolved IP is used. Keyless, read-only — queries the sources about the IP, never the IP itself.

Fetch and analyse a domain's SPF record: the parsed DNS-lookup count (RFC 7208 limit is 10), the 'all' qualifier, and warnings on a missing or permissive policy. Read-only.

Fully expand a domain's SPF record: follow every include: and redirect= recursively and count the DNS-lookup mechanisms across the WHOLE tree against the RFC 7208 limit of 10 — the real-world failure spf_check misses, where a nested include quietly pushes the total over 10 and the record hits permerror. Returns the flattened include tree, the total lookup count, and warnings on excess, loops or void lookups. DNS-only, read-only.

Inspect the leaf certificate a host serves on a live TLS handshake: subject, issuer, subject-alternative names, validity window and days to expiry, key and signature algorithms, serial, thumbprint, the negotiated TLS protocol/cipher, and the chain with its trust verdict. Complements cert_transparency (historical CT logs) with the certificate presented right now. Makes a benign TLS handshake to the target (no HTTP request); guarded against internal targets.

Grade a host's transport security A–F in one call, correlating tls_certificate (validity, chain trust, protocol, key/signature), cert_revocation (OCSP/CRL endpoints, must-staple) and hsts_preload_check (browser HSTS preload). Returns the letter grade, a 0–100 score, and the factors behind it (expired/weak-key/obsolete-protocol lower it; must-staple and HSTS preload strengthen it). A benign TLS handshake plus a keyless HSTS lookup — no probing. Read-only.

Report the first and most recent captures of a domain in the Internet Archive's Wayback Machine (keyless CDX), with a link to each snapshot — a site-age / history signal (how far back it is archived), complementing wayback_urls (which lists archived URLs). Read-only.

List a domain's historical URLs captured by the Internet Archive Wayback Machine (CDX API, keyless): old endpoints, forgotten paths and files no longer on the live site, across the domain and its subdomains. Passive OSINT — reads the archive, never the target. Read-only.

Find the abuse-reporting e-mail(s) for an IP (or a host's resolved IP) via RIPEstat's abuse-contact-finder — where to report a scanner or attacker surfaced by ip_reputation. Read-only.

Check whether a mail server is listed on common email DNS blocklists (DNSBLs). For a domain, its mail (MX) IPs are checked — what matters for email reputation — falling back to the A record when there is no MX; a literal IP is checked directly. Read-only DNS queries.

Check whether an IP sits inside a netblock on a curated keyless reputation list — Spamhaus DROP/EDROP (networks judged hijacked or bad-actor-controlled) and FireHOL level1 (a conservative aggregate of established abuse lists). Returns each list that matched with the matching CIDR and a reference, and which lists were reachable. Different from ip_reputation (GreyNoise scanner telemetry) and blacklist_check (mail DNSBLs): this is 'sits in a known-bad network' reputation. For a host name the first resolved IP is used. Read-only, never contacts the target.

Report a domain's CAA records (which CAs may issue its certificates) and an indicative DNSSEC signal (DNSKEY presence + Authenticated-Data flag — not a full chain validation). Read-only.

Consolidate where and how to report a security issue for a domain: the owner's own published channel (security_txt — RFC 9116 Contact, Policy, PGP key) and the network operator's registered abuse mailbox (abuse_contact, RIPEstat). Returns both sets of contacts and a clear yes/no on whether any reporting channel exists. Keyless, read-only.

Fetch a domain's DKIM public-key record for a given selector (<selector>._domainkey.<domain>). The selector comes from an email's DKIM-Signature s= tag or a known default. Read-only.

Fetch and analyse a domain's DMARC record (_dmarc TXT): the policy (none/quarantine/reject) and warnings on a weak or missing policy. Read-only.

Look up an IP's reputation in the SANS Internet Storm Center (DShield) data (keyless): how many attack reports it has across how many target sensors over the observed window, the network/AS it belongs to, and which ISC threat feeds list it. A high report count is a scanning/attacking signal. For a host name the first resolved IP is used. Read-only.

Get a CVE's EPSS score (FIRST's Exploit Prediction Scoring System): the probability (0–1) it will be exploited in the next 30 days, and its percentile rank among all CVEs. A forward-looking likelihood that complements kev_check's confirmed exploitation. Keyless, read-only.

Check an IP against abuse.ch's Feodo Tracker botnet command-and-control blocklist (keyless): a hit means the IP is a known C2 server for a malware family (Emotet, Dridex, QakBot, TrickBot, …), with the malware name, port and first-seen date. For a host name the first resolved IP is used. Threat-intel about the IP — never touches the target. Read-only.

Show the network path from the caller to a target host on a world map: origin (the caller's IP — the user when the agent runs client-side), destination (the target's geolocation), and the great-circle distance. Returns structured endpoints plus a link to an SVG map (the image itself is for the human, not the model). Makes no connection to the target.

Report a host's internet-facing exposure from Shodan's InternetDB (keyless): open ports, detected products (CPEs), known CVEs, hostnames and tags. Passive — reads Shodan's own scan data, never touches the target. For a domain the first resolved IP is used (behind a CDN this reflects the edge, not the origin). Read-only.

Check whether a domain is in the browsers' HSTS preload list (via hstspreload.org's keyless status API): the status (preloaded/pending/unknown), whether it was bulk-imported, and the parent domain it may be covered through. Preloaded domains are forced to HTTPS by browsers from the very first visit, before any HSTS header is seen — a stronger guarantee than the Strict-Transport-Security header alone. A membership lookup, never a probe of the target. Read-only.

Run a full reconnaissance sweep of a domain or URL and return a correlated report: web-security grade (via Astur), email-authentication posture (SPF/DMARC), nameservers, MX, registrar, subdomains from Certificate Transparency logs, the resolved IP's exposure (Shodan InternetDB) and reputation (GreyNoise), an overall roll-up grade, and prioritised highlights. Pass depth="deep" to also run the heavier OSINT (more calls, slower): RPKI route-origin validity, where to report a security issue (security.txt + the network's abuse mailbox), a dangling-CNAME subdomain-takeover scan, the resolved IP's folded reputation verdict (Spamhaus/FireHOL blocklists, GreyNoise, Feodo C2, Tor, DShield), the transport-security grade (certificate, revocation, HSTS preload) and the exposed CVEs ranked by KEV+EPSS — which can only WORSEN the overall grade (a malicious IP forces F; a D/F TLS posture or a known-exploited CVE floors it), never lift the web grade. Use this for broad 'investigate X' requests; use the granular tools (scan_site, spf_check, …) for specific questions.

Check whether a CVE is in CISA's Known Exploited Vulnerabilities (KEV) catalogue — i.e. confirmed exploited in the wild, the strongest 'patch this now' signal. Returns the vendor/product, when it was added, the remediation due date, and whether it's used in known ransomware campaigns. Interprets the CVE IDs host_exposure surfaces. Keyless, read-only.

List a domain's mail exchangers (MX), ordered by preference, with each host's resolved IP addresses. Read-only.

Find the certificates that name an ORGANISATION in Certificate Transparency (via crt.sh) and the distinct registrable domains on them — a link from a company name to its domain footprint, complementing cert_transparency's per-domain view. Passive OSINT, read-only.

Historical DNS resolutions for a domain or IP from Mnemonic's keyless Passive DNS: the answers a name resolved to over time (or the names that pointed at an IP), each with a first/last-seen window and observation count. Surfaces old/rotated infrastructure a live lookup can't. Reads the passive-DNS database, never the target. Read-only.

Look up registration data for a domain or IP via RDAP (the modern JSON successor to WHOIS): handle, name, statuses and lifecycle events, plus the raw record. Read-only.

Find other registrable domains that share a TLS certificate (a common SAN) with the given domain, from Certificate Transparency (crt.sh) — a passive link to sibling properties run on the same certificates. Read-only.

Reverse-resolve an IP address to its PTR host name(s). Read-only.

Passively read a site's robots.txt and the sitemap it points to. Returns the disallowed paths (often naming admin/staging areas — a recon signal), any declared crawl-delay, the sitemap URL(s), and — for the one sitemap fetched — whether it is a sitemap index, how many <loc> entries it holds, and a sample of them. Reads only these two public, owner-published files; it does NOT crawl, guess, or brute-force paths (that active content discovery is scan_site/Astur's job). Read-only.

Validate the BGP route-origin of an IP or prefix against RPKI (via RIPEstat): valid / invalid / unknown for the announcing ASN and covering prefix. 'invalid' means the origin isn't authorised by a ROA (possible hijack or misconfiguration); 'unknown' means no ROA covers the prefix. For a host name the first resolved IP is used. Read-only.

Run a passive web-security scan of a URL (via Astur). Returns an A–F grade, a 0–100 score and findings mapped to OWASP WSTG/ASVS. Non-intrusive — no active probing of the target.

Fetch a site's vulnerability-disclosure file (RFC 9116) from /.well-known/security.txt (falling back to /security.txt): the declared security Contact(s), Expires date and whether it has lapsed, PGP Encryption key, Policy/Acknowledgments links, preferred languages, and whether the file is PGP-signed, plus conformance warnings. A read of a public, owner-published file — complements abuse_contact (the RIR's registered mailbox) with the owner's own disclosure channel. Read-only, no probing.

Judge how easily a domain's mail can be forged by correlating SPF and DMARC into one verdict: 'hardened' (DMARC enforcing), 'partial' (DMARC quarantine) or 'spoofable' (no DMARC or p=none — receivers won't reject forged mail), with an A–F grade and the concrete reasons. The controlling factor is DMARC: SPF alone doesn't stop a From: spoof. Read-only DNS.

Check a domain's subdomains (enumerated from Certificate Transparency) for dangling-CNAME takeover risk: a CNAME that delegates to a third-party service (GitHub Pages, S3, Heroku, Azure, Netlify, …) which no longer claims the name. Status is 'vulnerable' (the service's unclaimed-page fingerprint was seen), 'dangling' (CNAME to the service but the name no longer resolves), or 'potential' (still resolves, unconfirmed). DNS-first; an HTTP GET runs only for CNAME matches, to confirm the fingerprint.

Check whether an IP is a current Tor exit node, from the Tor Project's public bulk exit list (keyless). Exit traffic is anonymised, so an IP seen in logs may not be the true origin — a useful context signal. For a host name the first resolved IP is used. Read-only.

Report a domain's popularity on the Tranco research list (keyless): its rank in the top ~1M sites, a band (top-1k/10k/100k/1M or 'unranked'), and how many recent daily lists it appears in. A cheap context signal — a top-1k domain and an unranked one warrant very different scrutiny, and an unexpectedly unranked lookalike is a phishing tell. Reads Tranco's database, never the target. Read-only.

Generate lookalike variants of a domain (omission, transposition, homoglyph, adjacent-key, hyphenation and TLD-swap typos) and report which ones actually resolve in DNS — the registered lookalikes worth checking for phishing or brand abuse. DNS-only and read-only; never touches the target. Candidate generation is bounded so the scan stays quick.

Search urlscan.io's public scan database (keyless) for a domain or IP: recent public scans of the site itself (its own pages, not other sites that merely load something from it) with each page's final URL, resolved IP, hosting country/server/ASN, and links to the scan result and its screenshot, plus a roll-up of the related domains urlscan saw serving the pages. Reads urlscan's data, never the target. A caller can pass a raw urlscan field query (e.g. `ip:1.2.3.4`). Read-only.

Test whether a domain's authoritative name servers allow a DNS zone transfer (AXFR) — a classic misconfiguration that leaks the entire zone (every hostname it holds) to anyone who asks (RFC 5936: AXFR must be limited to authorised secondaries). Returns a per-name-server verdict — 'transferred' (leaked — the finding), 'refused'/'notauth' (declined, the safe default), 'timeout'/'unreachable', or 'blocked' (the NS resolved to an internal address and wasn't contacted) — with a sample of the disclosed records. Read-only external check over DNS/TCP; never touches the target's application.