Quiet Failures

com.quietfailuresPublished by quietfailures.comOfficial publisherv1.4.8Updated Oct 24, 2026

Open weekly security base rates (CC BY 4.0), plus live DMARC, takeover and WHOIS checks.

VerifiedStreamable HTTPWeb executableWeb Search & ScrapingSecurity & Monitoring

Overview

AI-generated overview

Gives an assistant published security base rates plus live email authentication, subdomain takeover and WHOIS checks on domains.

What you can do
It exposes a catalog of published security base rates with global figures, sample sizes, severity and segment slugs, searchable by keyword and retrievable in full detail with confidence intervals, methodology, limits, time series and a citable source. It also runs live checks: an SPF, DKIM and DMARC audit of up to 50 domains with a portfolio grade, a subdomain takeover scan of one domain against 13 cloud providers, and WHOIS lookups for up to 100 domains.
When to use it
Useful when assessing email authentication posture across a set of domains, checking for dangling subdomains that could be taken over, or watching registration expiry dates. The base rates help put a finding in context by comparing it with published figures.
Requirements
A remote streamable HTTP endpoint; no authentication, environment variables or headers are declared. The live checks are rate-limited per client, and the takeover scan can take several minutes on large domains.
Before you install
The live checks query third-party services about domains you submit, so only scan domains you own or are authorized to test. Results are rate-limited and the takeover scan is slow on large domains. Base rate figures come with stated measurement limits and should be read alongside them.

Installation

In SourceWeft

  1. Open Quiet Failures in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/com.quietfailures%2Fquiet-failures/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "quiet-failures": {
      "type": "http",
      "url": "https://mcp.quietfailures.com/mcp"
    }
  }
}

Tools

6

list_base_rates

List security base rates

Catalog of all published Quiet Failures base rates: metric id, the global question, the current global figure, sample size, severity, and every published segment slug (valid `segment` values for get_base_rate). Use get_base_rate for full detail on one.

Takes no parameters.

find_base_rate

Find a base rate by keyword

Search the Quiet Failures base rates by keyword (e.g. "dmarc", "certificate expiry uk", "subdomain takeover"). Returns matching metrics and their most citable segments.

Parametersqueryrequired

get_base_rate

Get one base rate in full

Full detail for one Quiet Failures base rate segment: the figure with confidence interval, how it is measured, why it matters, the limits of the measurement, the recent time series, and the canonical source URL to cite. Segment defaults to "global"; country slugs (gb, fr, us…) and company cuts (gb-companies, gb-small…) are also published.

Parametersmetricrequiredsegment

check_email_auth

Check email authentication (live)

Live SPF, DKIM and DMARC audit of up to 50 domains the user owns or asks about. Returns a per-domain breakdown plus a portfolio grade. Compare against the base rates: most of the web fails these controls. Rate-limited per client.

Parametersdomainsrequired

check_subdomain_takeover

Check subdomain takeover exposure (live)

Live scan of one domain: enumerate its subdomains (CT logs + DNS), then test each for dangling references on 13 cloud providers. Slow on large domains (up to a few minutes). Rate-limited per client.

Parametersdomainrequired

check_whois

Check domain registrations (live)

Live WHOIS lookup for up to 100 domains: expiry date, registrar, nameservers. Use to catch registrations about to lapse. Rate-limited per client.

Parametersdomainsrequired

Version history

1
  1. v1.4.8LatestSep 16, 2026

Score

83% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • LicenseNot applicable

    A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.