Agent Preflight: OFAC, DNS, Email Auth, Domain, Email & URL

dev.workers.sdnscreen.sdn-screen-x402Published by sdn-screen-x402.sdnscreen.workers.devOfficial publisherv1.3.0Updated Oct 24, 2026

$0.01/call via x402: OFAC wallet screen, DNS, email auth, domain age, email verify, URL unshorten.

VerifiedStreamable HTTPWeb executableWeb Search & ScrapingFinanceSecurity & Monitoring

Overview

AI-generated overview

A remote MCP server that lets an assistant run preflight checks on wallets, domains, email authentication, email addresses and URLs.

What you can do
It exposes six lookup tools: screening a crypto wallet against the US Treasury OFAC sanctions list, resolving DNS records, grading a domain's SPF, DMARC, DKIM and MX setup, looking up domain registration age via RDAP, verifying an email address without sending mail, and following URL redirects to the final destination with safety flags. Results come back as structured JSON with verdicts, scores and coded issues.
When to use it
Useful when an assistant needs to vet an unfamiliar wallet, domain, email address or link before acting on it, for example checking a sender's domain authentication, a domain's age, or where a shortened URL really leads.
Requirements
Remote streamable HTTP endpoint; no packages, environment variables or headers declared. The description states calls are paid at $0.01 per call via x402, so a payment-capable client is implied. Network access to the endpoint is required.
Before you install
Each call is described as costing $0.01 through x402, so usage spends money and needs a payment setup. Queries (wallet addresses, domains, email addresses, URLs) are sent to a third-party service. Results are advisory signals, not guarantees.

Installation

In SourceWeft

  1. Open Agent Preflight: OFAC, DNS, Email Auth, Domain, Email & URL in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/dev.workers.sdnscreen.sdn-screen-x402%2Fagent-preflight/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "agent-preflight-ofac-dns-email-auth-doma": {
      "type": "http",
      "url": "https://sdn-screen-x402.sdnscreen.workers.dev/mcp"
    }
  }
}

Tools

6

ofac_wallet_screen

OFAC SDN Wallet Screen

Screens a crypto wallet address (EVM, BTC, TRON, SOL, XMR and every other chain OFAC lists) against all Digital Currency Addresses on the US Treasury OFAC SDN list. Returns sanctioned true/false, verdict block/no_match, SDN entity name, sdnType, programs and the list publish date. Use when an agent is about to send funds to, pay, or accept funds from an unfamiliar wallet. $0.01 USDC on Base. Paid tool: call it once to get the x402 PaymentRequired object, then retry with params._meta["x402/payment"].

Parametersaddressrequired

dns_lookup

DNS Records Lookup

Resolves live DNS records for any domain or hostname via 1.1.1.1: A, AAAA, CNAME, MX, NS, TXT, SOA and CAA in one call (type=ALL), or a single type incl. SRV, PTR, DS, DNSKEY, HTTPS. Clean JSON with TTLs, NXDOMAIN flag and DNSSEC-authenticated bit. A URL or email address is reduced to its host. Use when an agent needs to verify a domain, find mail servers or nameservers, or read TXT/SPF records. $0.01 USDC on Base. Paid tool: call it once to get the x402 PaymentRequired object, then retry with params._meta["x402/payment"].

Parametersnamerequiredtype

email_auth_check

Email Auth Check (SPF/DMARC/DKIM)

Checks a domain's email authentication: parses SPF (+all, ?all, multiple records, over 10 DNS lookups), DMARC (p, sp, pct, rua), DKIM keys (your selector or 15 common ones) and MX, then returns an A-F grade, 0-100 score and coded issues (spf_missing, dmarc_p_none, ...). Use when an agent must judge if a domain can be spoofed, debug deliverability, or vet a sender/vendor domain. $0.01 USDC on Base. Paid tool: call it once to get the x402 PaymentRequired object, then retry with params._meta["x402/payment"].

Parametersdomainrequiredselector

whois_domain_age

Domain Age & Registrar (RDAP)

Looks up a domain in its registry's RDAP server (the ICANN successor to WHOIS, found via the IANA bootstrap): registration date, age in days/years, newlyRegistered (<30 days), expiry, last change, registrar name + IANA ID, EPP status, nameservers and DNSSEC. No personal contact data. Use when an agent must judge if a domain, sender or vendor is brand-new (a phishing/fraud signal). Unsupported TLDs return 400, uncharged. $0.01 USDC. Paid tool: call it once to get the x402 PaymentRequired object, then retry with params._meta["x402/payment"].

Parametersdomainrequired

email_mx_verify

Email Address Verify (MX, no SMTP)

Checks an email address without sending mail or opening SMTP: syntax, domain exists, MX records (or RFC 5321 A/AAAA fallback), RFC 7505 null MX, MX host resolves, disposable-domain list (~9.9k domains), role account (info@, support@) and free provider. Verdict deliverable_domain, risky, undeliverable or unknown. Cannot prove the mailbox itself exists. Use when an agent validates a signup, lead or contact email before using it. $0.01 USDC. Paid tool: call it once to get the x402 PaymentRequired object, then retry with params._meta["x402/payment"].

Parametersemailrequired

url_unshorten

URL Unshorten & Redirect Check

Follows a URL's HTTP redirects hop by hop (max 10, page bodies never read) and returns the final URL, status, the full chain and heuristic safety flags: shortener_used, cross_domain_redirect, https_downgrade, ip_address_host, punycode_host, userinfo_in_url, high_abuse_tld, credential_keyword_after_redirect, loops. Risk low/medium/high. Use before an agent clicks, fetches or forwards an unfamiliar or shortened link. Not a malware-reputation lookup. $0.01 USDC. Paid tool: call it once to get the x402 PaymentRequired object, then retry with params._meta["x402/payment"].

Parametersurlrequired

Version history

2
  1. v1.3.0LatestOct 12, 2026
  2. v1.2.0Oct 12, 2026

Score

72% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts

    Publish an icon in the registry entry.

  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • LicenseNot applicable

    A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.