Lookproof DNS and mail security checks

io.github.lookproofPublished by GitHub account lookproofv0.1.0Updated Nov 6, 2026

SPF, DKIM, DMARC, MTA-STS, DNSSEC, TLS and DNS checks for domains, paid per call in USDC (x402)

VerifiedSTDIODesktop onlyCloud & InfrastructureSecurity & Monitoring

Overview

AI-generated overview

Runs DNS, email authentication, DNSSEC, TLS and HTTP security checks on public domains, paid per call in USDC via x402.

What you can do
  • Run combined health checks on a domain's mail setup, website and DNS in one call
  • Inspect individual mail records: SPF, SPF flattening, DMARC, DKIM keys and selector discovery, MTA-STS, TLS-RPT, MX, BIMI and mail provider
  • Inspect DNS and domain infrastructure: DNS lookups, DNSSEC state, CAA records, name servers and RDAP registration data
  • Check website security: TLS certificate details and HTTP security headers
  • Parse SPF and DMARC records you paste in, without DNS lookups
  • Report payment mode, USDC spent, calls made and remaining budget
When to use it
Useful when you need to audit or troubleshoot a domain's email deliverability and spoofing protection, verify DNSSEC, TLS or security headers, or gather registration and DNS facts about a domain without running dig or online checkers yourself.
Requirements
Local stdio process, run with uvx from the lookproof-mcp PyPI package (Python tooling required). Paid tools need a dedicated wallet private key supplied via PRIVATE_KEY or PRIVATE_KEY_FILE, X402_PAY set to 1 to actually pay, and USDC on Base; MAX_SPEND_USD caps spending per session and PAYTO_ALLOWLIST optionally restricts payees. Network access to DNS, RDAP and the checked sites is required.
Before you install
Most tools spend real USDC per call, so set MAX_SPEND_USD and PAYTO_ALLOWLIST before enabling X402_PAY; without X402_PAY calls are dry runs that only report prices. The server needs a wallet private key (PRIVATE_KEY or PRIVATE_KEY_FILE) holding funds, so use a dedicated low-balance wallet. Results include DNS records, policies and web content published by the checked domain, which the server itself says should be treated as data, not instructions.

Installation

In SourceWeft

  1. Open Lookproof DNS and mail security checks in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

This repository has no README.

Tools

24

get_spending

Free. Shows payment mode, USDC spent this session, calls made and budget left.

Takes no parameters.

domain_health

Full domain health in one call: MX, SPF, DMARC, DKIM selector discovery, MTA-STS with TLS-RPT, DNSSEC, reverse DNS of the mail servers, BIMI and CAA, with findings. Best first call for a domain. Costs $0.08 USDC per call.

Parametersdomainrequired

site_health

Website health in one call: TLS certificate, HTTP security headers and RDAP registration data. Costs $0.025 USDC per call.

Parametersdomainrequired

mail_check

Mail configuration: MX, SPF and DMARC together, plus DKIM for the selectors you pass (comma-separated, e.g. 'google,selector1'). Costs $0.03 USDC per call.

Parametersdomainrequireddkim_selectors

spf

SPF record: parsed include tree, all qualifier, DNS lookup count against the limit of 10. Costs $0.01 USDC per call.

Parametersdomainrequired

spf_flatten

SPF flattening analysis: every IP range the record authorizes, as a receiver would evaluate it. Costs $0.01 USDC per call.

Parametersdomainrequired

dmarc

DMARC record: policy, subdomain policy, pct, alignment and report addresses (RFC 9989 tree walk). Costs $0.01 USDC per call.

Parametersdomainrequired

dkim

DKIM key for one selector: key type and size, testing and revoked flags. Costs $0.01 USDC per call.

Parametersdomainrequiredselectorrequired

dkim_discover

DKIM selector discovery: tries the common selectors and returns the keys found. Costs $0.02 USDC per call.

Parametersdomainrequired

mta_sts

MTA-STS and TLS-RPT: fetches the policy, checks mode and max_age, compares the policy with the MX hosts. Costs $0.02 USDC per call.

Parametersdomainrequired

tlsrpt

TLS-RPT record: TLS reporting addresses for the domain. Costs $0.01 USDC per call.

Parametersdomainrequired

mx

MX records with resolved addresses, null MX and implicit MX. Costs $0.01 USDC per call.

Parametersdomainrequired

spoofable

Spoofing protection from the published SPF and DMARC policy: protected, partial, monitoring, unprotected or broken. Describes the policy; it does not prove whether forged mail gets through. Costs $0.01 USDC per call.

Parametersdomainrequired

bimi

BIMI record: logo and certificate URLs, and whether DMARC is enforced as BIMI requires. Costs $0.01 USDC per call.

Parametersdomainrequiredselector

mail_provider

Which mail provider handles the domain's mail, from MX and SPF. Costs $0.005 USDC per call.

Parametersdomainrequired

spf_parse

Parse an SPF record you paste (no DNS lookups). Costs $0.002 USDC per call.

Parametersrecordrequired

dmarc_parse

Parse a DMARC record you paste (no DNS lookups). Costs $0.002 USDC per call.

Parametersrecordrequired

dns_lookup

DNS lookup of one name; `types` is a comma-separated list of A, AAAA, CNAME, MX, NS, TXT, SOA, CAA, SRV (default A). Costs $0.005 USDC per call.

Parametersnamerequiredtypes

dnssec

DNSSEC state of the domain (secure, insecure, bogus) with DS and DNSKEY details. Costs $0.01 USDC per call.

Parametersdomainrequired

caa

CAA records: which certificate authorities may issue for the domain. Costs $0.01 USDC per call.

Parametersdomainrequired

nameservers

Name servers of the domain with their addresses; flags a single server, unresolvable servers, all servers in one network and missing glue. Costs $0.01 USDC per call.

Parametersdomainrequired

rdap

Registration data from RDAP (registrar, dates, status). Never registrant personal data. Costs $0.01 USDC per call.

Parametersdomainrequired

tls_certificate

TLS certificate of the domain's HTTPS server: issuer, validity, names and chain. Costs $0.01 USDC per call.

Parametersdomainrequired

security_headers

HTTP security headers of the domain's website (HSTS, CSP, and others). Costs $0.01 USDC per call.

Parametersdomainrequired

Version history

1
  1. v0.1.0LatestNov 5, 2026

Score

65% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts
  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • License10 pts

    Declare a license in the repository or the registry entry.