AdminKit

io.github.netbasecorpPublished by GitHub account netbasecorpv0.1.0Updated Nov 1, 2026

Network, DNS, mail-auth and MCP endpoint security checks for AI agents, backed by adminkit.net.

VerifiedSTDIODesktop onlyCloud & InfrastructureSecurity & Monitoring

Overview

AI-generated overview

AdminKit gives an AI assistant live network, DNS, mail-authentication and MCP endpoint security checks, plus offline IP and subnet utilities.

What you can do
  • Look up DNS records (A, AAAA, MX, TXT, NS, CAA, PTR, SOA, CNAME) and check SPF/DMARC mail posture
  • Check domain health: whois, TLS certificate and HTTP security headers, plus your own public IP, ASN and CGNAT hint
  • Probe an MCP endpoint for anonymous exposure and check port exposure on targets you have verified you own
  • Explain a shared AdminKit report in plain language and read aggregated honeypot/telemetry trends
  • Run offline utilities: subnet math, IP and IPv6 info, MAC vendor lookup and User-Agent parsing
When to use it
Useful when an assistant needs to diagnose DNS, mail authentication or domain/TLS configuration, or to audit whether an MCP endpoint or owned host is exposed. Also handy for quick offline subnet and IP calculations.
Requirements
Local Python 3.12+ process, installed from the package or run with uvx; network access to the AdminKit Check API. Optional ADMINKIT_API_KEY for report explanations and higher limits; optional ADMINKIT_API_BASE, ADMINKIT_SITE_BASE, ADMINKIT_MCP_TIMEOUT_SECONDS and ADMINKIT_MCP_RATE_LIMIT_PER_SECOND settings.
Before you install
Queries go to the third-party AdminKit API, so the domains, IPs and endpoints you check are sent to it. The optional ADMINKIT_API_KEY is a secret and should be supplied only through the environment. Port and endpoint checks should only target systems you own or are authorised to test.

Installation

In SourceWeft

  1. Open AdminKit in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

AdminKit MCP server + MCP endpoint scan Action

Open-source Model Context Protocol server that gives AI agents (Claude, ChatGPT, Cursor, VS Code, any MCP client) real network, DNS and mail checks from AdminKit, plus a read-only GitHub Action that scans your own MCP endpoint for anonymous-access exposure.

Every tool returns real data from the live AdminKit Check API (https://api.adminkit.net) or pure local computation. When a check cannot be reached, the tool says so; it never invents a result.

Tools

ToolWhat it does
check_ipYour own public IP, ASN and a CGNAT hint (only the caller's own IP).
dns_lookupA / AAAA / MX / TXT / NS / CAA / PTR / SOA / CNAME lookup.
check_mail_authSPF and DMARC posture for a domain.
check_domainAggregate domain health: whois, TLS certificate, HTTP security headers.
check_owned_portsPort exposure check for targets you have verified you own.
check_mcp_endpointExposure probe for an MCP server (initialize + tools/list only).
explain_reportPlain-language AI explanation of a shared AdminKit report (needs an API key).
get_radarAggregated honeypot / telemetry trends from AdminKit Radar.
subnet_calc, ip_info, ipv6_info, mac_vendor, user_agentOffline utilities: subnet math, address info, OUI vendor lookup, User-Agent parsing.

Install

Python 3.12+.

bash
pip install "git+https://github.com/netbasecorp/[email protected]"

or run it without installing, with uv:

bash
uvx --from "git+https://github.com/netbasecorp/[email protected]" adminkit-mcp

Claude Desktop / Claude Code / Cursor (stdio)

json
{  "mcpServers": {    "adminkit": {      "command": "uvx",      "args": ["--from", "git+https://github.com/netbasecorp/[email protected]", "adminkit-mcp"]    }  }}

Streamable HTTP

bash
adminkit-mcp --http 127.0.0.1:8080

Configuration (environment only)

VariableDefaultPurpose
ADMINKIT_API_BASEhttps://api.adminkit.netCheck API base URL.
ADMINKIT_SITE_BASEhttps://adminkit.netSite base URL (fallback for some checks).
ADMINKIT_API_KEYunsetOptional AdminKit API key (explain_report, higher limits). Never logged.
ADMINKIT_MCP_TIMEOUT_SECONDS10Per-request timeout.
ADMINKIT_MCP_RATE_LIMIT_PER_SECOND5Client-side rate limit.

GitHub Action: scan your MCP endpoint

Checks one MCP endpoint for: initialize accepted without credentials, tool list readable anonymously, tool names that look like shell/file/network access, and no TLS. It only sends initialize and tools/list and never calls tools/call, so it is safe against a live server. Outputs a 0-100 exposure score, a job summary, and score / findings-json outputs.

yaml
- name: Scan our MCP endpoint  id: scan  uses: netbasecorp/[email protected]  with:    url: https://mcp.example.com/mcp    fail-on: critical # none | warning | critical- run: echo "score ${{ steps.scan.outputs.score }}"
InputDefaultDescription
url(required)MCP endpoint URL to scan.
fail-oncriticalnone, warning (any finding) or critical (high/critical finding).
api-key""Reserved for sending results to the AdminKit dashboard; never sent to the target.
allow-privatefalseAllow a private/loopback target (only for CI fixtures you started yourself).

An unreachable target always fails the step. A private target refused with allow-private: false is reported as skipped. Full workflow: examples/scan-mcp-endpoint.yml.

The same probe runs from the command line:

bash
adminkit-mcp probe https://mcp.example.com/mcp

Scan only endpoints you own or are authorised to test.

Development

bash
pip install -e ".[dev]"pytest            # every test runs against local fakes on 127.0.0.1, no networkruff check . && mypybash action/test/test_action.sh

Licence

MIT, see LICENSE. The AdminKit website, API and platform are separate proprietary services operated by Netbase JSC; this repository contains only the open-source client.

Source: README.md at commit 4a9395f

Tools

0
SourceWeft started this package once in an isolated sandbox, without credentials, to list its tools. That failed: the package did not install.

Version history

1
  1. v0.1.0LatestNov 1, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts