RunStack Checks

pro.runstackPublished by runstack.proOfficial publisherv1.0.2Updated Nov 1, 2026

External checks of TLS, HTTP, email domain, DNS, ports, blocklists and domain expiry

VerifiedStreamable HTTPWeb executableCloud & InfrastructureSecurity & Monitoring

Overview

AI-generated overview

Remote MCP server that checks public TLS, HTTP, DNS, email, port, blocklist and domain-expiry settings from the outside and returns a diagnosis.

What you can do
  • Check TLS certificates, chains, protocols, ciphers and HSTS on a public host
  • Inspect HTTP status, redirect chains, security headers, caching and compression
  • Audit mail domains: MX, SPF, DKIM, DMARC, PTR, STARTTLS, MTA-STS, TLS-RPT, BIMI
  • Compare DNS answers across public resolvers and check TCP ports from the internet
  • Look up IP/ASN ownership, PTR, RPKI and geolocation, and check DNSBL/RBL listings
  • Look up domain registration, expiry, EPP status, nameservers and DNSSEC
When to use it
Useful when debugging certificate errors, redirect loops, missing security headers, mail landing in spam, DNS propagation after record changes, firewall rules, blocklist listings or upcoming domain renewals — as seen by users and other mail servers rather than from your own network.
Requirements
Remote Streamable HTTP endpoint; nothing runs locally. An optional free API key is sent in the X-RunStack-Key header (or as a bearer token) and raises the limit to 200 calls/day; without it, 10 calls/day per IP. Internet access to the endpoint is required.
Before you install
The API key is a secret sent in a header; keep it out of shared configs. Checks target public hosts and addresses only, so the hostnames and IPs you submit are sent to a third-party service. All tools are described as read-only, but results include report links on the provider's site.

Installation

In SourceWeft

  1. Open RunStack Checks in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/pro.runstack%2Fchecks/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "runstack-checks": {
      "type": "http",
      "url": "https://runstack.pro/api/mcp"
    }
  }
}

README

RunStack MCP — external infrastructure checks for AI agents

Remote MCP server that checks your public infrastructure from the outside — the way users, browsers and other mail servers see it — and returns a diagnosis: verdict, findings with cause and fix, and a shareable report link.

Nothing runs locally and nothing runs on your servers: only public data is checked.

  • Endpoint: https://runstack.pro/api/mcp (Streamable HTTP, stateless)
  • Auth: header X-RunStack-Key: rsk_... (or Authorization: Bearer rsk_...)
  • Free key: https://runstack.pro/account — 200 calls/day
  • Registry name: pro.runstack/checks

Tools

ToolWhat it checks
check_tlsCertificate validity and chain, expiry, hostname, TLS 1.0–1.3, ciphers, HSTS
check_httpStatus, redirect chain, security headers (HSTS, CSP, X-Frame-Options…), caching, compression
check_email_domainMX, SPF (10-lookup limit), DKIM, DMARC, PTR/FCrDNS, STARTTLS, MTA-STS, TLS-RPT, BIMI
check_dnsAnswers from several public resolvers compared — propagation, NXDOMAIN, inconsistencies
check_portTCP ports open / closed / filtered from the internet
check_ipIP or ASN owner, prefix, PTR, RPKI, geolocation

All tools are read-only.

Example (abridged, real output)

"Check the mail setup of runstack.ru"

FAIL: Mail domain runstack.ru: critical issues- MX: 10 mxs1.reg.ru, 20 mxs2.reg.ru- SPF: ~all · lookups 4/10- DMARC: p=none- DKIM: dkim
Findings:- [error] Multiple DMARC records  why: _dmarc.runstack.ru has 2 v=DMARC1 records — receivers then ignore DMARC entirely. Keep one.  how-to: https://runstack.ru/docs/fix-dmarc-p-none- [info] SPF ~all (softfail)  why: Soft fail — common during monitoring.- [info] MX certificate not valid for the server name  why: STARTTLS works, but the MX certificate doesn't match the name. Matters for MTA-STS and DANE.

Yes, that is our own domain — the check found it.

Setup

Claude Code

bash
claude mcp add --transport http runstack https://runstack.pro/api/mcp --header "X-RunStack-Key: rsk_..."

Cursor (~/.cursor/mcp.json) / VS Code / other clients

json
{  "mcpServers": {    "runstack": {      "url": "https://runstack.pro/api/mcp",      "headers": { "X-RunStack-Key": "rsk_..." }    }  }}

Codex (~/.codex/config.toml)

toml
[mcp_servers.runstack]url = "https://runstack.pro/api/mcp"http_headers = { "X-RunStack-Key" = "rsk_..." }

Language

Diagnoses are in English on runstack.pro. Russian: https://runstack.ru/api/mcp or ?lang=ru.

Links

Source: README.md at commit eb3a317

Tools

8

check_tls

TLS / certificate check

Scan a public host's TLS from the internet: certificate validity, chain completeness, expiry date, hostname match, enabled protocols (TLS 1.0–1.3), cipher suites, HSTS. Use when browsers show certificate errors, before/after renewing or rotating a certificate, or to confirm old TLS versions are disabled. Use this (not check_http) for anything about the certificate or TLS configuration itself; works on any TLS port, not only 443. Returns a verdict, findings with cause and fix, and a shareable report link. Takes up to ~60 s.

Parametershostrequiredport

check_http

HTTP response inspection

Request a public URL from outside your network and inspect the HTTP layer: status code, full redirect chain, security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy…), caching and compression headers. Use to debug redirect loops, unexpected status codes or missing headers as real visitors and CDNs see them, or to verify a web server / CDN config change after deploy. Use check_tls instead for certificate or TLS protocol questions. Returns a verdict and findings with fixes.

ParametersurlrequiredfollowRedirects

check_email_domain

Email domain check

Audit a mail domain as other mail servers see it: MX, SPF (including the 10-DNS-lookup limit), DKIM, DMARC policy, PTR / forward-confirmed reverse DNS, SMTP STARTTLS on the MX hosts, MTA-STS, TLS-RPT, BIMI. Use when mail lands in spam or bounces, after changing mail provider or DNS, or before tightening DMARC. Use this (not check_dns) for any email deliverability or authentication question. Returns a verdict, findings with cause and fix, and a report link.

ParametersdomainrequireddkimSelector

check_dns

DNS lookup across resolvers

Resolve a name at several public resolvers (Google, Cloudflare, Quad9, …) and compare their answers. Use after changing DNS records to check propagation, or when some users reach a different IP or get NXDOMAIN. Use check_email_domain instead for SPF/DKIM/DMARC analysis. Returns per-resolver answers, inconsistencies and a verdict.

Parameterstypedomainrequired

check_port

Port reachability from the internet

Check from the internet whether TCP ports of a public host are open, closed or filtered. Use to verify firewall / security group rules, or to find out why a service works locally but is unreachable from outside. Only public addresses are accepted; this does not test the application behind the port (use check_http or check_tls for that).

Parametershostrequiredportsrequired

check_ip

IP / ASN lookup

Look up an IP address or ASN: owner organization, announced prefix, PTR (reverse DNS), RPKI validity and geolocation. Use to identify who is behind an address seen in logs or headers, or to check PTR / RPKI for a mail or BGP issue. Does not test reachability (use check_port).

Parametersinputrequired

check_dnsbl

DNSBL / blocklist check

Check whether an IP address or a domain is on email blocklists (DNSBL/RBL): Spamhaus ZEN and DBL, SpamCop, Barracuda, UCEPROTECT, Mailspike, SURBL, URIBL and others. For a domain, its own name is checked on domain lists and its A/AAAA addresses on IP lists. Use when mail bounces with 'listed'/'blocked' errors or lands in spam, or after a server was compromised. Lists that refuse queries from public resolvers are reported as not tested, never as listed. Returns listed lists with the reason and a delisting link. For SPF/DKIM/DMARC use check_email_domain.

Parametersinputrequired

check_domain_expiry

Domain registration / expiry

Look up a domain's registration in the registry (RDAP, or WHOIS for .ru/.su/.рф): expiry date and days left, registrar, creation date, EPP status codes (clientHold, redemptionPeriod, transfer locks…) with explanations, nameservers and DNSSEC. Use to check when a domain must be renewed or why it suddenly stopped resolving. Subdomains are reduced to the registered domain. For DNS records use check_dns.

Parametersdomainrequired

Version history

2
  1. v1.0.2LatestNov 1, 2026
  2. v1.0.1Oct 17, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.