M
MCP Directory CURATED DIRECTORY
911 MCP servers indexed
中文
← Back to directory
B

BlackVeil DNS & Email Security Scanner

Community
DNS & email security scanner with 80 MCP tools, zero install
How to install ↓ Compare GitHub source repository ↗
Category
Dev Tools #308 of 438
Stars
★ 9 Popular
Transport
Streamable HTTP · SSE · stdio (local process)
Runtime
Hosted (no local runtime)
Credentials
Optional API key
License
Other / unspecified
Last commit
Tools
14
45FMRS · D

BlackVeil DNS provides comprehensive DNS and email security audits via MCP, suitable for authorized security testing. Interface is straightforward and outputs are detailed, but advanced features require a paid plan and responsible use must be followed.

Strongest · Setup experience 10/20 Weakest · Reliability 8/20

Reliability
8/20
Security and permissions
10/20
Maintenance
8/20
Documentation
9/20
Setup experience
10/20
Why each score
Reliability 8/20
Only README and manifest were supplied; no source files, CI workflows, or committed test artifacts are reviewable. Claims of 80 tools, chaos suites, and SSOT audit tests are untrusted self-reports, and the numbers conflict across sources (57 checks in the repo description, 79 tools in the manifest, 80 in the README), making the declared surface unverifiable. Error semantics (403 upgrade-required, 404 sessions, 400 protocol version) are documented but only as narrative; static review cannot confirm key paths, so capped well below 20.
Security and permissions 10/20
No red-line indicators found: passive read-only DoH checks, no credential requirements for the free path, paywall gating of offensive tools, explicit responsible-use policy, and disclosed PII/erasure mechanics. Deductions: unauthenticated arbitrary-domain scanning invites abuse; ANALYTICS_PII_LEVEL=full discloses caller-IP-derived queries to Google DoH (admitted in docs); operator-only tools (OSINT, Entra sign-in/UAL queries) rely on private bindings whose confirmation and least-privilege implementation cannot be statically verified.
Maintenance 8/20
Moderate positives: not archived, issue tracker active, SECURITY.md and security contact present, version 3.77.0 suggests iteration. Deductions: GitHub license field is NOASSERTION while README claims BUSL-1.1 (MIT after 2030) — an inconsistent governance signal; only 6 stars means minimal community validation; no visible evidence of release cadence or dependency-update practice.
Documentation 9/20
Well-layered docs: install, auth, quotas, pricing, architecture, tool _meta discovery metadata, and honest limitation disclosure (tiered mode private bindings, degrade behavior, PTR third-party disclosure). Deductions: tool-count inconsistencies (79/80/57); heavy reliance on a private deploy overlay that public reviewers cannot audit; claimed tests and SSOT guards lack accompanying reviewable evidence.
Setup experience 10/20
Strong zero-install story for the free tier: one-command Claude Code setup, Smithery command, downloadable desktop extension, health endpoint verification, and clear multi-transport documentation. Deductions: the extension comes from a separate repo's release requiring extra verification; a large portion of tools are paywalled, narrowing the out-of-box surface versus the marketing copy; endpoint behavior cannot be confirmed statically, so the score stays below the 15 execution-evidence threshold.

Static review · not runListed 2026-09-08

Read the FMRS scoring method →

Fit and risk

What it can accessUses the network

Best for

  • Security auditors
  • DevOps engineers
  • Site owners needing DNS/email security assessments
  • Compliance teams

Not for

  • Unauthorized domain reconnaissance
  • Users needing non-DNS features
  • Scenarios requiring local deployment without Cloudflare support

Required permissions

  • Queries public DNS via Cloudflare DoH
  • Accesses CT logs and RDAP data
  • Some tools require a paid API key
  • No authorization required from the target domain

Risks and side effects

  • Scan results may reveal sensitive information and should only be used for authorized testing
  • Misuse for unauthorized reconnaissance may violate laws
  • Free tier has limited quota; advanced features require payment
  • Data handling is subject to BlackVeil's privacy policy

Setup

Before you start

Runtime：Hosted (no local runtime)

BV_API_KEY optionalsecret Optional API key that bypasses per-IP rate limits and raises daily quotas; not needed on the free tier, sent as a Bearer header against the hosted service.

Hosted endpoint: https://dns-mcp.blackveilsecurity.com/mcp (Streamable HTTP). For Claude Code: claude mcp add --transport http blackveil-dns https://dns-mcp.blackveilsecurity.com/mcp. Also available via Smithery: smithery mcp add MadaBurns/bv-mcp. No API key needed for free tier.

Check that it works

Run curl https://dns-mcp.blackveilsecurity.com/health to confirm the endpoint is live, then add it via claude mcp add --transport http blackveil-dns https://dns-mcp.blackveilsecurity.com/mcp and ask the client to scan anthropic.com — a returned score and findings prove the connection.

Things to try

Once connected, you can ask your AI assistant things like:

  • Scan anthropic.com and tell me what needs fixing
  • Compare the email security of google.com and microsoft.com
  • Generate a DMARC record for example.com with reject policy
  • What attack paths exist for example.com?

Tools 14

check_mx read-only
Checks the MX records of a domain.
check_spf read-only
Inspects SPF record and validates syntax.
check_dmarc read-only
Evaluates DMARC policy and grading.
check_dkim read-only
Checks DKIM signing configuration.
check_mta_sts read-only
Checks MTA-STS policy presence and validity.
check_subdomain_takeover read-only
Detects potential subdomain takeover vulnerabilities.
scan_domain read-only
Performs a comprehensive security audit of a domain, including scoring and grading.
generate read-only
Generates fix plans or ready-to-publish DNS records like SPF, DMARC.
Show 6 more tools
validate_fix read-only
Confirms whether a fix was applied successfully.
map_supply_chain read-only
Builds a third-party dependency graph with trust levels.
simulate_attack_paths read-only
Enumerates attack paths such as spoofing, takeover, and hijacking.
map_compliance read-only
Maps scan findings to compliance frameworks like NIST, PCI DSS, SOC 2.
compare_domains read-only
Side-by-side comparison of email security postures of multiple domains.
discover_brand_domains read-only
Discovers domains related to a brand (paid plan).

Use cases

Performing security and compliance scans on domains you own
Generating DNS records to remediate issues
Assessing third-party supply chain risks
Simulating attack paths to understand potential vulnerabilities

Supported clients

Claude Desktop
Claude Code
Cursor
VS Code

Listed from the project's documentation, not tested by this site.

Overview

BlackVeil DNS is an open-source DNS and email security scanner hosted on Cloudflare Workers. It exposes 80 MCP tools covering 19 scoring categories including SPF, DMARC, DKIM, DNSSEC, SSL/TLS. Supports Streamable HTTP, stdio, and legacy HTTP+SSE transport. Free tier requires no API key and includes 25 scans/day. Paid tiers provide higher quotas and advanced tools like subdomain discovery and attack path simulation.

Similar servers

Context7 80 · B

Upstash's official server providing up-to-date third-party library docs for AI coding assistants

★ 63.3k · Tools 2 Compare with this →
Compare with other MCP servers

Source revision 47f1f55bec1f Data synced 2026-10-19 Read the FMRS scoring method