dns-sec-audit-mcpSAFE
A sovereign, local-first MCP server for Technical SEO DNS record auditing, SOA health checks, SSL/TLS inspection, and HTTP security header analysis.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
📖 Official Architecture & Documentation: SEOSiri DNS Security Audit Guide | Central MCP Directory
An open-source, local-first Model Context Protocol (MCP) server for Technical SEO DNS Record Auditing, SOA Expire Health Checks, SSL/TLS Inspection, and HTTP Security Header Analysis.
💖 Sponsorship, B2B Custom Solutions & Attribution
👨💻 Lead Architect & Attribution
Designed and engineered by [Momenul Ahmad](https://github.com/MOBILEPHONE), Lead Architect and Founder of [SEOSiri](https://seosiri.com).
🚀 Capabilities & Tools (10 Production Tools)
- `audit_dns_records`: Resolves and audits primary A, AAAA, and MX records.
- `check_soa_expiry_health`: Audits SOA Expire timers and refresh bounds.
- `audit_http_security_headers`: Evaluates HSTS, CSP, X-Frame-Options, and X-Content-Type-Options.
- `check_ssl_tls_certificate`: Inspects TLS certificate expiration dates and handshake validity.
- `validate_well_known_security_txt`: Audits RFC 9116
/.well-known/security.txtheaders. - `validate_well_known_llm_txt`: Audits presence and Markdown structure of
/llm.txt. - `calculate_technical_seo_security_score`: Computes an aggregate Technical SEO & Security Health Score ($0\text{--}100$).
- `sanitize_audit_payload`: Strips scripts and malicious payloads.
- `get_live_dns_throughput_metrics`: Monitors system health and performance metrics.
- `get_dns_server_specifications`: Returns protocol specs and capability matrices.
Quickstart
pip install -e . pytest tests/test_dns_sec.py
🔌 Claude Desktop / Cursor Configuration
Add this block to your claude_desktop_config.json:
{
"mcpServers": {
"seosiri-dns-sec-audit": {
"command": "uv",
"args": [
"run",
"--github",
"SEOSiri-Official/dns-sec-audit-mcp",5edf1245a24fOBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add seosiri-dns-sec-audit-mcp -- uvx seosiri-dns-sec-audit-mcp
{
"mcpServers": {
"seosiri-dns-sec-audit-mcp": {
"command": "uvx",
"args": [
"seosiri-dns-sec-audit-mcp"
]
}
}
}Exposed tools (10)
10 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
audit_dns_records | read | |
audit_http_security_headers | read | |
calculate_technical_seo_security_score | read | |
check_soa_expiry_health | read | |
check_ssl_tls_certificate | read | |
get_dns_server_specifications | read | SPECIFICATIONS: Returns technical protocol details and tool capability matrices. |
get_live_dns_throughput_metrics | read | ANALYTICS: Returns server operational health and performance metrics. |
sanitize_audit_payload | read | Sanitizes incoming content strings, stripping scripts and malicious tags. |
validate_well_known_llm_txt | read | |
validate_well_known_security_txt | read |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (5 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (0)
No findings outside the package's declared scope.
Gates applied: no_behavioural_pass.
5edf1245a24ffull audit observations/trust-audit/mcp-server/seosiri-official__dns-sec-audit-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 5edf1245a24f | SAFE | B | 89 | first audit |
Questions
What is the dns-sec-audit-mcp MCP server?
A sovereign, local-first MCP server for Technical SEO DNS record auditing, SOA health checks, SSL/TLS inspection, and HTTP security header analysis.
What tools does dns-sec-audit-mcp expose?
10 in total: 10 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is dns-sec-audit-mcp safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does dns-sec-audit-mcp need?
No credential environment variables were found in its source, so it appears to need none.
How does dns-sec-audit-mcp run?
It speaks stdio, so it runs as a local process your client starts. It is published on PyPI as seosiri-dns-sec-audit-mcp.
How current is this page?
The grade is for one exact copy of the source (5edf1245a24f), read on 2026-10-11. The repository is watched and re-audited when it changes.