x=hub

your toolset

    build deployment
    sign in

    idig-dns

    mcpother
    net.softricks/idig-dns · v1.0.0
    deploy just this

    Professional DNS diagnostics: 14 tools for DNS, DNSSEC, email security, SSL, and propagation.

    run it

    on your own machines, one way per deploy method
    generated from the record, not tested yet
    CHANGE_ME: built from the repository's Dockerfile, assuming it serves streamable HTTP at :8000/mcp. Nothing has run this yet; the worker replaces it with a tested recipe.
    # once, as root:
    docker build -t mcp-local/idig-dns:latest https://github.com/kbhave/mcp-service-idig.git
    
    #!/usr/bin/env bash
    # idig-dns (net.softricks/idig-dns), recipe docker (generated).
    # Generated by Hub for toolset "my-agent"; started by mcp-my-agent-idig-dns.service.
    set -euo pipefail
    export HOST=127.0.0.1 PORT=8101
    exec docker run --rm --name mcp-my-agent-idig-dns -p 127.0.0.1:${PORT}:8000 --env-file /etc/mcp/my-agent.env mcp-local/idig-dns:latest
    
    [Unit]
    Description=MCP server idig-dns (toolset my-agent), generated by Hub
    After=network-online.target docker.service
    Wants=network-online.target
    
    [Service]
    Type=simple
    User=mcp
    Group=mcp
    SupplementaryGroups=docker
    EnvironmentFile=/etc/mcp/my-agent.env
    Environment=HOME=/var/lib/mcp/idig-dns
    WorkingDirectory=/var/lib/mcp/idig-dns
    ExecStart=/opt/mcp/my-agent/bin/idig-dns.sh
    Restart=on-failure
    RestartSec=5
    NoNewPrivileges=true
    ProtectSystem=strict
    ProtectHome=true
    PrivateTmp=true
    ReadWritePaths=/var/lib/mcp/idig-dns
    
    [Install]
    WantedBy=multi-user.target
    
    generated from the record, not tested yet
    CHANGE_ME: built from the repository's Dockerfile, assuming it serves streamable HTTP at :8000/mcp. Nothing has run this yet; the worker replaces it with a tested recipe.
    docker build -t idig-dns https://github.com/kbhave/mcp-service-idig.git
    docker run --rm -p 127.0.0.1:8101:8000 idig-dns
    
    generated from the record, not tested yet
    CHANGE_ME: built from the repository's Dockerfile, assuming it serves streamable HTTP at :8000/mcp. Nothing has run this yet; the worker replaces it with a tested recipe.
    # Generated by Hub for toolset "my-agent" (2026-10-18T08:45:15+00:00).
    # Each package server runs behind a stdio->HTTP bridge and listens on localhost only.
    #   cp .env.example .env    # fill the ${VAR}s
    #   docker compose up -d && bash smoke.sh
    # Remote servers are not here: clients reach them directly (see clients/).
    name: mcp-my-agent
    services:
      idig-dns:
        build:
          context: https://github.com/kbhave/mcp-service-idig.git
        ports:
        - 127.0.0.1:8101:8000
        restart: unless-stopped
        x-note: 'CHANGE_ME: built from the repository''s Dockerfile, assuming it serves streamable HTTP at
          :8000/mcp. Nothing has run this yet; the worker replaces it with a tested recipe.'
    volumes:
      npm-cache: {}
      uv-cache: {}
    
    generated from the record, not tested yet
    CHANGE_ME: built from the repository's Dockerfile, assuming it serves streamable HTTP at :8000/mcp. Nothing has run this yet; the worker replaces it with a tested recipe.
    # Generated by Hub for toolset "my-agent" (2026-10-18T08:45:15+00:00).
    #   kubectl create namespace mcp
    #   kubectl -n mcp create secret generic mcp-credentials --from-env-file=.env
    #   kubectl apply -f kubernetes.yaml
    # Services are cluster-internal: <name>.mcp.svc.cluster.local:8000/mcp. Put an ingress
    # with auth in front before exposing any of them.
    apiVersion: v1
    kind: Namespace
    metadata:
      name: mcp
    ---
    apiVersion: apps/v1
    kind: Deployment
    metadata:
      name: idig-dns
      namespace: mcp
      labels: &id001
        app: idig-dns
    spec:
      replicas: 1
      selector:
        matchLabels: *id001
      template:
        metadata:
          labels: *id001
        spec:
          containers:
          - name: idig-dns
            image: CHANGE_ME
            ports:
            - containerPort: 8000
              name: http
            env: []
    ---
    apiVersion: v1
    kind: Service
    metadata:
      name: idig-dns
      namespace: mcp
    spec:
      selector:
        app: idig-dns
      ports:
      - port: 8000
        targetPort: http
        name: http
    
    generated from the record, not tested yet
    CHANGE_ME: built from the repository's Dockerfile, assuming it serves streamable HTTP at :8000/mcp. Nothing has run this yet; the worker replaces it with a tested recipe.
    # Generated by Hub for toolset "my-agent" (2026-10-18T08:45:15+00:00).
    # Credentials come from the Secret 'mcp-credentials' (kubectl create secret generic ... --from-env-file=.env).
    # Each server under `servers` is one Deployment + Service; the keys after it configure
    # upstream charts a worker verified.
    servers:
      idig-dns:
        enabled: true
        replicas: 1
        port: 8000
        path: /mcp
        container:
          name: idig-dns
          image: CHANGE_ME
          ports:
          - containerPort: 8000
            name: http
          env: []
    
    # helm install my-agent helm/my-agent -n mcp
    

    in the cloud

    one click: the provider's deploy form opens filled in, in your own account
    koyeb

    Koyeb builds the repository's Dockerfile from branch main; change the branch in the form if the default one has another name.

    Clients connect to the service's https://…koyeb.app address plus /mcp.

    cloud run

    Cloud Shell clones the repository, builds its Dockerfile and deploys it to Cloud Run.

    Cloud Run sends requests to $PORT (8080); the recipe expects :8000, so the server has to read PORT, or set the container port on the service afterwards.

    connect to it

    copy what your client needs
    {
      "mcpServers": {
        "idig-dns": {
          "command": "CHANGE_ME",
          "args": []
        }
      }
    }
    #!/usr/bin/env bash
    # Registers every server with Claude Code (run once; `claude mcp list` to check).
    set -euo pipefail
    set -a; [ -f .env ] && source .env; set +a
    claude mcp add idig-dns -- CHANGE_ME
    
    {
      "mcpServers": {
        "idig-dns": {
          "command": "CHANGE_ME",
          "args": []
        }
      }
    }
    {
      "servers": {
        "idig-dns": {
          "type": "stdio",
          "command": "CHANGE_ME",
          "args": []
        }
      }
    }
    name: my-agent
    target: local
    servers:
    - hub: net.softricks/idig-dns
    
    • no recipe for target 'local': fill the files by hand

    tools · 19

    • blacklist_checkIP blacklist / DNSBL check. Tests A-record and MX IPs against Spamhaus, Barracuda, SpamCop, SORBS, and more.

      IP blacklist / DNSBL check. Tests A-record and MX IPs against Spamhaus, Barracuda, SpamCop, SORBS, and more.

      pin 470c8592c989691710c44d5406e6dcfd5da0390cfa61d2e2bb5a5cfb573d5ca4
    • dane_validateDANE/TLSA validation: cross-validates TLSA DNS records against the live TLS certificate. Supports all four TLSA usage types.

      DANE/TLSA validation: cross-validates TLSA DNS records against the live TLS certificate. Supports all four TLSA usage types.

      pin 952a7e22cecbb8701f9ca182d051704c72190ec3e9c5bb2c5dbe488ed0f8267e
    • diagnoseFull diagnosis combining resolution + DNSSEC. Use first when something is broken.

      Full diagnosis combining resolution + DNSSEC. Use first when something is broken.

      pin 8f78e4191e359093308e02ecd752c24b18c781fa39431c3fe38955e479f8f7a8
    • dns_lookupLook up DNS records for a domain. Record types: a, aaaa, ns, mx, txt, soa, caa, srv, cname, ds, tlsa, https, svcb, any, all.

      Look up DNS records for a domain. Record types: a, aaaa, ns, mx, txt, soa, caa, srv, cname, ds, tlsa, https, svcb, any, all.

      pin 88cf2397024f4a1690451c78f18e8a503cafc7dee248e8356ef78171c3136444
    • dnssec_healthDNSSEC health report: key inventory, signature expiry, algorithm assessment, DS at parent, rollover readiness, full chain of trust (Root → TLD → Domain) with chain_intact flag and broken-link identification, warnings, and recommendations.

      DNSSEC health report: key inventory, signature expiry, algorithm assessment, DS at parent, rollover readiness, full chain of trust (Root → TLD → Domain) with chain_intact flag and broken-link identification, warnings, and recommendations.

      pin c97f1a927521ef3f5c6319859a5317f2604b98cc76559696f246b22fa35c226f
    • dnssec_validateValidate DNSSEC chain of trust. Returns: secure / insecure / bogus / indeterminate.

      Validate DNSSEC chain of trust. Returns: secure / insecure / bogus / indeterminate.

      pin 34e3660e53432e11c5b558f93b3dac690853f1c0e184972325f2c1033a984e74
    • domain_statusRegistrar lock and EPP status. Checks transfer lock, delete lock, serverHold, pendingDelete.

      Registrar lock and EPP status. Checks transfer lock, delete lock, serverHold, pendingDelete.

      pin 118be008b12ec4e06859f479ecf4ffc6ec521f42f2074102bfc3db58fda064b3
    • email_security_auditFull SPF, DKIM, DMARC, and BIMI audit with A-F grade and prioritized fix recommendations.

      Full SPF, DKIM, DMARC, and BIMI audit with A-F grade and prioritized fix recommendations.

      pin c6546d6937d8fba54d6d179b8697b45eee7cc4b710b4120661886c25864cc90b
    • geo_lookupGeolocation and hosting: country, city, ISP, ASN, CDN detection, is_hosting flag.

      Geolocation and hosting: country, city, ISP, ASN, CDN detection, is_hosting flag.

      pin 3de6738008e940c58b372edc27deac04e3fafab39c254276cf5c7fd65b6c6daa
    • http_checkHTTP/HTTPS reachability: status codes, redirect chain, HSTS header, HTTP→HTTPS redirect detection.

      HTTP/HTTPS reachability: status codes, redirect chain, HSTS header, HTTP→HTTPS redirect detection.

      pin c73d09bac8af0361d08769a74fc65468183d838941247e7b93b8096daa27799b
    • mx_checkMX health + provider detection: Google Workspace, M365, Proofpoint, Zoho, 35+ providers.

      MX health + provider detection: Google Workspace, M365, Proofpoint, Zoho, 35+ providers.

      pin 4d582492258fbcd604bf8014f13e786a5bb701d22eb9349a9a2b5d4e5dff17eb
    • propagation_checkCheck DNS propagation across 16 global resolvers: Google, Cloudflare, Quad9, China, Korea, Russia.

      Check DNS propagation across 16 global resolvers: Google, Cloudflare, Quad9, China, Korea, Russia.

      pin 3f25757a563a616d20f7eb89fd101005073c1688a3604e49183702927ff6a760
    • resolve_checkDNS resolution diagnostics. Returns status: ok / nxdomain / nodata / servfail / refused / timeout / degraded.

      DNS resolution diagnostics. Returns status: ok / nxdomain / nodata / servfail / refused / timeout / degraded.

      pin 2213d9f1bbe53e7c7fc156f7c7d249f3096863d8fc0256de1451a0354652a964
    • ssl_checkSSL certificate: validity, expiry countdown, domain match, issuer, chain completeness.

      SSL certificate: validity, expiry countdown, domain match, issuer, chain completeness.

      pin 874d016266510a6db210160ea753ac61b5a896a0f8b95bbf2e3b83dcbf269339
    • subdomain_discoverDiscover subdomains by probing 75 common names plus crt.sh Certificate Transparency logs. Surfaces exposed dev/staging environments.

      Discover subdomains by probing 75 common names plus crt.sh Certificate Transparency logs. Surfaces exposed dev/staging environments.

      pin de6dc8bdded81785fbcbb912b3a432a7979acf8fd1e280fdd9dd56648cc17784
    • ttl_checkTTL advisory: flags dangerous TTLs and gives step-by-step migration lowering plan.

      TTL advisory: flags dangerous TTLs and gives step-by-step migration lowering plan.

      pin e0336a8971038fdf4b2c335c72909cb6f72c9a3cd10e490a35d3cf2309c8713c
    • whois_lookupParsed WHOIS: registrar, creation/expiry dates, domain age, nameservers, EPP status, DNSSEC status.

      Parsed WHOIS: registrar, creation/expiry dates, domain age, nameservers, EPP status, DNSSEC status.

      pin 2f059fdd4cf73515edfefae6abf8871d489bf7046a6e112e63068440bfb4dcc9
    • zone_axfrAXFR zone transfer vulnerability check. Tests whether any authoritative NS allows public zone transfers (critical misconfiguration).

      AXFR zone transfer vulnerability check. Tests whether any authoritative NS allows public zone transfers (critical misconfiguration).

      pin 6169532b7054b5aea62488cd2dfcc2549c6f2e9cbae6b499285962d33403a09c
    • zone_consistencyCheck all authoritative nameservers return identical answers. Catches lame delegation and SOA mismatches.

      Check all authoritative nameservers return identical answers. Catches lame delegation and SOA mismatches.

      pin 8958c950110dea3ef98346c3265ecf4b234ef3d7de64d5d643f799dc92cc3b32

    runs · 1

    the latest tests of this entry by the hub and its workers, newest first
    dateworkermethodstatussandboxreason
    2026-10-16 09:50 local-mac remotemcp 2025-11-25 ok19 tools none —