# Dechonet MCP MCP server

30 security tools for AI agents: phishing links, exposure maps, DNS, SSL, PQC, history, pivots.

## At a glance

Dechonet MCP is an MCP server in the AI & Memory category. It runs locally over stdio via `npx -y dechonet-mcp`, and needs DECHONET_API_KEY and DECHONET_SESSION_COOKIE. It exposes 33 tools, including phishing_link_check, exposure_map and security_scan. It scores B (77/100) on the MCP Skills Hub health score as of Oct 28, 2026.

## Install

### How to install Dechonet MCP in Claude Code

1. Add the server

```bash
claude mcp add dechonet -e 'DECHONET_API_KEY=<DECHONET_API_KEY>' -e 'DECHONET_SESSION_COOKIE=<DECHONET_SESSION_COOKIE>' -- npx -y dechonet-mcp
```

2. Fill in your credentials

   Replace <DECHONET_API_KEY>, <DECHONET_SESSION_COOKIE> with your real values. Keep secrets out of any config file you commit.

3. Verify it's connected

```bash
claude mcp list
```

4. Sharing it with your team?

   Add `--scope project` to write it to .mcp.json in the repository root, which you can commit (with the secrets left as environment variables).

5. Use it in a session

   Ask Claude to use the tools this server exposes (e.g. phishing_link_check, exposure_map, security_scan). It discovers them automatically.

### How to install Dechonet MCP in Claude Desktop

1. Open your MCP config

   macOS: ~/Library/Application Support/Claude/claude_desktop_config.json · Windows: %APPDATA%\Claude\claude_desktop_config.json

2. Add this server

```json
{
  "mcpServers": {
    "dechonet": {
      "command": "npx",
      "args": [
        "-y",
        "dechonet-mcp"
      ],
      "env": {
        "DECHONET_API_KEY": "<DECHONET_API_KEY>",
        "DECHONET_SESSION_COOKIE": "<DECHONET_SESSION_COOKIE>"
      }
    }
  }
}
```

3. Fill in your credentials

   Replace <DECHONET_API_KEY>, <DECHONET_SESSION_COOKIE> with your real values. Keep secrets out of any config file you commit.

4. Restart Claude Desktop

   The tools appear under the 🔌 menu once the app reloads.

### How to install Dechonet MCP in Cursor

1. Create / edit .cursor/mcp.json in your project

```json
{
  "mcpServers": {
    "dechonet": {
      "command": "npx",
      "args": [
        "-y",
        "dechonet-mcp"
      ],
      "env": {
        "DECHONET_API_KEY": "<DECHONET_API_KEY>",
        "DECHONET_SESSION_COOKIE": "<DECHONET_SESSION_COOKIE>"
      }
    }
  }
}
```

2. Fill in your credentials

   Replace <DECHONET_API_KEY>, <DECHONET_SESSION_COOKIE> with your real values. Keep secrets out of any config file you commit.

3. Enable it

   Cursor Settings → MCP → toggle the server on. Tools become available to the Composer/Agent.

### How to install Dechonet MCP in Codex CLI

1. Add to ~/.codex/config.toml

```toml
[mcp_servers.dechonet]
command = "npx"
args = ["-y", "dechonet-mcp"]
env = { DECHONET_API_KEY = "<DECHONET_API_KEY>", DECHONET_SESSION_COOKIE = "<DECHONET_SESSION_COOKIE>" }
```

2. Fill in your credentials

   Replace <DECHONET_API_KEY>, <DECHONET_SESSION_COOKIE> with your real values. Keep secrets out of any config file you commit.

3. Run Codex

   Codex loads MCP servers from config.toml on startup and exposes their tools to the agent.

### How to install Dechonet MCP in Windsurf

1. Edit ~/.codeium/windsurf/mcp_config.json

```json
{
  "mcpServers": {
    "dechonet": {
      "command": "npx",
      "args": [
        "-y",
        "dechonet-mcp"
      ],
      "env": {
        "DECHONET_API_KEY": "<DECHONET_API_KEY>",
        "DECHONET_SESSION_COOKIE": "<DECHONET_SESSION_COOKIE>"
      }
    }
  }
}
```

2. Fill in your credentials

   Replace <DECHONET_API_KEY>, <DECHONET_SESSION_COOKIE> with your real values. Keep secrets out of any config file you commit.

3. Reload

   Windsurf → Cascade → refresh MCP servers. Cascade can now call the tools.

### How to install Dechonet MCP in Cline

1. Open Cline → MCP Servers → Configure

   Adds to cline_mcp_settings.json.

2. Add the server

```json
{
  "mcpServers": {
    "dechonet": {
      "command": "npx",
      "args": [
        "-y",
        "dechonet-mcp"
      ],
      "env": {
        "DECHONET_API_KEY": "<DECHONET_API_KEY>",
        "DECHONET_SESSION_COOKIE": "<DECHONET_SESSION_COOKIE>"
      }
    }
  }
}
```

3. Fill in your credentials

   Replace <DECHONET_API_KEY>, <DECHONET_SESSION_COOKIE> with your real values. Keep secrets out of any config file you commit.

### How to install Dechonet MCP in VS Code

1. Create .vscode/mcp.json

```json
{
  "servers": {
    "dechonet": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "dechonet-mcp"
      ],
      "env": {
        "DECHONET_API_KEY": "<DECHONET_API_KEY>",
        "DECHONET_SESSION_COOKIE": "<DECHONET_SESSION_COOKIE>"
      }
    }
  }
}
```

2. Fill in your credentials

   Replace <DECHONET_API_KEY>, <DECHONET_SESSION_COOKIE> with your real values. Keep secrets out of any config file you commit.

3. Start it

   VS Code shows a ▶ Start action above the server entry. Agent mode (Copilot Chat) can then use the tools.

## Tools

- `phishing_link_check` — Is this link a scam? — paste a text message or URL; follows shorteners, checks domain age, Korean brand impersonation, APK downloads, phishing feeds
- `exposure_map` — Admin pages open to the internet? — subdomains from CT, each opened once: admin screens, staging, dev tools, VPN logins, default pages, directory listings (counts; per-host detail for the verified owner on the web report)
- `security_scan` — Comprehensive scan — 9 checks in parallel, 0-100 Health Score, A-F grade
- `dns_lookup` — DNS records + DNSSEC + SPF/DMARC validation
- `ssl_check` — SSL/TLS certificate, chain, expiry, HSTS, CT history, A-F grade
- `http_security` — HTTP redirect trace + 10 security headers audit, A-F grade
- `email_auth` — SPF, DMARC, DKIM, BIMI, MTA-STS, DANE + blacklist check
- `port_scan` — Open TCP ports with service identification
- `dns_propagation` — DNS propagation across 6 public resolvers
- `reverse_dns` — PTR record + FCrDNS verification
- `asn_lookup` — ASN/BGP network identification + abuse contact
- `whois_lookup` — RDAP/WHOIS domain registration data
- `subdomain_discovery` — Passive subdomain enumeration from CT logs, operational-name flags (dev/staging/admin), wildcard detection
- `lookalike_domains` — Typosquat variants that are actually registered — homoglyph, affix (brand-login), TLD swap, keyboard slips — with the domain's own defensive registrations separated out
- `owasp_check` — OWASP-mapped checks that can be observed passively (headers, TLS, exposed files), honest about what is out of scope
- `impersonation_exposure` — Brand impersonation exposure grade: third-party lookalikes + exposed operational subdomains + wildcard certs
- `golive_check` — Go-live readiness — DNS, propagation, SSL, HTTP, registration in one READY / CAUTION / NOT READY verdict
- `domain_history` — Past nameservers, A/AAAA, MX, certificate issuer, registrar (and an IP's ASN/PTR) with first and last seen — from DechoNet's own observations, not passive DNS
- `infrastructure_pivot` — Other domains DechoNet saw with the same nameserver, IP, MX, issuer or registrar. Needs a free API key (`DECHONET_API_KEY`); shared infrastructure returns a count only
- `domain_changes` — What changed since the last check — status, grade, issuer, DNS, issues. Works from lookup history even without a watch
- `pqc_readiness` — Post-quantum TLS readiness: hybrid X25519MLKEM768 key exchange, whether the origin server or a CDN edge provides it, certificate signature algorithms. External indicator, not a full PQC audit
- `mcp_server_check` — Before you connect a remote MCP server: authentication and OAuth metadata, tools that act (commands, files, messages, payments, secrets), agent-steering text in tool descriptions, CORS/Origin, HTTPS. Initialize and tools/list only — no tool
- `watch_domain` — Register a domain for daily re-checks (SSL, DNS, HTTP, RDAP) so `domain_changes` accumulates a timeline. Writes a watch; idempotent
- `set_expectations` — State what a domain should show from outside (a header present, DMARC enforcing, an issue gone, a grade, certificate days, DNS records, HTTPS answering), check it now with fresh reads and every day after. Each result comes with a signed obs
- `check_before_action` — Before logging in, paying, downloading or submitting: whether the page impersonates a brand, how new the domain is, whether it was flagged before, and — when the caller reports the page structure as host names — whether the card fields sit 
- `report_page` — Report a page (phishing, fake payment window, hidden instructions for AI agents, malicious download, or a verdict that looks wrong), an MCP server whose tool descriptions steer agents, or a network anomaly (the certificate or addresses you 
- `verify_expectations` — Check a stored set (by id) or a one-off list from outside now — after a change, to see whether it is visible yet
- `ip_info` — Public IP, ISP, ASN, proxy detection
- `email_header_analysis` — Email delivery route tracing + auth results
- `subnet_calc` — CIDR subnet calculator (offline)
- `asm_nuclei_start` — Start a limited active check (Nuclei) on a verified asset from your attack-surface report. Needs current DNS TXT ownership, the exact root URL from that report and `confirm: "asm-nuclei-v2"`. Automatically runs `asm_verify` before creating 
- `asm_nuclei_status` — Progress, coverage and sanitized findings. Partial or failed is not a clean result; technology detection is not proof of a vulnerability. Never starts requests
- `asm_nuclei_cancel` — Stop new requests and end the job. Requests already sent cannot be recalled

Source repository: https://github.com/node-man/dechonet-mcp

---

Source: https://mcp-skills-hub.vercel.app/mcps/com-dechonet-mcp · MCP Skills Hub · data as of 2026-10-28T12:31:05Z