Fernando Melo MCP server

• Registry namenet.fmelo/cognitaverified in the MCP registry

The registry name sits under fmelo.net. The registry only lets a publisher use that namespace after proving control of the domain through DNS or HTTP.

• Stateanswerschecked 2026-10-27
• Tools51
• Server calls itselfCognita
• Server version1.0.9786.20433
• Protocol version2025-06-18

On 2026-10-27 the server answered initialize and tools/list without a sign-in. First answer in 556 ms.

• Its tools do every use case we checked: scan a website's DNS, TLS and email security posture; give AI agents read-only tools for site reconnaissance.
• Checked on 1 of the 7 days it takes to judge reliability.

Said by rules from the measurements above. The likely first call is a model's pick from the tool list; read its description before relying on it.

• INITE MCP scoreafter a weeka score needs 7 daily checks: 1 so far
• What an agent can do with it2 of 2 use cases
• Answeredmeasuring1 of the 7 daily checks it takes to print a share
• Median first answer2470 ms
• Space in an agent's context≈ 7,371 tokensthe definitions of all its tools (51), which an agent carries on every turn
• Tool definitionsB · 83 of 100
• Typed results0 of 51 toolsdeclared outputSchema: results come typed, read once

• Not saying whether it only reads or can destroy: 51 of 51

A program checks the server once a day: initialize and tools/list, no model. Tokens are the definitions' length at about four characters a token. The grade averages six checks of every tool's name, description, schema and annotations; it says how well the tools are described, not whether they work. The score weighs what was measured and nothing else: answering (25%), doing the product's job (25%), definitions (20%), context (10%), use (10%) and how readily a client connects (10%). A part that was not measured is left out, and a hidden instruction caps the score at 40. The state of vendors' MCP servers: method and numbers →

• asn_prefixes

  List the IP prefixes an autonomous system announces (via RIPEstat), with the network holder — the routed footprint of an ASN. Read-only.

• cve_triage

  Prioritise a host's internet-exposed CVEs: takes the CVEs from host_exposure (Shodan InternetDB) and enriches each with CISA KEV (confirmed exploited in the wild) and FIRST EPSS (exploit probability), then ranks them so the ones to patch…

• typosquat_scan

  Generate lookalike variants of a domain (omission, transposition, homoglyph, adjacent-key, hyphenation and TLD-swap typos) and report which ones actually resolve in DNS — the registered lookalikes worth checking for phishing or brand…

• email_header_analyzer

  Parse pasted raw email headers: the Received: delivery path with per-hop delays, the SPF/DKIM/DMARC verdicts, the originating IP, and spoofing warnings. Pure parsing — no network.

• dns_propagation

  Ask several independent public resolvers (Google, Cloudflare, DNS.SB, NextDNS) the same record over DNS-over-HTTPS and compare their answers. Returns each resolver's record set and DNS status, whether they all agree, and a note. Agreement…

• email_posture

  Report a domain's modern email-security records beyond SPF/DMARC/DKIM: MTA-STS (DNS record + fetched policy: enforce/testing mode, max_age, MX), TLS-RPT (reporting address) and BIMI (brand logo + VMC), with warnings on what is missing or…

• ct_org_search

  Find the certificates that name an ORGANISATION in Certificate Transparency (via crt.sh) and the distinct registrable domains on them — a link from a company name to its domain footprint, complementing cert_transparency's per-domain view…

• geo_route

  Show the network path from the caller to a target host on a world map: origin (the caller's IP — the user when the agent runs client-side), destination (the target's geolocation), and the great-circle distance. Returns structured…

• tls_posture

  Grade a host's transport security A–F in one call, correlating tls_certificate (validity, chain trust, protocol, key/signature), cert_revocation (OCSP/CRL endpoints, must-staple) and hsts_preload_check (browser HSTS preload). Returns the…

• feodo_c2_check

  Check an IP against abuse.ch's Feodo Tracker botnet command-and-control blocklist (keyless): a hit means the IP is a known C2 server for a malware family (Emotet, Dridex, QakBot, TrickBot, …), with the malware name, port and first-seen…

• dmarc_check

  Fetch and analyse a domain's DMARC record (_dmarc TXT): the policy (none/quarantine/reject) and warnings on a weak or missing policy. Read-only.

• tranco_rank

  Report a domain's popularity on the Tranco research list (keyless): its rank in the top ~1M sites, a band (top-1k/10k/100k/1M or 'unranked'), and how many recent daily lists it appears in. A cheap context signal — a top-1k domain and an…

• rpki_validation

  Validate the BGP route-origin of an IP or prefix against RPKI (via RIPEstat): valid / invalid / unknown for the announcing ASN and covering prefix. 'invalid' means the origin isn't authorised by a ROA (possible hijack or…

• cve_lookup

  Look up a CVE in the NVD (NIST National Vulnerability Database): its description, CVSS base score / severity / vector, CWE weakness IDs, publication dates and references. Turns a bare CVE ID (e.g. one from host_exposure) into meaning…

• spoofability

  Judge how easily a domain's mail can be forged by correlating SPF and DMARC into one verdict: 'hardened' (DMARC enforcing), 'partial' (DMARC quarantine) or 'spoofable' (no DMARC or p=none — receivers won't reject forged mail), with an A–F…

• subdomain_takeover_check

  Check a domain's subdomains (enumerated from Certificate Transparency) for dangling-CNAME takeover risk: a CNAME that delegates to a third-party service (GitHub Pages, S3, Heroku, Azure, Netlify, …) which no longer claims the name. Status…

• tls_certificate

  Inspect the leaf certificate a host serves on a live TLS handshake: subject, issuer, subject-alternative names, validity window and days to expiry, key and signature algorithms, serial, thumbprint, the negotiated TLS protocol/cipher, and…

• dns_lookup

  Resolve DNS records for a host name. Returns A, AAAA, MX, TXT, NS, CNAME and SOA by default; pass 'types' to narrow. Read-only.

• dshield_ip_check

  Look up an IP's reputation in the SANS Internet Storm Center (DShield) data (keyless): how many attack reports it has across how many target sensors over the observed window, the network/AS it belongs to, and which ISC threat feeds list…

• host_exposure

  Report a host's internet-facing exposure from Shodan's InternetDB (keyless): open ports, detected products (CPEs), known CVEs, hostnames and tags. Passive — reads Shodan's own scan data, never touches the target. For a domain the first…

• scan_site

  Run a passive web-security scan of a URL (via Astur). Returns an A–F grade, a 0–100 score and findings mapped to OWASP WSTG/ASVS. Non-intrusive — no active probing of the target.

• abuse_contact

  Find the abuse-reporting e-mail(s) for an IP (or a host's resolved IP) via RIPEstat's abuse-contact-finder — where to report a scanner or attacker surfaced by ip_reputation. Read-only.

• kev_check

  Check whether a CVE is in CISA's Known Exploited Vulnerabilities (KEV) catalogue — i.e. confirmed exploited in the wild, the strongest 'patch this now' signal. Returns the vendor/product, when it was added, the remediation due date, and…

• reverse_dns

  Reverse-resolve an IP address to its PTR host name(s). Read-only.

• ip_reputation

  Check an IP against GreyNoise's Community data: whether it is internet background 'noise' (a mass scanner) and, if so, GreyNoise's classification — 'malicious', 'benign' (an identified research scanner such as Shodan, Censys or Modat) or…

• hsts_preload_check

  Check whether a domain is in the browsers' HSTS preload list (via hstspreload.org's keyless status API): the status (preloaded/pending/unknown), whether it was bulk-imported, and the parent domain it may be covered through. Preloaded…

• disclosure_contacts

  Consolidate where and how to report a security issue for a domain: the owner's own published channel (security_txt — RFC 9116 Contact, Policy, PGP key) and the network operator's registered abuse mailbox (abuse_contact, RIPEstat). Returns…

• rdap

  Look up registration data for a domain or IP via RDAP (the modern JSON successor to WHOIS): handle, name, statuses and lifecycle events, plus the raw record. Read-only.

• tor_exit_check

  Check whether an IP is a current Tor exit node, from the Tor Project's public bulk exit list (keyless). Exit traffic is anonymised, so an IP seen in logs may not be the true origin — a useful context signal. For a host name the first…

• robots_sitemap

  Passively read a site's robots.txt and the sitemap it points to. Returns the disallowed paths (often naming admin/staging areas — a recon signal), any declared crawl-delay, the sitemap URL(s), and — for the one sitemap fetched — whether…

• passive_dns

  Historical DNS resolutions for a domain or IP from Mnemonic's keyless Passive DNS: the answers a name resolved to over time (or the names that pointed at an IP), each with a first/last-seen window and observation count. Surfaces…

• ip_blocklist_check

  Check whether an IP sits inside a netblock on a curated keyless reputation list — Spamhaus DROP/EDROP (networks judged hijacked or bad-actor-controlled) and FireHOL level1 (a conservative aggregate of established abuse lists). Returns…

• epss_score

  Get a CVE's EPSS score (FIRST's Exploit Prediction Scoring System): the probability (0–1) it will be exploited in the next 30 days, and its percentile rank among all CVEs. A forward-looking likelihood that complements kev_check's…

• spf_expand

  Fully expand a domain's SPF record: follow every include: and redirect= recursively and count the DNS-lookup mechanisms across the WHOLE tree against the RFC 7208 limit of 10 — the real-world failure spf_check misses, where a nested…

• asn_relations

  Report an autonomous system's BGP relationships via RIPEstat (keyless): its upstreams (transit providers), downstreams (customers) and peers, from observed AS paths — the neighbour ASNs ordered by how often the relationship is seen. The…

• spf_check

  Fetch and analyse a domain's SPF record: the parsed DNS-lookup count (RFC 7208 limit is 10), the 'all' qualifier, and warnings on a missing or permissive policy. Read-only.

• wayback_snapshot

  Report the first and most recent captures of a domain in the Internet Archive's Wayback Machine (keyless CDX), with a link to each snapshot — a site-age / history signal (how far back it is archived), complementing wayback_urls (which…

• cert_revocation

  Report the revocation posture of the certificate a host serves: the OCSP responder(s) and CRL distribution point(s) a client could use to check revocation, and whether the certificate is must-staple (TLS-feature status_request, forcing a…

• cert_transparency

  Enumerate a domain's subdomains and certificate-issuance history from public Certificate Transparency logs (crt.sh): the names ever certified under it, issuing CAs, and the issuance span. Reveals names even behind a CDN and never touches…

• related_domains

  Find other registrable domains that share a TLS certificate (a common SAN) with the given domain, from Certificate Transparency (crt.sh) — a passive link to sibling properties run on the same certificates. Read-only.

• zone_transfer_check

  Test whether a domain's authoritative name servers allow a DNS zone transfer (AXFR) — a classic misconfiguration that leaks the entire zone (every hostname it holds) to anyone who asks (RFC 5936: AXFR must be limited to authorised…

• urlscan_lookup

  Search urlscan.io's public scan database (keyless) for a domain or IP: recent public scans of the site itself (its own pages, not other sites that merely load something from it) with each page's final URL, resolved IP, hosting…

• mx_lookup

  List a domain's mail exchangers (MX), ordered by preference, with each host's resolved IP addresses. Read-only.

• dkim_lookup

  Fetch a domain's DKIM public-key record for a given selector (<selector>._domainkey.<domain>). The selector comes from an email's DKIM-Signature s= tag or a known default. Read-only.

• investigate

  Run a full reconnaissance sweep of a domain or URL and return a correlated report: web-security grade (via Astur), email-authentication posture (SPF/DMARC), nameservers, MX, registrar, subdomains from Certificate Transparency logs, the…

• wayback_urls

  List a domain's historical URLs captured by the Internet Archive Wayback Machine (CDX API, keyless): old endpoints, forgotten paths and files no longer on the live site, across the domain and its subdomains. Passive OSINT — reads the…

• blacklist_check

  Check whether a mail server is listed on common email DNS blocklists (DNSBLs). For a domain, its mail (MX) IPs are checked — what matters for email reputation — falling back to the A record when there is no MX; a literal IP is checked…

• ip_reputation_aggregate

  Fold every keyless IP-reputation source into one verdict — clean / suspicious / malicious / unknown: ip_blocklist_check (Spamhaus DROP + FireHOL), ip_reputation (GreyNoise), feodo_c2_check (botnet C2), tor_exit_check and dshield_ip_check…

• asn_geoip

  Geolocate an IP address (or a host's resolved IP): ASN, network organisation, and approximate city/country. Requires a configured GeoIP database. Read-only.

• security_txt

  Fetch a site's vulnerability-disclosure file (RFC 9116) from /.well-known/security.txt (falling back to /security.txt): the declared security Contact(s), Expires date and whether it has lapsed, PGP Encryption key, Policy/Acknowledgments…

• caa_dnssec

  Report a domain's CAA records (which CAs may issue its certificates) and an indicative DNSSEC signal (DNSKEY presence + Authenticated-Data flag — not a full chain validation). Read-only.