OrionCmd MCP server

Which MCP servers are OrionCmd's own, from the official registry and from asking its own domain, whether they answer, and what they offer. A program checked each of these, nobody copied them from a product page.

read 2026-10-27

← Back to OrionCmd

Whose server it is

Registry namecom.orioncmd.api/checksverified in the MCP registry

The registry name sits under orioncmd.com. The registry only lets a publisher use that namespace after proving control of the domain through DNS or HTTP.

When we asked itchecked 2026-10-27

Stateanswerschecked 2026-10-27
Tools13
Server calls itselforioncmd-checks
Server version1.6.0
Protocol version2025-06-18

On 2026-10-27 the server answered initialize and tools/list without a sign-in. First answer in 220 ms.

Should an agent connect itNot proven either way yet

Whether its tools do the product's job has not been judged yet.
Checked on 1 of the 7 days it takes to judge reliability.

Said by rules from the measurements above. The likely first call is a model's pick from the tool list; read its description before relying on it.

Measured dailydaily checks: 1, the first on 2026-10-27

INITE MCP scoreafter a weeka score needs 7 daily checks: 1 so far
Answeredmeasuring1 of the 7 daily checks it takes to print a share
Median first answer343 ms
Space in an agent's context≈ 2,581 tokensthe definitions of all its tools (13), which an agent carries on every turn
Tool definitionsA · 100 of 100
Typed results0 of 13 toolsdeclared outputSchema: results come typed, read once

Every tool passes all six checks.

Worth a look

None of the five warning signs in these definitions.

A program checks the server once a day: initialize and tools/list, no model. Tokens are the definitions' length at about four characters a token. The grade averages six checks of every tool's name, description, schema and annotations; it says how well the tools are described, not whether they work. The score weighs what was measured and nothing else: answering (25%), doing the product's job (25%), definitions (20%), context (10%), use (10%) and how readily a client connects (10%). A part that was not measured is left out, and a hidden instruction caps the score at 40. The state of vendors' MCP servers: method and numbers →

Tools it offers13 tools · read 2026-10-27

validate_target
Free. Check that a domain or URL is well-formed and get the normalized hostname, before calling a paid check. Offline: no network request, no payment. Rejects IP addresses, single-label names and URLs with credentials.
pricing
Free. Return the price of every paid tool, the payment network (Base) and the receiving address, so you can budget before calling. No input, no network request, no payment.
check_cert
Check the TLS certificate of one hostname: issuer, validity dates, days left, % of lifetime used, renewal cadence and a renewal-stall flag, plus a live HTTPS pass/fail probe. Use it when you only need certificate health; use site_health…
check_dns
Look up the live DNS of a domain: NS, A/AAAA/CNAME, MX, SPF, DMARC, CAA (climbing to the parent zone) and DNSSEC status, with plain-English findings. Use it for a DNS inventory or to debug resolution; use check_email_auth for a deeper…
check_domain_expiry
Check when a domain registration expires: registrar, registered and expiry dates, days left, EPP status codes and nameservers, from the registry's RDAP server. Use it for renewal risk on the registered domain (not the certificate; use…
site_health
Run check_cert, check_dns and check_domain_expiry together and return their raw results plus a short summary, the renewal-stall flag and the Let's Encrypt 64-day certificate note (from 2027-02-10). Use it for a full data dump in one call…
check_email_auth
Review the email authentication setup of a domain: SPF validity and DNS-lookup count (limit 10), DMARC policy, pct and reporting, DKIM on common selector names, MTA-STS mode, TLS-RPT and BIMI, with a rough 0-100 score and plain-English…
check_security_headers
Check the HTTP security headers of a website with one live HTTPS GET: redirect chain (up to 5 hops), final status, HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and COOP, with a simple A-F header…
domain_grade
Grade a domain's security posture A-F in one call, for vendor-risk or due-diligence checks. Runs the TLS, DNS (DNSSEC, CAA), registration-expiry, email-auth and HTTP-header checks and returns one letter, a 0-100 score, points per category…
full_site_audit
Full site audit report for one domain, for client reports, vendor reviews or a pre-launch check. Runs every check (TLS from CT logs + live probe, DNS/DNSSEC/CAA, registration expiry and transfer lock, SPF/DMARC/DKIM/MTA-STS, security…
threat_check
Is this domain known-bad? Resolves the hostname (A/AAAA), matches the name, its parent domains and resolved IPv4 against ThreatCluster's high-confidence 30-day IOC feed (cached, refreshed about hourly), and looks up ransomware leak-site…
bulk_threat_check
Check up to 100 domains or IPv4 addresses at once against ThreatCluster's high-confidence 30-day IOC feed; each domain is resolved and its IPv4 matched too. IOC only (no ransomware-claim lookups; use threat_check for one domain). Stale…
watch_status
Free. Status of a paid domain watch (created with HTTP POST /v1/watch): items, expiry, last check, current DNS/IOC/claim state, last webhook delivery.

How to connect

Add the server to your MCP client config. Claude Desktop, Cursor and most other clients read this shape:

{
  "mcpServers": {
    "checks": {
      "type": "http",
      "url": "https://api.orioncmd.com/mcp"
    }
  }
}

Add it

Claude Code, in a terminal

claude mcp add --transport http orioncmd https://api.orioncmd.com/mcp

Add to Cursor Add to VS Code

claude.ai, ChatGPT and other clients: add https://api.orioncmd.com/mcp as a custom connector in the settings.

Each line is something a program found when it went looking: the registry entry, the server's own answer, a spec that parses. A missing line means we did not find it, not that it does not exist.