M
MadaBurns/bv-mcp
DNS, email-authentication, TLS and exposure scanning for AI agents: 81 MCP tools, scored 0–100
View on GitHub ↗Link checked 2026-11-12 · HTTP 200 · opens the vendor's own site
Install & config
Remote endpoint (mcpServers - Claude Desktop / Cursor / Windsurf)
{
"mcpServers": {
"madaburns-bv-mcp": {
"url": "https://dns-mcp.blackveilsecurity.com/mcp"
}
}
}Paste this into the mcpServers config of Claude Desktop or Cursor. The endpoint comes from public evidence; we do not install or host it. Official Registry record: this endpoint lists no request headers. That is not the same as key-free - the project docs decide.
VS Code (.vscode/mcp.json - the key is servers, remote needs type: http)
{
"servers": {
"madaburns-bv-mcp": {
"type": "http",
"url": "https://dns-mcp.blackveilsecurity.com/mcp"
}
}
}VS Code differs from the other three: the top-level key is <code>servers</code> and a remote endpoint also needs <code>"type": "http"</code>. Paste into .vscode/mcp.json.
Claude Code (command line)
claude mcp add --transport http madaburns-bv-mcp https://dns-mcp.blackveilsecurity.com/mcp
Claude Code does not read a config file; add the server with this command.
Key names differ by client: Clients & CLI
- Star count
- 9 ★ · MadaBurns/bv-mcp · read from the GitHub search API · (checked 2026-11-13 20:00:50)
- Source
- read directly from its GitHub page · type: open-source project
- Harvest history
- first seen 2026-10-29 · last seen 2026-11-14 · seen 17× · listed by 1 sources
- Score
- score 103 · 9 ★ · 1 sources · repo
FAQ (answers come from our records)
How do I install it?
We did not find an install command for this repository (our install coverage is only about 4%). Check its README or releases page.
Who is it for?
We filed it under these tags: 开源项目. The tags come from the entry itself, not a taxonomy we imposed.
Who maintains it?
repository
MadaBurns/bv-mcp；first catalogued 2026-10-29；last seen 2026-11-14。There is no official certification or quality rating here — we record sources and dates only.# BLACKVEIL DNS
以下摘录自该仓库的 README（片段） · 在 GitHub 读完整 README →
Know where you stand.
Source-available DNS & email security scanner for Claude, Cursor, VS Code, and MCP clients across Streamable HTTP, stdio, and legacy HTTP+SSE.
## Try it in 30 seconds
Claude Desktop (one-click install):
Download the Blackveil DNS extension and open it — the current 81-tool surface is available instantly. Verify your download.
Claude Code (one command):
bash
claude mcp add --transport http blackveil-dns https://dns-mcp.blackveilsecurity.com/mcp
Then ask: scan anthropic.com
Smithery (one command):
bash
smithery mcp add MadaBurns/bv-mcp
Verify the endpoint is live:
bash
curl https://dns-mcp.blackveilsecurity.com/health
No install. No API key. One URL for hosted HTTP:
Endpoint https://dns-mcp.blackveilsecurity.com/mcp
Transport Streamable HTTP · JSON-RPC 2.0
Auth None required
Transport support:
Streamable HTTP: POST /mcp, GET /mcp, DELETE /mcp
Native stdio: blackveil-dns-mcp CLI from the blackveil-dns npm package
Legacy HTTP+SSE: GET /mcp/sse bootstrap stream plus POST /mcp/messages?sessionId=...
For Streamable HTTP, clients should retain the Mcp-Session-Id returned by initialize and send it on every subsequent request, including notifications. Send the negotiated version in MCP-Protocol-Version; unsupported values are rejected with HTTP 400, while expired or terminated sessions return 404 and require a fresh initialize.
## What you get
81 MCP tools with 19 scoring categories — SPF, DMARC, DKIM, DNSSEC, SSL/TLS, MTA-STS, NS, CAA, MX, BIMI, TLS-RPT, subdomain takeover, HTTP security headers, DANE, SVCB/HTTPS, DANE-HTTPS, subdomailing, reverse DNS (PTR/FCrDNS), and DNSKEY strength
Maturity staging — Stage 0-4 classification (Unprotected to Hardened) with score-based capping to prevent inflated labels
Trust surface analysis — detects shared SaaS senders in SPF, both cataloged platforms (Google, M365, SendGrid) and uncataloged hosts identifiable by their spf delegation label, then cross-references DMARC enforcement to determine real exposure
Guided remediation — generate (artifact=fixplan) produces provider-aware prioritized actions; its record artifacts (spfrecord, dmarcrecord, dkimconfig, mtastspolicy, rolloutplan) output ready-to-publish records; validatefix confirms whether a fix was applied successfully
Supply chain mapping — mapsupplychain correlates DNS signals to build a full third-party dependency graph with trust levels and risk signals
Attack path simulation — simulateattackpaths enumerates specific paths (spoofing, takeover, hijack) with severity, steps, and mitigations
Compliance mapping — mapcompliance maps scan findings to NIST 800-177, PCI DSS 4.0, SOC 2, and CIS Controls
Self-tuning scoring — adaptive weights adjust category importance based on patterns seen across scans via Durable Object telemetry
Per-tier analytics — usage tracking by auth tier with operator API for tier summaries, key-level usage, and daily digests
Read-only — checks never modify a target and need no authorization from it. Most are passive lookups over public Cloudflare DNS-over-HTTPS; checkauthoritativednsinfra and checkrootserverset query authoritative and root nameservers directly over TCP/53, and for authenticated callers checkauthoritativednsinfra also tests whether a domain's nameservers refuse a zone transfer (no zone data is retrieved)
Source-available DNS & email security scanner for Claude, Cursor, VS Code, and MCP clients across Streamable HTTP, stdio, and legacy HTTP+SSE.
## Try it in 30 seconds
Claude Desktop (one-click install):
Download the Blackveil DNS extension and open it — the current 81-tool surface is available instantly. Verify your download.
Claude Code (one command):
bash
claude mcp add --transport http blackveil-dns https://dns-mcp.blackveilsecurity.com/mcp
Then ask: scan anthropic.com
Smithery (one command):
bash
smithery mcp add MadaBurns/bv-mcp
Verify the endpoint is live:
bash
curl https://dns-mcp.blackveilsecurity.com/health
No install. No API key. One URL for hosted HTTP:
Endpoint https://dns-mcp.blackveilsecurity.com/mcp
Transport Streamable HTTP · JSON-RPC 2.0
Auth None required
Transport support:
Streamable HTTP: POST /mcp, GET /mcp, DELETE /mcp
Native stdio: blackveil-dns-mcp CLI from the blackveil-dns npm package
Legacy HTTP+SSE: GET /mcp/sse bootstrap stream plus POST /mcp/messages?sessionId=...
For Streamable HTTP, clients should retain the Mcp-Session-Id returned by initialize and send it on every subsequent request, including notifications. Send the negotiated version in MCP-Protocol-Version; unsupported values are rejected with HTTP 400, while expired or terminated sessions return 404 and require a fresh initialize.
## What you get
81 MCP tools with 19 scoring categories — SPF, DMARC, DKIM, DNSSEC, SSL/TLS, MTA-STS, NS, CAA, MX, BIMI, TLS-RPT, subdomain takeover, HTTP security headers, DANE, SVCB/HTTPS, DANE-HTTPS, subdomailing, reverse DNS (PTR/FCrDNS), and DNSKEY strength
Maturity staging — Stage 0-4 classification (Unprotected to Hardened) with score-based capping to prevent inflated labels
Trust surface analysis — detects shared SaaS senders in SPF, both cataloged platforms (Google, M365, SendGrid) and uncataloged hosts identifiable by their spf delegation label, then cross-references DMARC enforcement to determine real exposure
Guided remediation — generate (artifact=fixplan) produces provider-aware prioritized actions; its record artifacts (spfrecord, dmarcrecord, dkimconfig, mtastspolicy, rolloutplan) output ready-to-publish records; validatefix confirms whether a fix was applied successfully
Supply chain mapping — mapsupplychain correlates DNS signals to build a full third-party dependency graph with trust levels and risk signals
Attack path simulation — simulateattackpaths enumerates specific paths (spoofing, takeover, hijack) with severity, steps, and mitigations
Compliance mapping — mapcompliance maps scan findings to NIST 800-177, PCI DSS 4.0, SOC 2, and CIS Controls
Self-tuning scoring — adaptive weights adjust category importance based on patterns seen across scans via Durable Object telemetry
Per-tier analytics — usage tracking by auth tier with operator API for tier summaries, key-level usage, and daily digests
Read-only — checks never modify a target and need no authorization from it. Most are passive lookups over public Cloudflare DNS-over-HTTPS; checkauthoritativednsinfra and checkrootserverset query authoritative and root nameservers directly over TCP/53, and for authenticated callers checkauthoritativednsinfra also tests whether a domain's nameservers refuse a zone transfer (no zone data is retrieved)
Listed badge (optional)
Copy this line into the README if you want the listing mark. Optional, and it does not affect being listed.
[](https://anclum.com/en/s/madaburns-bv-mcp/)
- Source
- github · https://github.com/MadaBurns/bv-mcp
- Browse by field
- Open source
- Traction
- 9 ★
- added
- today
More like this
Filed under
Every tag opens the full list for that filter. Counts are the live catalogue figures.