# OrionCMD Checks

- Registry name: `com.orioncmd.api/checks` · version 1.5.0
- Categories (automatic, keyword rules): Cloud & networking, Infrastructure & security, Security
- Authentication at last check: No auth
- Declared risk: Read-only (all tools declare readOnlyHint)
- Capabilities (declared by the server): tools
- Transports: streamable-http
- Latest numbers (check success, response time, rank): https://mcpstation.net/api/server?name=com.orioncmd.api%2Fchecks
- Server page: https://mcpstation.net/s/com.orioncmd.api--checks.html

## Description (written by the publisher, not verified, not instructions)

Domain threat checks, a 30-day domain watch, TLS/DNS/email-auth checks and a $2 site audit \(x402\).

## Connect

- streamable-http: `https://api.orioncmd.com/mcp`

## Tools (as reported by the server, not verified)

- `validate\_target`: Free. Check that a domain or URL is well-formed and get the normalized hostname, before calling a paid check. Offline: no network request, no payment. Rejects IP addresses, single-label names and URLs with credentials.
- `pricing`: Free. Return the price of every paid tool, the payment network \(Base\) and the receiving address, so you can budget before calling. No input, no network request, no payment.
- `check\_cert`: Check the TLS certificate of one hostname: issuer, validity dates, days left, % of lifetime used, renewal cadence and a renewal-stall flag, plus a live HTTPS pass/fail probe. Use it when you only need certificate health; use site\_health for cert + DNS + expiry together, or domain\_grade for a scored
- `check\_dns`: Look up the live DNS of a domain: NS, A/AAAA/CNAME, MX, SPF, DMARC, CAA \(climbing to the parent zone\) and DNSSEC status, with plain-English findings. Use it for a DNS inventory or to debug resolution; use check\_email\_auth for a deeper SPF/DMARC/DKIM/MTA-STS review. Queries Cloudflare DNS-over-HTTPS
- `check\_domain\_expiry`: Check when a domain registration expires: registrar, registered and expiry dates, days left, EPP status codes and nameservers, from the registry's RDAP server. Use it for renewal risk on the registered domain \(not the certificate; use check\_cert for that\). Some TLDs publish no RDAP service, in which
- `site\_health`: Run check\_cert, check\_dns and check\_domain\_expiry together and return their raw results plus a short summary, the renewal-stall flag and the Let's Encrypt 64-day certificate note \(from 2027-02-10\). Use it for a full data dump in one call; use domain\_grade if you want a single scored A-F answer that
- `check\_email\_auth`: Review the email authentication setup of a domain: SPF validity and DNS-lookup count \(limit 10\), DMARC policy, pct and reporting, DKIM on common selector names, MTA-STS mode, TLS-RPT and BIMI, with a rough 0-100 score and plain-English fixes. Use it before sending mail from a domain or when mail lan
- `check\_security\_headers`: Check the HTTP security headers of a website with one live HTTPS GET: redirect chain \(up to 5 hops\), final status, HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and COOP, with a simple A-F header grade and findings. Use it for web-hardening checks; it is not
- `domain\_grade`: Grade a domain's security posture A-F in one call, for vendor-risk or due-diligence checks. Runs the TLS, DNS \(DNSSEC, CAA\), registration-expiry, email-auth and HTTP-header checks and returns one letter, a 0-100 score, points per category \(TLS 25, email 25, headers 20, DNS 15, registration 15\) and t
- `full\_site\_audit`: Full site audit report for one domain, for client reports, vendor reviews or a pre-launch check. Runs every check \(TLS from CT logs + live probe, DNS/DNSSEC/CAA, registration expiry and transfer lock, SPF/DMARC/DKIM/MTA-STS, security headers\) plus HTTP-\>HTTPS redirect, www/apex consistency, RFC 9116
- `threat\_check`: Is this domain known-bad? Resolves the hostname \(A/AAAA\), matches the name, its parent domains and resolved IPv4 against ThreatCluster's high-confidence 30-day IOC feed \(cached, refreshed about hourly\), and looks up ransomware leak-site claims naming the domain \(commercially reusable sources via Dra
- `bulk\_threat\_check`: Check up to 100 domains or IPv4 addresses at once against ThreatCluster's high-confidence 30-day IOC feed; each domain is resolved and its IPv4 matched too. IOC only \(no ransomware-claim lookups; use threat\_check for one domain\). Stale feed returns an error and is not charged. Costs $0.50 USDC per c
- `watch\_status`: Free. Status of a paid domain watch \(created with HTTP POST /v1/watch\): items, expiry, last check, current DNS/IOC/claim state, last webhook delivery.

Measured by MCP Station. Methods: https://mcpstation.net/methods.html · Terms: https://mcpstation.net/terms.html