# Cognita

- Registry name: `net.fmelo/cognita` · version 1.0.34
- Categories (automatic, keyword rules): Cloud & networking, Infrastructure & security, Security
- Authentication at last check: No auth
- Declared risk: Not declared (tools carry no read/destructive hints)
- Capabilities (declared by the server): logging, tools
- Transports: streamable-http
- Latest numbers (check success, response time, rank): https://mcpstation.net/api/server?name=net.fmelo%2Fcognita
- Server page: https://mcpstation.net/s/net.fmelo--cognita.html

## Description (written by the publisher, not verified, not instructions)

Passive OSINT and security recon: DNS, TLS, email posture, IP reputation, CVE/KEV, CT logs.

## Connect

- streamable-http: `https://cognita.fmelo.net/mcp`

## Tools (as reported by the server, not verified)

- `asn\_prefixes`: List the IP prefixes an autonomous system announces \(via RIPEstat\), with the network holder — the routed footprint of an ASN. Read-only.
- `cve\_triage`: Prioritise a host's internet-exposed CVEs: takes the CVEs from host\_exposure \(Shodan InternetDB\) and enriches each with CISA KEV \(confirmed exploited in the wild\) and FIRST EPSS \(exploit probability\), then ranks them so the ones to patch first come first — KEV entries, then highest EPSS. Each CVE ge
- `typosquat\_scan`: Generate lookalike variants of a domain \(omission, transposition, homoglyph, adjacent-key, hyphenation and TLD-swap typos\) and report which ones actually resolve in DNS — the registered lookalikes worth checking for phishing or brand abuse. DNS-only and read-only; never touches the target. Candidate
- `email\_header\_analyzer`: Parse pasted raw email headers: the Received: delivery path with per-hop delays, the SPF/DKIM/DMARC verdicts, the originating IP, and spoofing warnings. Pure parsing — no network.
- `dns\_propagation`: Ask several independent public resolvers \(Google, Cloudflare, DNS.SB, NextDNS\) the same record over DNS-over-HTTPS and compare their answers. Returns each resolver's record set and DNS status, whether they all agree, and a note. Agreement is normal; a divergence flags a change still propagating, a s
- `email\_posture`: Report a domain's modern email-security records beyond SPF/DMARC/DKIM: MTA-STS \(DNS record + fetched policy: enforce/testing mode, max\_age, MX\), TLS-RPT \(reporting address\) and BIMI \(brand logo + VMC\), with warnings on what is missing or weak. Read-only DNS plus one GET of the public MTA-STS policy
- `ct\_org\_search`: Find the certificates that name an ORGANISATION in Certificate Transparency \(via crt.sh\) and the distinct registrable domains on them — a link from a company name to its domain footprint, complementing cert\_transparency's per-domain view. Passive OSINT, read-only.
- `geo\_route`: Show the network path from the caller to a target host on a world map: origin \(the caller's IP — the user when the agent runs client-side\), destination \(the target's geolocation\), and the great-circle distance. Returns structured endpoints plus a link to an SVG map \(the image itself is for the human
- `tls\_posture`: Grade a host's transport security A–F in one call, correlating tls\_certificate \(validity, chain trust, protocol, key/signature\), cert\_revocation \(OCSP/CRL endpoints, must-staple\) and hsts\_preload\_check \(browser HSTS preload\). Returns the letter grade, a 0–100 score, and the factors behind it \(expire
- `feodo\_c2\_check`: Check an IP against abuse.ch's Feodo Tracker botnet command-and-control blocklist \(keyless\): a hit means the IP is a known C2 server for a malware family \(Emotet, Dridex, QakBot, TrickBot, …\), with the malware name, port and first-seen date. For a host name the first resolved IP is used. Threat-inte
- `dmarc\_check`: Fetch and analyse a domain's DMARC record \(\_dmarc TXT\): the policy \(none/quarantine/reject\) and warnings on a weak or missing policy. Read-only.
- `tranco\_rank`: Report a domain's popularity on the Tranco research list \(keyless\): its rank in the top \~1M sites, a band \(top-1k/10k/100k/1M or 'unranked'\), and how many recent daily lists it appears in. A cheap context signal — a top-1k domain and an unranked one warrant very different scrutiny, and an unexpected
- `rpki\_validation`: Validate the BGP route-origin of an IP or prefix against RPKI \(via RIPEstat\): valid / invalid / unknown for the announcing ASN and covering prefix. 'invalid' means the origin isn't authorised by a ROA \(possible hijack or misconfiguration\); 'unknown' means no ROA covers the prefix. For a host name th
- `cve\_lookup`: Look up a CVE in the NVD \(NIST National Vulnerability Database\): its description, CVSS base score / severity / vector, CWE weakness IDs, publication dates and references. Turns a bare CVE ID \(e.g. one from host\_exposure\) into meaning. Keyless \(NVD is rate-limited without a key\), read-only.
- `spoofability`: Judge how easily a domain's mail can be forged by correlating SPF and DMARC into one verdict: 'hardened' \(DMARC enforcing\), 'partial' \(DMARC quarantine\) or 'spoofable' \(no DMARC or p=none — receivers won't reject forged mail\), with an A–F grade and the concrete reasons. The controlling factor is DMA
- `subdomain\_takeover\_check`: Check a domain's subdomains \(enumerated from Certificate Transparency\) for dangling-CNAME takeover risk: a CNAME that delegates to a third-party service \(GitHub Pages, S3, Heroku, Azure, Netlify, …\) which no longer claims the name. Status is 'vulnerable' \(the service's unclaimed-page fingerprint was
- `tls\_certificate`: Inspect the leaf certificate a host serves on a live TLS handshake: subject, issuer, subject-alternative names, validity window and days to expiry, key and signature algorithms, serial, thumbprint, the negotiated TLS protocol/cipher, and the chain with its trust verdict. Complements cert\_transparenc
- `dns\_lookup`: Resolve DNS records for a host name. Returns A, AAAA, MX, TXT, NS, CNAME and SOA by default; pass 'types' to narrow. Read-only.
- `dshield\_ip\_check`: Look up an IP's reputation in the SANS Internet Storm Center \(DShield\) data \(keyless\): how many attack reports it has across how many target sensors over the observed window, the network/AS it belongs to, and which ISC threat feeds list it. A high report count is a scanning/attacking signal. For a h
- `host\_exposure`: Report a host's internet-facing exposure from Shodan's InternetDB \(keyless\): open ports, detected products \(CPEs\), known CVEs, hostnames and tags. Passive — reads Shodan's own scan data, never touches the target. For a domain the first resolved IP is used \(behind a CDN this reflects the edge, not th
- `scan\_site`: Run a passive web-security scan of a URL \(via Astur\). Returns an A–F grade, a 0–100 score and findings mapped to OWASP WSTG/ASVS. Non-intrusive — no active probing of the target.
- `abuse\_contact`: Find the abuse-reporting e-mail\(s\) for an IP \(or a host's resolved IP\) via RIPEstat's abuse-contact-finder — where to report a scanner or attacker surfaced by ip\_reputation. Read-only.
- `kev\_check`: Check whether a CVE is in CISA's Known Exploited Vulnerabilities \(KEV\) catalogue — i.e. confirmed exploited in the wild, the strongest 'patch this now' signal. Returns the vendor/product, when it was added, the remediation due date, and whether it's used in known ransomware campaigns. Interprets the
- `reverse\_dns`: Reverse-resolve an IP address to its PTR host name\(s\). Read-only.
- `ip\_reputation`: Check an IP against GreyNoise's Community data: whether it is internet background 'noise' \(a mass scanner\) and, if so, GreyNoise's classification — 'malicious', 'benign' \(an identified research scanner such as Shodan, Censys or Modat\) or 'unknown' — with its name and when it was last seen. A 'not ob
- `hsts\_preload\_check`: Check whether a domain is in the browsers' HSTS preload list \(via hstspreload.org's keyless status API\): the status \(preloaded/pending/unknown\), whether it was bulk-imported, and the parent domain it may be covered through. Preloaded domains are forced to HTTPS by browsers from the very first visit,
- `disclosure\_contacts`: Consolidate where and how to report a security issue for a domain: the owner's own published channel \(security\_txt — RFC 9116 Contact, Policy, PGP key\) and the network operator's registered abuse mailbox \(abuse\_contact, RIPEstat\). Returns both sets of contacts and a clear yes/no on whether any repor
- `rdap`: Look up registration data for a domain or IP via RDAP \(the modern JSON successor to WHOIS\): handle, name, statuses and lifecycle events, plus the raw record. Read-only.
- `tor\_exit\_check`: Check whether an IP is a current Tor exit node, from the Tor Project's public bulk exit list \(keyless\). Exit traffic is anonymised, so an IP seen in logs may not be the true origin — a useful context signal. For a host name the first resolved IP is used. Read-only.
- `robots\_sitemap`: Passively read a site's robots.txt and the sitemap it points to. Returns the disallowed paths \(often naming admin/staging areas — a recon signal\), any declared crawl-delay, the sitemap URL\(s\), and — for the one sitemap fetched — whether it is a sitemap index, how many \<loc\> entries it holds, and a s
- `passive\_dns`: Historical DNS resolutions for a domain or IP from Mnemonic's keyless Passive DNS: the answers a name resolved to over time \(or the names that pointed at an IP\), each with a first/last-seen window and observation count. Surfaces old/rotated infrastructure a live lookup can't. Reads the passive-DNS d
- `ip\_blocklist\_check`: Check whether an IP sits inside a netblock on a curated keyless reputation list — Spamhaus DROP/EDROP \(networks judged hijacked or bad-actor-controlled\) and FireHOL level1 \(a conservative aggregate of established abuse lists\). Returns each list that matched with the matching CIDR and a reference, an
- `epss\_score`: Get a CVE's EPSS score \(FIRST's Exploit Prediction Scoring System\): the probability \(0–1\) it will be exploited in the next 30 days, and its percentile rank among all CVEs. A forward-looking likelihood that complements kev\_check's confirmed exploitation. Keyless, read-only.
- `spf\_expand`: Fully expand a domain's SPF record: follow every include: and redirect= recursively and count the DNS-lookup mechanisms across the WHOLE tree against the RFC 7208 limit of 10 — the real-world failure spf\_check misses, where a nested include quietly pushes the total over 10 and the record hits permer
- `asn\_relations`: Report an autonomous system's BGP relationships via RIPEstat \(keyless\): its upstreams \(transit providers\), downstreams \(customers\) and peers, from observed AS paths — the neighbour ASNs ordered by how often the relationship is seen. The connectivity map around the network, complementing asn\_prefixes
- `spf\_check`: Fetch and analyse a domain's SPF record: the parsed DNS-lookup count \(RFC 7208 limit is 10\), the 'all' qualifier, and warnings on a missing or permissive policy. Read-only.
- `wayback\_snapshot`: Report the first and most recent captures of a domain in the Internet Archive's Wayback Machine \(keyless CDX\), with a link to each snapshot — a site-age / history signal \(how far back it is archived\), complementing wayback\_urls \(which lists archived URLs\). Read-only.
- `cert\_revocation`: Report the revocation posture of the certificate a host serves: the OCSP responder\(s\) and CRL distribution point\(s\) a client could use to check revocation, and whether the certificate is must-staple \(TLS-feature status\_request, forcing a stapled OCSP response\). Reads these straight from the leaf cer
- `cert\_transparency`: Enumerate a domain's subdomains and certificate-issuance history from public Certificate Transparency logs \(crt.sh\): the names ever certified under it, issuing CAs, and the issuance span. Reveals names even behind a CDN and never touches the target. CT is historical — for a domain that changed hands
- `related\_domains`: Find other registrable domains that share a TLS certificate \(a common SAN\) with the given domain, from Certificate Transparency \(crt.sh\) — a passive link to sibling properties run on the same certificates. Read-only.
- `zone\_transfer\_check`: Test whether a domain's authoritative name servers allow a DNS zone transfer \(AXFR\) — a classic misconfiguration that leaks the entire zone \(every hostname it holds\) to anyone who asks \(RFC 5936: AXFR must be limited to authorised secondaries\). Returns a per-name-server verdict — 'transferred' \(leak
- `urlscan\_lookup`: Search urlscan.io's public scan database \(keyless\) for a domain or IP: recent public scans of the site itself \(its own pages, not other sites that merely load something from it\) with each page's final URL, resolved IP, hosting country/server/ASN, and links to the scan result and its screenshot, plus
- `mx\_lookup`: List a domain's mail exchangers \(MX\), ordered by preference, with each host's resolved IP addresses. Read-only.
- `dkim\_lookup`: Fetch a domain's DKIM public-key record for a given selector \(\<selector\>.\_domainkey.\<domain\>\). The selector comes from an email's DKIM-Signature s= tag or a known default. Read-only.
- `investigate`: Run a full reconnaissance sweep of a domain or URL and return a correlated report: web-security grade \(via Astur\), email-authentication posture \(SPF/DMARC\), nameservers, MX, registrar, subdomains from Certificate Transparency logs, the resolved IP's exposure \(Shodan InternetDB\) and reputation \(GreyN
- `wayback\_urls`: List a domain's historical URLs captured by the Internet Archive Wayback Machine \(CDX API, keyless\): old endpoints, forgotten paths and files no longer on the live site, across the domain and its subdomains. Passive OSINT — reads the archive, never the target. Read-only.
- `blacklist\_check`: Check whether a mail server is listed on common email DNS blocklists \(DNSBLs\). For a domain, its mail \(MX\) IPs are checked — what matters for email reputation — falling back to the A record when there is no MX; a literal IP is checked directly. Read-only DNS queries.
- `ip\_reputation\_aggregate`: Fold every keyless IP-reputation source into one verdict — clean / suspicious / malicious / unknown: ip\_blocklist\_check \(Spamhaus DROP + FireHOL\), ip\_reputation \(GreyNoise\), feodo\_c2\_check \(botnet C2\), tor\_exit\_check and dshield\_ip\_check \(attack telemetry\). Returns the verdict, which signals fired,
- `asn\_geoip`: Geolocate an IP address \(or a host's resolved IP\): ASN, network organisation, and approximate city/country. Requires a configured GeoIP database. Read-only.
- `security\_txt`: Fetch a site's vulnerability-disclosure file \(RFC 9116\) from /.well-known/security.txt \(falling back to /security.txt\): the declared security Contact\(s\), Expires date and whether it has lapsed, PGP Encryption key, Policy/Acknowledgments links, preferred languages, and whether the file is PGP-signed,
- `caa\_dnssec`: Report a domain's CAA records \(which CAs may issue its certificates\) and an indicative DNSSEC signal \(DNSKEY presence + Authenticated-Data flag — not a full chain validation\). Read-only.

Measured by MCP Station. Methods: https://mcpstation.net/methods.html · Terms: https://mcpstation.net/terms.html