SiteCheck Web Intel

npm registry search for MCP servers that convert Markdown to PDF (public npm search API, no key): package name, version, description, publisher, last publish date, monthly and weekly downloads, and npm link. Lists packages as npm reports them; quality is not checked.

New York Times home page headlines from the public NYT RSS feed (latest items; keyword filter on title/summary/categories). Headlines and abstracts only. Public feed, no key.

NHS England primary-care prescribing for a drug (official NHSBSA English Prescribing Dataset, monthly, ~2 months behind; the raw data behind OpenPrescribing.net): items, actual cost (GBP) and quantity, grouped by region, ICB, GP practice or product presentation, largest first. Match on BNF chemical substance or presentation name. Open Government Licence, no key.

Official World Golf Ranking (OWGR public ranking API, no key): current men's position, player name, country, total points, average points and last week's position for the top players. Current ranking only; no tour or event history.

PR Newswire latest news-release list from its public RSS feed (keyword filter on title/summary). Press release headlines and summaries. Public feed, no key.

PR Newswire health-category press releases from its public RSS feed (keyword filter on title/summary). Latest items only. Public feed, no key.

Reuters latest articles from Reuters' public news sitemap (no key): headline, article URL and publication time, newest first. Covers only the most recent items in the sitemap; headlines and links only, no article text. Optional keyword filter on the headline.

Semafor articles from its public RSS feed (keyword filter on title/summary/categories). Latest items only. Public feed, no key.

USDA AMS Market News (official MyMarketNews API): search the catalogue of livestock, grain, dairy, fruit/vegetable and other market reports by title, or pass a report slug id to get its latest published rows (prices, volumes, report date). Data straight from USDA; needs the owner's free MARS API key.

Internet Archive Wayback Machine CDX index: archived snapshots of a URL or domain (timestamp, original URL, MIME type, HTTP status, length) with a link to each capture. Public, no key; the index lists captures, not page text.

AbuseIPDB reputation for an IPv4 address over the last 90 days: abuse confidence score (0-100), number of abuse reports, last report date, ISP, usage type and country. Needs a free AbuseIPDB key configured by the operator; reports are crowd-sourced.

For an autonomous system (e.g. AS13335): how many upstream (transit) and downstream neighbours RIPEstat sees in BGP, the top upstreams ranked by 'power' with their IPv4 and IPv6 peer counts, and the top downstreams. Built from RIS route collector paths, so it is an observed view, not the contract.

Checks an IPv4 mail-sending address against the Barracuda Reputation Block List (b.barracudacentral.org) through public DNS. Listed addresses return a 127.0.0.x code; unlisted ones return no record. The list is updated continuously, so this is a point-in-time answer. Domain reputation is not covered.

For an IPv4 prefix (e.g. 8.8.8.0/24): the origin AS seen announcing it now across RIPE RIS peers, its RPKI status for that origin (valid, invalid or unknown), route objects, visibility, and how many more-specific and less-specific prefixes are seen. An 'invalid' RPKI status is a hijack warning sign; it is not proof of a hijack.

Censys host view for an IPv4 address: the services, ports and protocols Censys has observed on it with their last scan time and detected software, plus autonomous system, location, network owner and reverse DNS, from the Censys Platform API.

CISA's Known Exploited Vulnerabilities catalog (public JSON). With cveId: whether that CVE is on the list, with vendor, product, date added, federal due date, required action and ransomware-use flag. Without it: catalog size, release date and the newest additions (up to 50). Listing means exploitation was reported, not a risk score.

Lists the cookies a site sets on its public home page (one anonymous GET, no login) with their Secure, HttpOnly and SameSite flags, and flags the ones missing a flag. Cookies set later, after login or on other pages, are not seen.

Checks how a site's home page answers a cross-origin request from a made-up origin: whether it echoes that origin back, sends a wildcard (*), and whether credentials are allowed with it. Echoing an arbitrary origin together with credentials is the risky case. One GET of the home page; it does not test API routes or the null origin.

One CVE record from the NIST National Vulnerability Database: description, published and last-modified dates, NVD status, primary CVSS score and severity (v4.0, 3.1, 3.0 or 2.0, whichever NVD marks primary first), CWE weakness IDs and up to 5 reference URLs. It does not say whether the CVE is being exploited (use cisa-known-exploits or epss-exploit-score for that).

Email authentication DNS records for a domain: DMARC policy (p, sp, pct, rua), SPF record and its all-mechanism, and DKIM public keys for a selector you give or for 8 common selectors (revoked keys and CNAME-delegated keys are reported). Reads the published DNS records only; it does not check alignment against a real message.

Asks two independent public DNS resolvers (AdGuard DNS and NextDNS) for the same name and record type right now and reports whether they agree, with each answer set and its lowest TTL. It shows cache and geo-DNS differences between resolvers; it is two vantage points, not a worldwide propagation survey.

DNSSEC check for a domain: whether a DS record exists at the parent zone (the domain is signed), and whether two public validating resolvers (AdGuard DNS, NextDNS) return its A answer with the AD (authenticated) flag. It reads the resolvers' verdict; it does not validate the signature chain itself.

For a brand domain, generates up to 24 lookalike names (letter omission, doubling and swapping, plus .co/.net/.org/.io swaps) and checks which ones have name servers in DNS right now. Registered-looking names are listed with their name servers. A lookalike with no name servers may still be registered without DNS, and this is not a trademark or phishing verdict.

Checks whether an email address's domain (or a domain you give) is on the community disposable and temporary email blocklist (about 9,900 domains). Only the domain is checked, never the mailbox, and a domain missing from the list is not proven to be permanent.

Checks an IPv4 address against the abuse.ch Feodo Tracker botnet C2 blocklist (Emotet, QakBot and similar). A hit returns the port, online status, malware family, country, AS and first and last seen dates. Covers only the C2 servers this feed tracks.

GreyNoise Community lookup for an IPv4 address: whether it was seen mass-scanning the internet recently (noise), whether it is a known benign service (riot), its classification (benign, malicious, unknown), name and last-seen date. An address GreyNoise has not seen returns noise=false with a message; it is not a clean verdict.

Lists the data breaches HaveIBeenPwned has recorded for a domain (breach name, breach date, accounts affected, data types exposed, verified flag). It is the public breach catalogue, not a check of individual email addresses (that needs a paid key and is not offered here).

WordPress.org news posts from the official WordPress news RSS feed (keyword filter on title/summary/categories). Latest posts only. Public feed, no key.

World Rugby men's 15s world rankings (official rankings API, public, no key): position, team, country code, rating points and previous position and points, from the current table. Men's rankings only; the table is updated by World Rugby.

WSJ World News headlines from the public Dow Jones RSS feed (latest items; keyword filter on title/summary). Headlines and short summaries only; full articles are paywalled and not returned. Public feed, no key.

Reads a domain's BIMI record (default._bimi.<domain> TXT): whether it is published, the SVG logo URL (l=) and the certificate URL (a=, a VMC or CMC for mailbox providers). Checks the v=BIMI1 tag and that the URLs are https. It does not download the logo or validate the certificate.

Checks an IPv4 address against the Blocklist.de 'all' list of IPs reported for attacks such as failed logins, SSH and mail abuse (about 24,000 addresses). A hit means it was reported recently; the list keeps only current reports.

For a domain's current certificate (taken from public Certificate Transparency data via CertSpotter): reads its CRL Distribution Point, downloads that public CRL, and reports whether the certificate's serial number is on it, plus the CRL's thisUpdate and nextUpdate. OCSP is not queried. Revocation status is as of the CRL's publication time.

Checks an IPv4 address against the CI Army (CINS Score) bad-IP list, a collective-intelligence list of addresses that recently showed hostile activity across a sensor network (about 15,000 entries). Listed means it is on the current list; the list is a snapshot.

Reads a site's public crossdomain.xml (Adobe Flash) and clientaccesspolicy.xml (Silverlight) if they exist, lists the origins they allow, and flags wildcard grants ('*'). Old policies are rarely needed now, so a wildcard here mostly means leftovers; absence is the normal case.

Subdomain names found in public Certificate Transparency logs for a domain (via CertSpotter): unique host names and wildcard names, issuers, latest issue date and how many listed certificates are still valid. Returns the first page only (up to 100 certificates) and lists at most 100 names; wildcard names are shown as *.domain.

Reads the Content-Security-Policy header of a site's home page and lists weak points: 'unsafe-inline' and 'unsafe-eval' in script sources, bare wildcards, data: or http: script sources, a missing default-src or script-src, and a missing policy altogether. Reports directives. Header only; a CSP in a meta tag is not read.

Vulnerability trend for a vendor (optionally one product) from the NIST NVD: CVEs published in the last N days (default 7, up to 120; a big vendor over a long window can take NVD 30+ seconds) naming the vendor (or mapped to its CPE with match=cpe), counts by severity, average and maximum CVSS score, CVEs per week, top CWE weaknesses and the highest-scored CVEs with score, severity, vector, date an

Maps an IPv4 address to its origin AS number, the BGP prefix that covers it, the country, the registry and the allocation date, using Team Cymru's public IP-to-ASN DNS service. Returns no origin when Cymru has no mapping for the address.

Reads the DKIM public key published at <selector>._domainkey.<domain>: key type, whether it is revoked (empty p=), decoded key size in bytes and a strength hint (about 1024-bit vs 2048-bit RSA), and basic syntax (v=DKIM1). Follows one CNAME, which large providers use. Does not check a signed message.

Lists the CAA (Certification Authority Authorization) records published on a domain: which CAs may issue certificates (issue), wildcard certificates (issuewild) and the incident-report address (iodef). Shows the records on the exact name only; CAA is inherited from parent domains when a name has none, which this tool does not walk.

EPSS (Exploit Prediction Scoring System) for one CVE from FIRST's public API: the estimated probability (0 to 1) of exploitation in the next 30 days, its percentile among all scored CVEs and the scoring date. EPSS predicts; it does not say an exploit exists (see cisa-known-exploits).

IPv4 or IPv6 address → covering BGP prefix, origin AS number and holder name, whether the prefix is announced, and a coarse country and map point, all from RIPEstat. Location is an estimate (a block-level database), not a street address; the city is often empty.

Checks an IPv4 address against IPsum, an aggregate of public blocklists: returns the number of source feeds that list it (its level, 1 to 8) and whether it is listed at all. A higher level means more feeds agree. Not listed means none of the aggregated feeds list it.

Decodes a JWT you supply (header and payload, base64url JSON) and reports its algorithm, key id, claims, and time checks (exp, nbf, iat). Flags alg none, symmetric HS algorithms, missing exp and a jku/x5u key reference. It does not verify the signature, because no key is given, and it does not fetch the key URL.

Looks up a file hash (SHA-256, SHA-1 or MD5) in abuse.ch MalwareBazaar: whether the sample is known, its other hashes, file name, type, size, signature (malware family), first/last seen, reporter, origin country, delivery method, tags, download count and code-signing info. Metadata only; the sample itself is never downloaded.

Looks up one MITRE ATT&CK technique (e.g. T1059 or T1059.001) on its official public page: its name, the tactic-level summary text and the page title. Reads one page per call; it does not return the whole matrix or a technique's sub-techniques list.

Checks MTA-STS for a mail domain: the _mta-sts TXT record (v=STSv1 and id) and the HTTPS policy file (mode enforce, testing or none, the MX patterns and max_age). Reports whether the record and the policy are both present and whether the policy's version is valid. Does not test the mail servers themselves.

For a mail domain: lists up to 3 MX hosts with their IPv4 addresses and, from Shodan's pre-collected passive scan data, which SMTP ports (25, 465, 587) were seen open on each address. Passive and possibly old; no SMTP conversation, banner, STARTTLS or certificate test is made.

Reports whether Shodan's pre-collected passive scan data shows NTP (port 123) seen open on an IPv4 address. Passive and possibly old; the monlist amplification check itself is not run, so this cannot say whether monlist is enabled.