plugin.json

{
  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
  "name": "dechonet",
  "version": "1.0.0",
  "description": "Security checks for domains, links and IP addresses from public data: DNS, TLS certificates, HTTP security headers, email authentication, registration data, phishing links and exposure.",
  "author": {
    "name": "DechoNet",
    "email": "support@dechonet.com",
    "url": "https://dechonet.com"
  },
  "homepage": "https://dechonet.com/mcp",
  "repository": "https://github.com/node-man/dechonet-mcp",
  "license": "MIT",
  "keywords": [
    "security",
    "domain",
    "phishing",
    "dns",
    "ssl",
    "email",
    "dmarc",
    "recon"
  ],
  "extensions": {
    "com.openai": {
      "interface": {
        "displayName": "DechoNet",
        "shortDescription": "Domain & phishing link checks",
        "longDescription": "DechoNet checks domains, links and pages from the outside, using only public information, and explains what it finds. Seen. Remembered. Signed.\n\nWhat you can ask:\n- An overall security score and grade for a domain, with the fixes that matter most (DNS, TLS certificate, HTTP security headers, email authentication, registration data, network) \u2014 passive, public lookups only.\n- Whether a page is fine to log in, pay, submit a form or download on: phishing signals, where card fields are hosted, and hidden text addressed to AI agents. Every answer lists what was not checked.\n- Whether a link from a text message or email shows phishing signals: redirects and shorteners are followed to the real destination, which is compared with the brand it imitates.\n- What should stay true about your domain (HTTPS works, a header is present, DMARC policy, certificate days left), confirmed from the outside now and every day, with where to fix what does not hold.\n- A single check for any one area: DNS and propagation, certificate and TLS, email authentication, response headers, registration, network, subdomains, look-alike domains.\n- What changed on a domain since DechoNet last looked, and reporting a page or MCP server that looks malicious so DechoNet checks it itself.\n\nDomain, host and IP results come with a signed observation record that anyone can verify against DechoNet's public key.\n\nWho it is for: site owners, developers, IT and security staff, people building AI agents, and anyone who received a suspicious link.\n\nLimits: DechoNet reads public data only. Ports are checked only on request. It does not log in, guess passwords or test applications from the inside, so it cannot find application-level vulnerabilities. A result without warning signs is not a guarantee; it is a snapshot at the time shown. A report alone never changes a verdict. Tools that save something (monitoring, expectations, reports) are marked as such in their annotations; all others only read.",
        "developerName": "DechoNet",
        "category": "Developer Tools",
        "capabilities": [
          "Domain security score",
          "Check before login or payment",
          "Phishing link check",
          "Outside verification of expectations",
          "DNS and email authentication",
          "TLS certificate check",
          "HTTP security headers",
          "Domain change history"
        ],
        "websiteURL": "https://dechonet.com/mcp",
        "supportURL": "https://dechonet.com/help",
        "privacyPolicyURL": "https://dechonet.com/privacy",
        "termsOfServiceURL": "https://dechonet.com/terms",
        "defaultPrompt": [
          "Run a full security check of github.com and list the top fixes.",
          "Is it fine to log in on https://login.microsoftonline.com? Check it before I do.",
          "Does this link from a text message show phishing signals? https://bit.ly/example"
        ],
        "brandColor": "#E01E1E",
        "brandColorDark": "#FF5A5A",
        "composerIcon": "./assets/icon.png",
        "logo": "./assets/logo.png"
      },
      "review": {
        "test_cases": {
          "positive": [
            {
              "description": "Overall security check of a domain",
              "prompt": "Run a full security check of github.com and tell me the top fixes.",
              "tools_triggered": "security_scan",
              "expected_behavior": "Returns a 0-100 health score and A-F grade for github.com, a per-area breakdown (DNS, SSL, HTTP, email, propagation, RDAP, reverse DNS, ASN; ports are not scanned in this passive check), a short list of recommended fixes and a link to the full report on dechonet.com."
            },
            {
              "description": "Phishing check of a link",
              "prompt": "I got a text with this link: https://login.microsoftonline.com \u2014 is it a phishing link?",
              "tools_triggered": "phishing_link_check",
              "expected_behavior": "Follows the link, recognises login.microsoftonline.com as the brand's official domain and reports no phishing signals, without calling the site safe."
            },
            {
              "description": "Expired certificate",
              "prompt": "Check the SSL certificate of expired.badssl.com.",
              "tools_triggered": "ssl_check",
              "expected_behavior": "Reports that the certificate has expired (critical), plus the TLS findings (no HSTS, legacy TLS versions accepted) and how to fix them."
            },
            {
              "description": "Email authentication",
              "prompt": "Are SPF, DKIM and DMARC set up for gmail.com?",
              "tools_triggered": "email_auth",
              "expected_behavior": "Shows the MX, SPF, DKIM and DMARC findings for gmail.com (SPF and DKIM found, DMARC policy none) with a score and what each finding means."
            },
            {
              "description": "HTTP security headers",
              "prompt": "Which HTTP security headers is github.com missing?",
              "tools_triggered": "http_security",
              "expected_behavior": "Lists the security headers github.com sends and the ones it lacks (for example Permissions-Policy, Cross-Origin-Opener-Policy), with a header grade."
            }
          ],
          "negative": [
            {
              "description": "Attack request (credential guessing)",
              "prompt": "Try the default admin passwords on the login page of example-shop.com."
            },
            {
              "description": "Purchase or registration",
              "prompt": "Register the domain my-new-shop.com for me and pay for it."
            },
            {
              "description": "Identifying a private person",
              "prompt": "Find the home address and phone number of the person who owns this domain."
            }
          ]
        },
        "demo_recording_url": "https://youtu.be/kCRXemXax7k",
        "commerce": false,
        "commerce_description": "DechoNet does not sell products or process payments in ChatGPT."
      },
      "publication": {
        "release_notes": "Checks for domains, links and IP addresses from public data, a check before logging in or paying on a page, outside verification of what should stay true about a domain, page reports, and signed observation records.",
        "translations": {
          "ko-KR": {
            "subtitle": "\ub3c4\uba54\uc778\u00b7\ud53c\uc2f1 \ub9c1\ud06c \uc810\uac80",
            "description": "\uacf5\uac1c\ub41c \uc815\ubcf4\ub9cc\uc73c\ub85c \ub3c4\uba54\uc778\u00b7\ub9c1\ud06c\u00b7\ud398\uc774\uc9c0\ub97c \uc678\ubd80\uc5d0\uc11c \uc810\uac80\ud558\uace0 \uacb0\uacfc\ub97c \ud480\uc5b4\uc11c \uc124\uba85\ud569\ub2c8\ub2e4.\n\n- \ub3c4\uba54\uc778 \uc885\ud569 \ubcf4\uc548 \uc810\uc218\uc640 \ub4f1\uae09, \uc6b0\uc120 \uc870\uce58\ud560 \ud56d\ubaa9(DNS\u00b7\uc778\uc99d\uc11c\u00b7HTTP \ubcf4\uc548 \ud5e4\ub354\u00b7\uc774\uba54\uc77c \uc778\uc99d\u00b7\ub4f1\ub85d \uc815\ubcf4\u00b7\ub124\ud2b8\uc6cc\ud06c \u2014 \uacf5\uac1c \uc870\ud68c\ub9cc)\n- \ub85c\uadf8\uc778\u00b7\uacb0\uc81c\u00b7\uc81c\ucd9c\u00b7\ub2e4\uc6b4\ub85c\ub4dc \uc804 \ud398\uc774\uc9c0 \ud655\uc778: \ud53c\uc2f1 \uc2e0\ud638, \uce74\ub4dc \uc785\ub825\uce78\uc758 \uc704\uce58, AI \uc5d0\uc774\uc804\ud2b8\ub97c \uaca8\ub0e5\ud55c \uc228\uc740 \uc9c0\uc2dc\ubb38. \ud655\uc778\ud558\uc9c0 \ubabb\ud55c \ud56d\ubaa9\ub3c4 \ud568\uaed8 \uc54c\ub9bd\ub2c8\ub2e4\n- \ubb38\uc790\u00b7\uba54\uc77c\ub85c \ubc1b\uc740 \ub9c1\ud06c\uc758 \ud53c\uc2f1 \uc2e0\ud638: \ub9ac\ub2e4\uc774\ub809\ud2b8\uc640 \ub2e8\ucd95 \uc8fc\uc18c\ub97c \ub05d\uae4c\uc9c0 \ub530\ub77c\uac00 \uc0ac\uce6d \ube0c\ub79c\ub4dc\uc640 \uc2e4\uc81c \ub3c4\uba54\uc778\uc744 \ube44\uad50\ud569\ub2c8\ub2e4\n- \uc678\ubd80 \uac80\uc99d: HTTPS \uc751\ub2f5\u00b7\ud5e4\ub354\u00b7DMARC \uc815\ucc45\u00b7\uc778\uc99d\uc11c \ub0a8\uc740 \uae30\uac04\ucc98\ub7fc \uc720\uc9c0\ub418\uc5b4\uc57c \ud560 \ud56d\ubaa9\uc744 \uc9c0\uae08, \uadf8\ub9ac\uace0 \ub9e4\uc77c \uc678\ubd80\uc5d0\uc11c \ud655\uc778\ud558\uace0 \ubbf8\ucda9\uc871 \ud56d\ubaa9\uc758 \uc870\uce58 \ubc29\ubc95\uc744 \uc54c\ub9bd\ub2c8\ub2e4\n- DNS\u00b7\uc804\ud30c\u00b7\uc778\uc99d\uc11c\u00b7\uc774\uba54\uc77c \uc778\uc99d\u00b7\uc751\ub2f5 \ud5e4\ub354\u00b7\ub4f1\ub85d \uc815\ubcf4\u00b7\ub124\ud2b8\uc6cc\ud06c\u00b7\uc11c\ube0c\ub3c4\uba54\uc778\u00b7\uc720\uc0ac \ub3c4\uba54\uc778 \uac1c\ubcc4 \uc810\uac80\n- \uc9c0\ub09c\ubc88 \uc774\ud6c4 \ubc14\ub010 \uc810, \uc545\uc131\uc73c\ub85c \ubcf4\uc774\ub294 \ud398\uc774\uc9c0\u00b7MCP \uc11c\ubc84 \uc81c\ubcf4\n\n\ub3c4\uba54\uc778\u00b7\ud638\uc2a4\ud2b8\u00b7IP \uacb0\uacfc\uc5d0\ub294 DechoNet \uacf5\uac1c \ud0a4\ub85c \uac80\uc99d\ud560 \uc218 \uc788\ub294 \uc11c\uba85\ub41c \uad00\uce21 \uae30\ub85d\uc774 \ubd99\uc2b5\ub2c8\ub2e4.\n\n\ud55c\uacc4: \uacf5\uac1c \uc815\ubcf4\ub9cc \uc77d\uc2b5\ub2c8\ub2e4. \ub85c\uadf8\uc778\u00b7\ube44\ubc00\ubc88\ud638 \ub300\uc785\u00b7\ub0b4\ubd80 \uc2dc\ud5d8\uc740 \ud558\uc9c0 \uc54a\uc544 \uc571 \ub0b4\ubd80 \ucde8\uc57d\uc810\uc740 \ucc3e\uc9c0 \ubabb\ud569\ub2c8\ub2e4. \uacbd\uace0 \uc2e0\ud638\uac00 \uc5c6\ub2e4\ub294 \uacb0\uacfc\ub294 \ubcf4\uc99d\uc774 \uc544\ub2c8\ub77c \ud655\uc778\ud55c \uc2dc\uc810\uc758 \uad00\uce21\uc785\ub2c8\ub2e4."
          }
        }
      },
      "apps": "./.app.json"
    }
  }
}