Domain intel

Full domain security and SEO intelligence in one call: WHOIS, DNS, TLS cert, HTTP headers, tech stack, robots policy, and certificate transparency.

When to use this pack

Evaluating a domain for acquisition, investigating a phishing site, auditing a competitor's infrastructure, or preparing a security review - one call gives you the complete external footprint.

Tools in this pack

All 6 run inside the single $0.016 call above. Each is also callable on its own if you only need one part.

• Domain WHOIS (RDAP) POST /api/whois Domain registration data via RDAP (the structured WHOIS successor): registrar, creation/expiry dates, status, nameservers.
• DNS lookup POST /api/dns-lookup Resolve any DNS record type for a host: A, AAAA, MX, TXT, CNAME, NS, SOA, CAA, SRV, PTR. Returns the records plus a count. Built on Node's native resolver - no external API.
• TLS certificate POST /api/tls-cert Inspect the TLS certificate of any public host: subject, issuer, validity window, days remaining, SANs, and SHA-256 fingerprint.
• HTTP headers + security analysis POST /api/http-headers Fetch a URL and return every response header plus a security analysis: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP/CORP/COEP. Scores 0–100 by presence, flags weak HSTS, and warns on Server/X-Powered-By identity leaks. SSRF-protected.
• Tech stack detection POST /api/tech-stack Detect the technology stack of a public website: CDN, web server, language/runtime, frontend framework (Next.js, Nuxt, SvelteKit, Remix, Astro, React, Vue, Angular), CMS (WordPress, Drupal, Ghost, Shopify, Wix, Squarespace, Webflow), analytics (GA, GTM, PostHog, Mixpanel, Segment, Hotjar, Plausible, Fathom), and payments (Stripe, PayPal). Signature-based; no third-party API.
• Robots.txt check POST /api/robots-check Fetch a site's robots.txt and answer: may this user-agent crawl this path? Returns the matched rule and all declared sitemaps.

Bought one at a time, these 6 tools cost $0.017 together; the pack is that sum less a 10% bundle discount, rounded up to the $0.001 settlement floor, which is $0.016.

Workflow

1. Pull WHOIS records - registrar, creation date, expiry, registrant (often privacy-shielded but the age alone is a signal).
2. Resolve DNS A records to identify the hosting provider and detect CDN fronting.
3. Inspect the live TLS certificate - issuer, expiry, SANs, and chain validity.
4. Fetch HTTP response headers - security posture (HSTS, CSP, XFO), caching, and server fingerprint.
5. Fingerprint the tech stack - CMS, framework, CDN, analytics, and third-party scripts.
6. Check robots.txt for crawl directives - reveals hidden paths and bot policies.

Arguments

What one call returns

A JSON object with pack, args, steps, summary; steps holds one entry per tool (whois, dns-lookup, tls-cert, http-headers, tech-stack, robots-check), each with its own result or error. Full example on the API page.

Call it directly

Any x402 client pays the 402 and gets the whole workflow back in one response. With the agent402-client SDK (npm i agent402-client, an ES module):

import { Agent402 } from "agent402-client";
// payFetch: an x402-wrapped fetch your wallet signs (@x402/fetch).
// Tools on the free tier need no options: new Agent402() pays them by proof-of-work.
// an existing prepaid credits key also works: new Agent402({ creditsKey })
const client = new Agent402({ fetch: payFetch });
const result = await client.call("skill-domain-intel", {"domain":"stripe.com"});

Run it in Claude

claude mcp add agent402 -s user -- npx -y agent402-mcp@latest

Then paste this prompt into Claude:

Run a full domain intelligence report on stripe.com using Agent402's domain-intel skill pack: (1) WHOIS - age, registrar, expiry. (2) DNS A records - hosting/CDN. (3) TLS cert - issuer, expiry, SANs. (4) HTTP headers - security headers score. (5) Tech stack - frameworks, CDN, analytics. (6) robots.txt - hidden paths. Output a structured report with a risk summary.

← All skill packs