Loading ToolBench
A domain tools suite exposing domain availability checking, WHOIS lookup, DNS resolution, SSL/TLS inspection, email authentication analysis, subdomain enumeration, security headers grading, redirect tracing, portfolio expiry checking, and IDN homograph detection. Available as an MCP server over stdio, HTTP endpoints, and CLI.
WebToolsHub presents 13 well-named, domain-focused tools with comprehensive descriptions (avg 180 chars, within baseline 194). All tools have explicit input schemas with typed properties and descriptions. Naming follows verb_noun convention (check_domain, whois_lookup, dns_lookup, ssl_check, email_auth, who_hosts, dns_propagation, find_subdomains, security_headers, trace_redirects, portfolio_expiry, idn_homograph). Descriptions are action-oriented and include use-case guidance. However, output schemas are not documented in the visible code, only input schemas are defined. Error handling is minimal (generic 500 errors in api/tool.py). No tool annotations (readOnlyHint, destructiveHint, idempotentHint) despite all tools being read-only. Parameter descriptions are present but some lack format/constraint details (e.g., 'domain' params don't specify TLD format rules). No pagination support documented for bulk operations.
Check whether a single domain name is available to register across one or more TLDs. Uses authoritative RDAP data with DNS cross-check. Returns each domain as available, taken, or unknown. .com and .in are prioritised and listed first.
Check many names at once across the given TLDs. Returns availability for every name and TLD combination. Ideal for comparing brand name options. .com and .in are prioritised.
Look up DNS records for a domain over DNS-over-HTTPS: A, AAAA, CNAME, MX, NS, TXT, SOA and CAA. Use this to find a domain's IP addresses, mail servers (MX), nameservers, TXT records (SPF, DKIM, verification), or CAA policy. Returns records grouped by type with TTLs.
Check DNS propagation for a record across several independent public resolvers (Google, Cloudflare, AdGuard, Quad9) at once and report whether they agree. Use after changing a DNS record to see if it has propagated everywhere.
Analyze a domain's email authentication: SPF, DMARC, DKIM (optional selector) and MX records. Returns each record parsed, a letter grade, and a list of issues such as a missing DMARC policy or a weak SPF 'all' qualifier. Use to check whether a domain can be spoofed or why its email fails delivery.
Output schemas not documented. LLMs cannot plan downstream tool calls or extract required fields without knowing response structure. Baseline: 100% of A+ tools document return types.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint). All 13 tools are read-only but this is not declared in schemas, forcing LLMs to infer safety from descriptions alone.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 63 | <=2025-11-25 | v2 |
Enumerate a domain's subdomains from public Certificate Transparency logs (crt.sh). Passive, no scanning. Use for recon, asset inventory, or finding forgotten subdomains.
Analyze an IDN (Internationalized Domain Name) for homograph attack risk. Decodes Punycode, checks for confusable characters, and flags lookalike domains that could be used for phishing. Use to spot spoofed domains.
Check when a portfolio of domains expires. Pass a comma-separated list and get back each domain's expiry date, days remaining, registrar, and a summary. Useful for renewal planning.
Fetch a URL and grade its HTTP security headers (HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy), flag information-leaking headers, and return a letter grade with fixes.
Inspect a website's SSL/TLS certificate. Connects to the host on port 443 and returns the issuer, common name, Subject Alternative Names, validity window, days remaining until expiry, the negotiated TLS version and cipher, and whether the certificate is currently valid for the host. Use this to check when a certificate expires or whether HTTPS is set up correctly.
Trace a URL's HTTP redirect chain hop by hop and report each status code and Location until the final destination. Use for SEO audits, link checking, or debugging redirect loops.
Find who hosts a domain. Resolves its IP addresses and looks each up in RDAP to reveal the hosting network, organization, ASN region and country, plus reverse DNS. Answers 'where is this site hosted / who runs it'.
Look up the full WHOIS registration record for a domain via RDAP: registrar (name, IANA id, abuse contact), creation / update / expiry dates, EPP status codes with plain-English meanings, nameservers, DNSSEC signing state, registry domain ID, and any contact fields the registry still publishes (most are GDPR redacted). Use this to find who a domain is registered with, when it expires, or whether it is locked. For a bare name with no dot, '.com' is assumed.
Error handling is generic and non-actionable. api/tool.py returns bare 500 errors with only exception type name (e.g., 'internal error', 'detail: type(e).__name__'). No recovery guidance or constraint violations explained. Baseline: errors should tell LLM what to do next.
Parameter format constraints not specified. 'domain' and 'target' params lack format rules (e.g., 'must be a valid domain name', 'must start with http:// or https://'). LLMs cannot validate input before calling.
No pagination or result-limiting documented for bulk operations. check_domains_bulk accepts unbounded 'names' array; no limit, offset, or total_count guidance. Large requests could exhaust context or timeout.