Home / Servers / Web and Network
Web and Network MCP server
See any site from the outside: DNS, headers, feeds, sitemaps.
Resolve DNS, inspect HTTP headers and security grades, extract page metadata and links, read feeds and sitemaps, check robots.txt, and look up domain and IP registration and certificate logs. Every URL passes the same SSRF rules as Fetch.
Why use the hosted one: Requests leave from Cloudflare, redirects are re-checked hop by hop, and robots.txt is honoured, so your assistant can audit sites without a scraper.
Connect
claude mcp add --transport http hj-web https://mcp.hjlabs.in/mcp/web \
--header "Authorization: Bearer YOUR_API_KEY"Create an API key and put it in place of YOUR_API_KEY. Step-by-step guides: claude.ai and ChatGPT connectors, Claude Code, Cursor, VS Code, Claude Desktop, Windsurf, Zed, OpenAI Codex CLI, Gemini CLI.
All 22 tools
| Tool | What it does |
|---|---|
dns_lookup | Resolve DNS records for a name over Cloudflare DNS-over-HTTPS. Types: A, AAAA, MX, TXT, NS, CNAME, SOA, CAA, SRV, PTR, or "all" for the common set. Returns each record with its TTL and whether the answer was DNSSEC-va… |
reverse_dns | Find the hostname (PTR record) for an IPv4 or IPv6 address, via DNS-over-HTTPS. Many addresses have no PTR; the result says so. |
http_headers | Fetch a URL and report its HTTP status, final URL after redirects, the redirect chain, response headers, server, content type, size and response time. Does not return the body. Use it to debug redirects, caching heade… |
url_status | Check up to 20 URLs at once and report each one's HTTP status, final URL and response time, or the connection error. Use it to find broken links or confirm a deploy. Private addresses are refused. |
security_headers_check | Grade a site's HTTP security headers (HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, plus leaks like Server and X-Powered-By) with an A–F grade and a concr… |
page_metadata | Fetch a web page and extract its SEO and social metadata: title, meta description, canonical URL, robots meta, language, charset, Open Graph and Twitter Card tags, JSON-LD schema types, hreflang alternates, favicon, f… |
extract_links | Fetch a web page and list the links on it, split into internal and external, with anchor text and rel=nofollow flags, plus counts. Honours robots.txt. Up to 500 links. |
read_feed | Read an RSS, Atom, RDF or JSON feed and return its title and latest items (title, link, date, author, summary, categories). Pass the feed URL; use discover_feeds if you only have the site URL. |
discover_feeds | Find the RSS/Atom/JSON feeds a website advertises: reads the page's <link rel="alternate"> tags and probes the usual paths (/feed, /rss, /atom.xml, /feed.xml, /index.xml, /rss.xml). Returns feed URLs with their type a… |
read_sitemap | Read an XML sitemap or sitemap index and return its URLs with lastmod dates and a count. For a sitemap index, lists the child sitemaps (set follow=true to read the first few children too). Handles gzip-less XML and pl… |
robots_check | Fetch a site's robots.txt and say whether a given path may be crawled by a given user agent (longest-match rules, RFC 9309), plus the sitemaps it declares and the user-agent groups it defines. Use it before scraping, … |
rdap_domain | Look up a domain's registration (the modern WHOIS, via RDAP): registrar, status codes, creation/expiry/last-changed dates, age in days, days until expiry, nameservers and DNSSEC. Use it to check who owns a domain, whe… |
rdap_ip | Look up who an IPv4 or IPv6 address is allocated to (via RDAP): the network name, CIDR range, the regional registry, country and the organisation. Use it to see which cloud or ISP an address belongs to. |
certificate_log | List TLS certificates issued for a domain from Certificate Transparency logs (Cert Spotter): issuer, validity dates, and every DNS name each certificate covers, including subdomains. Use it to discover subdomains or c… |
email_validate | Check an email address: syntax (RFC 5322-ish), whether the domain has MX (or fallback A) records so it can receive mail, and flags for disposable-style or role addresses. It does not contact the mail server, so it can… |
url_parse | Break a URL into scheme, host, port, path, query parameters (as an object and a list), fragment, and show the punycode and Unicode forms of the host. Pure, no network. |
url_build | Build or normalise a URL: start from a base URL, optionally resolve a relative path against it, set/remove query parameters, strip tracking parameters (utm_*, fbclid, gclid...), lower-case the host, drop the fragment … |
ip_inspect | Inspect an IP address without any network call: version, whether it is private/loopback/link-local/multicast/reserved (and which RFC range), its integer form, expanded IPv6 form, reverse-DNS name, and for IPv4 the cla… |
mime_lookup | Look up the MIME type for a file extension (e.g. "webp" → image/webp) or the usual extensions for a MIME type (e.g. "application/json" → json). Pure table lookup covering about 120 common types. |
http_status_explain | Explain an HTTP status code: its standard name, what it means and what to do about it. Covers 1xx–5xx including WebDAV and Cloudflare 52x codes. Pass "all" to list every code. |
user_agent_parse | Parse a browser User-Agent string into browser and version, operating system and version, device type (desktop, mobile, tablet, tv, bot), rendering engine and whether it looks like a bot. Best-effort, pure, no network. |
well_known_port | What service usually runs on a TCP/UDP port number (e.g. 5432 → PostgreSQL), or which port a named service uses (e.g. "redis" → 6379). Pure table of about 130 common ports. |
Try asking
Check the security headers and SEO metadata of https://example.com and tell me what to fix.
Usage and limits
Every account gets a free daily allowance of tool calls; connecting, listing and searching are not counted. See the limits. Only a tool that runs costs a call.