check_agent_discovery

shallow

com.blackveilsecurity/dns · Verify this server

Assess the security posture of IETF BANDAID agent-discovery records (draft-mozleywilliams-dnsop-dnsaid). Detects SVCB agent records under _agents/_index._{protocol}._agents, reports whether the discovery zone is DNSSEC-anchored (unsigned = spoofable agent endpoints), evaluates DANE/TLSA binding trust (RFC 6698 §10.1), and checks capability-document integrity (cap / cap-sha256). Read-only; uses Private-Use SVCB param code points pending IANA assignment.

No longer in the registry. The MCP registry stopped listing this server as of 31 Aug 2026. This report card stays available because the measurement was real, but the tool is excluded from search, rankings, and Vouch’s corpus counts. A published behaviour score is never recomputed or removed — it reflects what was measured while the server was listed.

100.0/100

1 trials · measured 8 days ago

check_agent_discovery scores 100.0/100 on Vouch's measured behaviour index, from 1 real invocation trials against com.blackveilsecurity/dns, measured 25 Aug 2026 under methodology v0.2.0. Every measured component scored 100.

Component breakdown

ComponentWeightValue
Reliability35%not applicable
Schema integrity25%100.0
Failure behaviour15%not applicable
Latency15%not applicable
Concurrency10%not applicable

Tool details

Transport
remote + stdio
Credential class
open
Category
Communication
Input schema
declared
Output schema
declared
Side-effect classification
unclassified
Declared input schema
{
  "type": "object",
  "required": [
    "domain"
  ],
  "properties": {
    "name": {
      "type": "string",
      "maxLength": 63,
      "minLength": 1,
      "description": "Resolve a single named agent ({name}.{domain}) instead of enumerating the zone."
    },
    "domain": {
      "type": "string",
      "maxLength": 253,
      "minLength": 1,
      "description": "Domain to check for published agent-discovery records (e.g., example.com)."
    },
    "format": {
      "enum": [
        "full",
        "compact"
      ],
      "type": "string",
      "description": "Output verbosity. Auto-detected if omitted."
    },
    "protocol": {
      "enum": [
        "a2a",
        "mcp",
        "https"
      ],
      "type": "string",
      "description": "Scope discovery to a single agent protocol index (_index._{protocol}._agents). Omit to sweep the zone."
    },
    "verify_cap": {
      "type": "boolean",
      "description": "Fetch each declared capability document (cap=) over HTTPS via safeFetch and verify it against the cap-sha256 integrity pin. Default false (declaration/existence check only)."
    },
    "force_refresh": {
      "type": "boolean",
      "description": "Bypass cache and run a fresh check. Useful after DNS changes."
    }
  }
}

Score history

DayScoreTierMethodology
2026-08-25100.0shallowv0.2.0
2026-08-2436.9deepv0.1.0

Probe evidence

ProbeOutcomes
schema_integritypass: 1
reliabilitytimeout: 1, fail: 10, error: 9
malformed_inputerror: 4
timeout_honourskipped: 2
cancellationpass: 2
determinismerror: 4
concurrencyerror: 20

Raw request/response logs are not archived yet — the outcome counts above are drawn directly from every recorded trial.

Embed this score

Available for every tool, scored or not — not a verification perk. Always links back to this page.

Vouch score: check_agent_discovery
[![Vouch score](https://vouch.tools/api/tools/d6ead638-7a2f-4188-84f6-b0a3b8522bd4/badge.svg)](https://vouch.tools/tools/d6ead638-7a2f-4188-84f6-b0a3b8522bd4)
check_agent_discovery — Vouch