bots.st/orioncmd-checks
OrionCMD Checks
Domain threat, TLS/DNS and email-auth checks
2069 ms
answered our call
- State
- Answered
- Protocol
- MCP 2025-06-18
- Tools listed
- 14
- Answered
- 3 of the last 3 calls
How to reach it
- MCP, HTTP
https://api.orioncmd.com/mcp
What it can do
| Tool | What it says it does |
|---|---|
bulk_threat_check | Check up to 100 domains or IPv4 addresses at once against ThreatCluster's high-confidence 30-day IOC feed; each domain is resolved and its IPv4 matched too. IOC only (no ransomware-claim lookups; use threat_check for one domain). Stale feed returns an error and is not charged. Costs $0.50 USDC per… |
check_cert | Check the TLS certificate of one hostname: issuer, validity dates, days left, % of lifetime used, renewal cadence and a renewal-stall flag, plus a live HTTPS pass/fail probe. Use it when you only need certificate health; use site_health for cert + DNS + expiry together, or domain_grade for a… |
check_dns | Look up the live DNS of a domain: NS, A/AAAA/CNAME, MX, SPF, DMARC, CAA (climbing to the parent zone) and DNSSEC status, with plain-English findings. Use it for a DNS inventory or to debug resolution; use check_email_auth for a deeper SPF/DMARC/DKIM/MTA-STS review. Queries Cloudflare… |
check_domain_expiry | Check when a domain registration expires: registrar, registered and expiry dates, days left, EPP status codes and nameservers, from the registry's RDAP server. Use it for renewal risk on the registered domain (not the certificate; use check_cert for that). Some TLDs publish no RDAP service, in… |
check_email_auth | Review the email authentication setup of a domain: SPF validity and DNS-lookup count (limit 10), DMARC policy, pct and reporting, DKIM on common selector names, MTA-STS mode, TLS-RPT and BIMI, with a rough 0-100 score and plain-English fixes. Use it before sending mail from a domain or when mail… |
check_security_headers | Check the HTTP security headers of a website with one live HTTPS GET: redirect chain (up to 5 hops), final status, HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and COOP, with a simple A-F header grade and findings. Use it for web-hardening checks; it is… |
domain_grade | Grade a domain's security posture A-F in one call, for vendor-risk or due-diligence checks. Runs the TLS, DNS (DNSSEC, CAA), registration-expiry, email-auth and HTTP-header checks and returns one letter, a 0-100 score, points per category (TLS 25, email 25, headers 20, DNS 15, registration 15) and… |
expiry_batch | Certificate and domain-registration expiry for 2 to 5 domains in one call: days left, expiry dates and an ok/warn/expired status per domain, plus the soonest date overall. Certificate dates come from CT logs, registration dates from RDAP. Partial results if some lookups fail; if every domain fails… |
full_site_audit | Full site audit report for one domain, for client reports, vendor reviews or a pre-launch check. Runs every check (TLS from CT logs + live probe, DNS/DNSSEC/CAA, registration expiry and transfer lock, SPF/DMARC/DKIM/MTA-STS, security headers) plus HTTP->HTTPS redirect, www/apex consistency, RFC… |
pricing | Free. Return the price of every paid tool, the payment network (Base) and the receiving address, so you can budget before calling. No input, no network request, no payment. |
site_health | Run check_cert, check_dns and check_domain_expiry together and return their raw results plus a short summary, the renewal-stall flag and the Let's Encrypt 64-day certificate note (from 2027-02-10). Use it for a full data dump in one call; use domain_grade if you want a single scored A-F answer… |
threat_check | Is this domain known-bad? Resolves the hostname (A/AAAA), matches the name, its parent domains and resolved IPv4 against ThreatCluster's high-confidence 30-day IOC feed (cached, refreshed about hourly), and looks up ransomware leak-site claims naming the domain (commercially reusable sources via… |
validate_target | Free. Check that a domain or URL is well-formed and get the normalized hostname, before calling a paid check. Offline: no network request, no payment. Rejects IP addresses, single-label names and URLs with credentials. |
watch_status | Free. Status of a paid domain watch (created with HTTP POST /v1/watch): items, expiry, last check, current DNS/IOC/claim state, last webhook delivery. Needs the webhook_secret from creation. |
In its maker's words
Domain threat checks, a 30-day domain watch, TLS/DNS/email-auth checks and a $2 site audit (x402).
- Website
- api.orioncmd.com/llms.txt
- Publisher
- api.orioncmd.com
- Listed from
- the official MCP Registry as
com.orioncmd.api/checks - Version
- 1.5.0, updated 17 Oct 2026
- Kinds of work
- Security and trust, Domains and websites, Search and research
The domain it lives on
- orioncmd.com
- registered 9 Aug 2026 (3 months ago), at GoDaddy.com, LLC, its home page is a working site
From our own crawl of domain names: registry records and the home page as our crawler last saw it.
Every call we made
| When | What happened | Time |
|---|---|---|
| Answered | 2069 ms | |
| Answered | 1774 ms | |
| Answered | 1084 ms |
Next door
- paidforAssess an x402 seller before payment
- WhisperDNS-verifiable agent networking and control
- EchelonGraph CVE & ExposureCVE and internet exposure lookups
- RevClamp MCP ServerAudits payments, disputes, and VAT compliance
- APIEmpresas: Spanish company dataKYB checks using CIF, directors, sanctions, tenders, BORME
Is this your bot? Claim its address to add a verified badge and keep the listing current.