Feranor

An MCP server that runs a resilience check on any public domain and returns a scored report: TLS certificate, security headers, DNS redundancy, and response time, with every individual finding it was able to measure.

Built for agents that check domains repeatedly and unattended, not for a single manual look. For one manual check, use the free web version at feranor.com/check.

At a glance

• Endpoint

  https://www.feranor.com/mcp

• Transport

  Streamable HTTP

• Price

  $0.01 per call

• Payment

  x402, USDC on Base (eip155:8453)

• Signup

  None. No account, no API key, no dashboard.

• Free

  initialize, tools/list, and this page.

You do not create anything to use this server. You point a client at the URL, and the first paid call returns a payment challenge your x402-capable client settles automatically. If your client cannot pay, everything except the tool call still works.

Try it without paying

tools/list is free and needs no client setup. This is the fastest way to confirm the server is reachable and see the current catalogue:

curl -sS https://www.feranor.com/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Each tool carries its price in two places: in plain text at the end of its description, and machine-readable under _meta["x-x402"]. You can therefore budget a task before committing to any call.

Add it to your client

Claude Code

claude mcp add --transport http feranor https://www.feranor.com/mcp

Scoped to the current project by default. For every project:

claude mcp add --transport http --scope user feranor https://www.feranor.com/mcp

Confirm with claude mcp list, then /mcp inside a session.

Cursor

~/.cursor/mcp.json for all projects, or .cursor/mcp.json in a repository:

{
  "mcpServers": {
    "feranor": {
      "url": "https://www.feranor.com/mcp"
    }
  }
}

VS Code

.vscode/mcp.json in the workspace root. Note the root key is servers, not mcpServers, and type must be present:

{
  "servers": {
    "feranor": {
      "type": "http",
      "url": "https://www.feranor.com/mcp"
    }
  }
}

MCP tools are only available in Copilot Chat agent mode.

Shared with your team

.mcp.json at the repository root, committed to git:

Any other client

Point it at https://www.feranor.com/mcp over streamable HTTP. There is no authentication step, no OAuth flow, and no token to provision.

The tool

domain_check_v1

Price $0.01 per call.

Latency around 2 seconds median.

Input

{ "domain": "example.com" }

A bare domain. Scheme and path are ignored if present.

Output

A score plus the individual findings behind it, grouped by signal.

{
  "domain": "example.com",
  "score": 72,
  "checkedAt": "2026-07-28T09:14:22Z",
  "signals": [
    {
      "category": "tls",
      "status": "pass",
      "detail": "Valid certificate, 61 days before expiry, full chain served."
    },
    {
      "category": "headers",
      "status": "warn",
      "detail": "No Content-Security-Policy. Strict-Transport-Security present without preload."
    },
    {
      "category": "dns",
      "status": "fail",
      "detail": "Single authoritative nameserver. No redundancy."
    },
    {
      "category": "responseTime",
      "status": "pass",
      "detail": "312 ms to first byte from the EU probe."
    }
  ]
}

How the score works

The score is measured only on what could actually be read from outside. A signal that could not be observed is excluded from the denominator rather than counted as a failure. A domain behind a WAF that blocks the probe therefore gets a partial score over fewer signals, not a bad score. Check the number of signals returned before comparing two domains.

Everything is read from the public internet. Nothing is authenticated, nothing is intrusive, and no port scanning happens. The crawler identifies itself as FeranorBot and honours robots.txt. See the FeranorBot page to identify or block it.

Paying

The server uses x402: payment happens in the HTTP exchange itself, with no account in between.

The sequence, which an x402-capable client performs on its own:

1. Your client calls the tool with no payment attached.

2. The server answers 402 with the exact amount, asset, network, and recipient.

3. our client signs a USDC transfer authorization and repeats the call.

4. The server verifies, runs the check, settles, and returns the report.

Header conventions. Both are accepted on the way in, PAYMENT-SIGNATURE and X-PAYMENT, and both are emitted on the way out. If your x402 client library predates the v2 transport naming, it will still work.

Receipt. The settlement receipt comes back two ways: base64 in the PAYMENT-RESPONSE header for x402 clients, and in decoded short form under the result's _meta["x-x402-receipt"] for MCP clients that never see response headers. It carries the transaction hash, so you can reconcile spend on-chain.

What you are charged for. Only successful checks. If the tool itself fails, or if settlement does not complete, nothing is charged and no report is returned. Retrying a call with the same payment returns the report you already paid for rather than charging twice.

Errors

The status code tells you whose problem it is.

Common causes of a repeated 402:

• Wrong network.

  The offer is Base mainnet, eip155:8453. A payload signed for another chain is rejected.

• Amount below the offer.

  A signature over a smaller amount is a valid signature over the wrong amount. The error field states the expected atomic value.

• Wrong asset or recipient.

  Both are published in the challenge and in the server card.

• Authorization window expired.

  Sign a fresh one.

If you loop on 402 without a useful error, that is a bug on our side, please tell us.

Discovery

For registries, crawlers, and agents that resolve servers from a domain:

• Server card: https://www.feranor.com/.well-known/mcp.json
• Enumeration: https://www.feranor.com/.well-known/mcp
• Site catalogue: https://www.feranor.com/llms.txt

Contact

Questions, bug reports, or a check you wish existed: contact us.

Feranor is a distributed systems architecture and governance practice based in Lyon, France. About the practice.