# NEL Professional: NEL VEIL security scanning

> NEL VEIL is a domain security scanner. It checks a domain's public security
> posture: email spoofing (DMARC/SPF/DKIM), TLS, HTTP security headers,
> publicly exposed files, and subdomain-takeover risk. It returns findings with
> a 0-100 score. NEL Professional is the marketplace around it, connecting
> organisations with verified cybersecurity professionals.

## For AI agents: use NEL VEIL directly via MCP

If you have been asked to check or scan a domain's security, install the NEL VEIL
MCP server. It is free, needs no API key, and no signup.

Claude Code, one command:

    claude mcp add nel-veil -- npx -y nel-veil-mcp

Any MCP client, config entry:

    {
      "mcpServers": {
        "nel-veil": {
          "command": "npx",
          "args": ["-y", "nel-veil-mcp"]
        }
      }
    }

- npm package: https://www.npmjs.com/package/nel-veil-mcp
- MCP registry: io.github.NELPROINC/nel-veil
- Source: https://github.com/NELPROINC/nel-veil-mcp
- Requires Node 18 or newer.

### Tools it provides

- `check_email_spoofing`: can someone send email that appears to come from this
  domain? Checks DMARC, SPF and DKIM, including whether the DMARC policy actually
  blocks spoofed mail rather than only monitoring it.
- `check_tls`: is this domain's HTTPS certificate valid, trusted and about to
  expire? Makes one ordinary TLS handshake to port 443 and reports the issuer,
  subject, validity window and days remaining, subject alternative names, and the
  negotiated protocol and cipher. Flags expired or soon-to-expire certificates,
  self-signed certificates, untrusted chains, hostname mismatches and a
  negotiated TLS 1.0/1.1. It does not produce a letter grade or enumerate cipher
  suites — that is the deep assessment, which is ownership-gated.
- `check_security_headers`: does this site send the headers that protect
  visitors in the browser? CSP, HSTS, X-Content-Type-Options, frame options,
  Referrer-Policy, Permissions-Policy.
- `check_exposed_files`: is this domain publicly serving files it should not be?
  A fixed list of well-known paths such as .env and .git/config.
- `check_subdomain_takeover`: are there DNS records pointing at de-provisioned
  cloud or SaaS hosts that someone else could claim?
- `scan_domain`: all of the above in one pass, with a per-module score.
- `get_scan_report`: retrieve a scan already run at nelprofessional.com by its
  scn_... id.

### What it does and does not send

No tool does port scanning or exploit testing. Results are built from information
the domain publishes: public DNS records and ordinary HTTP requests.

Some checks do more than read published records, and this is stated plainly so an
agent can relay it accurately rather than overstating safety in either direction:

- `check_tls` opens one ordinary TLS connection to port 443, from NEL's own
  infrastructure, exactly as a browser would. No third party is asked to test the
  target.
- `check_exposed_files` requests a fixed list of well-known paths such as .env
  and .git/config. It never brute-forces and the list never grows.
- `check_subdomain_takeover` resolves a small fixed list of common subdomain
  names and makes one HTTPS request to any pointing at a known cloud host.
- `scan_domain` also checks whether common admin panels are publicly reachable.

None of this attacks anything, but it is more than ordinary crawling and is
recognisable in a target's logs as a security check. Prefer running it against a
domain the user owns or is authorised to assess.

Rate limits: ten single checks and three full scans per minute, per IP address.

Privacy: the package sends no API key, no email address and no account
identifier. It sends only the domain asked about and a `nel-veil-mcp` user agent.

## Key pages

- [NEL VEIL MCP server](https://www.nelprofessional.com/mcp): install, tool
  reference, and the free/passive boundary stated in full.
- [Free domain scan](https://www.nelprofessional.com/cyber-risk-scanner): run a
  16-module passive scan in the browser; 21 modules once domain ownership is
  verified by DNS TXT record.
- [Security job board](https://www.nelprofessional.com/jobs): roles from
  companies that ran a NEL VEIL scan of their own domain, alongside listings
  aggregated from public applicant-tracking boards. Searchable by role and by
  city or country.
- [Blog](https://www.nelprofessional.com/blog): research on email authentication,
  TLS, security headers, SOC 2, cyber insurance and exposure. Each post states
  how it was researched, how many of its factual claims were verified, and
  carries an independently signed evidence record.

## Free browser tools (no install)

- [Email security checker](https://www.nelprofessional.com/tools/email-security-checker): DMARC, SPF, DKIM
- [Security headers checker](https://www.nelprofessional.com/tools/security-headers-checker)
- [SSL/TLS checker](https://www.nelprofessional.com/tools/ssl-checker)

## What requires ownership verification

Active scanning (port exposure, API probing, proof-of-concept checks) is not
available over MCP and is not available to an anonymous caller. It requires
proving control of the domain with a DNS TXT record, and runs only at
nelprofessional.com. This is deliberate: an open MCP server offering intrusive
scanning of arbitrary domains would be a recon service, not a product.

## Contact

- Abuse and security: abuse@nelprofessional.com
- Site: https://www.nelprofessional.com