NEL VEIL MCP Server
Free domain security scanning for AI agents. Ask your agent whether a domain can be email-spoofed, and get a real answer in about ten seconds.
Seven tools. No port scanning, no exploit testing. No API key, no signup.
Install
Claude Code:
claude mcp add nel-veil -- npx -y nel-veil-mcpAny other MCP client:
{
"mcpServers": {
"nel-veil": {
"command": "npx",
"args": ["-y", "nel-veil-mcp"]
}
}
}Requires Node 18 or newer.
Tools
| Tool | Answers |
|---|---|
| check_email_spoofing | Can someone send email that appears to come from this domain? Checks DMARC, SPF and DKIM. |
| check_tls | Does this domain's TLS have known weaknesses? Returns the Qualys SSL Labs grade — note this one is not passive; see below. |
| check_security_headers | Does this site send the headers that protect visitors in the browser? CSP, HSTS and the rest. |
| check_exposed_files | Is this domain publicly serving files it should not be? |
| check_subdomain_takeover | Are there DNS records pointing at services someone else could claim? |
| scan_domain | Everything above at once, with a per-module score, plus a check for publicly reachable admin panels. |
| get_scan_report | Retrieve a scan already run on nelprofessional.com by its id. |
What this sends, stated plainly
Being precise here matters more than sounding safe, because this is the paragraph you rely on when deciding whether you may point a tool at someone else's domain.
No tool does port scanning or exploit testing. Those are genuinely intrusive, they need the domain owner's permission, and they are deliberately not exposed over MCP at all.
But “passive” is not the same as “invisible”, and some checks do more than read public records:
- check_tls is not passive.It queries Qualys SSL Labs, which performs its own active TLS assessment of the target from Qualys's infrastructure. NEL sends no probe itself, but running it does cause the target to be actively tested by a third party. It returns the SSL Labs grade and known problems — it does not report certificate expiry, issuer, or hostname validity.
- check_subdomain_takeover is not DNS-only. It resolves a small fixed list of common subdomain names and makes one HTTPS request to any that point at a known cloud host. It never claims or modifies anything.
- check_exposed_files requests a small fixed list of well-known paths (
.env,.git/config). It never brute-forces or fuzzes, but these are paths a crawler would not request. - scan_domain runs all of the above, and also checks whether common admin panels (
/phpmyadmin/,/manager/html) are publicly reachable.
All of it is information the domain publishes, and none of it attacks anything — but it is more than ordinary crawling and is recognisable in a target's logs as a security check. Prefer running it against a domain you own or are authorised to assess.
NEL VEIL does offer active scanning. It lives on the web app, where you prove you control the domain with a DNS TXT record first. Run a full scan on a domain you own →
Rate limits: ten single checks and three full scans per minute, per IP address. The package sends no API key, no email address and no account identifier — each request carries the domain you asked about and a nel-veil-mcp user-agent. As with any HTTP service, NEL sees the originating IP; that is what the rate limit is keyed on.
Frequently asked questions
What is the NEL VEIL MCP server?
NEL VEIL MCP is a free Model Context Protocol server that gives AI agents seven tools for checking a domain's public security posture: email spoofing (DMARC/SPF/DKIM), TLS weaknesses via the Qualys SSL Labs grade, HTTP security headers, publicly exposed files, and subdomain-takeover risk. It installs with one command and needs no API key.
How do I install the NEL VEIL MCP server?
In Claude Code, run: claude mcp add nel-veil -- npx -y nel-veil-mcp. In any other MCP client, add a server entry with command npx and args -y and nel-veil-mcp. It requires Node 18 or newer.
Does it cost anything or need an API key?
No. Every tool is free and needs no API key, no signup and no account. The free tier is rate limited per IP address to ten single checks and three full scans per minute.
Is it safe to scan a domain I do not own?
There is no port scanning and no exploit testing, and nothing here attacks anything — every result is built from information the domain publishes. But it is more than ordinary crawling: check_exposed_files requests a fixed list of well-known paths such as .env, scan_domain also checks whether common admin panels are publicly reachable, check_subdomain_takeover resolves common subdomain names and makes an HTTPS request to those pointing at cloud hosts, and check_tls asks Qualys SSL Labs to run its own active TLS assessment of the target. That activity is recognisable in a target's logs as a security check, so prefer running it against a domain you own or are authorised to assess.
Can it do port scanning or penetration testing?
No, and that is deliberate. Active techniques send traffic a target would reasonably call intrusive, so they are not exposed through an open MCP server. NEL VEIL offers active scanning at nelprofessional.com, after you prove you control the domain with a DNS TXT record.
What does it check for email spoofing?
It reads the domain's published SPF, DKIM and DMARC records and reports whether DMARC exists, whether its policy actually blocks spoofed mail rather than only monitoring it, whether SPF is present and not overly permissive, and whether the records are valid.
The web app adds active modules — port exposure, API probing and proof-of-concept checks — once you have verified ownership, plus a remediation report you can hand to an engineer.