@paulgit/mcp-dns-tools 2.2.0

package/dist/index.js

@@ -0,0 +1,1439 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+
+// src/cli.ts
+import { parseArgs } from "util";
+function parseCliArgs(args) {
+  const { values } = parseArgs({
+    args,
+    options: {
+      transport: {
+        type: "string",
+        default: "stdio"
+      }
+    },
+    strict: true
+  });
+  if (values.transport !== "stdio") {
+    throw new Error(
+      `Unsupported transport: ${values.transport}. Only stdio is supported.`
+    );
+  }
+  return { transport: "stdio" };
+}
+
+// src/dns.ts
+import dns2 from "dns/promises";
+import { setServers } from "dns";
+import net2 from "net";
+
+// src/registration.ts
+import dns from "dns/promises";
+import net from "net";
+import { domainToASCII } from "url";
+import { Agent, fetch as undiciFetch } from "undici";
+var RDAP_DNS_BOOTSTRAP = "https://data.iana.org/rdap/dns.json";
+var RDAP_IPV4_BOOTSTRAP = "https://data.iana.org/rdap/ipv4.json";
+var RDAP_IPV6_BOOTSTRAP = "https://data.iana.org/rdap/ipv6.json";
+var BOOTSTRAP_TTL_MS = 24 * 60 * 60 * 1e3;
+var REQUEST_TIMEOUT_MS = 1e4;
+var MAX_REDIRECTS = 3;
+var MAX_RDAP_BYTES = 1024 * 1024;
+var MAX_BOOTSTRAP_BYTES = 2 * 1024 * 1024;
+var MAX_WHOIS_BYTES = 1024 * 1024;
+var MAX_WHOIS_QUERIES = 3;
+var RegistrationLookupError = class extends Error {
+  constructor(message, kind, source, reason) {
+    super(message);
+    this.kind = kind;
+    this.source = source;
+    this.reason = reason;
+    this.name = "RegistrationLookupError";
+  }
+};
+var bootstrapCache = /* @__PURE__ */ new Map();
+var blockedAddresses = new net.BlockList();
+var syntheticHttpsProxyAddresses = new net.BlockList();
+syntheticHttpsProxyAddresses.addSubnet("198.18.0.0", 15, "ipv4");
+for (const [address, prefix] of [
+  ["0.0.0.0", 8],
+  ["10.0.0.0", 8],
+  ["100.64.0.0", 10],
+  ["127.0.0.0", 8],
+  ["169.254.0.0", 16],
+  ["172.16.0.0", 12],
+  ["192.0.0.0", 24],
+  ["192.0.2.0", 24],
+  ["192.168.0.0", 16],
+  ["198.18.0.0", 15],
+  ["198.51.100.0", 24],
+  ["203.0.113.0", 24],
+  ["224.0.0.0", 4],
+  ["240.0.0.0", 4]
+]) {
+  blockedAddresses.addSubnet(address, prefix, "ipv4");
+}
+for (const [address, prefix] of [
+  ["::", 128],
+  ["::1", 128],
+  ["64:ff9b:1::", 48],
+  ["100::", 64],
+  ["2001:db8::", 32],
+  ["fc00::", 7],
+  ["fe80::", 10],
+  ["fec0::", 10],
+  ["ff00::", 8]
+]) {
+  blockedAddresses.addSubnet(address, prefix, "ipv6");
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function stringValue(value) {
+  if (typeof value === "string" && value.trim()) return value.trim();
+  if (Array.isArray(value)) {
+    const values = value.map((entry) => stringValue(entry)).filter((entry) => entry !== void 0);
+    return values.length > 0 ? values.join(", ") : void 0;
+  }
+  return void 0;
+}
+function stringArray(value) {
+  if (!Array.isArray(value)) return [];
+  return value.filter(
+    (entry) => typeof entry === "string" && entry.length > 0
+  );
+}
+function isBlockedAddress(address) {
+  const family = net.isIP(address);
+  if (family === 4) return blockedAddresses.check(address, "ipv4");
+  if (family === 6) return blockedAddresses.check(address, "ipv6");
+  return true;
+}
+async function resolvePublicHostname(hostname, allowSyntheticNetworkProxy = false) {
+  const normalised = hostname.replace(/^\[|\]$/g, "").replace(/\.$/, "").toLowerCase();
+  if (!normalised || normalised === "localhost" || normalised.endsWith(".local")) {
+    throw new RegistrationLookupError(
+      `Refusing registration-data connection to ${hostname}`,
+      "security"
+    );
+  }
+  if (net.isIP(normalised) !== 0) {
+    if (isBlockedAddress(normalised)) {
+      throw new RegistrationLookupError(
+        `Refusing registration-data connection to non-public address ${hostname}`,
+        "security"
+      );
+    }
+    return [
+      {
+        address: normalised,
+        family: net.isIP(normalised)
+      }
+    ];
+  }
+  let addresses;
+  try {
+    addresses = await dns.lookup(normalised, {
+      all: true,
+      verbatim: true
+    });
+  } catch (error) {
+    throw new RegistrationLookupError(
+      `Unable to resolve registration-data service ${hostname}: ${errorMessage(error)}`,
+      "network"
+    );
+  }
+  const resolved = addresses.filter(
+    (entry) => entry.family === 4 || entry.family === 6
+  );
+  if (resolved.length === 0 || resolved.some(
+    (entry) => isBlockedAddress(entry.address) && !(allowSyntheticNetworkProxy && entry.family === 4 && syntheticHttpsProxyAddresses.check(entry.address, "ipv4"))
+  )) {
+    throw new RegistrationLookupError(
+      `Refusing registration-data connection to ${hostname}: destination is not public`,
+      "security"
+    );
+  }
+  return resolved;
+}
+function pinnedLookup(addresses) {
+  return (_hostname, options, callback) => {
+    const requestedFamily = options.family ?? 0;
+    const candidates = addresses.filter(
+      (entry) => requestedFamily === 0 || entry.family === requestedFamily
+    );
+    if (candidates.length === 0) {
+      const error = new Error(
+        `No validated address for requested family ${requestedFamily}`
+      );
+      error.code = "EAI_ADDRFAMILY";
+      callback(error, "");
+      return;
+    }
+    if (options.all) {
+      callback(null, candidates);
+      return;
+    }
+    const [selected] = candidates;
+    if (!selected) {
+      callback(new Error("No validated address available"), "");
+      return;
+    }
+    callback(null, selected.address, selected.family);
+  };
+}
+function errorMessage(error) {
+  return error instanceof Error ? error.message : "unknown error";
+}
+function errorCode(error) {
+  return error instanceof Error ? error.code : void 0;
+}
+function reasonForError(protocol, error) {
+  if (error instanceof RegistrationLookupError && error.reason)
+    return error.reason;
+  const message = errorMessage(error).toLowerCase();
+  const code = errorCode(error);
+  if (message.includes("exceeds") && message.includes("bytes"))
+    return "RESPONSE_TOO_LARGE";
+  if (message.includes("referral loop")) return "REFERRAL_LOOP";
+  if (message.includes("referral limit")) return "REFERRAL_LIMIT_REACHED";
+  if (protocol === "RDAP") {
+    if (error instanceof RegistrationLookupError && error.kind === "not-found")
+      return "RDAP_NOT_FOUND";
+    if (error instanceof RegistrationLookupError && error.kind === "rate-limited")
+      return "RDAP_RATE_LIMITED";
+    if (message.includes("timed out") || code === "ETIMEDOUT")
+      return "RDAP_TIMEOUT";
+    if (message.includes("http ")) return "RDAP_HTTP_ERROR";
+    if (error instanceof RegistrationLookupError && error.kind === "security")
+      return "RDAP_DESTINATION_REJECTED";
+    if (error instanceof RegistrationLookupError && (error.kind === "invalid-response" || error.kind === "unsupported"))
+      return error.kind === "unsupported" ? "RDAP_NOT_AVAILABLE" : "RDAP_INVALID_RESPONSE";
+    return "RDAP_NETWORK_ERROR";
+  }
+  if (code === "ECONNREFUSED") return "WHOIS_CONNECTION_REFUSED";
+  if (code === "ECONNRESET") return "WHOIS_CONNECTION_RESET";
+  if (code === "ENOTFOUND" || code === "EAI_AGAIN") return "WHOIS_DNS_FAILURE";
+  if (message.includes("unable to resolve registration-data service"))
+    return "WHOIS_DNS_FAILURE";
+  if (message.includes("timed out") || code === "ETIMEDOUT")
+    return "WHOIS_TIMEOUT";
+  if (message.includes("no whois data")) return "WHOIS_EMPTY_RESPONSE";
+  if (error instanceof RegistrationLookupError && error.kind === "unsupported")
+    return "WHOIS_NOT_ADVERTISED";
+  if (error instanceof RegistrationLookupError && error.kind === "rate-limited")
+    return "WHOIS_RATE_LIMITED";
+  if (error instanceof RegistrationLookupError && error.kind === "security")
+    return "REFERRAL_REJECTED";
+  return "UNKNOWN_ERROR";
+}
+function warningText(warning) {
+  return `${warning.reason}: ${warning.detail}`;
+}
+function failureSuggestion(rdapReason, whoisReason) {
+  if (whoisReason === "WHOIS_WEB_ONLY")
+    return "Use the registry's web-based registration lookup service.";
+  if (rdapReason === "RDAP_RATE_LIMITED" || whoisReason === "WHOIS_RATE_LIMITED")
+    return "Retry later and reduce lookup frequency.";
+  if (whoisReason === "WHOIS_SERVICE_RETIRED")
+    return "Use the registry's RDAP or web-based replacement service.";
+  if (whoisReason === "WHOIS_CONNECTION_REFUSED" || whoisReason === "WHOIS_CONNECTION_RESET" || whoisReason === "WHOIS_TIMEOUT" || whoisReason === "WHOIS_DNS_FAILURE")
+    return "Check outbound HTTPS and TCP port 43 access, then retry.";
+  if (whoisReason === "WHOIS_NOT_ADVERTISED" || whoisReason === "WHOIS_UNSUPPORTED_RESPONSE")
+    return "Consult the TLD registry website for its supported lookup service.";
+  if (whoisReason === "REFERRAL_REJECTED" || whoisReason === "REFERRAL_LOOP")
+    return "Use the last authoritative source shown or consult the registry website.";
+  return "Retry later or consult the registry's registration-data service.";
+}
+function formatLookupFailure(queryType, query, rdapError, whoisError) {
+  const rdapReason = reasonForError("RDAP", rdapError);
+  const whoisReason = reasonForError("WHOIS", whoisError);
+  const rdapSource = rdapError instanceof RegistrationLookupError ? rdapError.source : void 0;
+  const whoisSource = whoisError instanceof RegistrationLookupError ? whoisError.source : void 0;
+  return [
+    "Status: failed",
+    `${queryType}: ${query}`,
+    "RDAP status: failed",
+    `RDAP reason: ${rdapReason}`,
+    ...rdapSource ? [`RDAP source: ${rdapSource}`] : [],
+    `RDAP detail: ${errorMessage(rdapError)}`,
+    "WHOIS status: failed",
+    `WHOIS reason: ${whoisReason}`,
+    ...whoisSource ? [`WHOIS source: ${whoisSource}`] : [],
+    `WHOIS detail: ${errorMessage(whoisError)}`,
+    `Suggestion: ${failureSuggestion(rdapReason, whoisReason)}`
+  ].join("\n");
+}
+async function readResponseBody(response, maximumBytes) {
+  const contentLength = response.headers.get("content-length");
+  if (contentLength && Number(contentLength) > maximumBytes) {
+    await response.body?.cancel();
+    throw new RegistrationLookupError(
+      `Registration-data response exceeds ${maximumBytes} bytes`,
+      "invalid-response"
+    );
+  }
+  if (!response.body) return "";
+  const reader = response.body.getReader();
+  const chunks = [];
+  let total = 0;
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.byteLength;
+    if (total > maximumBytes) {
+      try {
+        await reader.cancel();
+      } catch {
+      }
+      throw new RegistrationLookupError(
+        `Registration-data response exceeds ${maximumBytes} bytes`,
+        "invalid-response"
+      );
+    }
+    chunks.push(value);
+  }
+  const body = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    body.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return new TextDecoder().decode(body);
+}
+function validateHttpsUrl(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new RegistrationLookupError(
+      `Invalid RDAP service URL: ${value}`,
+      "invalid-response"
+    );
+  }
+  if (url.protocol !== "https:" || url.username || url.password || url.port && url.port !== "443") {
+    throw new RegistrationLookupError(
+      `Refusing non-standard RDAP service URL: ${value}`,
+      "security"
+    );
+  }
+  return url;
+}
+async function fetchJson(initialUrl, maximumBytes) {
+  let url = validateHttpsUrl(initialUrl);
+  for (let redirects = 0; redirects <= MAX_REDIRECTS; redirects += 1) {
+    const addresses = await resolvePublicHostname(url.hostname, true);
+    const dispatcher = new Agent({
+      connect: { lookup: pinnedLookup(addresses) }
+    });
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
+    try {
+      const response = await undiciFetch(url, {
+        headers: {
+          accept: "application/rdap+json, application/json",
+          "user-agent": "mcp-dns-tools/registration-lookup"
+        },
+        dispatcher,
+        redirect: "manual",
+        signal: controller.signal
+      });
+      if ([301, 302, 303, 307, 308].includes(response.status)) {
+        const location = response.headers.get("location");
+        if (!location) {
+          throw new RegistrationLookupError(
+            `RDAP redirect from ${url.hostname} has no location`,
+            "invalid-response"
+          );
+        }
+        if (redirects === MAX_REDIRECTS) {
+          throw new RegistrationLookupError(
+            "RDAP redirect limit exceeded",
+            "invalid-response"
+          );
+        }
+        await response.body?.cancel();
+        url = validateHttpsUrl(new URL(location, url).href);
+        continue;
+      }
+      const body = await readResponseBody(response, maximumBytes);
+      if (response.status === 404) {
+        throw new RegistrationLookupError(
+          "Registration data not found",
+          "not-found",
+          url.href
+        );
+      }
+      if (response.status === 429) {
+        const retryAfter = response.headers.get("retry-after");
+        throw new RegistrationLookupError(
+          `RDAP service rate limited the request${retryAfter ? `; retry after ${retryAfter}` : ""}`,
+          "rate-limited"
+        );
+      }
+      if (!response.ok) {
+        throw new RegistrationLookupError(
+          `RDAP service returned HTTP ${response.status}`,
+          "network"
+        );
+      }
+      let parsed;
+      try {
+        parsed = JSON.parse(body);
+      } catch {
+        throw new RegistrationLookupError(
+          `RDAP service ${url.hostname} returned invalid JSON`,
+          "invalid-response"
+        );
+      }
+      if (!isRecord(parsed)) {
+        throw new RegistrationLookupError(
+          `RDAP service ${url.hostname} returned an invalid object`,
+          "invalid-response"
+        );
+      }
+      return { data: parsed, source: url.href };
+    } catch (error) {
+      if (controller.signal.aborted) {
+        throw new RegistrationLookupError(
+          `Request to ${url.hostname} timed out`,
+          "network",
+          url.href,
+          "RDAP_TIMEOUT"
+        );
+      }
+      if (error instanceof RegistrationLookupError) throw error;
+      throw new RegistrationLookupError(
+        `Request to ${url.hostname} failed: ${errorMessage(error)}`,
+        "network"
+      );
+    } finally {
+      clearTimeout(timeout);
+      await dispatcher.close();
+    }
+  }
+  throw new RegistrationLookupError("RDAP request failed", "network");
+}
+async function getBootstrap(url) {
+  const cached = bootstrapCache.get(url);
+  if (cached && cached.expiresAt > Date.now()) return cached.data;
+  const response = await fetchJson(url, MAX_BOOTSTRAP_BYTES);
+  const services = response.data.services;
+  if (!Array.isArray(services)) {
+    throw new RegistrationLookupError(
+      "IANA RDAP bootstrap response has no services array",
+      "invalid-response"
+    );
+  }
+  const data = { services };
+  bootstrapCache.set(url, { data, expiresAt: Date.now() + BOOTSTRAP_TTL_MS });
+  return data;
+}
+function bootstrapServices(data) {
+  const services = [];
+  for (const service of data.services) {
+    if (!Array.isArray(service) || service.length !== 2) continue;
+    const entries = stringArray(service[0]).map((entry) => entry.toLowerCase());
+    const urls = stringArray(service[1]).filter(
+      (url) => url.startsWith("https://")
+    );
+    if (entries.length > 0 && urls.length > 0) services.push({ entries, urls });
+  }
+  return services;
+}
+function domainServiceUrls(data, domain) {
+  let longestMatch = -1;
+  let urls = [];
+  for (const service of bootstrapServices(data)) {
+    for (const entry of service.entries) {
+      if (domain !== entry && !domain.endsWith(`.${entry}`)) continue;
+      const labels = entry.split(".").length;
+      if (labels > longestMatch) {
+        longestMatch = labels;
+        urls = [...service.urls];
+      } else if (labels === longestMatch) {
+        urls.push(...service.urls);
+      }
+    }
+  }
+  return [...new Set(urls)];
+}
+function ipServiceUrls(data, ip) {
+  const family = net.isIP(ip);
+  const type = family === 4 ? "ipv4" : "ipv6";
+  let longestPrefix = -1;
+  let urls = [];
+  for (const service of bootstrapServices(data)) {
+    for (const entry of service.entries) {
+      const [network, rawPrefix] = entry.split("/");
+      const prefix = Number(rawPrefix);
+      if (!network || !Number.isInteger(prefix) || net.isIP(network) !== family)
+        continue;
+      try {
+        const block = new net.BlockList();
+        block.addSubnet(network, prefix, type);
+        if (!block.check(ip, type)) continue;
+      } catch {
+        continue;
+      }
+      if (prefix > longestPrefix) {
+        longestPrefix = prefix;
+        urls = [...service.urls];
+      } else if (prefix === longestPrefix) {
+        urls.push(...service.urls);
+      }
+    }
+  }
+  return [...new Set(urls)];
+}
+async function queryFirstRdapService(baseUrls, path) {
+  let lastError;
+  for (const baseUrl of baseUrls) {
+    try {
+      const base = validateHttpsUrl(baseUrl);
+      if (!base.pathname.endsWith("/")) base.pathname += "/";
+      const queryUrl = new URL(path, base);
+      return await fetchJson(queryUrl.href, MAX_RDAP_BYTES);
+    } catch (error) {
+      if (error instanceof RegistrationLookupError && error.kind === "not-found") {
+        throw error;
+      }
+      lastError = error;
+    }
+  }
+  throw lastError ?? new RegistrationLookupError("No usable RDAP service", "unsupported");
+}
+function relatedRdapUrl(data) {
+  if (!Array.isArray(data.links)) return void 0;
+  for (const value of data.links) {
+    if (!isRecord(value) || value.rel !== "related") continue;
+    const href = stringValue(value.href);
+    const type = stringValue(value.type);
+    if (href && type?.toLowerCase().includes("application/rdap+json"))
+      return href;
+  }
+  return void 0;
+}
+function eventLines(data) {
+  if (!Array.isArray(data.events)) return [];
+  const labels = {
+    registration: "Registered",
+    expiration: "Expires",
+    "last changed": "Updated",
+    "last update of RDAP database": "RDAP database updated"
+  };
+  const lines = [];
+  for (const event of data.events) {
+    if (!isRecord(event)) continue;
+    const action = stringValue(event.eventAction);
+    const date = stringValue(event.eventDate);
+    if (action && date) lines.push(`${labels[action] ?? action}: ${date}`);
+  }
+  return lines;
+}
+function vcardFields(entity) {
+  const fields = /* @__PURE__ */ new Map();
+  if (!Array.isArray(entity.vcardArray) || !Array.isArray(entity.vcardArray[1]))
+    return fields;
+  for (const property of entity.vcardArray[1]) {
+    if (!Array.isArray(property) || property.length < 4) continue;
+    const name = stringValue(property[0])?.toLowerCase();
+    const value = stringValue(property[3]);
+    if (!name || !value) continue;
+    fields.set(name, [...fields.get(name) ?? [], value]);
+  }
+  return fields;
+}
+function entityLines(data) {
+  if (!Array.isArray(data.entities)) return [];
+  const lines = [];
+  const visit = (entity) => {
+    if (!isRecord(entity)) return;
+    const roles = stringArray(entity.roles);
+    const fields = vcardFields(entity);
+    const name = fields.get("fn")?.[0] ?? fields.get("org")?.[0];
+    const handle = stringValue(entity.handle);
+    const identity = name ?? handle;
+    if (identity) {
+      const publicIds = Array.isArray(entity.publicIds) ? entity.publicIds.map((value) => {
+        if (!isRecord(value)) return void 0;
+        const type = stringValue(value.type);
+        const identifier = stringValue(value.identifier);
+        return type && identifier ? `${type} ${identifier}` : void 0;
+      }).filter((value) => value !== void 0) : [];
+      const details = [
+        ...publicIds,
+        ...(fields.get("email") ?? []).map((value) => `email ${value}`),
+        ...(fields.get("tel") ?? []).map((value) => `telephone ${value}`)
+      ];
+      lines.push(
+        `Entity${roles.length > 0 ? ` (${roles.join(", ")})` : ""}: ${identity}${details.length > 0 ? `; ${details.join("; ")}` : ""}`
+      );
+    }
+    if (Array.isArray(entity.entities)) entity.entities.forEach(visit);
+  };
+  data.entities.forEach(visit);
+  return [...new Set(lines)];
+}
+function noticeTitles(data) {
+  if (!Array.isArray(data.notices)) return [];
+  return data.notices.map((notice) => isRecord(notice) ? stringValue(notice.title) : void 0).filter((title) => title !== void 0);
+}
+function formatDomainRdap(responses, requestedDomain, warnings) {
+  const data = Object.assign(
+    {},
+    ...responses.slice().reverse().map((response) => response.data)
+  );
+  data.entities = responses.flatMap(
+    (response) => Array.isArray(response.data.entities) ? response.data.entities : []
+  );
+  data.notices = responses.flatMap(
+    (response) => Array.isArray(response.data.notices) ? response.data.notices : []
+  );
+  data.events = responses.flatMap(
+    (response) => Array.isArray(response.data.events) ? response.data.events : []
+  );
+  const lines = [
+    "Protocol: RDAP",
+    ...responses.map((response) => `Source: ${response.source}`),
+    `Domain: ${stringValue(data.unicodeName) ?? stringValue(data.ldhName) ?? requestedDomain}`
+  ];
+  const handle = stringValue(data.handle);
+  if (handle) lines.push(`Registry ID: ${handle}`);
+  lines.push(...eventLines(data));
+  const statuses = stringArray(data.status);
+  if (statuses.length > 0) lines.push(`Status: ${statuses.join(", ")}`);
+  if (Array.isArray(data.nameservers)) {
+    const nameservers = data.nameservers.map(
+      (value) => isRecord(value) ? stringValue(value.unicodeName) ?? stringValue(value.ldhName) : void 0
+    ).filter((value) => value !== void 0);
+    if (nameservers.length > 0)
+      lines.push(`Nameservers: ${nameservers.join(", ")}`);
+  }
+  if (isRecord(data.secureDNS)) {
+    const signed = data.secureDNS.delegationSigned;
+    if (typeof signed === "boolean")
+      lines.push(`DNSSEC: ${signed ? "signed" : "unsigned"}`);
+  }
+  lines.push(...entityLines(data));
+  const notices = noticeTitles(data);
+  if (notices.length > 0) lines.push(`Notices: ${notices.join("; ")}`);
+  lines.push(...warnings.map((warning) => `Warning: ${warning}`));
+  return lines.join("\n");
+}
+function formatIpRdap(response, ip) {
+  const { data } = response;
+  const lines = ["Protocol: RDAP", `Source: ${response.source}`, `IP: ${ip}`];
+  for (const [label, key] of [
+    ["Network", "name"],
+    ["Handle", "handle"],
+    ["Start address", "startAddress"],
+    ["End address", "endAddress"],
+    ["IP version", "ipVersion"],
+    ["Type", "type"],
+    ["Country", "country"],
+    ["Parent handle", "parentHandle"]
+  ]) {
+    const value = stringValue(data[key]);
+    if (value) lines.push(`${label}: ${value}`);
+  }
+  const statuses = stringArray(data.status);
+  if (statuses.length > 0) lines.push(`Status: ${statuses.join(", ")}`);
+  lines.push(...eventLines(data), ...entityLines(data));
+  const notices = noticeTitles(data);
+  if (notices.length > 0) lines.push(`Notices: ${notices.join("; ")}`);
+  return lines.join("\n");
+}
+function normaliseRegistrationDomain(domain) {
+  const candidate = domain.trim().replace(/\.$/, "");
+  const containsControlCharacter = [...candidate].some((character) => {
+    const codePoint = character.codePointAt(0) ?? 0;
+    return codePoint <= 31 || codePoint === 127;
+  });
+  if (!candidate || containsControlCharacter) {
+    throw new Error("Invalid domain");
+  }
+  const ascii = domainToASCII(candidate).toLowerCase();
+  if (!ascii || ascii.length > 253) throw new Error("Invalid domain");
+  const labels = ascii.split(".");
+  if (labels.some(
+    (label) => label.length === 0 || label.length > 63 || !/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/u.test(label)
+  )) {
+    throw new Error("Invalid domain");
+  }
+  return ascii;
+}
+function parseWhoisEndpoint(value, allowWebScheme = false) {
+  const candidate = value.includes("://") ? value : `whois://${value}`;
+  let url;
+  try {
+    url = new URL(candidate);
+  } catch {
+    throw new RegistrationLookupError(
+      `Invalid WHOIS referral: ${value}`,
+      "invalid-response",
+      void 0,
+      "REFERRAL_REJECTED"
+    );
+  }
+  const webScheme = url.protocol === "http:" || url.protocol === "https:";
+  const port = webScheme ? 43 : url.port ? Number(url.port) : 43;
+  if (url.protocol !== "whois:" && !(allowWebScheme && webScheme) || !url.hostname || url.username || url.password || url.pathname && url.pathname !== "/" || url.search || url.hash || !webScheme && url.port && url.port !== "43") {
+    throw new RegistrationLookupError(
+      `Refusing unsafe WHOIS referral: ${value}`,
+      "security",
+      void 0,
+      "REFERRAL_REJECTED"
+    );
+  }
+  return { host: url.hostname.replace(/^\[|\]$/g, "").toLowerCase(), port };
+}
+function whoisReferral(response) {
+  for (const [pattern, allowWebScheme] of [
+    [/^refer:[ \t]*(\S+)/im, false],
+    [/^whois:[ \t]*(\S+)/im, false],
+    [/^Registrar WHOIS Server:[ \t]*(\S+)/im, true],
+    [/^ReferralServer:[ \t]*(\S+)/im, false]
+  ]) {
+    const match = response.match(pattern);
+    if (match?.[1]) return parseWhoisEndpoint(match[1].trim(), allowWebScheme);
+  }
+  return void 0;
+}
+function inspectWhoisResponse(response) {
+  const hasRegistrationData = /^(?:Domain Name|Domain|domain|NetRange|CIDR|inetnum|network|route):[ \t]*\S+/imu.test(
+    response
+  );
+  if (!hasRegistrationData && /(?:rate limit|query limit|quota exceeded|too many quer(?:y|ies)|maximum number of quer(?:y|ies)|try again later)/iu.test(
+    response
+  )) {
+    throw new RegistrationLookupError(
+      "WHOIS service rate limited the request",
+      "rate-limited",
+      void 0,
+      "WHOIS_RATE_LIMITED"
+    );
+  }
+  if (!hasRegistrationData && /(?:whois service (?:has been |is )?(?:retired|discontinued)|whois is no longer available)/iu.test(
+    response
+  )) {
+    throw new RegistrationLookupError(
+      "WHOIS service reports that it has been retired",
+      "unsupported",
+      void 0,
+      "WHOIS_SERVICE_RETIRED"
+    );
+  }
+  if (!hasRegistrationData && /(?:web[- ]based whois|web whois|visit .{0,80}whois)/isu.test(response)) {
+    throw new RegistrationLookupError(
+      "Registry directs queries to a web-based WHOIS service",
+      "unsupported",
+      void 0,
+      "WHOIS_WEB_ONLY"
+    );
+  }
+  if (!hasRegistrationData && /(?:invalid query|malformed query|unsupported query|syntax error|^usage:)/imu.test(
+    response
+  )) {
+    throw new RegistrationLookupError(
+      "WHOIS service rejected the query syntax",
+      "invalid-response",
+      void 0,
+      "WHOIS_UNSUPPORTED_RESPONSE"
+    );
+  }
+  const warnings = [];
+  if (response.includes("\uFFFD")) {
+    warnings.push({
+      reason: "WHOIS_INVALID_ENCODING",
+      detail: "WHOIS response contains bytes that are not valid UTF-8"
+    });
+  }
+  return {
+    notFound: !hasRegistrationData && /(?:no match for|not found|no entries found|no object found)/iu.test(
+      response
+    ),
+    warnings
+  };
+}
+function whoisQueryValue(host, query) {
+  if (host === "whois.jprs.jp" && !query.endsWith("/e")) return `${query}/e`;
+  if (host === "whois.denic.de") return `-T dn,ace ${query}`;
+  return query;
+}
+async function whoisQuery(endpoint, query) {
+  const addresses = await resolvePublicHostname(endpoint.host, true);
+  return await new Promise((resolve, reject) => {
+    let settled = false;
+    let total = 0;
+    const chunks = [];
+    const timeoutError = () => new RegistrationLookupError(
+      "WHOIS query timed out",
+      "network",
+      void 0,
+      "WHOIS_TIMEOUT"
+    );
+    const socket = net.createConnection(
+      { ...endpoint, lookup: pinnedLookup(addresses) },
+      () => {
+        socket.write(`${whoisQueryValue(endpoint.host, query)}\r
+`);
+      }
+    );
+    const deadline = setTimeout(
+      () => socket.destroy(timeoutError()),
+      REQUEST_TIMEOUT_MS
+    );
+    const finish = (error) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(deadline);
+      if (error) reject(error);
+      else resolve(Buffer.concat(chunks).toString("utf-8"));
+    };
+    socket.on("data", (chunk) => {
+      total += chunk.byteLength;
+      if (total > MAX_WHOIS_BYTES) {
+        socket.destroy(
+          new RegistrationLookupError(
+            `WHOIS response exceeds ${MAX_WHOIS_BYTES} bytes`,
+            "invalid-response",
+            void 0,
+            "RESPONSE_TOO_LARGE"
+          )
+        );
+        return;
+      }
+      chunks.push(chunk);
+    });
+    socket.on("end", () => finish());
+    socket.on("error", (error) => finish(error));
+    socket.setTimeout(REQUEST_TIMEOUT_MS, () => {
+      socket.destroy(timeoutError());
+    });
+  });
+}
+async function legacyWhois(query) {
+  let endpoint = { host: "whois.iana.org", port: 43 };
+  const visited = /* @__PURE__ */ new Set();
+  let response = "";
+  const warnings = [];
+  for (let index = 0; index < MAX_WHOIS_QUERIES; index += 1) {
+    const key = `${endpoint.host}:${endpoint.port}`;
+    if (visited.has(key)) {
+      throw new RegistrationLookupError(
+        "WHOIS referral loop detected",
+        "invalid-response",
+        `whois://${endpoint.host}:43`,
+        "REFERRAL_LOOP"
+      );
+    }
+    visited.add(key);
+    try {
+      response = (await whoisQuery(endpoint, query)).trim();
+    } catch (error) {
+      throw new RegistrationLookupError(
+        errorMessage(error),
+        error instanceof RegistrationLookupError ? error.kind : "network",
+        `whois://${endpoint.host}:43`,
+        reasonForError("WHOIS", error)
+      );
+    }
+    let referral;
+    try {
+      referral = whoisReferral(response);
+    } catch (error) {
+      if (index === 0) throw error;
+      warnings.push({
+        reason: reasonForError("WHOIS", error),
+        detail: errorMessage(error)
+      });
+      break;
+    }
+    if (!referral) {
+      if (index === 0) {
+        throw new RegistrationLookupError(
+          "IANA does not advertise a WHOIS service for this query",
+          "unsupported",
+          "whois://whois.iana.org:43",
+          "WHOIS_NOT_ADVERTISED"
+        );
+      }
+      break;
+    }
+    const referralKey = `${referral.host}:${referral.port}`;
+    if (visited.has(referralKey)) {
+      if (referralKey === key) break;
+      throw new RegistrationLookupError(
+        "WHOIS referral loop detected",
+        "invalid-response",
+        `whois://${endpoint.host}:43`,
+        "REFERRAL_LOOP"
+      );
+    }
+    if (index === MAX_WHOIS_QUERIES - 1) {
+      warnings.push({
+        reason: "REFERRAL_LIMIT_REACHED",
+        detail: `WHOIS referral limit of ${MAX_WHOIS_QUERIES} queries reached`
+      });
+      break;
+    }
+    try {
+      await resolvePublicHostname(referral.host, true);
+    } catch (error) {
+      if (index === 0) throw error;
+      warnings.push({
+        reason: reasonForError("WHOIS", error),
+        detail: errorMessage(error)
+      });
+      break;
+    }
+    endpoint = referral;
+  }
+  if (!response)
+    throw new RegistrationLookupError(
+      "No WHOIS data returned",
+      "network",
+      `whois://${endpoint.host}:43`,
+      "WHOIS_EMPTY_RESPONSE"
+    );
+  let inspection;
+  try {
+    inspection = inspectWhoisResponse(response);
+  } catch (error) {
+    throw new RegistrationLookupError(
+      errorMessage(error),
+      error instanceof RegistrationLookupError ? error.kind : "invalid-response",
+      `whois://${endpoint.host}:43`,
+      reasonForError("WHOIS", error)
+    );
+  }
+  warnings.push(...inspection.warnings);
+  return [
+    "Protocol: WHOIS",
+    `Source: whois://${endpoint.host}:43`,
+    ...inspection.notFound ? ["Status: not registered or not found", "Reason: WHOIS_NOT_FOUND"] : [],
+    ...warnings.map((warning) => `Warning: ${warningText(warning)}`),
+    "",
+    response
+  ].join("\n");
+}
+function fallbackWarning(error) {
+  return `${reasonForError("RDAP", error)}: ${errorMessage(error)}; used WHOIS fallback`;
+}
+async function domainRegistrationLookupResult(domain) {
+  const normalised = normaliseRegistrationDomain(domain);
+  let rdapError;
+  try {
+    const bootstrap = await getBootstrap(RDAP_DNS_BOOTSTRAP);
+    const urls = domainServiceUrls(bootstrap, normalised);
+    if (urls.length > 0) {
+      try {
+        const registry = await queryFirstRdapService(
+          urls,
+          `domain/${encodeURIComponent(normalised)}`
+        );
+        const responses = [registry];
+        const warnings = [];
+        const related = relatedRdapUrl(registry.data);
+        if (related) {
+          try {
+            responses.push(await fetchJson(related, MAX_RDAP_BYTES));
+          } catch (error) {
+            warnings.push(
+              `${reasonForError("RDAP", error)}: registrar RDAP lookup failed: ${errorMessage(error)}`
+            );
+          }
+        }
+        return {
+          text: formatDomainRdap(responses, normalised, warnings),
+          failed: false
+        };
+      } catch (error) {
+        if (error instanceof RegistrationLookupError && error.kind === "not-found") {
+          return {
+            text: `Protocol: RDAP
+Source: ${error.source ?? "authoritative RDAP service"}
+Domain: ${normalised}
+Status: not registered or not found
+Reason: RDAP_NOT_FOUND`,
+            failed: false
+          };
+        }
+        rdapError = error;
+      }
+    } else {
+      rdapError = new RegistrationLookupError(
+        "IANA has no RDAP bootstrap service for this TLD",
+        "unsupported"
+      );
+    }
+  } catch (error) {
+    rdapError = error;
+  }
+  try {
+    const result = await legacyWhois(normalised);
+    return {
+      text: rdapError ? `${result}
+
+Warning: ${fallbackWarning(rdapError)}` : result,
+      failed: false
+    };
+  } catch (whoisError) {
+    if (rdapError) {
+      return {
+        text: formatLookupFailure("Domain", normalised, rdapError, whoisError),
+        failed: true
+      };
+    }
+    return {
+      text: formatLookupFailure(
+        "Domain",
+        normalised,
+        new RegistrationLookupError(
+          "RDAP was not attempted",
+          "unsupported",
+          void 0,
+          "RDAP_NOT_AVAILABLE"
+        ),
+        whoisError
+      ),
+      failed: true
+    };
+  }
+}
+async function ipRegistrationLookupResult(ip) {
+  const family = net.isIP(ip);
+  if (family === 0) throw new Error("Invalid IP address");
+  let rdapError;
+  try {
+    const bootstrap = await getBootstrap(
+      family === 4 ? RDAP_IPV4_BOOTSTRAP : RDAP_IPV6_BOOTSTRAP
+    );
+    const urls = ipServiceUrls(bootstrap, ip);
+    if (urls.length > 0) {
+      try {
+        const response = await queryFirstRdapService(
+          urls,
+          `ip/${encodeURIComponent(ip)}`
+        );
+        return { text: formatIpRdap(response, ip), failed: false };
+      } catch (error) {
+        if (error instanceof RegistrationLookupError && error.kind === "not-found") {
+          return {
+            text: `Protocol: RDAP
+Source: ${error.source ?? "authoritative RDAP service"}
+IP: ${ip}
+Status: registration data not found
+Reason: RDAP_NOT_FOUND`,
+            failed: false
+          };
+        }
+        rdapError = error;
+      }
+    } else {
+      rdapError = new RegistrationLookupError(
+        "IANA has no RDAP bootstrap service for this address",
+        "unsupported"
+      );
+    }
+  } catch (error) {
+    rdapError = error;
+  }
+  try {
+    const result = await legacyWhois(ip);
+    return {
+      text: rdapError ? `${result}
+
+Warning: ${fallbackWarning(rdapError)}` : result,
+      failed: false
+    };
+  } catch (whoisError) {
+    if (rdapError) {
+      return {
+        text: formatLookupFailure("IP", ip, rdapError, whoisError),
+        failed: true
+      };
+    }
+    return {
+      text: formatLookupFailure(
+        "IP",
+        ip,
+        new RegistrationLookupError(
+          "RDAP was not attempted",
+          "unsupported",
+          void 0,
+          "RDAP_NOT_AVAILABLE"
+        ),
+        whoisError
+      ),
+      failed: true
+    };
+  }
+}
+
+// src/dns.ts
+function configureDnsServers(env = process.env) {
+  const raw = env.DNS_SERVERS;
+  if (!raw) return;
+  const servers = raw.split(",").map((s) => s.trim()).filter((s) => net2.isIP(s) !== 0);
+  if (servers.length > 0) {
+    setServers(servers);
+  }
+}
+function mapDnsError(error, type, target) {
+  const code = error.code;
+  switch (code) {
+    case "ENODATA":
+      return `No ${type} records found for ${target}.`;
+    case "ENOTFOUND":
+      return `Domain not found: ${target}`;
+    case "EREFUSED":
+      return `DNS server refused the ${type} query for ${target}. The local resolver may not support this record type; set DNS_SERVERS to use a different resolver.`;
+    case "ETIMEOUT":
+      return `DNS query for ${target} (${type}) timed out.`;
+    default:
+      return `DNS lookup failed for ${target} (${type}): ${code ?? "unknown error"}`;
+  }
+}
+var DOMAIN_RE = /^(?=.{1,253}$)[a-zA-Z0-9_]([a-zA-Z0-9_-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9_]([a-zA-Z0-9_-]{0,61}[a-zA-Z0-9])?)*\.?$/;
+function assertValidDomain(domain) {
+  if (!DOMAIN_RE.test(domain)) {
+    throw new Error("Invalid domain");
+  }
+}
+async function dnsLookup(domain, type) {
+  assertValidDomain(domain);
+  let records;
+  try {
+    records = await dns2.resolve(domain, type);
+  } catch (error) {
+    return mapDnsError(error, type, domain);
+  }
+  switch (type) {
+    case "MX": {
+      const mx = records;
+      if (mx.length === 0) return "No MX records found.";
+      return mx.sort((a, b) => a.priority - b.priority).map((r) => `${r.priority}  ${r.exchange}`).join("\n");
+    }
+    case "TXT": {
+      const txt = records;
+      if (txt.length === 0) return "No TXT records found.";
+      return txt.map((entries) => entries.join("")).join("\n");
+    }
+    case "CAA": {
+      const caa = records;
+      if (caa.length === 0) return "No CAA records found.";
+      const formatted = caa.flatMap(
+        ({ critical, ...tags }) => Object.entries(tags).filter(
+          (entry) => entry[0] !== "type" && typeof entry[1] === "string"
+        ).map(([tag, value]) => `${critical} ${tag} ${JSON.stringify(value)}`)
+      );
+      return formatted.length > 0 ? formatted.join("\n") : "No CAA records found.";
+    }
+    case "SOA": {
+      const soa = records;
+      const s = soa[0];
+      if (!s) return "No SOA record found.";
+      return [
+        `nsname:    ${s.nsname}`,
+        `hostmaster: ${s.hostmaster}`,
+        `serial:    ${s.serial}`,
+        `refresh:   ${s.refresh}`,
+        `retry:     ${s.retry}`,
+        `expire:    ${s.expire}`,
+        `minttl:    ${s.minttl}`
+      ].join("\n");
+    }
+    case "SRV": {
+      const srv = records;
+      if (srv.length === 0) return "No SRV records found.";
+      return srv.map((r) => `${r.priority} ${r.weight} ${r.port} ${r.name}`).join("\n");
+    }
+    default: {
+      const arr = records;
+      if (arr.length === 0) return `No ${type} records found.`;
+      return arr.join("\n");
+    }
+  }
+}
+async function reverseDns(ip) {
+  if (net2.isIP(ip) === 0) {
+    throw new Error("Invalid IP address");
+  }
+  let hostnames;
+  try {
+    hostnames = await dns2.reverse(ip);
+  } catch (error) {
+    return mapDnsError(error, "PTR", ip);
+  }
+  return hostnames.length > 0 ? hostnames.join("\n") : "No PTR records found.";
+}
+async function resolveAll(domain) {
+  assertValidDomain(domain);
+  const types = [
+    { name: "A", type: "A" },
+    { name: "AAAA", type: "AAAA" },
+    { name: "MX", type: "MX" },
+    { name: "TXT", type: "TXT" },
+    { name: "CAA", type: "CAA" },
+    { name: "NS", type: "NS" },
+    { name: "CNAME", type: "CNAME" }
+  ];
+  const results = [];
+  for (const { name, type } of types) {
+    try {
+      const records = await dnsLookup(domain, type);
+      results.push(`=== ${name} ===
+${records}`);
+    } catch {
+      results.push(`=== ${name} ===
+(no records or error)`);
+    }
+  }
+  return results.join("\n\n");
+}
+async function checkNameservers(domain) {
+  assertValidDomain(domain);
+  let nameservers;
+  try {
+    nameservers = await dns2.resolveNs(domain);
+  } catch (error) {
+    return mapDnsError(error, "NS", domain);
+  }
+  return nameservers.length > 0 ? nameservers.join("\n") : "No nameserver records found.";
+}
+async function whoisLookupResult(domain) {
+  return await domainRegistrationLookupResult(domain);
+}
+async function ipWhoisResult(ip) {
+  return await ipRegistrationLookupResult(ip);
+}
+
+// src/server.ts
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { z } from "zod";
+
+// package.json
+var package_default = {
+  name: "@paulgit/mcp-dns-tools",
+  mcpName: "it.paulg/dns-tools",
+  version: "2.2.0",
+  description: "MCP server for DNS lookups, including CAA checks, reverse DNS, and RDAP-first domain or IP registration data with WHOIS fallback; zero auth, zero config",
+  type: "module",
+  publishConfig: {
+    access: "public"
+  },
+  engines: {
+    node: ">=24"
+  },
+  bin: {
+    "mcp-dns-tools": "./dist/index.js"
+  },
+  files: [
+    "dist",
+    "skills"
+  ],
+  scripts: {
+    build: "tsup",
+    typecheck: "tsc --noEmit",
+    test: "vitest run",
+    "test:watch": "vitest",
+    "test:coverage": "vitest run --coverage",
+    lint: "eslint . && prettier --check .",
+    format: "prettier --write .",
+    "audit:deps": "npm audit --omit=dev --audit-level=high",
+    prepack: "npm run build",
+    prepublishOnly: "npm run lint && npm run typecheck && npm test",
+    prepare: "husky"
+  },
+  keywords: [
+    "mcp",
+    "mcp-server",
+    "model-context-protocol",
+    "dns",
+    "whois",
+    "domain",
+    "network",
+    "lookup",
+    "nameserver",
+    "caa",
+    "tls",
+    "certificate-authority",
+    "ai",
+    "llm",
+    "claude",
+    "cursor"
+  ],
+  author: "Paul Git (https://code.paulg.it/paulgit)",
+  license: "MIT",
+  repository: {
+    type: "git",
+    url: "https://code.paulg.it/paulgit/mcp-dns-tools.git"
+  },
+  bugs: {
+    url: "https://code.paulg.it/paulgit/mcp-dns-tools/issues"
+  },
+  homepage: "https://code.paulg.it/paulgit/mcp-dns-tools#readme",
+  dependencies: {
+    "@modelcontextprotocol/sdk": "^1.26.0",
+    undici: "^8.10.0",
+    zod: "^3.25.0"
+  },
+  devDependencies: {
+    "@eslint/js": "^9.0.0",
+    "@types/node": "^22.0.0",
+    eslint: "^9.0.0",
+    "eslint-config-prettier": "^10.0.0",
+    husky: "^9.0.0",
+    "lint-staged": "^15.0.0",
+    prettier: "^3.0.0",
+    tsup: "^8.0.0",
+    typescript: "^5.7.0",
+    "typescript-eslint": "^8.0.0",
+    vitest: "^3.2.0"
+  },
+  "lint-staged": {
+    "*.{ts,tsx,js}": [
+      "eslint --fix",
+      "prettier --write"
+    ],
+    "*.{json,md,yml,yaml}": [
+      "prettier --write"
+    ]
+  }
+};
+
+// src/server.ts
+var recordTypeSchema = z.enum(["A", "AAAA", "MX", "TXT", "CNAME", "NS", "SOA", "SRV", "CAA", "PTR"]).default("A");
+var readOnlyAnnotations = {
+  readOnlyHint: true,
+  destructiveHint: false
+};
+function createMcpServer() {
+  const server = new McpServer(
+    {
+      name: "mcp-dns-tools",
+      version: package_default.version
+    },
+    {
+      instructions: "When the user names one DNS record type, call dns_lookup and pass that type, except for NS or nameserver-only requests, which must use check_nameservers. For CAA requests, call dns_lookup with type CAA. Use resolve_all only when the user asks for all records, multiple record types, a DNS overview, or a general investigation. Never use resolve_all for one named record type. Use whois for domain registration, registrar, registration status, or registration-date questions. Use ip_whois for IP allocation and network ownership questions."
+    }
+  );
+  server.registerTool(
+    "dns_lookup",
+    {
+      title: "DNS record lookup",
+      description: "Use this when the user requests one specific DNS record type, except for NS or nameserver requests, which must use check_nameservers. For CAA or certificate authority issuance questions, call this tool with type CAA. Supports A, AAAA, MX, TXT, CNAME, SOA, SRV, CAA, PTR, and NS for backwards compatibility. Do not use resolve_all when the user names one record type.",
+      inputSchema: {
+        domain: z.string().describe("Domain name to look up (e.g. example.com)"),
+        type: recordTypeSchema.describe(
+          "Specific record type to return: A, AAAA, MX, TXT, CNAME, NS, SOA, SRV, CAA, or PTR. Use CAA for certificate authority issuance policy."
+        )
+      },
+      annotations: readOnlyAnnotations
+    },
+    async ({ domain, type }) => {
+      const result = await dnsLookup(domain, type);
+      return { content: [{ type: "text", text: result }] };
+    }
+  );
+  server.registerTool(
+    "reverse_dns",
+    {
+      title: "Reverse DNS lookup",
+      description: "Perform a reverse DNS (PTR) lookup on an IP address.",
+      inputSchema: {
+        ip: z.string().describe("IP address (e.g. 8.8.8.8)")
+      },
+      annotations: readOnlyAnnotations
+    },
+    async ({ ip }) => {
+      const result = await reverseDns(ip);
+      return { content: [{ type: "text", text: result }] };
+    }
+  );
+  server.registerTool(
+    "resolve_all",
+    {
+      title: "DNS overview",
+      description: "Use this only when the user requests all common DNS records, multiple record types, a DNS overview, or a general domain investigation. Returns A, AAAA, MX, TXT, CAA, NS, and CNAME. Do not use this for one named record type.",
+      inputSchema: {
+        domain: z.string().describe("Domain name to resolve (e.g. example.com)")
+      },
+      annotations: readOnlyAnnotations
+    },
+    async ({ domain }) => {
+      const result = await resolveAll(domain);
+      return { content: [{ type: "text", text: result }] };
+    }
+  );
+  server.registerTool(
+    "check_nameservers",
+    {
+      title: "Nameserver lookup",
+      description: "Use this whenever the user requests NS records, nameservers, authoritative nameservers, or domain delegation nameservers.",
+      inputSchema: {
+        domain: z.string().describe("Domain name (e.g. example.com)")
+      },
+      annotations: readOnlyAnnotations
+    },
+    async ({ domain }) => {
+      const result = await checkNameservers(domain);
+      return { content: [{ type: "text", text: result }] };
+    }
+  );
+  server.registerTool(
+    "whois",
+    {
+      title: "Domain registration lookup",
+      description: "Query authoritative domain registration data, including registrar, status, dates, nameservers, and DNSSEC. Uses IANA RDAP discovery over HTTPS and follows a registrar RDAP link when available, with bounded legacy WHOIS fallback for TLDs without working RDAP. Supports Unicode domain names. Failures identify each attempted protocol, endpoint, stable reason code, detail, and suggested next action.",
+      inputSchema: {
+        domain: z.string().describe("Domain name for registration lookup (e.g. example.com)")
+      },
+      annotations: readOnlyAnnotations
+    },
+    async ({ domain }) => {
+      const result = await whoisLookupResult(domain);
+      return {
+        content: [{ type: "text", text: result.text }],
+        isError: result.failed
+      };
+    }
+  );
+  server.registerTool(
+    "ip_whois",
+    {
+      title: "IP registration lookup",
+      description: "Query authoritative IPv4 or IPv6 allocation and network ownership data. Uses IANA RDAP bootstrap discovery over HTTPS, with bounded legacy WHOIS fallback to the appropriate Regional Internet Registry. Failures identify each attempted protocol, endpoint, stable reason code, detail, and suggested next action.",
+      inputSchema: {
+        ip: z.string().describe("IP address (e.g. 8.8.8.8 or 2001:4860:4860::8888)")
+      },
+      annotations: readOnlyAnnotations
+    },
+    async ({ ip }) => {
+      const result = await ipWhoisResult(ip);
+      return {
+        content: [{ type: "text", text: result.text }],
+        isError: result.failed
+      };
+    }
+  );
+  return server;
+}
+
+// src/index.ts
+configureDnsServers();
+async function main() {
+  parseCliArgs(process.argv.slice(2));
+  const server = createMcpServer();
+  const transport = new StdioServerTransport();
+  await server.connect(transport);
+}
+main().catch((error) => {
+  console.error("Fatal error:", error);
+  process.exit(1);
+});
+//# sourceMappingURL=index.js.map