Let your AI agent check our work

Everything DomainGuard tells you about a domain is a claim you can check from outside. "This host runs WooCommerce 8.4.0." "CVE-2026-57777 applies to it." "Your DMARC record is p=none." An AI agent connected to your account can re-run our tests itself and tell us, and you, where we were wrong.

Plan: Pro and Enterprise. A read-only key is enough.

Connect an agent in two clicks

In the dashboard, open Settings, then API & MCP access, and click Connect an AI agent.
Claude Code is already selected. Pick a different agent if you use one, then click Create key & copy setup.

What lands on your clipboard depends on the agent:

Agent	What you get
Claude Code	One terminal command. It adds the DomainGuard server and starts the verification.
Cursor, VS Code	A config snippet for `~/.cursor/mcp.json` or `.vscode/mcp.json`
Claude Desktop	A config snippet for `claude_desktop_config.json`
Any other agent	A prompt to paste into its chat. It covers MCP, or plain REST for agents without MCP

The key is read-only unless you tick Also let it make changes (Enterprise). Verifying and reporting don't need it. The key is shown once, so revoke it on the same page when you're done.

What the agent does

It asks for the domain's verification tasks. Each task is one claim, with how we tested it and the commands that reproduce the test: dig for DNS, curl for pages and headers, openssl for certificates, nc for a service's greeting.
It runs those checks against your domains and compares the results.
It sends back a verdict for each claim: confirmed, incorrect (with what it actually saw) or could not verify. It also reports real problems we didn't list.
It tells you in plain words what we got right, what we got wrong, and what to fix first.

The checks are read-only and only touch your own domains. Nothing logs in, fills in a form or tries an exploit. For a vulnerability, the proof is the version the site publishes and the range the advisory publishes.

What happens to a verdict

Confirmed verdicts are counted. They tell us how accurate each of our tests is.
Incorrect verdicts go to a person at NHM as one message per domain, and the finding is re-checked on our side. Your result isn't changed just because an agent disagreed. Agents can be wrong too, so we re-test first and fix the scanner if the agent was right.
You can see what your agents confirmed and disputed over the last 30 days under Settings, API & MCP access.

Limits

Limit	Value
Verdicts per call	60, plus 5 missed problems
Verdicts per account per day	400
Re-checking a finding	Skipped for 7 days after a verdict, unless our claim changes

How we test

The full method is public at nhmohio.com/mcp/verify.md. It covers every kind of claim, the exact command to re-test it, and every data source we use with its licence. Everything it points to can be used commercially, and you can reuse the method itself under CC BY 4.0.

Endpoints

MCP tools get_verification_tasks and submit_verification_results, and the prompt verify_findings. Over REST with the same key: GET /api/verification/tasks, POST /api/verification/results and GET /api/verification/summary.