API and MCP

MCP tool reference

The 196 tools by family, the scope each needs, and the most useful tools in each with what they return. 104 read, 82 write, 10 destructive.

Updated · 5 min read

Tools are grouped by scope. R reads stored data (Pro and up). W changes state, runs a live lookup, or spends (Enterprise, with write). WD is destructive and the assistant is told to confirm first. list_domains is the entry point: its numeric ids are what almost every other tool takes.

Domains, DNS and deliverability (domains)

Tool Access Returns
list_domains R Every domain with health score, last scan, SSL expiry. Start here
get_domain_history R Results over time for one domain
get_domain_events, get_domain_hijack_events, get_domain_event, act_on_domain_event R / W Change events with lifecycle; authorize or deny one
get_uptime_snapshots, get_downtime_events R Probe observations and outage windows
get_dmarc_summary, get_dmarc_diagnostics, get_dmarc_setup_status, get_dmarc_senders, list_dmarc_reports, get_dmarc_inbox R The report stream: 30-day volume and alignment, ranked deliverability findings, the five-step checklist, sender attribution, the rua= address
add_domain, add_domains_bulk, update_domain, delete_domain W / WD Inventory writes; bulk takes up to 100
get_domain_email_security, discover_domain_subdomains W Live DNS reads of SPF/DKIM/DMARC/MX/MTA-STS/TLS-RPT; passive subdomain discovery
plan_domain_onboarding, onboard_domain, get_domain_setup_guide, skip_domain_setup_step R / W The interview, the one write that applies it, and the computed checklist
list_alerts, get_alert_activity, mark_alerts_read R / W The alert inbox and the History ledger
get_account_settings, update_account_settings R / W Every notification and scan setting
list_domain_groups, create_domain_group, assign_domains_to_group, delete_domain_group, list_scan_clients, create_scan_client, delete_scan_client R / W / WD Labels and clients
list_support_conversations, get_support_conversation, reply_to_support_conversation, update_support_conversation R / W Support threads with NHM
rotate_dmarc_inbox, get_managed_email_auth, enable_managed_email_auth, check_managed_email_auth, set_managed_dmarc_policy, disable_managed_email_auth W The report address and delegated records

Scans, checkups and dark web (scans)

get_checkup_history (R, the richest single answer to "what is wrong with this site"), run_domain_scan (W, health plus checkup plus single-page SEO), run_domain_checkup (W), get_dark_web_status (R, cache only), run_dark_web_scan (W), get_dark_web_breach (R), add_dark_web_email, remove_dark_web_email, list_dark_web_domain_monitors, add_dark_web_domain_monitor, run_dark_web_domain_scan, remove_dark_web_domain_monitor, get_dark_web_alert_delivery, update_dark_web_alert_delivery, report_scanner_issue, submit_scanner_review.

SEO and Local SEO (seo)

get_seo_results, get_seo_history, run_seo_scan, start_site_audit, get_site_audit_status, get_site_audit_results, get_seo_intent_conflicts (R, free); get_seo_policy, fetch_sitemap, start_deep_seo_job, list_deep_seo_jobs, get_deep_seo_job, cancel_deep_seo_job, get_deep_seo_scans, get_deep_seo_scan_pages, list_manual_url_scans; check_page_seo, assess_website, score_page_accessibility, score_page_performance (W, any public URL); email_seo_report, get_report_branding, save_report_branding. Local: get_local_seo_profile, save_local_seo_profile, get_local_keyword_targets, add_local_keyword_target, delete_local_keyword_target, get_local_rank_history, check_local_ranks, get_geogrid_scans, run_geogrid_scan, get_local_seo_catalog (R, call before running an action), run_local_seo_action, get_local_seo_operation (recover a paid action after a timeout), get_local_seo_credits, get_local_seo_quickstart, run_local_seo_quickstart, plus the discovery, quote and location tools.

Accessibility (accessibility)

quote_accessibility_audit, list_accessibility_audits, get_accessibility_audit (R); start_accessibility_audit (W, spends 5 credits, takes a request_key).

Vulnerability and exposure (vulnscan)

get_vuln_scan_latest, get_vuln_scan_results, get_vuln_scan_history, get_vulnerability_assets, get_open_ports, get_observed_components, list_software_vendors, get_software_vendor, list_software_alerts (with exposure verdicts), get_software_alert_summary, get_vulnerability_feed, get_software_advisory_history, list_vuln_dismissals (R); start_vuln_scan, get_scan_ownership_verification, verify_scan_ownership, verify_scan_ownership_bulk, request_ownership_email_link, get_scan_clearance_status, request_scan_authorization, get_scan_authorization, list_scan_authorizations, dismiss_vuln_finding, restore_vuln_dismissal, update_software_alert, list_tracked_software, search_software_catalog, track_software, update_tracked_software, untrack_software (WD); lookalikes: list_lookalikes, get_lookalike_events, run_lookalike_scan, set_lookalike_verdict, set_lookalike_watch, get_lookalike_evidence, act_on_lookalike_event, get_lookalike_alert_settings, update_lookalike_alert_settings; network: list_ip_targets, add_ip_target, update_ip_target, delete_ip_target, list_ip_target_scans, scan_ip_target.

Compliance (compliance)

get_compliance_records (R), update_compliance_item (W: unanswered, met, partial, not met, n/a; uses the record id), create_incident_record (W: an incident with its playbook steps and WISP text), and the incident list.

Status (status)

list_status_checks, get_status_services (R); create_status_check, run_status_check (W); delete_status_check (WD).

Operator reads (admin)

list_error_events, get_self_check_status, list_scan_failures, list_scanner_reports. Only from an administrator's own session; a customer key cannot carry the scope.

Three habits the server asks of an assistant

  1. Read stored results before running a scan; scans take minutes and count against the plan.
  2. Quote before any paid step and wait for a yes.
  3. Verify a finding it can check itself (resolve the record, fetch the page) before presenting it as fact, and report a disagreement with report_scanner_issue.

Still stuck?

Ask the people who run the scanner.

Send the domain and what you expected to see. We look at the same scan you are looking at and write back with what it means and what to change.