Public assessment

oso95/domain-suite-mcp (domain-suite-mcp)

domain-suite-mcp · v0.1.0 · scanned Aug 3, 2026

What changed in the harness

Selection accuracy 100→100, token cost up 16%, unconfirmed writes 0%→0%.

Category breakdown

Where the score comes from.

Earned points across the four signals Gradable measures. Safety and Legibility are scored out of 30; Economics and Discoverability are scored out of 20.

01Safety

0.0 / 30

0.0 out of 30

02Legibility

20.9 / 30

20.9 out of 30

03Economics

17.7 / 20

17.7 out of 20

04Discoverability

11.5 / 20

11.5 out of 20

Highest-impact fix

Estimated gain +30 points

Add explicit identity and permission preflight tools

Expose machine-readable principal/tenant confirmation and a non-mutating permission check so agents can verify both before destructive actions.

Description evidence

Defects and rewrites.

21 defects found across the exposed tool descriptions. Suggested rewrites make purpose, inputs, boundaries, and returns easier for an agent to understand.

Tool	Defect types	Suggested rewrite
`list_providers`	name_restates_behavior no_return_description	Enumerate the providers currently configured in this server and what each supports, so you can decide which provider to pass to provider-aware calls (availability, DNS, certificates, etc.). Returns a list of configured providers along with their capabilities.
`check_availability`	no_return_description	Check whether a name is available for a given TLD, querying registries via RDAP/WHOIS with zero configuration required; when a provider is passed, pricing is added to the result. Returns availability status and pricing (if a provider is configured) for each requested name/TLD combination.
`list_domains`	name_restates_behavior no_return_description	Enumerate every domain you manage across all configured providers, optionally scoped to a single provider, to get an overview before managing DNS, renewals, or transfers. Returns the complete list of domains and the provider(s) that host them.
`get_domain`	name_restates_behavior params_unexplained no_return_description	Retrieve full registration details for a single fully-qualified domain (e.g. myapp.com), using the given provider or auto-detecting it from configured providers. Returns the domain's registration status, expiry, and provider details.
`register_domain`	name_restates_behavior params_unexplained no_return_description	Register a new fully-qualified domain (e.g. myapp.com) with the given provider for the specified number of years, supplying the registrar-required registrant contact object; optionally enable auto-renewal and disable WHOIS privacy protection (on by default). Returns the registration result, including the newly registered domain.
`renew_domain`	name_restates_behavior params_unexplained no_return_description	Extend the registration of an existing fully-qualified domain (e.g. myapp.com) by the given number of years, using the given provider or auto-detecting it. Returns the renewal result, including the domain's new expiry date.
`list_dns_records`	name_restates_behavior params_unexplained no_return_description	List every DNS record (A, AAAA, CNAME, MX, TXT, and others) for a fully-qualified domain (e.g. myapp.com), using the given provider or auto-detecting it, e.g. to inspect current DNS before creating or updating records. Returns the records, including each record's ID for use in update/delete calls.
`create_dns_record`	params_unexplained no_return_description	Add a new DNS record of a given type (A, AAAA, CNAME, MX, TXT, NS, SRV, or CAA) to a fully-qualified domain (e.g. myapp.com); the provider is auto-detected when omitted, and priority is required for MX and SRV records. Returns confirmation of the created record.
`update_dns_record`	params_unexplained no_return_description	Replace an existing DNS record for a fully-qualified domain (e.g. myapp.com), identified by the record ID from list_dns_records, with the full new set of fields (type, name, content, ttl, priority) — this is a full record replacement, not a partial update. Returns confirmation of the updated record.
`delete_dns_record`	name_restates_behavior params_unexplained no_return_description	Remove a DNS record for a fully-qualified domain (e.g. myapp.com) using its record ID from list_dns_records, with the provider auto-detected if omitted; note that on GoDaddy all records of the same type+name are deleted due to an API limitation. Returns confirmation of the deletion.
`list_certificates`	name_restates_behavior params_unexplained no_return_description	List the SSL/TLS certificates issued for a fully-qualified domain (e.g. myapp.com), using the given provider or auto-detecting it. Returns the certificates with their IDs and metadata, suitable for status lookups.
`create_certificate`	params_unexplained no_return_description	Provision an SSL/TLS certificate for a fully-qualified domain (e.g. myapp.com); on Porkbun it retrieves the auto-provisioned certificate (no explicit creation is needed) and on Cloudflare it requires the Advanced Certificate Manager add-on. Returns the issued certificate and its ID.
`get_certificate_status`	name_restates_behavior params_unexplained no_return_description	Check the provisioning status of an SSL/TLS certificate using its certificate ID (from list_certificates or create_certificate); the provider is required. Returns the certificate's current status (e.g. issued, pending, error) and any relevant details.
`setup_spf`	params_unexplained no_return_description	Add an SPF TXT record to a fully-qualified domain (e.g. myapp.com) using the chosen mailProvider's template (google, resend, sendgrid, mailgun, ses, postmark, or custom); a customPolicy is required when mailProvider is 'custom'. Returns the DNS record created.
`setup_dkim`	params_unexplained no_return_description	Add a DKIM TXT record to a fully-qualified domain (e.g. myapp.com) using the given selector and public key, where the key may be base64 or PEM (headers are auto-stripped) and the algorithm is rsa or ed25519. Returns the DNS record created.
`setup_dmarc`	params_unexplained no_return_description	Add a DMARC policy TXT record to a fully-qualified domain (e.g. myapp.com) with an enforcement policy (none, quarantine, or reject), an optional reporting email address, and the percentage of messages to filter. Returns the DNS record created.
`setup_mx`	params_unexplained no_return_description	Configure MX records for a fully-qualified domain (e.g. myapp.com) using the chosen mailProvider's template (google, resend, sendgrid, mailgun, ses, protonmail, or custom); customRecords (exchange/priority pairs) are required when mailProvider is 'custom'. Returns the DNS records created.
`transfer_domain_in`	name_restates_behavior params_unexplained no_return_description	Initiate an inbound transfer of a fully-qualified domain (e.g. myapp.com) into the given provider, supplying the authorization/EPP code obtained from the current registrar. Returns the transfer initiation status, which you can track with get_transfer_status.
`get_transfer_status`	params_unexplained no_return_description	Check the status of an inbound transfer for a fully-qualified domain (e.g. myapp.com); during an in-flight transfer the domain may not appear in list_domains yet, so pass the provider explicitly in that case. Returns the transfer's current state and progress.
`get_whois_contact`	name_restates_behavior params_unexplained no_return_description	Retrieve the WHOIS registrant contact details for a fully-qualified domain (e.g. myapp.com); specify the provider when it cannot be auto-detected. Returns the full contact record, including name, email, phone, and mailing address.
`update_whois_contact`	name_restates_behavior params_unexplained no_return_description	Replace the WHOIS registrant contact details for a fully-qualified domain (e.g. myapp.com) with the supplied full contact object (name, email, phone, and address fields); the provider is auto-detected when omitted. Returns confirmation of the updated contact.

Selection evidence

Confusable tool pairs.

10 pairs where similar names or overlapping descriptions may send an agent toward the wrong tool.

Tool A	Tool B	Confidence	Why they collide
`get_certificate_status`	`get_transfer_status`	medium	Both are "get status" tools keyed by domain; a task like "check the status of my domain" doesn't reveal whether it refers to the SSL certificate or an in-flight transfer, so an agent could pick the wrong one.
`setup_spf`	`setup_mx`	medium	Both configure email via a mail-provider template and share mailbox/record/setup wording; "set up email for example.com with Google" is ambiguous between MX routing and SPF authentication.
`setup_dkim`	`setup_dmarc`	medium	Both add email-authentication TXT records under a setup verb; a task like "add email authentication records for my domain" matches either tool equally well.
`setup_spf`	`setup_dmarc`	low	A generic "set up email security/authentication for my domain" task maps to either SPF or DMARC since both are TXT-based auth setups with identical setup/record framing.
`get_whois_contact`	`update_whois_contact`	low	The idiomatic phrase "update me on the whois contact for example.com" (informational) could trigger update_whois_contact instead of get_whois_contact; otherwise get vs update is usually clear.
`update_dns_record`	`update_whois_contact`	low	"Update the contact record for my domain" is ambiguous between editing a DNS record and updating the WHOIS contact, since both tools are update-by-domain and share the term record.
`list_domains`	`get_domain`	low	"Tell me about example.com" could be read as listing all domains or retrieving details for one specific domain, though the presence of a specific name usually disambiguates.
`transfer_domain_in`	`get_transfer_status`	low	A task mentioning "my domain transfer" is ambiguous between initiating the transfer and checking its status when the user hasn't supplied an auth code.
`list_certificates`	`create_certificate`	low	"Get me an SSL certificate for my domain" could mean listing existing certificates or provisioning a new one, and both are one-arg domain operations.
`register_domain`	`renew_domain`	low	"Register my domain for another year" (meaning renew the existing registration) matches register_domain lexically despite the action being a renewal.

Compare the field

One score is useful.
The evidence makes it actionable.

Back to the leaderboard