dnsSec

What dnsSec does on Mcp

AI agents call dnsSec to retrieve information from Mcp without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Parameters from the server's own tool schema.

Why dnsSec is rated Low

This tool retrieves DNSSEC configuration status for a domain, which is a read-only network information lookup. It has no side effects, does not modify any data, execute code, or cause irreversible changes. The blast radius of misuse is minimal—an attacker could only enumerate DNSSEC enablement across domains, which is non-sensitive reconnaissance that is typically publicly queryable via standard DNS tools.

From the tool's definition Tool name 'dnsSec' with description 'Check if DNSSEC is enabled for a domain' performs a DNS security status query with no write, execute, or destructive capabilities.

Risk signalsAccepts URL/endpoint input (url)

The rule that runs dnsSec safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Mcp, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For dnsSec, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "dnsSec": {}
  }
}

Questions about dnsSec