B+

mcp.agentdomains.co

https://mcp.agentdomains.co
87/100 · MCP Trust Grade · checked 15h ago · MCP 2024-11-05

Is the mcp.agentdomains.co MCP server safe to use?

Independent trust grade B+ (87/100). No blocking issues found in the static + spec checks. wmcp.sh continuously watches mcp.agentdomains.co for tool drift and rug-pulls. The grade is free and identical whether or not the operator pays.

✓ Watched since 2026-10-29 — behavioral baseline locked. We re-check this server's tool surface on a schedule; if it adds, removes, or silently rewrites a tool (rug-pull), we record it.

What it offers — 19 tools · Developer Tools

check_availability

Check whether a subdomain label is free before claiming it. Requires no API key. Returns { label, domain, fqdn, available, reason } where reason is 'a

signup

Create a new AgentDomains account and get an API key. Requires no existing key. IMPORTANT: the returned api_key is shown ONCE and is never retrievable

whoami

Show the current account: id, state, attached email and whether it is verified, domains used, and which domains are available to claim under. When quo

attach_email

Attach an email address to the account and send it a verification link. A human must click that link within 30 days or the provisional account and its

claim_domain

Register a subdomain (label.makes.fyi or label.agentdomains.co) on this account, optionally creating its first DNS record in the same call. An email i

list_domains

List every subdomain on this account, with each one's DNS records and whether it is forwarding, proxying, or delegated to external nameservers.

get_domain

Show one subdomain in full: its fqdn, DNS records, forward or proxy configuration, and delegation state.

delete_domain

DESTRUCTIVE AND IRREVERSIBLE: permanently delete a subdomain and every DNS record, forward, and proxy attached to it. The hostname stops resolving imm

add_dns_record

Add a DNS record to a subdomain you already own. Use type A or AAAA to point at an IP address, CNAME to point at another hostname, or TXT for verifica

delete_record

DESTRUCTIVE: permanently remove ONE DNS record from a subdomain, keeping the name and every other record. Use this to undo a single record — a wrong I

add_acme_challenge

Publish a Let's Encrypt DNS-01 challenge: creates a TXT record at _acme-challenge.<label>.<domain> with the token your ACME client printed. Use this t

set_forward

Forward (HTTP-redirect) a subdomain to another URL. Claims the label first if you do not own it yet, in which case an email may be required exactly as

remove_forward

Stop forwarding a subdomain. The name itself stays registered on the account; only the redirect is removed.

set_proxy

Serve a backend at this subdomain through the AgentDomains edge, which terminates TLS with its own certificate — this is how you get working HTTPS on

remove_proxy

Stop reverse-proxying a subdomain, so the edge no longer serves the backend or terminates TLS for it. The name stays registered on the account.

delegate_nameservers

Delegate the subdomain to your own nameservers, handing you full control of it and everything beneath it (your own records, MX, deeper sub-domains). A

delete_account

DESTRUCTIVE AND IRREVERSIBLE, AND THE LARGEST ONE HERE: delete the whole AgentDomains account and invalidate its API key, which cannot be recovered or

upgrade_to_pro

Get a Stripe checkout link for AgentDomains Pro: 100 names instead of the free 10, names never released for being unreachable, and priority email supp

+1 more tool

Spec conformance20%100
Security (OWASP MCP)30%100
Reliability / performance20%84
Tool hygiene15%47
Transparency / provenance15%90

Observed behavior

No proxied traffic observed for this host yet. Connect it at /connect and its grade gains a measured Reliability score + per-tool behavioral evidence — the half a static scan can't produce.

Findings

No blocking issues found in the static + spec checks.
Grade another server

We re-grade mcp.agentdomains.co on a schedule and alert your Slack/webhook the moment its tools change or its grade drops — rug-pull insurance for the connection.

Run mcp.agentdomains.co? Claim it (free) to get drift alerts and show an independently-verified trust badge. The grade stays free — claiming just ties it to you.

Share this report card

A 1200×630 card with the grade + audit — drop it in a post, Slack, or your repo.

MCP Trust report card — mcp.agentdomains.co grade B+
Share on X Open card image

Embed this grade

A live badge — it re-verifies itself and shows current stability. Static scorecards can't. Paste it in your README or site to show users you're independently audited.

MCP Trust Grade B+ · wmcp.sh
[![MCP Trust Grade B+](https://wmcp.sh/mcp/grade/mcp.agentdomains.co/badge.svg)](https://wmcp.sh/mcp/grade/mcp.agentdomains.co)
<a href="https://wmcp.sh/mcp/grade/mcp.agentdomains.co"><img src="https://wmcp.sh/mcp/grade/mcp.agentdomains.co/badge.svg" alt="MCP Trust Grade B+ · wmcp.sh"></a>

Agents: check this before connecting

Add the wmcp.sh trust oracle as an MCP server and call grade_mcp_server / check_mcp_drift in your agent's pre-connection gate:

https://wmcp.sh/mcp/trust
How this grade is computed. An open, independent rubric — Spec conformance (20%), Security mapped to the OWASP MCP Top 10 (30%), Reliability (20%), Tool hygiene (15%), Transparency (15%) — run by connecting to the server and inspecting its real MCP surface. The grade is free and identical whether or not the operator pays. v1 uses static + spec signals from a single connection; continuous uptime, real latency, and annotation-truthing (declared readOnly vs observed behavior) layer on via the wmcp.sh proxy.