mcp BTOVEN/MCP agents.btoven.net/mcp
Model Context Protocol · Streamable HTTP

Free network utilities, as tools for your AI agent.

agents.btoven.net is a single remote MCP endpoint that connects any MCP client to the BTOVEN NETWORK toolkit — built around two pillars: internet security testing (headers, email auth, PGP key discovery, RDAP) and privacy, data sovereignty and anonymity (private metasearch, translation, leak checkers). Anonymous, read-only and free.

Install in your client Browse 14 tools
POST https://agents.btoven.net/mcp · no auth · no data stored
agent → agents.btoven.net live example 
tools/call
  name : security_headers_check
  args : { "url": "example.com" }

→ {
    "domain": "example.com",
    "score": 9,
    "score_class": "score-low",
    "headers_present": ["x-content-type-options"],
    "headers_missing": [
      { "name": "content-security-policy", ... },
      { "name": "strict-transport-security", ... }
    ]
  }

Why this endpoint

🕵

Free & anonymous

No accounts, no API keys, no user database. The server keeps no client data — only a short in-memory result cache.

🔁

Read-only & idempotent

Every tool is a pure lookup: calling it twice returns the same answer. Safe to retry, safe to parallelize.

🔌

One endpoint, many services

One MCP URL connects your agent to the whole BTOVEN toolkit — testers, PGP discovery, RDAP, metasearch, translation.

🎯

Grounded, machine-readable

Raw service responses are summarized into compact JSON with scores and errors — small context, high signal.

📦

Self-hostable

Single Node process + a declarative tools.yaml. Point the upstreams at your own instances and run your own gateway.

📜

Documented for agents

llms.txt, a machine-readable /.well-known/mcp.json server card, and OpenAPI on every upstream tester.

Install

One remote endpoint, four ways to connect. No keys, no signup — copy, paste, done.

OpenCode

opencode mcp add btoven --url https://agents.btoven.net/mcp --global

Add it globally or drop `--global` to scope it to the current project.

Claude Code

claude mcp add --transport http btoven https://agents.btoven.net/mcp

Remote MCP over Streamable HTTP — no local process required.

Any client (JSON)

{
  "mcpServers": {
    "btoven": {
      "type": "streamable-http",
      "url": "https://agents.btoven.net/mcp"
    }
  }
}

Cursor, Windsurf, Zed, Cline, Klein… paste into your MCP config file.

Stdio-only clients

{
  "mcpServers": {
    "btoven": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://agents.btoven.net/mcp"]
    }
  }
}

For clients that only speak stdio (e.g. older Claude Desktop), `mcp-remote` bridges the remote endpoint.

Discovery files: /llms.txt · /.well-known/mcp.json — both generated from the same tool registry the server runs on.

Tools

Two pillars, one gateway: internet security and privacy, data sovereignty and anonymity. Every tool is a plain HTTP lookup against a BTOVEN service — the same public API the testers document in their own llms.txt.

14 tools · all read-only

Security testing

Attack surface and posture of any domain: headers, email auth, exposed agent skills, RFC 9116. 5
security_headers_check
security GET

Scan the HTTPS security headers of a domain and return a 0-100 score, the grade class, which headers are present and which are missing (CSP, HSTS, X-Frame-Options, etc.). Read-only, safe to retry.

Returns: Compact score object: {domain, score 0-100, score_class, https_enabled, headers_present[], headers_missing[{name, recommendation}]}.

url
required — Domain or URL to scan (example.com or https://example.com)
curl example 
curl -s "https://securityheaders.btoven.net/api/lookup?url=example.com"
securitytxt_check
security GET

Validate the /.well-known/security.txt file of a domain: fetch results, RFC 9116 validation successes and errors (expiry, contact, encryption fields, HTTPS requirement). Read-only, safe to retry.

Returns: {domain, well_known_url, valid, validation_successes[], validation_errors[], fetch_successes[], fetch_errors[]}.

url
required — Domain or URL whose security.txt should be validated
curl example 
curl -s "https://securitytxt.btoven.net/api/lookup?url=example.com"
email_auth_check
security GET

Check the email authentication posture of a domain: SPF, DKIM selectors, DMARC, MX and CAA records with a 0-100 score. Useful before sending mail from a new domain. Read-only, safe to retry.

Returns: {domain, score 0-100, score_class, spf{present, all_qualifier}, dkim_selectors[], dmarc{present, policy}, errors[]}.

domain
required — Domain to check (example.com)
curl example 
curl -s "https://emailauth.btoven.net/api/lookup?domain=example.com"
agent_skills_lookup
security GET

Return the agent skills (MCP-style tools/capabilities) a domain advertises via /.well-known/agent-skills/index.json, plus fetch/parse diagnostics. Read-only, safe to retry.

Returns: {domain, index_url, skills_count, skills[], plus fetch/parse/validation diagnostics}.

url
required — Domain or URL to query for advertised agent skills
curl example 
curl -s "https://agent-skills.btoven.net/api/lookup?url=example.com"
security_report
security GET

One-call consolidated security report for a domain: runs security headers, security.txt, email auth and WHOIS/DNSSEC lookups server-side in parallel, then returns scores, validity flags and PRIORITIZED recommendations with reasons. Read-only and idempotent; every sub-result keeps its own cache. Use this first when auditing a domain, then the individual tools for follow-ups.

Returns: {domain, scores{security_headers, email_auth}, valid{securitytxt, dnssec}, recommendations_count, recommendations[{priority, action, why}] max 10, details? (only with details=full), errors?}

domain
required — Domain to audit (example.com)
details
default: summary — 'summary' (scores+recommendations only, compact) or 'full' (adds the 4 sub-results as evidence)
curl example 
curl -s -X POST https://agents.btoven.net/mcp \
  -H 'content-type: application/json' \
  -H 'accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"security_report","arguments":{"domain":"example.com","details":"{details}"}}}'
cache 300s · server-side fan-out

Privacy & sovereignty

Encrypted key discovery (WKD/DANE), search without tracking, translation without a third-party SaaS. 5
wkd_lookup
privacy GET

Look up an OpenPGP key via Web Key Directory (WKD), trying the Advanced method (openpgpkey subdomain) and the Direct method. Returns whether a key was found and any fetch errors. Read-only, safe to retry.

Returns: {email, key_found, key_fingerprint, methods_tried[{method, uri, found, errors}], errors[], successes[]}.

email
required — Email address whose owner key should be looked up
curl example 
curl -s "https://wkd.btoven.net/api/lookup?email=user%40example.com"
dane_lookup
privacy GET

Validate the OPENPGPKEY (TYPE 61) DNS record of an email address, secured by DNSSEC (RFC 7929 DANE-OPENPGP). Returns whether a key was published and DNS/record diagnostics. Read-only, safe to retry.

Returns: {email, dns_name, key_found, plus DNS/record errors[] and successes[]}.

email
required — Email address whose OPENPGPKEY record should be checked
curl example 
curl -s "https://dane.btoven.net/api/lookup?email=user%40example.com"
web_search
privacy GET

Privacy-respecting metasearch across Google, Bing, DuckDuckGo, Qwant, Wikipedia and more via the BTOVEN SearXNG instance. Returns titles, URLs and snippets with no tracking. Read-only, safe to retry.

Returns: {query, results[{title, url, snippet max 300 chars, engine}] max 10, answers[], suggestions[]}.

q
required — Search query
categories
default: general — Comma-separated categories: general, images, news, videos, music, it, science, files
language
optional — UI/results language code (en, es, de...). Auto if omitted
curl example 
curl -s "https://searxng.btoven.net/search?q=privacy%20best%20practices&categories=general"
translate_text
privacy POST

Translate text between languages using the self-hosted LibreTranslate instance. Deterministic for the same input (source/target pinned), so it is safe to retry. Read-only: nothing is stored.

Returns: {translated_text, detected_language?} — deterministic for the same input and languages.

q
required — Text to translate
source
default: en — Source language code (auto-detect if omitted)
target
default: es — Target language code
curl example 
curl -s -X POST "https://translate.btoven.net/translate" \
  -H 'content-type: application/json' \
  -d '{"q":"hello world","source":"en","target":"es"}'
ip_details
privacy GET

Reveal what an IP address exposes about its holder: reverse DNS, ISP, organization, country/region/city, timezone and coordinates. Use it to audit your own egress IPs (VPN/proxy/runner) for location or identity leaks. Read-only, safe to retry.

Returns: {reverse[], isp, org, country, region, city, timezone, lat, lon} for the inspected IP.

ip
required — IPv4 or IPv6 address to inspect
curl example 
curl -s "https://digger.btoven.net/api/ip-details?ip=1.1.1.1"

Utility

Domain registration intel (RDAP) and language support. 4
rdap_lookup
utility GET

Query RDAP for domain registration data (handle, status, registrar, events, nameservers) plus enrichment: RIR info, abuse contacts, threat context and ownership validation. Supports domains, IPs, ASN and entities. Read-only, safe to retry.

Returns: {query, query_type, handle, status[], registration/expiration dates, nameservers[], registrar, rir, abuse_contacts[], status_flags[], errors[]}.

q
required — Domain, IP address, ASN or entity to look up
curl example 
curl -s "https://rdap.btoven.net/query?q=example.com"
list_languages
utility GET

List the languages available for translation as a COMPACT list of codes and names (target pairs are not included to save tokens — they remain at upstream GET /languages). Static data, safe to retry.

Returns: {count, languages[{code, name}]} — compact list without target pairs (per-language targets stay at upstream GET /languages).

curl example 
curl -s "https://translate.btoven.net/languages"
whois_summary
utility GET

Quick registration summary of a domain: registered or not, registrar, creation date and DNSSEC status (signed delegation or not) — useful to check the sovereignty posture of a domain in one call. Read-only.

Returns: {registered, registrar, createdAt, dnssec: signedDelegation | unsigned}.

domain
required — Domain to summarize (example.com)
curl example 
curl -s "https://digger.btoven.net/api/whois-summary?domain=example.com"
favicon_lookup
utility GET

Resolve the favicon of a domain and return its metadata: source URL, dimensions, format, byte size and dominant color palette — a quick brand/identity fingerprint of a site without loading it. Read-only.

Returns: {url, sourceUrl, width, height, format, bytes, source, palette[] of hex colors}.

domain
required — Domain whose favicon should be resolved (example.com)
size
default: 64 — Icon size in px (16, 32, 64, 128, 256)
format
default: png — Output format: png, jpg, webp, ico, svg
curl example 
curl -s "https://favicon.btoven.net/{domain}?domain=example.com&size=64&format=png"

How it works

1 · client

Your MCP client calls a tool over Streamable HTTP at agents.btoven.net/mcp. No session, no state — each request stands alone.

2 · gateway

The server validates arguments against tools.yaml, applies per-IP rate limits, checks its in-memory cache and summarizes the response for LLM consumption.

3 · services

It fans out to BTOVEN services (*.btoven.net) over their public JSON APIs — each one an independent, self-hosted project you can also run alone. 

┌────────────┐   POST /mcp    ┌───────────────────┐   HTTPS    ┌─────────────────────────┐
│ MCP client │ ─────────────▶ │ agents.btoven.net │ ─────────▶ │ securityheaders / wkd / │
│ (agent/IDE)│ ◀─ JSON/SSE ── │ rate limit+cache  │ ◀─ JSON ── │ rdap / searxng / lt …   │
└────────────┘                │ (stateless)       │            └─────────────────────────┘
                              └───────────────────┘
        no accounts · no identity · no client logs · results cached in memory only

Errors, limits & future payments

Every failure is machine-readable: tool errors return isError: true with one compact JSON envelope {"error":"…","retry":"…","retry_after_s":N} so the client reacts instead of guessing — today with rate limits, tomorrow with x402 payments (shape documented, not yet active).

Code / HTTP Cuándo Reacción del cliente Estado
rate_limited · 429 Límite por IP alcanzado (también header transport) Esperar retry_after_s / Retry-After, reintentar una vez live
upstream_unavailable · 503 Upstream caído o saturado Backoff exponencial con jitter live
timeout · 504 Upstream sin respuesta Backoff y reintentar una vez live
upstream_error · invalid_arguments 4xx: input rechazado o argumentos malos Corregir argumentos; reintentar igual falla igual live
payment_required · 402 Tool de pago (gate x402 por ruta) Nunca en bucle: mostrar el costo al usuario, continuar solo con pago aprobado; existe alternativa gratuita planned

En cada respuesta /mcp: X-RateLimit-Limit · -Remaining · -Reset · X-Cache-Policy. Catálogo completo (live + planned) en el recurso MCP btoven://policy. Authentik (401) queda para cuando haya identidad — hoy es opcional y anónimo.

FAQ

› Do you store anything about me?

No. There is no user database, no accounts and no client logging. Results are cached in memory with a short TTL to keep upstream services fast, and the cache is keyed by tool + arguments only.

› What does idempotent mean here?

All tools are read-only lookups. Making the same call twice gives the same result and has no side effects, so agents can safely retry after timeouts or rate-limit responses.

› Is it really free? What is the catch?

The whole BTOVEN NETWORK is free and self-hosted with no usage quotas for humans and agents. Abuse is handled with per-IP rate limits, not with accounts. Enterprise SLA support lives at BTOVEN.com.

› Can I add or customize endpoints?

Yes — tools are declared in a single tools.yaml (name, upstream URL template, parameters, response transform). The server loads it at startup: adding a tool is a config change, not a code change.

› Will there be paid tools or API keys?

Not for now. The design leaves room for both: an optional x402 payment gate per route (crypto micropayments) and OIDC/API-key auth via Authentik — both can be enabled later without rewriting the tools.

› How do I run my own instance?

Clone the repo, `npm install && npm run build`, then `npm start`. Point tools.yaml at your own service instances. No database, no migrations, no background jobs.

› What happens if I hit the rate limit — or when paid tools arrive?

Today: HTTP 429 with Retry-After and X-RateLimit-* headers, or a tool error envelope like {"error":"rate_limited","retry_after_s":30,"retry":"honor-retry-after"} — wait that long, retry once, never loop. In the future, paid tools (x402) will answer with error "payment_required" (HTTP 402): the documented behavior is to show the cost to the user and continue only with an approved payment — free tools stay free. The full catalog (live + planned) lives in the MCP resource btoven://policy and at /#errors.

Ready? One command.

opencode mcp add btoven --url https://agents.btoven.net/mcp --global

Part of BTOVEN NETWORK — free, self-hosted, privacy-first services. Need an SLA or dedicated deployment? BTOVEN.com.