# BTOVEN MCP

> A free, anonymous, read-only Model Context Protocol server operated by BTOVEN NETWORK. It exposes utilities in two pillars — (1) internet security testing and (2) data privacy, sovereignty and anonymity checks — as MCP tools. No accounts, no API keys, no identity, no client data stored. All tools are idempotent lookups over open APIs.

## Endpoint

- URL: `https://agents.btoven.net/mcp`
- Transport: Streamable HTTP (JSON responses; stateless, no session)
- Auth: none (per-IP rate limiting only; no identity attached to usage)
- Idempotency: all tools are read-only GET-style lookups; retry-safe
- Server card: `https://agents.btoven.net/.well-known/mcp.json`
- This file: `https://agents.btoven.net/llms.txt`
- Docs / install UI: https://agents.btoven.net

## Install

```bash
# OpenCode
opencode mcp add btoven --url https://agents.btoven.net/mcp --global
# Claude Code
claude mcp add --transport http btoven https://agents.btoven.net/mcp
```

Generic MCP client config:

```json
{ "mcpServers": { "btoven": { "type": "streamable-http", "url": "https://agents.btoven.net/mcp" } } }
```

## Tools — Security testing (5)

### security_headers_check

Scan the HTTPS security headers of a domain and return a 0-100 score, the grade class, which headers are present and which are missing (CSP, HSTS, X-Frame-Options, etc.). Read-only, safe to retry.

Returns: Compact score object: {domain, score 0-100, score_class, https_enabled, headers_present[], headers_missing[{name, recommendation}]}.

Parameters:
- `url` (required) — Domain or URL to scan (example.com or https://example.com)

- Upstream: `GET https://securityheaders.btoven.net/api/lookup` (public JSON API)
- Upstream UI: https://securityheaders.btoven.net
- Cache: 600s server-side (memory only)

### securitytxt_check

Validate the /.well-known/security.txt file of a domain: fetch results, RFC 9116 validation successes and errors (expiry, contact, encryption fields, HTTPS requirement). Read-only, safe to retry.

Returns: {domain, well_known_url, valid, validation_successes[], validation_errors[], fetch_successes[], fetch_errors[]}.

Parameters:
- `url` (required) — Domain or URL whose security.txt should be validated

- Upstream: `GET https://securitytxt.btoven.net/api/lookup` (public JSON API)
- Upstream UI: https://securitytxt.btoven.net
- Cache: 600s server-side (memory only)

### email_auth_check

Check the email authentication posture of a domain: SPF, DKIM selectors, DMARC, MX and CAA records with a 0-100 score. Useful before sending mail from a new domain. Read-only, safe to retry.

Returns: {domain, score 0-100, score_class, spf{present, all_qualifier}, dkim_selectors[], dmarc{present, policy}, errors[]}.

Parameters:
- `domain` (required) — Domain to check (example.com)

- Upstream: `GET https://emailauth.btoven.net/api/lookup` (public JSON API)
- Upstream UI: https://emailauth.btoven.net
- Cache: 600s server-side (memory only)

### agent_skills_lookup

Return the agent skills (MCP-style tools/capabilities) a domain advertises via /.well-known/agent-skills/index.json, plus fetch/parse diagnostics. Read-only, safe to retry.

Returns: {domain, index_url, skills_count, skills[], plus fetch/parse/validation diagnostics}.

Parameters:
- `url` (required) — Domain or URL to query for advertised agent skills

- Upstream: `GET https://agent-skills.btoven.net/api/lookup` (public JSON API)
- Upstream UI: https://agent-skills.btoven.net
- Cache: 600s server-side (memory only)

### security_report

One-call consolidated security report for a domain: runs security headers, security.txt, email auth and WHOIS/DNSSEC lookups server-side in parallel, then returns scores, validity flags and PRIORITIZED recommendations with reasons. Read-only and idempotent; every sub-result keeps its own cache. Use this first when auditing a domain, then the individual tools for follow-ups.

Returns: {domain, scores{security_headers, email_auth}, valid{securitytxt, dnssec}, recommendations_count, recommendations[{priority, action, why}] max 10, details? (only with details=full), errors?}

Parameters:
- `domain` (required) — Domain to audit (example.com)
- `details` (optional, default: summary) — 'summary' (scores+recommendations only, compact) or 'full' (adds the 4 sub-results as evidence)

- Upstream: composite of `security_headers_check + securitytxt_check + email_auth_check + whois_summary` (parallel server-side fan-out, each sub-result cached)
- Cache: 300s server-side (memory only)

## Tools — Privacy & sovereignty (5)

### wkd_lookup

Look up an OpenPGP key via Web Key Directory (WKD), trying the Advanced method (openpgpkey subdomain) and the Direct method. Returns whether a key was found and any fetch errors. Read-only, safe to retry.

Returns: {email, key_found, key_fingerprint, methods_tried[{method, uri, found, errors}], errors[], successes[]}.

Parameters:
- `email` (required) — Email address whose owner key should be looked up

- Upstream: `GET https://wkd.btoven.net/api/lookup` (public JSON API)
- Upstream UI: https://wkd.btoven.net
- Cache: 3600s server-side (memory only)

### dane_lookup

Validate the OPENPGPKEY (TYPE 61) DNS record of an email address, secured by DNSSEC (RFC 7929 DANE-OPENPGP). Returns whether a key was published and DNS/record diagnostics. Read-only, safe to retry.

Returns: {email, dns_name, key_found, plus DNS/record errors[] and successes[]}.

Parameters:
- `email` (required) — Email address whose OPENPGPKEY record should be checked

- Upstream: `GET https://dane.btoven.net/api/lookup` (public JSON API)
- Upstream UI: https://dane.btoven.net
- Cache: 3600s server-side (memory only)

### web_search

Privacy-respecting metasearch across Google, Bing, DuckDuckGo, Qwant, Wikipedia and more via the BTOVEN SearXNG instance. Returns titles, URLs and snippets with no tracking. Read-only, safe to retry.

Returns: {query, results[{title, url, snippet max 300 chars, engine}] max 10, answers[], suggestions[]}.

Parameters:
- `q` (required) — Search query
- `categories` (optional, default: general) — Comma-separated categories: general, images, news, videos, music, it, science, files
- `language` (optional) — UI/results language code (en, es, de...). Auto if omitted

- Upstream: `GET https://searxng.btoven.net/search` (public JSON API)
- Upstream UI: https://search.btoven.net
- Cache: 900s server-side (memory only)

### translate_text

Translate text between languages using the self-hosted LibreTranslate instance. Deterministic for the same input (source/target pinned), so it is safe to retry. Read-only: nothing is stored.

Returns: {translated_text, detected_language?} — deterministic for the same input and languages.

Parameters:
- `q` (required) — Text to translate
- `source` (optional, default: en) — Source language code (auto-detect if omitted)
- `target` (optional, default: es) — Target language code

- Upstream: `POST https://translate.btoven.net/translate` (public JSON API)
- Upstream UI: https://translate.btoven.net
- Cache: 86400s server-side (memory only)

### ip_details

Reveal what an IP address exposes about its holder: reverse DNS, ISP, organization, country/region/city, timezone and coordinates. Use it to audit your own egress IPs (VPN/proxy/runner) for location or identity leaks. Read-only, safe to retry.

Returns: {reverse[], isp, org, country, region, city, timezone, lat, lon} for the inspected IP.

Parameters:
- `ip` (required) — IPv4 or IPv6 address to inspect

- Upstream: `GET https://digger.btoven.net/api/ip-details` (public JSON API)
- Upstream UI: https://digger.btoven.net
- Cache: 86400s server-side (memory only)

## Tools — Utility (4)

### rdap_lookup

Query RDAP for domain registration data (handle, status, registrar, events, nameservers) plus enrichment: RIR info, abuse contacts, threat context and ownership validation. Supports domains, IPs, ASN and entities. Read-only, safe to retry.

Returns: {query, query_type, handle, status[], registration/expiration dates, nameservers[], registrar, rir, abuse_contacts[], status_flags[], errors[]}.

Parameters:
- `q` (required) — Domain, IP address, ASN or entity to look up

- Upstream: `GET https://rdap.btoven.net/query` (public JSON API)
- Upstream UI: https://rdap.btoven.net
- Cache: 3600s server-side (memory only)

### list_languages

List the languages available for translation as a COMPACT list of codes and names (target pairs are not included to save tokens — they remain at upstream GET /languages). Static data, safe to retry.

Returns: {count, languages[{code, name}]} — compact list without target pairs (per-language targets stay at upstream GET /languages).

- Upstream: `GET https://translate.btoven.net/languages` (public JSON API)
- Upstream UI: https://translate.btoven.net
- Cache: 86400s server-side (memory only)

### whois_summary

Quick registration summary of a domain: registered or not, registrar, creation date and DNSSEC status (signed delegation or not) — useful to check the sovereignty posture of a domain in one call. Read-only.

Returns: {registered, registrar, createdAt, dnssec: signedDelegation | unsigned}.

Parameters:
- `domain` (required) — Domain to summarize (example.com)

- Upstream: `GET https://digger.btoven.net/api/whois-summary` (public JSON API)
- Upstream UI: https://digger.btoven.net
- Cache: 86400s server-side (memory only)

### favicon_lookup

Resolve the favicon of a domain and return its metadata: source URL, dimensions, format, byte size and dominant color palette — a quick brand/identity fingerprint of a site without loading it. Read-only.

Returns: {url, sourceUrl, width, height, format, bytes, source, palette[] of hex colors}.

Parameters:
- `domain` (required) — Domain whose favicon should be resolved (example.com)
- `size` (optional, default: 64) — Icon size in px (16, 32, 64, 128, 256)
- `format` (optional, default: png) — Output format: png, jpg, webp, ico, svg

- Upstream: `GET https://favicon.btoven.net/{domain}` (public JSON API)
- Upstream UI: https://favicon.btoven.net
- Cache: 86400s server-side (memory only)

## Response conventions

- Success: MCP tool result, single `text` content block containing JSON.
- Failure: tool result with `isError: true`; the text is ONE compact JSON envelope: `{"error": code, "message", "status"?, "retry_after_s"?, "retry": "honor-retry-after"|"backoff"|"never"}`.
- Live codes: `rate_limited` (429 → wait retry_after_s), `upstream_unavailable` (503 → backoff), `timeout` (504 → backoff), `upstream_error` / `invalid_arguments` (4xx → fix args, do not retry unchanged).
- Planned code: `payment_required` (HTTP 402, x402) — documented, NOT yet emitted; when it appears: never loop, surface the cost to the user, proceed only with an approved payment (free alternatives may exist). See https://agents.btoven.net/#errors
- Transport-level HTTP 429: back off and retry honoring `Retry-After`; every `/mcp` response carries `X-RateLimit-Limit` / `-Remaining` / `-Reset`.
- Full error catalog (live + planned) and data policy: MCP resource `btoven://policy`.

## Principles

- No costs or mandatory registration
- No client data stored; no client logs; no identity attached to usage
- Read-only, idempotent tools over open BTOVEN APIs
- Each upstream service also runs standalone