API and MCP server

The same check as the home page, callable programmatically — or straight from an AI assistant.

Check a domain

One GET request, one JSON response. No signup, no key.

curl 'https://cyberbilan.ca/api/scan?domain=exemple.com'

The response carries the overall score and grade, then the detail: email (SPF, DKIM, DMARC, MX, advanced posture), website (HTTPS, security headers, certificate), age (RDAP) and dnssec.

Optional sel parameter: an explicit DKIM selector, when the common ones are not in use.

From an AI assistant (MCP)

Cyberbilan exposes an MCP server: your assistant runs the check itself, no copy-paste.

https://cyberbilan.ca/mcp

Two tools are exposed:

• scan_domain — the full check of a domain.
• analyze_email_header — the verdict on a suspicious email header.

curl -X POST https://cyberbilan.ca/mcp \
  -H 'content-type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Limits and fair use

• 40 checks per hour per IP address. Repeat scans of the same domain come from a 10-minute cache and do not count.
• Public data only: DNS, HTTP headers, TLS certificate, reputation lists. No mailbox access.
• The DKIM probe cannot guess a custom or rotating selector: a non-detection does not prove DKIM is missing.

/llms.txt — the summary language models read.