Quiet Failures over MCP

Connect

One endpoint, Streamable HTTP, no authentication:

https://mcp.quietfailures.com/mcp

Claude Code:

claude mcp add --transport http quiet-failures https://mcp.quietfailures.com/mcp

Anything that takes a JSON config — Claude Desktop, Cursor, VS Code:

{
  "mcpServers": {
    "quiet-failures": {
      "type": "http",
      "url": "https://mcp.quietfailures.com/mcp"
    }
  }
}

Some clients accept the bare host without the /mcp path; that works too.

What it can do

Read the datasets. These answer “how common is this?”. They read the same published files the site serves, so a figure quoted through MCP is the figure on the page, with the same citation line.

• list_base_ratesThe whole catalog: every metric, its global figure, sample size and the segment slugs you can ask for.
• find_base_rateKeyword search over the catalog — "dmarc", "certificate expiry uk", "subdomain takeover".
• get_base_rateOne figure in full: confidence interval, how it was measured, its limits, the recent series, and the URL to cite.

Check one domain, live. These answer “what about mine?”. They run real DNS, WHOIS and CT lookups at the moment you ask, through the DomainOps free tools.

• check_email_authLive SPF, DKIM and DMARC audit of up to 50 domains, with a portfolio grade.
• check_subdomain_takeoverEnumerates a domain’s subdomains from CT logs and DNS, then tests each for dangling references across 13 cloud providers.
• check_whoisExpiry date, registrar and nameservers for up to 100 domains — catches registrations about to lapse.

Every tool is read-only and annotated as such, so a client shouldn't need to confirm each call. The three live checks are marked open-world: they reach third-party services and their answers are not reproducible. Nothing here writes, changes or deletes anything.

The pairing it's built for

The two families are meant to be used together, and that is the one thing worth knowing before you start. Ask how common a failure is, then ask whether you have it:

“How many domains have no enforcing DMARC policy — and does mine?”

An agent answers the first half from get_base_rate (a population figure with its confidence interval and a citable URL) and the second from check_email_auth (your actual records, now). The number on its own is trivia; the number plus your position against it is the useful part.

Limits, stated plainly

• Live checks are rate-limited to 3 per hour per tool, per client IP. The dataset tools are not limited.
• The subdomain scan is slow — up to a few minutes on a large domain, because it really does enumerate and test.
• Datasets are aggregate-only. No company is ever named, and a slice is published only where it holds at least 100 measured members — so an absent country or CA means too little data, not zero failures.
• Each control is measured weekly, on a fixed weekday, so figures for different controls can be up to six days apart. Every result carries its own measurement date.
• No accounts, no persistence. See privacy for exactly what is and isn't kept.

Licence and citation

The data is CC BY 4.0 — reuse it, including commercially, with attribution. Every dataset result carries the line to cite and the canonical URL for the figure. The server code is MIT. Those are two different things deliberately: the code is a convenience, the data is the point.

Prefer raw files to a protocol? The catalog is at /datasets/manifest.json, every dataset page has .json and .csv, and there is a plain-text summary for crawlers at /llms.txt.