Nel Veil · LLM Mart

Name: Nel Veil
Author: LLM Mart

No install snippet on purpose. A working MCP config is a command, its arguments and an environment block — the last two are where API keys live, so this catalogue never stores them and cannot publish them. Follow the link above for the authors' own instructions.

Ask your agent "can someone spoof email from example.com?" and get a real answer in about ten seconds.

NEL VEIL MCP gives any MCP-compatible agent nine tools for checking a domain's public security posture: email spoofing (DMARC/SPF/DKIM), TLS weaknesses, HTTP security headers, publicly exposed files, subdomain-takeover risk, a combined scan, retrieval of an earlier scan, and compliance readiness against a register of 102 global frameworks.

Free. No API key. No signup.

Install

Claude Code — one command:

claude mcp add nel-veil -- npx -y nel-veil-mcp

Any MCP client — add this to your config file:

{
  "mcpServers": {
    "nel-veil": {
      "command": "npx",
      "args": ["-y", "nel-veil-mcp"]
    }
  }
}

Run it directly, to check it works:

npx -y nel-veil-mcp

It prints a ready line to stderr — something like nel-veil-mcp 0.2.1 ready — 9 tools, free passive tier. — and then waits for JSON-RPC on stdin. That is correct: it is a stdio server, not a CLI, and stdout carries the protocol, so nothing else is ever written there.

Requires Node 18 or newer.

30 seconds: is your domain spoofable?

After installing, ask your agent:

Check if example.com can be email-spoofed.

It calls check_email_spoofing. Real output for example.com at the time of writing:

Check if a domain can be email-spoofed — example.com
Score: 100/100 (done)

2 findings:
  [LOW] DMARC has no reporting address (rua/ruf), you have no visibility into spoofing
  [LOW] DKIM key may be 1024-bit (weak), 2048-bit recommended

Free check, built from public information. No port scanning and no exploit testing —
though some checks (well-known path requests, admin-panel reachability) do more than
passive reading; see nelprofessional.com/mcp. Active scanning requires verified domain
ownership and runs only at nelprofessional.com.
More: https://www.nelprofessional.com/mcp

That domain is in good shape. The finding people are most often surprised by is a DMARC policy of p=none — it looks configured, monitors everything, and blocks nothing.

Tools

Tool	Answers
`check_email_spoofing`	Can someone send email that appears to come from this domain? (DMARC/SPF/DKIM)
`check_tls`	Is this domain's certificate valid, trusted and not about to expire — and is the connection still negotiating a deprecated TLS version?
`check_security_headers`	Does this site send the headers that protect visitors in the browser?
`check_exposed_files`	Is this domain publicly serving files it should not be?
`check_subdomain_takeover`	Are there DNS records pointing at services someone else could claim?
`scan_domain`	All of the above at once, with a per-module score.
`get_scan_report`	Retrieve a scan already run at nelprofessional.com, by its `scn_…` id.
`list_compliance_frameworks`	Which laws and standards can this be checked against — and which can it not?
`check_compliance`	What do these findings suggest about alignment with GDPR, NIS2, PIPEDA, CCPA, ISO 27001, SOC 2 and 96 more?

Each returns a 0–100 score plus specific findings you can act on.

Compliance

check_compliance maps one passive scan onto a register of 102 frameworks across Canada, the United States, the EU/EEA, the United Kingdom, Asia-Pacific, Africa and the global standards — citing the specific provision each finding bears on.

Read the coverage field before repeating a score. Every framework reports how many of the scan categories it relies on were actually observed, as 9/16: