shohei

日本語 | 中文

SHOHEI — Security Host Observation & Healthy Evaluation Instrument

shohei v2.5.1 — Rust infrastructure diagnostics library with 168 MCP tools across 62 modules. Comprehensive security, OSINT, threat intelligence, and governance coverage. DNSSEC chain validation, DANE/TLSA, modern protocols, IPv6 dual-stack, security headers, technology fingerprinting, CVE lookup, typosquatting detection, and redirect analysis built in. 0 API keys required — all free/open APIs. Use in Rust projects or hand to Claude for autonomous diagnosis.

Core Diagnostics (v1.0+)

• MCP server for Claude — 168 diagnostic tools; ask "Check example.com's TLS certificate, DNSBL status, IPv6 support, technology stack, CVE vulnerabilities, typosquatting variants, and redirect chain" for autonomous analysis
• TLS certificate inspection — DANE/TLSA validation (RFC 6698), chain analysis, OCSP responder detection, IPv6 support, OCSP stapling detection, TLS version probing (1.0–1.3), cipher suite enumeration
• Email security scoring — MX records, SPF, DKIM, DMARC, BIMI, MTA-STS, TLS-RPT validation with 0–100 compliance score + issue linting
• IP reputation — DNSBL checks against Spamhaus, Barracuda, SORBS; reverse DNS (PTR) + forward-confirmed reverse DNS (FCrDNS)
• CDN/WAF detection — Identify Cloudflare, AWS CloudFront, Fastly, Akamai, Vercel, Netlify, Imperva via HTTP headers
• DNS delegation audit — SOA serial consistency check, lame delegation detection across authoritative NS
• Domain health report — Composite scoring across MX, SPF, DMARC, TLS, DNSSEC
• Security headers audit — CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy with risk scoring

DNS & Network (v1.0+)

• DNS propagation checker — Verify domain consistency across 6 global resolvers (Google, Cloudflare, Quad9, OpenDNS, 1.1.1.1, 8.8.8.8)
• DNSSEC chain tree — see every DS, DNSKEY, and trust step from . to your domain; per-zone validation runs in parallel; add -v for key tags and algorithm names
• Iterative resolution trace — watch queries travel from root servers to TLD to authoritative NS
• Latency benchmarking — Multi-transport timing: System, DoH, DoT, DoQ across multiple rounds
• Reverse DNS — PTR lookups for IPv4/IPv6 with FCrDNS validation
• Subdomain enumeration — Check common subdomains (www, mail, api, staging, dev, etc.) with DNS resolution + HTTP status + TLS validity
• Port reachability — TCP connectivity test for 15 common ports (SSH/22, HTTP/80, HTTPS/443, SMTP/25, MySQL/3306, etc.) with banner grab
• IPv6 dual-stack checker — Verify AAAA records, IPv6 TCP/TLS/HTTP reachability, dual-stack completeness
• DNS amplification potential — Measure UDP query/response size ratio, DDoS attack risk assessment
• Wildcard DNS detection — Probe random subdomains to detect misconfigured *.domain records
• Traceroute / hop analysis — Multi-platform hop-by-hop latency measurement (Linux/macOS/Windows)

Advanced Features (v1.0+)

• DoH, DoT, and DoQ — DNS-over-HTTPS, DNS-over-TLS, and DNS-over-QUIC built in
• Zone transfer (AXFR) — dump an entire zone from an authoritative server; detect critical misconfiguration
• N-way server comparison — diff any number of resolvers simultaneously with --compare
• Multiple record types — --type a --type aaaa --type mx queries all types concurrently in a single invocation
• Stdin and file batch mode — pipe a list of domains or use -f domains.txt
• JSON output — pipe-friendly for scripting and automation
• Watch mode — auto-refresh at a set interval with --watch
• Interactive TUI — browse records, DNSSEC chain, and trace in a single terminal window (--features tui)
• HTTP protocol detection — Automatically detect HTTP/1.1, HTTP/2, HTTP/3 version in responses
• RPKI/ROA validation — BGP origin authorization checks via Cloudflare API
• ARC authentication — Email chain authentication record validation (DNS-level)
• TLS-RPT checking — SMTP TLS Reporting Policy record discovery and parsing

Web Reconnaissance & Threat Intelligence (v1.3–1.4)

• Technology stack fingerprinting — Identify web server, language runtime, CMS (WordPress/Drupal), frameworks from HTTP headers
• CVE lookup via NVD API — Search for known vulnerabilities (no API key required); integrates with tech fingerprinting
• Typosquatting detection — Generate 200+ domain variants (TLD swap, missing char, transposition, homoglyph, etc.); parallel DNS resolution to find live squats
• URL redirect chain tracing — Follow HTTP redirects hop-by-hop; detect HTTPS→HTTP downgrades and redirect loops
• Parked domain detection — Identify domains parked for sale via header signatures (Sedo, GoDaddy, Bodis, etc.)

Why shohei?

AI-First Infrastructure Diagnostics

Most infrastructure tools are CLI-only. shohei is built for AI agents:

• MCP Server Ready: Expose all diagnostics to Claude, ChatGPT, and custom AI agents without writing integration code
• Claude Desktop Integration: Ask Claude "Check example.com's TLS certificate" → get automated diagnosis with full chain analysis
• Structured Async APIs: Every function returns serializable types (DnsCheckResult, TlsCheckResult, EmailSecurityResult) — perfect for agents
• No CLI, No Python: Pure Rust library + MCP server; scales from single checks to automated monitoring

Developer-Friendly

• Library-first design: Import into Rust projects, CI/CD pipelines, or automation frameworks
• Trust chain validation: The only open-source library that validates DNS → DNSSEC → TLS → DANE/TLSA in one call
• Modern protocols: DoH, DoT, DoQ, DNSSEC, DANE/TLSA all built in
• Automation-friendly: Concurrent queries, batching, multi-resolver checks, and programmatic APIs

Compared to alternatives (dig, dog, drill): shohei is composable—use it in tests, monitoring, CI/CD, or hand it to Claude for autonomous diagnosis.

| Feature | shohei | dig | dog | doggo | q | delv | drill | |---------|:------:|:---:|:---:|:-----:|:-:|:----:|:-----:| | Colored output | ✓ | | ✓ | ✓ | ✓ | | | | DNSSEC chain-of-trust tree | ✓ | | | | | | | | DNSSEC validation | ✓ | ✓ | | | | ✓ | ✓ | | Iterative resolution trace (visual) | ✓ | | | | | | | | Authority + Additional sections | ✓ | ✓ | | | | ✓ | ✓ | | N-way server comparison (--compare) | ✓ | | | | | | | | Zone transfer (AXFR) | ✓ | ✓ | | | | | ✓ | | Watch / auto-refresh (--watch) | ✓ | | | | | | | | Script-friendly output (--short) | ✓ | | | | | | | | Multiple record types (--type a --type mx) | ✓ | | | ✓ | | | | | Reverse DNS shorthand (-x 1.2.3.4) | ✓ | ✓ | | ✓ | | | | | Force TCP (--tcp) | ✓ | ✓ | | | | | ✓ | | Disable recursion (--no-recurse) | ✓ | ✓ | | | | ✓ | ✓ | | Query latency display | ✓ | ✓ | | ✓ | ✓ | | | | DNS-over-HTTPS (DoH) | ✓ | ✓ | ✓ | ✓ | ✓ | | | | DNS-over-TLS (DoT) | ✓ | ✓ | ✓ | ✓ | ✓ | | | | DNS-over-QUIC (DoQ) | ✓ | | | | ✓ | | | | JSON output | ✓ | ✓ | ✓ | ✓ | ✓ | | | | Interactive TUI | ✓ | | | | | | | | Technology stack fingerprinting | ✓ | | | | | | | | CVE lookup (no API key) | ✓ | | | | | | | | Typosquatting detection | ✓ | | | | | | | | URL redirect chain tracing | ✓ | | | | | | | | Parked domain detection | ✓ | | | | | | |

dig = BIND utils 9.16+; q = natesales/q; delv = BIND DNSSEC-validating resolver; drill = ldns-based

v2.4.0 additions: 168 MCP tools across 62 modules, robots.txt/OAuth/OIDC/API exposure, unauthenticated DB/container detection, subdomain takeover (30+ services), DGA risk scoring, DKIM key strength, attack surface composite score, RIPE Stat passive DNS, Azure AD exposure.

v2.5.1 security patch: 9 CRITICAL/HIGH SSRF fixes (VMC fetch, TCP port scan, MX connect, redirect-follow without per-hop validation across 8 modules), 15+ bug fixes (IPv6 DNSBL trailing-dot, Levenshtein panic on IDN, crypto stubs returning valid=true, hardcoded year comparisons, SPF all qualifier never populated, sequential awaits parallelised), 4× performance improvement on trust/threat scoring via tokio::join!.

MCP Security Servers Comparison

shohei v2.5.1 stands out as the most comprehensive free, API-key-free MCP security server:

| Feature | shohei | honeylabs | kastell | unphurl | cloud-audit | maigret | |---------|:------:|:---------:|:-------:|:-------:|:-----------:|:-------:| | MCP Tools | 168 | ~25 | ~30 | ~15 | ~20 | ~35 | | Modules | 62 | ~8 | ~10 | ~5 | ~7 | ~12 | | DNS/DNSSEC | ✓ | ✓ | ✓ | | | | | TLS/Certificate | ✓ | ✓ | ✓ | | | | | Email Security | ✓ | | | | | | | OSINT/Recon | ✓ | ✓ | | ✓ | | ✓ | | Threat Intel | ✓ | | | | | | | WHOIS/Domain | ✓ | | ✓ | | | | | Port/Service | ✓ | | | | | | | IP Reputation | ✓ | ✓ | | | | | | Compliance/Governance | ✓ | | | | ✓ | | | Crypto/Blockchain | ✓ | | | | | | | Web Headers | ✓ | ✓ | | ✓ | | | | API Keys Required | 0 | Multiple | Multiple | Some | Multiple | Multiple | | Free/Open APIs Only | ✓ | Partial | Partial | Partial | Partial | Partial | | Active Maintenance | ✓ | | | | | ✓ | | Open Source | ✓ (MIT) | | | | | ✓ |

Key Advantages:

• 168 MCP tools — largest comprehensive security toolkit (v2.5.1)
• 0 API keys — all tools use free/open public APIs
• 62 modules — DNS, TLS, email, OSINT, threat intel, governance, crypto, web security, supply chain, compliance
• Zero setup cost — no vendor API accounts or authentication required
• Pure library + MCP — Rust library for CI/CD + MCP server for Claude Desktop/agents

Installation

As a library (Rust projects)

Add to your Cargo.toml:

[dependencies]
shohei = "2.4"

Then import and use:

use shohei::resolver::standard::query;

#[tokio::main]
async fn main() {
    let result = query("example.com", "A").await;
    println!("{:?}", result);
}

For full API documentation: cargo doc --open or docs.rs/shohei.

As a CLI (manual diagnosis)

cargo install shohei

Or download a pre-built binary from the releases page.

For the interactive TUI mode:

cargo install shohei --features tui

Library Examples

shohei is designed to be imported and composed in Rust projects. See the examples/ directory:

• propagation_check.rs — Check if a domain is propagated globally
• tls_chain_verify.rs — Validate TLS certificate chains (Phase 2)
• email_security.rs — Check email security records (Phase 1)

Run examples:

cargo run --example propagation_check -- example.com
cargo run --example tls_chain_verify -- example.com
cargo run --example email_security -- example.com

CLI Usage

The CLI is a convenient wrapper around the library for manual inspection and testing.

DNS record query

shohei google.com              # A records (default)
shohei google.com --type AAAA  # AAAA records
shohei google.com --type NS    # Nameservers
shohei gmail.com  --type MX    # Mail exchangers

# Multiple record types in one command
shohei google.com --type a --type aaaa --type mx