Nel Veil

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/nelproinc-nel-veil

About

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list and install config. Checked Oct 25, 2026.

Tools

9 read · 0 write · 0 deleteRead-only

Secrets

None asked for

Install scripts

Not scanned yet

Runs as

Node.js package

Tools (9)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

• check_complianceAssess a domain's readiness signals against compliance frameworksread-only

  Answers: what do this domain's public-facing security signals suggest about its alignment with the laws and standards that apply to it? Runs one passive scan and maps the findings onto a register of 102 frameworks — GDPR, UK GDPR, PIPEDA, CCPA/CPRA and the US state privacy acts, NIS2, DORA, the EU AI Act, PIPL, APPI, POPIA, ISO 27001, SOC 2, PCI DSS, NIST CSF and more — returning a per-framework readiness score with the specific provision each finding bears on. READ THE COVERAGE FIELD BEFORE RELAYING A SCORE. Every framework reports how many of the scan categories it relies on were actually ob…

• check_email_spoofingCheck if a domain can be email-spoofedread-only

  Answers: can someone send email that appears to come from this domain? Checks the published SPF, DKIM and DMARC DNS records — whether DMARC exists, whether its policy actually blocks spoofed mail (p=none only monitors, it does not stop anything), whether SPF is present and not overly permissive, and whether the records are syntactically valid. Returns a 0-100 score plus specific findings, each tied to the record it came from, so the exact problem can be quoted. This is a free check that uses public information: DNS records and ordinary HTTP requests. It does no port scanning and no exploit tes…

• check_exposed_filesCheck a domain for publicly exposed sensitive filesread-only

  Answers: is this domain publicly serving files it should not be? Requests a small, fixed list of well-known sensitive paths — things like .env, .git/config, backup archives and exposed configuration — and reports which return real content rather than a 404. Returns a 0-100 score plus a finding per exposed path. How it works, stated plainly: it makes ordinary GET requests for a small FIXED list of well-known paths. It does not brute-force, fuzz, or enumerate — the list never grows and never adapts to what it finds. Note that these are paths an ordinary crawler would not request (.env, .git/conf…

• check_security_headersCheck a domain's HTTP security headersread-only

  Answers: does this site send the HTTP response headers that protect visitors in the browser? Checks for Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options / frame-ancestors, Referrer-Policy and Permissions-Policy — whether each is present and whether its value is actually protective rather than nominal. Returns a 0-100 score plus a finding per header explaining what a missing or weak value exposes. This is a free check that uses public information: DNS records and ordinary HTTP requests. It does no port scanning and no exploit testing. Use this for clic…

• check_subdomain_takeoverCheck a domain for subdomain-takeover riskread-only

  Answers: does this domain have DNS records pointing at services someone else could claim? Inspects published DNS records for dangling CNAMEs — entries still pointing at a de-provisioned cloud or SaaS host (an unclaimed bucket, an expired app instance) that an attacker could register and then serve content from a hostname users already trust. Returns a 0-100 score plus a finding per at-risk record, naming the record and the service it points to. How it works, stated plainly: it resolves a small fixed list of common subdomain names (www, mail, dev, staging and similar) and, for any that resolve …

• check_tlsCheck a domain's HTTPS/TLS configurationread-only

  Answers: is this domain's HTTPS certificate valid, trusted, and about to expire? Makes ONE ordinary TLS handshake to port 443 — the same thing a browser does when it loads the site — and reports what the server presents: the certificate issuer and subject, the validity window and how many days remain, the subject alternative names, and the protocol and cipher that were negotiated. It flags an expired certificate, one expiring within 14 or 30 days, a self-signed certificate, an untrusted chain, a certificate that does not cover the hostname, and a connection negotiated over deprecated TLS 1.0 o…

• get_scan_reportRetrieve a previously run NEL VEIL scan by its idread-only

  Answers: what did an earlier NEL VEIL scan find? Fetches the stored results of a scan already run at nelprofessional.com, by its scan id (the scn_... identifier shown on the scan page and in its shareable report link). Returns the saved findings and score for that scan. Use this to pull a scan someone already ran on the website into the conversation — to summarise it, compare it against a later scan, or turn it into a remediation plan. It cannot start a new scan: use scan_domain for that. It only reads scans that exist and are publicly retrievable by id.

• list_compliance_frameworksList the compliance frameworks NEL VEIL can assess a domain againstread-only

  Answers: which laws, regulations and standards can this tool report on, and which can it not? Returns the full register — 102 frameworks across Canada, the United States, the EU/EEA, the United Kingdom, Asia-Pacific, Africa and global standards (ISO 27001, SOC 2, PCI DSS, NIST CSF and others) — grouped by region, each with its id, jurisdiction, regulator and subject area. Each entry says whether it is externally ASSESSABLE. Around a quarter are not: an anti-money-laundering regime, a consumer-protection statute, a criminal offences provision or a securities disclosure rule imposes no technical…

• scan_domainRun a full passive security posture scan of a domainread-only

  Answers: what is this domain's overall security posture? Runs every passive NEL VEIL module in one pass — DNS, email authentication (SPF/DKIM/DMARC), TLS, HTTP security headers, cookies, CORS, exposed files, subdomain-takeover risk, technology fingerprinting, breach exposure, domain reputation, cloud misconfiguration and JavaScript supply chain — and returns findings from all of them with a per-module score. Use this when the question is broad: how secure is this domain, review this vendor, what should we fix first. For a single specific question prefer the narrower tool — check_email_spoofing…

Signals

Stars

0

Forks

0

Open issues

0

Last commit

Sep 4, 2026 (1 month ago)

Last release

Sep 2, 2026 (1 month ago)

From GitHub (fetched Oct 24, 2026).

Details

Registry name

io.github.NELPROINC/nel-veil

Version

0.2.0

Auth

No auth

Packages

npm nel-veil-mcp

License

MIT

Repository

github.com/NELPROINC/nel-veil-mcp

First seen

Oct 24, 2026

Last checked

Oct 24, 2026

Source

Official MCP Registrygithub-graphql