Ask, don’t dig.
argus0 is an MCP server. Connect it once and ask your assistant about your domains — every answer is computed from your own reports, never guessed.
Any spoofing overnight?
Asked argus0 list_incidents get_domain_failures
Yes, one source. In the reports that arrived overnight, covering 13 Oct, 185.220.101.4 sent 2,918 messages as company.com. Your policy is p=reject, so receivers refused all of them.
Connect it
- In Claude open Settings → Connectors → Add custom connector.
- Paste the URL above and click Add.
- Sign in to argus0 and click Allow access.
- Ask away. Revoke any time from My Account → AI assistants.
Read-only, except marking an incident as fixed. It never touches your DNS.
Morning briefing, please.
Overnight: one new incident on company.com — 2,918 spoofed messages from 185.220.101.4, delivered because the policy is still p=none. Two domains are ready for quarantine; one has no DMARC at all. Nothing else changed.
What it can answer
- get_dashboard_summary
- list_incidents
- check_domain
- get_domain_failures
- list_domains
- get_top_senders
- find_source
- get_domain_history
- list_subdomains
- resolve_incident (needs the write permission, dmarc:write)