Netonica
Run a free check

What we check

Six checks, one question: did it change?

Each check looks at one part of what your domain tells the outside world. We record the answer, compare it with the last one, and only speak up when something moved.

TLSPQC DNS MCP robots.txt Agent Card x402

TLS

Live

Every TLS endpoint makes promises: a chain a client will trust, a named owner, a date it stops being true. We handshake the way a browser does, write down what was presented, and compare it against what stood there last time.

Run this check

What one scan records

  • Which protocol versions answer, from TLS 1.0 to 1.3
  • The chain as served: issuer, subject, names, key fingerprint
  • Days left before the leaf certificate expires
  • Whether an ordinary client verifies the chain
  • Negotiated cipher, key exchange group and ALPN

What we tell you about

  • The chain stopped verifying, so clients see errors now
  • Expiry crossed 90, 30, 14 or 7 days, or ran out
  • The issuing CA changed, or the key was rotated
  • Names were added to or dropped from the certificate
  • A protocol version, cipher or group came or went

PQC

Live

Traffic recorded today can be opened later, once the machine to open it exists. Hybrid key exchange closes that window. We ask your endpoint three questions in three handshakes, and record which answers it is willing to give.

Run this check

What one scan records

  • Whether hybrid X25519MLKEM768 key exchange is accepted
  • Whether classical-only key exchange still works
  • Which group the server picks when offered both
  • Whether TLS 1.3 is available at all
  • Whether the certificate carries a post-quantum signature

What we tell you about

  • Hybrid key exchange was turned off
  • TLS 1.3 disappeared from the endpoint
  • Hybrid key exchange arrived for the first time
  • The preferred group changed under you
  • A post-quantum certificate showed up

DNS

Live

A name is the front door, and everything follows it. We ask one record type at one name, write the answers down as a set, and compare that set with the last one. A TTL ticking down is not a change; the records are.

Run this check

What one scan records

  • Every answer for one record type at one name
  • A, AAAA, CNAME, MX, NS, SRV or TXT, one type per monitor
  • The answers as a set, so their order is not a change
  • Whether the name answers with nothing at all

What we tell you about

  • The whole record set vanished
  • A name that answered with nothing started answering
  • One record was swapped for another
  • A record was added, or one was removed

MCP

Live

An MCP server tells agents which tools exist and what they do. A description rewritten quietly is a new instruction to every agent that reads it, and nothing else would show you. We speak the protocol, list what is on offer, and diff it.

Run this check

What one scan records

  • Server name, version and protocol version
  • Every tool: name, title, description and input schema
  • Resources and prompts the server exposes
  • Whether a token is required, and under which scheme
  • The capabilities the server advertises

What we tell you about

  • Authentication stopped being required
  • A tool description or title was rewritten
  • A tool's input schema gained or lost a field
  • A tool appeared or disappeared
  • Resources, prompts or capabilities changed

robots.txt

In build

robots.txt is the one place you tell crawlers and AI agents what they may take. It is edited by hand, rarely, and a deploy can replace it without anyone reading the diff.

What one scan records

  • Whether the file is served, and with what status
  • Allow and disallow rules, per user agent
  • Rules aimed at AI crawlers specifically
  • Sitemap and crawl-delay directives
  • Lines no crawler will honour

What we tell you about

  • The file went missing, or stopped parsing
  • A disallow rule was dropped
  • An AI crawler was newly allowed, or newly blocked
  • The sitemap now points somewhere else

Agent Card

In build

An agent card is what another system reads before it calls you: who you are, what you can do, where to send the request and how to authenticate. When it drifts, your callers are working from an older answer than you think.

What one scan records

  • Whether the card is served, and matches its schema
  • Declared name, version and provider
  • Skills, and what each one claims to do
  • Endpoint URLs, and the transports on offer
  • The authentication schemes it declares

What we tell you about

  • The card vanished, or stopped validating
  • A skill was added, removed or reworded
  • An endpoint moved to another URL
  • Authentication requirements were weakened

x402

Live

x402 turns HTTP 402 into a working handshake, so an agent can pay per call with no account to open first. The terms quoted there are money, so a change to them is a change to what your callers pay. We ask one path once and never pay, so the quote is all we ever hold.

Run this check

What one scan records

  • Every payment option: scheme, network, asset and address
  • The price exactly as quoted, in the units it was quoted in
  • The signing domain a paying client has to match
  • Whether the terms come in the body or in a header
  • Whether a shared cache may keep the answer, and who is in front

What we tell you about

  • The receiving address changed
  • The endpoint stopped charging and answers for free
  • The price, asset or network moved
  • A cache guard was lost, or a CDN appeared in front
  • A payment option was added or withdrawn

The same method, every check

Record, compare, report

Every check runs on the schedule you choose, and behaves the same way once it does.

1

We record the answer

Each scan is written down in full, in one canonical shape, so two scans can be compared field by field.

2

We compare it with the last one

Only a real difference counts. Noise that means nothing — ordering, formatting — never reaches you.

3

We tell you what moved

A change arrives named and ranked, with the before and the after, and it stays as evidence.

One last thing

Run a check on your own domain.

If it comes back clean, you have lost nothing. If it does not, you found out today.

Run a free check

No card needed