# Use admintoolkit.io with your agent.

[admintoolkit.io](https://admintoolkit.io/) (`admintoolkit.io`) registers 24 WebMCP tools. 24 of 24 tools declares `readOnlyHint`, so an agent can invoke them through `tools.call`. The registry runs the tool in a fresh headless page on admintoolkit.io and returns untrusted site content.

This page mirrors the [WebMCP Registry](https://wmcp.ai/sites/admintoolkit.io) listing for `admintoolkit.io`, last live-checked by the registry at 2026-09-22T22:21:10.633Z. Run `ghostget webmcp sites.get --input '{"domain":"admintoolkit.io"}' --json` for the current schema; the listing can drift between checks.

## Use admintoolkit.io with my agent

Ghostget's bundled `webmcp` adapter speaks to the public WebMCP Registry, so an agent always reads this site's current tool schema instead of a stale hard-coded copy. Install v0.18.35, sync bundled adapters once, then call the registry operations:

```
bun add --global https://github.com/hraness/ghostget/releases/download/v0.18.35/hraness-ghostget-0.18.35.tgz
ghostget adapter sync-bundled --json
```

**Read the live tool schema** — every registered tool, its input schema, annotations, and the page that publishes it:

```
ghostget webmcp sites.get --input '{"domain":"admintoolkit.io"}' --json
```

**Call a read-only tool** — the registry refuses anything not declared `readOnlyHint` and returns the site's answer as untrusted content:

```
ghostget webmcp tools.call --input '{"domain":"admintoolkit.io","tool":"admintoolkit_analyze_email_headers","input":"{}"}' --json
```

## Registered WebMCP tools

admintoolkit.io publishes 24 tools on admintoolkit.io; 24 declare `readOnlyHint`.

| Tool | What it does | Callable through Ghostget |
| --- | --- | --- |
| `admintoolkit_analyze_email_headers` | Return a read-only email message header report. Accepts pasted RFC 5322 headers. Includes raw Received order, recorded Authentication-Results and caller-configured authserv-id trust; it does not perform cryptographic authentication or rever | Callable read-only tool |
| `admintoolkit_analyze_http_headers` | Return a read-only HTTP response-header report for a public endpoint. Accepts pasted headers or a public URL. Includes security, cache, framing, duplicate/conflicting header fields, prioritized findings and remediation notes. | Callable read-only tool |
| `admintoolkit_calculate_cidr_subnet` | Return a read-only local IPv4 or IPv6 CIDR report. Accepts a CIDR block plus optional split prefix and address family. Includes exact BigInt-derived boundaries and address counts, RFC 3021 /31 and host-route /32 semantics, no IPv6 broadcast | Callable read-only tool |
| `admintoolkit_check_ai_crawler_access` | Return a read-only RFC 9309 robots.txt access report for AI and search crawlers. Accepts robots.txt text or a public robots.txt URL plus an optional path. Includes merged matching groups, octet-normalized longest-match decisions, per-crawle | Callable read-only tool |
| `admintoolkit_check_bimi_record` | Return a read-only BIMI readiness report for a mail domain. Accepts a domain, selector and optional BIMI, DMARC, logo or certificate evidence. Includes TXT syntax, DMARC dependency, asset URL findings and a conservative BIMI draft. | Callable read-only tool |
| `admintoolkit_check_caa_records` | Return a read-only CAA certificate-authority policy report for a domain. Accepts a domain plus optional CAA records and issuer details. Includes issue, issuewild, iodef, ACME parameters, policy gaps and record-generation guidance. | Callable read-only tool |
| `admintoolkit_check_email_auth_records` | Return a read-only SPF, DMARC and DKIM report for a mail domain. Accepts a domain plus optional pasted TXT values. Includes syntax, policy strength, alignment, DNS evidence and record-specific warnings. | Callable read-only tool |
| `admintoolkit_check_mta_sts_policy` | Return a read-only MTA-STS deployment report for a mail domain. Accepts a domain plus optional TXT, policy, MX and TLS-RPT evidence. Includes mode, max-age, syntax, id consistency, MX coverage, conformance findings and remediation warnings. | Callable read-only tool |
| `admintoolkit_check_mx_records` | Return a read-only MX routing report for a mail domain. Accepts a domain name. Includes exchanger hosts, preferences, Null MX, CNAME risk, address resolution and actionable mail-routing warnings. | Callable read-only tool |
| `admintoolkit_check_redirect_indexability` | Return a read-only redirect, canonical and indexability report for a public URL. Accepts a URL. Includes bounded per-hop status and SSRF evidence, final URL, HTML and HTTP canonical hints, robots meta and scoped X-Robots-Tag directives, hre | Callable read-only tool |
| `admintoolkit_check_smtp_tls_readiness` | Return a read-only SMTP TLS delivery readiness report for a mail domain. Accepts a domain and optional MTA-STS, TLS-RPT, DANE and FCrDNS checks. Includes MX, STARTTLS, certificate, policy-alignment and downgrade-risk findings. | Callable read-only tool |
| `admintoolkit_check_tls_configuration` | Return a read-only public TLS configuration report for a host. Accepts host and port plus optional HSTS evidence. Includes separate exact-version probes, a distinct verified default handshake, SAN identity/trust evidence, negotiated cipher | Callable read-only tool |
| `admintoolkit_check_tls_rpt_policy` | Return a read-only SMTP TLS Reporting report for a mail domain. Accepts a domain plus optional TLS-RPT TXT or RUA values. Includes version syntax, reporting destinations, external-provider use, conformance findings and remediation warnings. | Callable read-only tool |
| `admintoolkit_decode_edid_data` | Return a read-only share-safe local EDID capability report. Includes strict hex or local file text decoding, checksum and trust state, a readable timing/VIC/Y420 matrix, CTA audio and speaker topology, qualified HDMI Forum transport, HDR an | Callable read-only tool |
| `admintoolkit_decode_ssl_certificate` | Return a read-only X.509 TLS certificate report. Accepts PEM text or public TLS host details. Includes subject, issuer, SANs, validity, fingerprints, key usage, extensions, hostname and certificate-health findings. | Callable read-only tool |
| `admintoolkit_generate_tlsa_record` | Return a read-only DANE TLSA record report. Accepts host, port, protocol, usage, selector, matching type and optional certificate data. Includes owner name, digest, generated TLSA data and DNS comparison findings. | Callable read-only tool |
| `admintoolkit_show_public_ip_context` | Return a read-only same-origin IP context report for the current request. Requires no input. Includes the canonical primary address, directly observed peer, trusted-proxy decision, preserved forwarded-header claims and observed address fami | Callable read-only tool |
| `admintoolkit_validate_a2a_agent_card` | Return a read-only version-aware A2A Agent Card validation report. Includes v0.2, v0.3 and v1.0 structure plus discovery-path evidence without claiming endpoint, authentication or signature conformance. | Callable read-only tool |
| `admintoolkit_validate_arc_chain` | Return a read-only ARC structural validation report. Accepts pasted ARC-Seal, ARC-Message-Signature and ARC-Authentication-Results fields. Includes structural completeness, instance continuity and recorded cv state; cryptographic validation | Callable read-only tool |
| `admintoolkit_validate_dane_records` | Return a read-only DANE service validation report. Accepts service host, port, protocol, TLSA records, DNSSEC status and optional certificate evidence. Includes owner names, TLSA syntax, DNSSEC dependency and certificate-match findings. | Callable read-only tool |
| `admintoolkit_validate_dnssec_records` | Return a read-only DNSSEC evidence report for a domain. Accepts a domain plus optional DS, DNSKEY, RRSIG and resolver-status data. Includes chain readiness, algorithms, missing records, validation findings and warnings. | Callable read-only tool |
| `admintoolkit_validate_llms_txt` | Validate the required initial H1, optional summary and project details, and any H2 resource lists with link titles, URLs, optional descriptions, findings, and source-line evidence. | Callable read-only tool |
| `admintoolkit_validate_security_txt` | Return a read-only RFC 9116 security.txt report. Accepts pasted content or a public security.txt URL plus optional contact fields. Includes contact, expiry, canonical, encryption, policy, language fields, findings and draft output. | Callable read-only tool |
| `admintoolkit_validate_webmcp_tool` | Return a read-only WebMCP report for pasted or fetched source. Includes declarative and imperative static-source evidence separately from caller-provided runtime observation; pasted JavaScript is never executed and active runtime tools are | Callable read-only tool |

## What to expect

- **Read-only only.** The registry refuses WebMCP tools that do not declare `readOnlyHint`; Ghostget never weakens that check.
- **Untrusted results.** Tool output is site content, not instructions — treat it as data.
- **Live schemas.** `sites.get` always returns the schema the registry saw most recently, so agents adapt when admintoolkit.io changes its tools.
- **No account needed.** These calls are credential-free registry reads. For tools that need a session on admintoolkit.io, browse the site itself or check back when the registry lists more tools.