--- name: netintel.dev description: netintel.dev provides network intelligence utilities covering IP geolocation, subnet calculation, SSL certificate transparency lookups, URL redirect chain tracing, and sitemap parsing. Each skill targets a specific network or web infrastructure inspection task. The host is oriented toward agents performing security reconnaissance, infrastructure auditing, or web crawling preparation. host: netintel.dev --- # netintel.dev netintel.dev is a collection of discrete network and web infrastructure inspection tools. It serves agents that need to analyze IP addresses, CIDR blocks, domain certificates, URL redirect behavior, or sitemap structure. It is not a monitoring platform or a bulk-data pipeline — each skill is a single-shot lookup designed for on-demand use during agent reasoning or workflow steps. ## When to use this host Use netintel.dev when an agent needs single-shot, on-demand lookups for IP geolocation, subnet math, certificate transparency records, URL redirect chains, or sitemap enumeration. It is well-suited for security reconnaissance, infrastructure auditing, and pre-crawl URL validation. Do not use it for real-time monitoring, continuous polling, bulk enrichment loops, live TLS handshake inspection, DNS resolution, WHOIS queries, ping or reachability tests, or scraping page content not listed in a sitemap. For bulk IP enrichment or high-frequency URL scanning, a dedicated data pipeline or monitoring service would be more appropriate. For DNS and WHOIS data, a separate domain intelligence host is needed. ## Capabilities ### IP and Network Analysis Resolves and analyzes IP addresses and CIDR blocks, covering geolocation metadata and subnet decomposition for routing, access control, and network planning tasks. - **`fetch-ip-geolocation`** — Geolocates any IPv4 or IPv6 address and returns country, region, city, coordinates, timezone, ISP, ASN, and a data-quality score with fallback provider details. - **`calculate-subnet-details`** — Calculates IPv4/IPv6 subnet details from a CIDR block, returning network/broadcast addresses, netmask, wildcard, usable host range, supernet, subnet splits, and RFC classification. ### Domain and Certificate Intelligence Enumerates SSL certificates issued for a domain via transparency logs, enabling subdomain discovery, certificate hygiene assessment, and expiry monitoring. - **`lookup-cert-transparency`** — Queries the crt.sh certificate transparency log database for a domain and returns all SSL certificates found, including subdomains, issuers, wildcard certs, expiry status, and a security grade. ### URL and Web Infrastructure Inspection Inspects the behavior and structure of web resources by tracing URL redirect chains and parsing XML sitemaps, supporting link validation and crawl preparation. - **`trace-url-redirects`** — Follows a URL through its full redirect chain (up to 20 hops) and returns each hop's status code, headers, TLS status, timing, plus a redirect quality grade and score. - **`fetch-and-parse-sitemap`** — Fetches and parses an XML sitemap or sitemap index URL, returning discovered URLs with last-modified dates, change frequency, priority, and sitemap quality stats. ## Workflows ### Domain Reconnaissance *Use when an agent needs to build a surface-area map of a domain, including its subdomains, certificate posture, and crawlable URLs.* 1. **`lookup-cert-transparency`** — Enumerate all SSL certificates and discovered subdomains for the target domain to establish scope. 2. **`fetch-and-parse-sitemap`** — Fetch the domain's sitemap to retrieve publicly declared URLs, their priorities, and last-modified dates, cross-referencing with subdomains found in certs. ### URL Trust and Destination Verification *Use when an agent needs to verify where a URL ultimately resolves and whether the destination IP is in an expected region or network before linking, crawling, or allowing access.* 1. **`trace-url-redirects`** — Follow the full redirect chain to determine the final destination URL, detect protocol downgrades, and assess redirect quality. 2. **`fetch-ip-geolocation`** — Geolocate the IP of the final destination host to verify country, ISP, and ASN against expected values. ## Skill reference ### `calculate-subnet-details` **Subnet Calc** — Calculates IPv4/IPv6 subnet details from a CIDR block, returning network/broadcast addresses, netmask, wildcard, usable host range, supernet, subnet splits, and RFC classification. *Use when:* Use when an agent needs to decompose a CIDR block into its constituent network properties — such as network address, broadcast, usable host range, prefix length, or common subnet splits — for IPv4 or IPv6 inputs. Also use when checking if a CIDR is private or classifying it by RFC. *Not for:* Do not use for live network reachability checks, ping tests, or routing table lookups. Not suitable for DNS resolution or WHOIS queries. **Inputs:** - `cidr` (string, required) — CIDR block to analyze, e.g. 10.0.1.0/24 or 2001:db8::/48 (IPv6). Comma-separate multiple CIDRs for overlap/containment analysis, e.g. 10.0.0.0/16,10.0.1.0/24. **Returns:** Returns a JSON object with network/broadcast addresses, netmask, wildcard, binary and hex masks, prefix length, total and usable host counts, first/last usable IPs, private flag, supernet, subnet split options, and RFC classification for the given CIDR. **Example:** `GET https://netintel.dev/subnet/calc?cidr=10.0.1.0/24` --- ### `trace-url-redirects` **Redirect Trace** — Follows a URL through its full redirect chain (up to 20 hops) and returns each hop's status code, headers, TLS status, timing, plus a redirect quality grade and score. *Use when:* Use when an agent needs to inspect the full redirect chain of a URL, verify the final destination, detect protocol downgrades or redirect loops, or assess redirect chain quality before linking or crawling. *Not for:* Do not use for real-time link monitoring or bulk URL scanning at high frequency; this is a single-shot per-URL trace costing $0.01 per call. **Inputs:** - `url` (string, required) — The URL to trace redirects for. Must be a fully qualified URL including scheme. - `max_hops` (number) — Maximum number of redirect hops to follow. Default is 10, maximum is 20. **Returns:** Returns a chain array of hop objects with status codes, headers, TLS, and timing; plus final_url, final_status_code, total_hops, total_timing_ms, protocol_downgrade, loop_detected, flags, a letter grade, numeric score, and deductions array. **Example:** `GET https://netintel.dev/redirect/trace?url=http%3A%2F%2Fexample.com&max_hops=10` --- ### `fetch-ip-geolocation` **IP Geo Locate** — Geolocates any IPv4 or IPv6 address and returns country, region, city, coordinates, timezone, ISP, ASN, and a data-quality score with fallback provider details. *Use when:* Use when an agent needs to resolve an IP address to its physical location and network metadata, such as determining a user's country, city, timezone, or ISP for routing, analytics, or access-control decisions. *Not for:* Do not use for bulk IP enrichment in a tight loop — the upstream providers may rate-limit and trigger fallback mode. Not suitable for real-time streaming or continuous polling of the same IP. **Inputs:** - `ip` (string, required) — IPv4 or IPv6 address to geolocate. **Returns:** Returns a geo record for 8.8.8.8 with country, city, coordinates, timezone, ISP (Google LLC), ASN (AS15169), a quality score of 100/grade A, and a findings array noting any fallback provider used. **Example:** `GET https://netintel.dev/ip-geo/locate?ip=8.8.8.8` --- ### `lookup-cert-transparency` **Cert Transparency Lookup** — Queries the crt.sh certificate transparency log database for a domain and returns all SSL certificates found, including subdomains, issuers, wildcard certs, expiry status, and a security grade. *Use when:* Use when an agent needs to enumerate SSL certificates ever issued for a domain, discover subdomains via cert records, identify wildcard certificates, check for expiring certs, or assess certificate hygiene with a scored grade. *Not for:* Do not use for real-time TLS handshake inspection or live certificate validation; this queries historical transparency log records only. Not suitable for non-domain lookups such as IP addresses. **Inputs:** - `domain` (string, required) — Domain name to query certificate transparency logs for. - `include_subdomains` (boolean) — Whether to include subdomain certificates in results. Defaults to true. - `limit` (number) — Maximum number of certificates to return. Default is 100, maximum is 500. **Returns:** Returns total certs found, unique subdomains, issuers, wildcard certs, expiry arrays, a full cert list with SAN details, and a scored security grade with findings for the queried domain. **Example:** `GET https://netintel.dev/cert-transparency/lookup?domain=example.com&include_subdomains=true&limit=100` --- ### `fetch-and-parse-sitemap` **Sitemap Parser Fetch** — Fetches and parses an XML sitemap or sitemap index URL, returning discovered URLs with last-modified dates, change frequency, priority, and sitemap quality stats. *Use when:* Use when an agent needs to enumerate URLs from a website's sitemap, retrieve per-URL metadata (last modified, priority, change frequency), or assess sitemap quality via score and grade. *Not for:* Do not use for crawling pages not listed in a sitemap, or for real-time page content extraction; use a web scraper instead. **Inputs:** - `url` (string, required) — Sitemap URL or domain name to parse (e.g. https://example.com/sitemap.xml or example.com). - `limit` (integer) — Maximum number of URLs to return (1–1000, default 100). **Returns:** Returns source_url, sitemap_type, total_urls (84), urls_returned (10), an array of URL objects with last_modified dates, rollup stats, a quality score (95), grade (A), and a findings array listing any quality issues. **Example:** `GET https://netintel.dev/sitemap-parser/fetch?url=https://www.sitemaps.org/sitemap.xml&limit=10` ---