MCP servers.

Small Model Context Protocol servers that bolt onto your stack and give any client — Claude Code, your work environment, another agent — real capabilities it didn't have. Two starters below, both running code you can read. I build custom ones against your tools and data.

email-enrichment

EML

sender / domain / IP reputation and email-auth forensics for any MCP client — proofpoint-grade triage signal without the per-seat license.

enrich_domain() MX / A / SPF / DMARC / RDAP registrar

enrich_ip() PTR, ASN / org / geo, Spamhaus DNSBL reputation

check_email_auth() SPF + DMARC posture, parsed policy, spoofability verdict

analyze_headers() received hop chain, auth-results, From/Return-Path skew

all lookups passive — public DNS / RDAP / IP intel only. nothing sent, nothing touched.

model-workflow

MDL

cheap-first model routing as a tool. local model first, frontier (claude / gpt / grok / gemini) as fallback — swap vendors by config, never get locked in.

route() run a prompt through the fallback chain — cheap | verify | default

providers() show the configured chains + which API keys are present

wraps the home-lab model_router. if a provider gets cut off, the chain just falls through.

enterprise signal, hobbyist cost

• you own it. self-hosted on your box. no seat licenses, no data leaving for a vendor cloud you didn't pick.
• local-first models. the bulk runs on a local model at $0/call; frontier models only when the work earns it.
• vendor-proof. model routing is config-driven — swap claude for gpt for a local model without touching a line of workflow code.
• fits your stack. enrichment lands in the tools your analysts already use, not another portal to babysit.