Resources · Cyber Security
How do you ask your AI assistant for a security scan of your company?
Short answer
Once you have added the Fjordex MCP connector to Claude, all you need to do is type "run a full security pre-scan for mycompany.com" in the chat. Claude runs Fjordex's five passive checks (email security, DNS hygiene, subdomain discovery, lookalike domains, full scan) and explains the findings in order of severity. Nothing connects to your systems, and no installation or agent is needed. A ChatGPT connector is in preparation.
Why inside Claude?
The biggest problem with security tools is that they go unused: installation, licences, learning an interface, interpreting the output. MCP (Model Context Protocol) is an open standard that lets assistants such as Claude call external tools safely. Because Fjordex is offered through this standard, the tool comes into the chat window you already use. You do not need to be a security expert to read the output; you simply ask "what does this finding mean, and what should I do?"
An important distinction: Claude calls the tool and explains the result, but Claude does not produce the findings. Fjordex evaluates DNS and Certificate Transparency data with deterministic rules; Claude only acts as the interpreter. That is why the results are repeatable and free of hallucinations.
Setup steps
- Open Claude (web, desktop or mobile). Adding a connector requires a Pro, Max, Team or Enterprise plan.
- Go to Settings → Connectors and click Add custom connector.
- Enter
Fjordexin the name field andhttps://fjordex-mcp-887408198095.europe-west1.run.app/mcpin the URL field, then add it. - Open a new chat. In the tools menu (the paperclip / "+" icon), check that Fjordex is switched on.
- Type: "Check email security for arvenova.ai." On the first run Claude asks for permission to use the tool; approve it.
Setup is done once; in later chats the tool is ready. On Team and Enterprise plans an administrator can enable the connector for the whole organisation in one go.
Which prompts work?
The Fjordex connector offers five tools. Asking in plain language is enough; Claude picks the right tool:
| What you ask | Tool that runs | What it returns |
|---|---|---|
| "check email security for mycompany.com" | check_email_security | Findings on MX, SPF (lookup count, +all/~all), DMARC policy, DKIM, MTA-STS, TLS-RPT, BIMI |
| "look at our DNS hygiene" | check_dns_hygiene | Configuration issues such as DNSSEC, CAA, dangling CNAMEs, zone transfer |
| "which of our subdomains are visible" | discover_subdomains | Subdomain inventory from Certificate Transparency logs |
| "is anyone imitating our brand with a domain" | find_lookalike_domains | Registered typosquat / lookalike domains and whether they can send email |
| "run a full scan" | full_scan | All of the above, with one summary and the severity breakdown |
Then you can ask: "What should I check before setting DMARC to p=reject?", "Could this subdomain be a service we used in the past?", "Turn these findings into an email I can send to our IT provider."
A sample chat
You: run a full security pre-scan for mycompany.com
Claude: Fjordex full_scan completed. Summary: 1 high, 2 medium, 1 low.
HIGH No DMARC record. Fake email can be sent in the company's name.
Fix: a _dmarc TXT record, starting with p=none.
MEDIUM The SPF record needs 12 DNS lookups (the limit is 10); some
receivers treat SPF as invalid. Fix: simplify the include chain.
MEDIUM Lookalike domain registered: mycompany.co (has MX).
Fix: verify ownership; if not yours, file an abuse report.
LOW A certificate is visible for test.mycompany.com, no A record.
Fix: remove it from DNS if it is not in use.
You: write these up as a work order for our IT provider
Claude: (a prioritised, step-by-step task list)What it gives you, and what it does not
It gives you
- A clear picture of your email spoofing risk (SPF/DKIM/DMARC)
- An inventory of externally visible subdomains
- Registered domains that imitate your brand
- Basic DNS configuration errors
- Evidence and a concrete recommendation for every finding
- Repeatable, deterministic results
It does not give you
- Open port and service scanning
- CVE / vulnerability matching (included in the full Fjordex assessment, not in the connector)
- Web application security testing
- Real-time attack detection
- A signed report you can submit for an audit
- Any change on your systems
The output in Claude is an automated, unsigned preview of ArveNova's external attack surface assessment. Contact us for the signed Turkish report that also covers open ports and CVEs (from €2,200) and for monthly monitoring (from €99/month); the final price is confirmed by asset count and scope.
Privacy and authorisation
The Fjordex connector in Claude reads only public DNS and Certificate Transparency data; it does not connect to target servers, does not ask for credentials and installs nothing on your systems. Even so, only use the tool for domains you operate or are authorised to assess. Apart from the domain name you query, no data from your Claude chat is passed to Fjordex.
If you use ChatGPT: a ChatGPT connector is in preparation. This page will be updated when it goes live; until then you can take the output from Claude and have ChatGPT interpret it.
Need a signed assessment?
Contact us for a signed report, finding validation and regular monitoring. The final price is confirmed after a short scoping call.
Frequently asked questions
Can I use it with Claude's free plan?
Adding custom connectors is available on paid plans.
How often should I run the scan?
Once a month, and also after every infrastructure change (new hosting, a new email service, a new subdomain). For regular, comparative monitoring the monthly delta report is a better fit.
Where are the results stored?
Fjordex returns the query result to Claude; your chat history stays in your Claude account. On the ArveNova side nothing is stored apart from the domain name and a timestamp.
Can I use the output for an audit or insurance?
The output is a preview and is not signed. An audit, insurance or tender file requires a signed Tier 1 report with human review.