🕵️ DNS Detective

An agent that diagnoses DNS, TLS and email-record problems by running real probes, not by guessing. You describe the symptom; the model decides which lookups to run, reads the actual answers, follows the evidence, and delivers a diagnosis with the exact record to fix.

Powered by DigitalOcean Serverless Inference (OpenAI-compatible API, function calling) and four small probe tools: DNS resolution, TLS handshakes, RDAP registration data, and HTTP checks.

SYMPTOM: Customers say they cannot email us at example.com. Why?

  → dns_lookup(example.com, MX)
    {"status": "ok", "records": ["0 ."], "ttl": 100}

DIAGNOSIS: example.com publishes a null MX record (0 .), which explicitly
tells the internet it does not accept email, so all inbound mail is
rejected immediately.

Every claim in a diagnosis must cite a probe the agent actually ran; the system prompt forbids invented records, and the probe results are printed as they happen so you can audit the trail.

🚀 Run it

pip install -r requirements.txt
export DO_INFERENCE_KEY=your_key   # DigitalOcean Serverless Inference
python3 detective.py "describe the symptom"

Optional: DETECTIVE_MODEL overrides the model (default openai-gpt-oss-120b; any tool-calling model on the platform works).

🧪 Try the included mysteries

Public, deliberately broken infrastructure makes great practice:

python3 detective.py "Mail to example.com bounces immediately. Why?"
python3 detective.py "Monitoring says https://expired.badssl.com is down but the server is up."
python3 detective.py "dnssec-failed.org loads on one old server but nowhere else. Diagnose."
python3 detective.py "https://wrong.host.badssl.com throws certificate errors. What exactly is wrong?"

🔧 The probes

Tool	What it actually does
dns_lookup	Resolves any record type; distinguishes NXDOMAIN / NoAnswer / NoNameservers (the DNSSEC tell) / timeout
tls_check	Real TLS handshake; on verification failure it re-reads the offered certificate so the diagnosis can say why
rdap_lookup	Registration data (registrar, expiry, status) via RDAP, the WHOIS successor
http_check	Fetches without following redirects; status and headers

📄 License

MIT