DEVONagent Plugin

Add intelligence-grade DNS security analysis to your DEVONagent research workflows. Each query returns up to 15 enriched results — security reports, reconnaissance data, integrity-verified snapshots, and provenance metadata.

Works with DEVONagent Pro and DEVONagent Express. Both editions support the plugin and search set. For best results in Express, uncheck Express Search in the app menu to use agent mode — this gives you post-filtered, precise results instead of mixing DNS Tool data with general web results.

When a domain is analyzed through this plugin, you'll see a Plugin tag next to the domain in your analysis history.

What You Get

Every scan delivers a 15-file intelligence bundle. File 01 is an orientation guide; the remaining 14 files are listed below in the exact order DEVONagent downloads them.

01. Intelligence Guide — orientation: what this analysis contains and how to use it
02. Engineer's DNS Intelligence Report — full security analysis with live scanning (the engineering report)
03. Analysis History — previous scans of this domain and security posture changes over time
04. Observed Records Snapshot — reconstructed zone file from live resolver responses, SHA-3-512 verified
05. Detailed Security Badge — full posture score badge (SVG, embeddable)
06. Covert Security Badge — scotopic-optimized embeddable badge for dark environments
07. Covert Recon Report — full analysis rendered in low-visibility covert operations mode
08. Executive Intelligence Brief — board-ready executive summary
09. DNS Topology — interactive topology visualization, signal flow, and RFC source mapping
10. Full Intelligence Data (JSON) — complete machine-readable payload including the full subdomain inventory
11. Discovered Subdomains (CSV) — every subdomain found via Certificate Transparency logs and DNS reconnaissance
12. SHA-3 Integrity Checksum — cryptographic verification that the analysis data has not been tampered with
13. Security Remediation Plan — prioritized, actionable remediation steps for the domain
14. Wayback Archive — permanent third-party record via the Internet Archive
15. Sources & Methodology — RFC citations, data sources, and the scoring methodology behind every verdict

The full scoring methodology, RFC citations, and intelligence-community alignment are documented in file 15 of every bundle. The permanent scientific record lives at doi.org/10.5281/zenodo.19468134.

Download & Install

Step 1 — Install the Plugin

The plugin is the search engine connector — it tells DEVONagent how to query our server.

Download Plugin (.plist)

Download the plugin file

Click the download button above to get the .plist file.

Move it to the Plugins folder

Place the downloaded file in:
~/Library/Application Support/DEVONagent Pro/Plugins/

To open this folder: in Finder, press ⇧⌘G and paste the path above. The plugin file must remain in this folder — DEVONagent loads it from here each time it launches.

Restart DEVONagent

Quit and relaunch DEVONagent Pro. The plugin will appear under Window → Plugins & Scanners in the Security category.

Step 2 — Install the Search Set Recommended

A search set is a saved configuration that bundles the plugin with optimal settings — no follow-link crawling (the plugin already returns all results), auto-archive, and DEVONthink integration. You can use the plugin on its own, but the search set gives you the best out-of-box experience.

Download Search Set (.agentSet)

Download the search set file

Click the download button above to get the .agentSet file.

Double-click to install

Double-click the .agentSet file in Finder. DEVONagent Pro will open and import the search set automatically. It will appear under Search Sets in the search dropdown as “DNS Intelligence”. You can delete the downloaded file afterward — DEVONagent stores the set internally.

Configure the search set

Open the search set editor (File → Edit Search Sets), select DNS Intelligence, and verify these settings:

General tab: Under Filter, uncheck both Similar Pages and Archived Pages.
Sites tab: Should be empty — no URLs listed.
Plugins tab: Only DNS Tool should be checked. Uncheck all other plugins (Web, Bing, DuckDuckGo, etc.).

Search any domain

Select DNS Intelligence from the Search Sets dropdown, type a domain name, and press Enter. DEVONagent will return all 15 intelligence artifacts directly from the plugin — no external crawling.

Upgrading? DEVONagent does not overwrite an existing search set with the same name. To install an updated version, first delete the old “DNS Intelligence” set in File → Edit Search Sets, then double-click the new .agentSet file.

Why uncheck Archived Pages? DNS Tool returns curated intelligence artifacts with stable URLs. DEVONagent’s Archived Pages filter hides URLs it has seen before — since our artifact URLs are consistent across searches, this filter silently discards results on repeat scans. Unchecking Archived Pages ensures all 15 artifacts appear every time. The Similar Pages filter should also stay unchecked because our artifacts intentionally share a common layout that DEVONagent’s AI would classify as near-duplicates.

Two ways to search. You can use DNS Tool from the Search window (select the DNS Intelligence search set) or from the Menu Extra (the menu bar icon). In the Menu Extra, select DNS Tool as the plugin and search directly — both methods return all 15 artifacts.

Plugin vs Search Set — what’s the difference? The plugin (.plist) is the search engine connector — it tells DEVONagent how to query DNS Tool. You install it by placing the file in the Plugins folder (it must stay there). The search set (.agentSet) is a saved configuration that wraps the plugin with optimized settings: no follow-link crawling, skip crawling, accept all file types, and auto-archive results. You install it by double-clicking — DEVONagent imports it internally. You need both for the best experience, but the plugin alone works for quick searches via the Menu Extra.

Search Set Settings

The search set ships with these settings pre-configured. Power users can customize them in DEVONagent’s search set editor (File → Edit Search Sets).

Setting	Value	Why
`skipCrawling`	`true`	Our server returns complete HTML pages — no crawling needed.
`followLevels`	`0`	No follow-link crawling. The plugin returns all 15 result URLs directly via `ParseLinks`, each titled with the searched domain so they pass DEVONagent’s relevance filter. Following links would cause DEVONagent to spider into the analyzed domain’s pages.
`followMode`	`0` (Off)	Disabled — not needed when `followLevels` is 0.
`filterDuplicates`	`false`	All 15 results are unique intelligence artifacts — duplicate filtering would incorrectly remove some.
`download`	`79`	Accept all file types: HTML, PDF, text, CSV, JSON, and more.
`ArchiveResults`	`true`	Automatically saves results to DEVONagent’s internal archive for later retrieval.
`AddResultsToDEVONthink`	`true`	Automatically sends results to DEVONthink’s Global Inbox when the search completes (requires DEVONthink to be installed).
`expressSearch`	`false`	Agent mode — DEVONagent downloads and indexes each result page, enabling full-text search and archiving within DEVONthink.
`filterArchivedPages`	`false`	Disables the Archived Pages filter. Without this, DEVONagent hides stable-URL results it has seen before, silently dropping artifacts on repeat scans.
`engines`	`["dnstool.it-help.tech"]`	Uses only the DNS Tool plugin — no other search engines are queried.

Tip: Increase Max Download Size. DNS Tool intelligence reports can be up to 2 MB. In DEVONagent Preferences → Search, increase Max. Download Size to at least 4096 KB to ensure full reports are captured. The default 2048 KB may truncate large analyses.

Plugin Source Code

View the plugin configuration below, or use the download button above.

<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Author</key> <string>IT Help San Diego Inc.</string> <key>Category</key> <string>Security</string> <key>Description</key> <string>Intelligence-grade domain security analysis. RFC-compliant DNS auditing with ICD 203 confidence scoring, FAIR-principled data delivery. DNS Intelligence by IT+Help San Diego Inc. IT research in action.</string> <key>Encoding</key> <string>UTF-8</string> <key>EngineUrl</key> <string>https://dnstool.it-help.tech/agent/search?q=__agentQuery__</string> <key>FilterSimilarPages</key> <false/> <key>FollowLinks</key> <false/> <key>Identifier</key> <string>dnstool.it-help.tech</string> <key>Info</key> <string>Domain Intelligence — OSINT Intelligence Reports — RFC-grounded domain analysis with Bayesian confidence scoring. Returns enriched reports with security badges, observed-records snapshots (SHA-3-512), DNS topology maps, Wayback Machine archives, CSV exports, remediation playbooks, and Zotero-compatible citation metadata. Concept DOI: 10.5281/zenodo.19468134. Plugin homepage: https://dnstool.it-help.tech/agent/plugin</string> <key>Keyword</key> <array> <string>dns</string> <string>security</string> <string>spf</string> <string>dkim</string> <string>dmarc</string> <string>dnssec</string> <string>subdomain</string> <string>certificate</string> <string>transparency</string> <string>email</string> <string>security</string> <string>posture</string> </array> <key>Keywords</key> <string>dns,security,spf,dkim,dmarc,dnssec,subdomain, certificate-transparency,email-security,posture, domain,intelligence</string> <key>LinksMatching</key> <array> <string>*dnstool.it-help.tech*</string> <string>*doi.org*</string> </array> <key>Name</key> <string>DNS Tool</string> <key>OffsetPerPage</key> <integer>1</integer> <key>Operators</key> <integer>59</integer> <key>ParseLinks</key> <true/> <key>PostScan</key> <false/> <key>ResultsPerPage</key> <integer>15</integer> <key>SkipsCrawling</key> <true/> <key>Start</key> <integer>0</integer> <key>StripHTML</key> <false/> <key>URL</key> <string>https://dnstool.it-help.tech/agent/plugin</string> <key>UserAgent</key> <string>DEVONagent/3 (dnstool-plugin/2.0; +https://dnstool.it-help.tech/agent/plugin)</string> <key>Version</key> <string>3.1</string> </dict> </plist>

How It Works

When DEVONagent queries a domain through this plugin, it sends a GET request to the /agent/search endpoint. Because ParseLinks is enabled, DEVONagent extracts every <a href> from the returned HTML as a separate search result — giving you direct access to every report, badge, export, and data artifact from a single query.

The __agentQuery__ placeholder in the engine URL is automatically replaced by DEVONagent with whatever domain you search for.

With the search set installed, followLevels is set to 0 — DEVONagent does not follow links beyond the initial result set. This is intentional: since ParseLinks already extracts all 15 intelligence artifacts as separate results, following links would cause DEVONagent to spider into pages on the analyzed domain (the target you’re scanning), polluting results with unrelated content.

Plugin Anatomy

DEVONagent plugins are defined by a small set of configuration keys. Every key below is documented in DEVONagent’s built-in Help (Help → DEVONagent Pro Help → Appendix → Search Plugin Format) and observable in the built-in plugins shipped at /Applications/DEVONagent.app/Contents/Resources/Plugins/.

Name: Display name shown in the plugin list and search sets. Appears in Preferences → Plugins & Scanners and in search set checkboxes.
Identifier: Unique identifier for the plugin. Convention is reverse-DNS notation or the service domain (ours: dnstool.it-help.tech).
Category: Folder group in the Plugins & Scanners window. Our plugin uses Security. Built-in categories include General, News, Science, and Shopping.
Author: Plugin author metadata. Shown in the plugin info panel. Ours: IT Help San Diego Inc.
URL: Homepage URL for the plugin. Links to this documentation page.
EngineUrl: The search endpoint. The placeholder __agentQuery__ is replaced with the user’s search term at query time. __agentOffset__ handles pagination for multi-page result sets.
ParseLinks: When true, DEVONagent extracts every <a href> from the HTML response as a separate search result. This is how our single HTML page delivers 15 distinct intelligence artifacts.
StripHTML: When false, DEVONagent preserves the HTML structure of the response. Our plugin sets this to false to retain link context and result descriptions.
ResultsPerPage: Expected number of results per page. Set to 15 to match the number of links our endpoint returns.
Keyword: Array of trigger words. DEVONagent may prioritize this plugin when user queries match these terms. We declare 13 terms covering DNS security protocols.
Operators: Bitmask for supported search operators (phrase, Boolean, wildcards, etc.). Value 59 enables the standard operator set.
PostScan: When false, DEVONagent accepts all pages returned by the plugin without checking if they match the search term. Essential for curated result sets like ours where every result is intentionally selected. Default is true.
FilterSimilarPages: When false, DEVONagent keeps all results even if they have similar page structure. Our 15 artifacts intentionally share a common layout — without this set to false, DEVONagent’s AI would classify them as near-duplicates and discard most of them. Default is true.
FollowLinks: When false, DEVONagent does not follow links from result pages. Prevents spidering into the analyzed domain. Reinforces the search set’s followLevels=0. Default is true.
SkipsCrawling: When true, marks this plugin as skipping crawling. Our server returns complete HTML pages — DEVONagent does not need to crawl them.
LinksMatching: Array of wildcard patterns that restrict which links DEVONagent extracts. Ours whitelist *dnstool.it-help.tech* and *doi.org* to prevent accidental extraction of unrelated anchors.
UserAgent: Custom User-Agent header sent with requests. Ours identifies the plugin version in server logs: DEVONagent/3 (dnstool-plugin/2.0; +https://dnstool.it-help.tech/agent/plugin).
Encoding: Declares the character encoding for response parsing. Set to UTF-8.
Start / OffsetPerPage: Pagination controls. For single-page results, set Start: 0 and OffsetPerPage: 1. Multi-page plugins increment the offset per page to fetch subsequent result pages.

References

DEVONagent Pro Help — Help → DEVONagent Pro Help → Appendix → Search Plugin Format. In-app documentation describing all plugin configuration keys, placeholder syntax (__agentQuery__, __agentOffset__), and XPath extraction. Accessible from the DEVONagent Pro menu bar.
Built-in plugin reference implementations — /Applications/DEVONagent.app/Contents/Resources/Plugins/. The shipping app bundle contains the plist source for every built-in search plugin (Google, Bing, arXiv, Wikipedia, etc.), providing working examples of all supported keys and pagination patterns.
Apple Property List format — Apple Developer Documentation: About Information Property List Files. Defines the XML plist DTD and serialization format used by DEVONagent plugins.
DEVONtechnologies product page — devontechnologies.com/apps/devonagent. Official product information and download for DEVONagent Pro and DEVONagent Express.

Rules of Engagement

What You May Do

What You May Not Do