Skip to main content
Glama
OnlyDNS MCP Server

OnlyDNS MCP Server

Official
by Onlydns

OnlyDNS MCP Server (@onlydns/mcp)

Official Model Context Protocol (MCP) server for OnlyDNS enabling AI agents (Claude Desktop, Cursor, Devin, LangChain) to inspect and manage DNS zones, records, 1-click DNSSEC, and TSIG keys directly. Learn more on the AI Agent Infrastructure solution page.

npm install -g @onlydns/mcp

Or run instantly: npx -y @onlydns/mcp

Authentication Environment Variable: ONLYDNS_API_TOKEN (see Configuration).


Features

  • 🌐 Domain Management: List all managed domains and create new DNS zones.

  • 📝 DNS Record Operations:

    • list_records: Query DNS records with optional filtering by type (A, AAAA, CNAME, MX, TXT, SRV, CAA, etc.) or hostname.

    • add_record: Create new records or append values to existing record sets with automatic domain normalization.

    • update_record: Modify existing DNS records and update TTLs.

    • delete_record: Delete specific record values or entire record sets.

    • set_records: Batch replace full zone record sets.

  • 🔐 DNSSEC Management: Inspect DNSSEC status, fetch DS/DNSKEY records, enable, and disable DNSSEC signing.

  • 🔑 TSIG Keys: Generate and manage TSIG keys for secondary DNS zone transfers (AXFR) and RFC 2136 dynamic updates.


Related MCP server: Cloudflare DNS MCP Server

Installation & Quick Start

1. One-Click Desktop Installation (MCPB Bundle)

Download onlydns-mcp.mcpb directly from the GitHub Releases page. Compatible desktop clients (such as Claude Desktop) allow one-click installation and configure your ONLYDNS_API_TOKEN through a secure settings dialog.

2. Using npx (No installation needed)

You can run the server directly using npx:

export ONLYDNS_API_TOKEN="your_onlydns_api_token"
npx -y @onlydns/mcp

3. Global Installation

npm install -g @onlydns/mcp

Configuration

The server requires an OnlyDNS API Bearer Token.

Environment Variables

Variable

Description

Default

ONLYDNS_API_TOKEN

Your OnlyDNS API Bearer Token (Required)

-

ONLYDNS_API_BASE_URL

OnlyDNS REST API base URL

https://api.onlydns.com/v1


Client Integration Examples

Claude Desktop

Add the following to your claude_desktop_config.json:

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json

Windows: %APPDATA%\Claude\claude_desktop_config.json

Linux: ~/.config/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "onlydns": {
      "command": "npx",
      "args": ["-y", "@onlydns/mcp"],
      "env": {
        "ONLYDNS_API_TOKEN": "YOUR_ONLYDNS_BEARER_TOKEN"
      }
    }
  }
}

Cursor (or Windsurf / Claude Code)

Add to your MCP settings or .cursor/mcp.json:

{
  "mcpServers": {
    "onlydns": {
      "command": "npx",
      "args": ["-y", "@onlydns/mcp"],
      "env": {
        "ONLYDNS_API_TOKEN": "YOUR_ONLYDNS_BEARER_TOKEN"
      }
    }
  }
}

Available MCP Tools

🌐 Domains

  • list_domains(limit?, offset?): Lists all domains in the account.

  • create_domain(domainName): Creates a new DNS zone for a domain.

📝 DNS Records

  • list_records(domainName, type?, name?): Lists DNS records for a domain, with optional filtering.

  • add_record(domainName, name, type, value, ttl?): Adds/appends a DNS record (e.g. A, CNAME, MX, TXT, URL, PROXY).

  • update_record(domainName, name, type, value, ttl?): Replaces values and/or TTL for a record type.

  • delete_record(domainName, name, type, value?): Deletes a record or specific value.

  • set_records(domainName, records): Batch replaces all records for a zone.

🔐 DNSSEC

  • get_dnssec(domainName): Fetches DNSSEC status and keys (DS, DNSKEY).

  • enable_dnssec(domainName): Enables DNSSEC signing for a zone.

  • disable_dnssec(domainName): Disables DNSSEC signing.

🔑 TSIG Keys

  • list_tsig_keys(): Lists all account TSIG keys.

  • get_tsig_key(keyName): Retrieves TSIG key details.

  • create_tsig_key(algorithm?): Generates a new TSIG key (hmac-sha256, hmac-sha512, etc.).

  • get_domain_tsig(domainName): Retrieves TSIG keys and permissions configured on a domain.

  • configure_domain_tsig(domainName, keyName, allowAxfr, allowDnsUpdate, subdomains?): Configures AXFR, DDNS, and optional subdomain restriction permissions for a domain.

  • remove_domain_tsig(domainName): Removes all TSIG keys from a domain.


Development & Testing

# Clone and install dependencies
git clone https://github.com/Onlydns/onlydns-mcp.git
cd onlydns-mcp
npm install

# Run unit tests
npm test

# Build TypeScript
npm run build

# Run locally in development
npm run dev

License

MIT © 2026 OnlyDNS

Available Tools

16 tools
add_recordA

Add a DNS record to a domain. Accepts relative hostnames (e.g. "testing"), domain-qualified names (e.g. "testing.example.com"), or canonical FQDNs (e.g. "testing.example.com."). If a record with the same name and type already exists, the new value is appended to the record set.

Inputs: name (required), type (required), value (required), domainName (required), +1 more.

configure_domain_tsigC

Attach and configure TSIG permissions (AXFR transfer / dynamic DNS updates / subdomain restrictions) for a domain.

Inputs: keyName (required), allowAxfr (required), domainName (required), allowDnsUpdate (required), +1 more.

create_domainC

Create/add a new DNS zone/domain under the OnlyDNS account.

Inputs: domainName (required).

create_tsig_keyB

Generate a new TSIG key for secondary DNS transfers (AXFR) or dynamic DNS updates.

Inputs: algorithm.

delete_recordB

Delete a DNS record or specific value from a domain. Accepts relative names (e.g. "testing"), domain-qualified names (e.g. "testing.example.com"), or canonical FQDNs (e.g. "testing.example.com.").

Inputs: name (required), type (required), domainName (required), value.

disable_dnssecB

Disable DNSSEC signing and remove DNSSEC keys for a domain in OnlyDNS.

Inputs: domainName (required).

enable_dnssecC

Enable DNSSEC signing for a domain in OnlyDNS.

Inputs: domainName (required).

get_dnssecB

Get DNSSEC configuration status, NSEC3 parameters, and DS / DNSKEY keys for a domain.

Inputs: domainName (required).

get_domain_tsigA

Get TSIG keys and permissions (AXFR transfers, dynamic DNS updates, subdomain restrictions) configured for a domain.

Inputs: domainName (required).

get_tsig_keyC

Get details for a specific TSIG key by name.

Inputs: keyName (required).

list_domainsB

List all DNS domains managed in the OnlyDNS account.

Inputs: limit, offset.

list_recordsA

List all DNS records for a domain, with optional filtering by record type (A, AAAA, CNAME, MX, TXT, etc.) or hostname.

Inputs: domainName (required), name, type.

list_tsig_keysB

List all TSIG keys configured for the OnlyDNS account.

Inputs: no named parameters.

remove_domain_tsigB

Remove all TSIG keys associated with a domain.

Inputs: domainName (required).

set_recordsA

Completely replace ALL DNS records in a zone with a new list of records. Warning: destructive if omitted records are intended to be preserved.

Inputs: records (required), domainName (required).

update_recordA

Update an existing DNS record set for a given name and type, completely replacing its values and/or TTL. Accepts relative names (e.g. "testing"), domain-qualified names (e.g. "testing.example.com"), or canonical FQDNs (e.g. "testing.example.com.").

Inputs: name (required), type (required), value (required), domainName (required), +1 more.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    TDQS

    B3.4/5.0

    Scored across 16 tools

    Disambiguation4/5

    Record tools (list/add/update/delete/set_records) are mostly distinct, and the destructive nature of set_records is explicitly flagged. Minor overlap exists between get_domain_tsig (per-domain key permissions) and get_tsig_key (key by name), and between update_record and set_records, but descriptions clarify the boundaries.

    Naming Consistency5/5

    All 16 tools follow a consistent snake_case verb_noun pattern (create_domain, list_records, add_record, enable_dnssec, list_tsig_keys). No mixing of camelCase or vague verbs anywhere in the set.

    Tool Count4/5

    16 tools is slightly on the heavy side but justified by three sub-domains (zones, records, TSIG/DNSSEC). Each tool maps to a real operation, though a few TSIG getters could potentially be consolidated.

    Completeness3/5

    Records have full lifecycle coverage (list/add/update/delete/set) and DNSSEC/TSIG are well covered, but there is no delete_domain or update-domain operation, leaving zone management without a delete path. Agents cannot remove a domain, which is a notable gap.

    Maintenance

    ActivityMaintained
    ResponsivenessNo recent community issues

    Related MCP Connectors

    Related MCP Servers