DNSFilter MCP Server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| AUTH_MODE | No | Authentication mode. env (default, reads DNSFILTER_API_KEY) or gateway (credential arrives per-request via X-DNSFilter-Api-Key header). | env |
| LOG_LEVEL | No | Log level. debug | info (default) | warn | error. | info |
| MCP_TRANSPORT | No | Transport for the MCP server. stdio (default) or http. | stdio |
| DNSFILTER_API_KEY | No | DNSFilter API key, generated in the DNSFilter dashboard. | |
| CONDUIT_S2S_SECRET | No | When set, the HTTP transport requires a valid X-Gateway-S2S header (Conduit sidecar auth) on every /mcp request. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
| logging | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| dnsfilter_list_organizationsA | List the organizations visible to this API key, with basic info (name, type, MSP relationships). Organization IDs from this response are required by dnsfilter_get_organization, dnsfilter_list_networks/policies/block_pages (via organization_id), and every traffic-report tool. |
| dnsfilter_get_organizationA | Get one organization's basic information. Requires an organization ID from dnsfilter_list_organizations. |
| dnsfilter_get_organization_settingsB | Get organization-level settings, optionally scoped to a specific organization or MSP. |
| dnsfilter_list_networksA | List the networks (sites/locations) visible to this API key, with basic info and whether a filtering policy is assigned. Network IDs from this response are required by dnsfilter_get_network and can scope most traffic-report tools via network_ids. |
| dnsfilter_get_networkA | Get one network's basic information. Requires a network ID from dnsfilter_list_networks. |
| dnsfilter_lookup_network_by_ipA | Find the network associated with a given source IP address, along with that network's block-page branding. |
| dnsfilter_get_networks_geoA | Get every visible network's geo/location metadata only (name, lat/long, physical address) - a lighter-weight variant of dnsfilter_list_networks for mapping. |
| dnsfilter_list_policiesA | List filtering policies visible to this API key. Policy IDs from this response are required by dnsfilter_get_policy and dnsfilter_get_policy_permissive_mode. |
| dnsfilter_get_policyA | Get one policy's full configuration: allow/block domain lists, allow/block category rules, allowed/blocked applications, and which networks it's assigned to. Requires a policy ID from dnsfilter_list_policies. |
| dnsfilter_get_application_policiesA | Get which policies in an organization allow or block a specific application. Requires an application ID and organization ID. |
| dnsfilter_get_policy_permissive_modeA | Get whether a policy currently has permissive (monitor-only, non-blocking) mode enabled. Requires a policy ID from dnsfilter_list_policies. |
| dnsfilter_list_categoriesA | List DNSFilter's content-filtering categories (e.g. Malware, Gambling, Social Networking) used to build allow/block rules in a policy. Category IDs from this response are required by dnsfilter_get_category and can filter traffic-report tools via category_ids. |
| dnsfilter_get_categoryA | Get one content category's details and hierarchy (parent/child categories). Requires a category ID from dnsfilter_list_categories. |
| dnsfilter_list_application_categoriesA | List application categories, used for the application allow/block surface of a policy (distinct from content categories). IDs from this response are required by dnsfilter_get_application_category and can filter traffic-report tools via application_category_ids. |
| dnsfilter_get_application_categoryB | Get one application category's details. Requires an application category ID from dnsfilter_list_application_categories. |
| dnsfilter_list_block_pagesA | List the custom block pages configured for the current user/organization (shown to end users when a request is filtered). Block page IDs from this response are required by dnsfilter_get_block_page. |
| dnsfilter_get_block_pageA | Get one custom block page's configuration: branding (org name, logo), contact email, and appearance settings. Requires a block page ID from dnsfilter_list_block_pages. |
| dnsfilter_get_organization_usageA | Get usage information (plan, term, user/wifi counts, total requests, estimated users) for an organization over a date range. Maximum range is 365 days. Requires an organization ID from dnsfilter_list_organizations. |
| dnsfilter_get_organization_usage_detailedA | Get the detailed (per-metric) breakdown of an organization's usage over a date range. Maximum range is 365 days. Requires an organization ID from dnsfilter_list_organizations. |
| dnsfilter_get_qpsB | Queries-per-second time series - the closest thing to a live traffic pulse. |
| dnsfilter_get_qps_active_agentsC | Queries-per-second broken out by active client/agent. |
| dnsfilter_get_qps_active_organizationsC | Queries-per-second broken out by active organization. |
| dnsfilter_get_query_logsB | Raw DNS query log entries - domain queried, requester, category, and allow/block result. The most granular, PII-bearing report this connector exposes. |
| dnsfilter_get_top_agentsC | Clients/agents generating the most traffic. |
| dnsfilter_get_top_application_categoriesC | Application categories generating the most traffic. |
| dnsfilter_get_top_categoriesC | Content categories generating the most traffic. |
| dnsfilter_get_top_collectionsC | Collections (roaming-client groupings) generating the most traffic. |
| dnsfilter_get_top_domainsC | Domains queried most often. |
| dnsfilter_get_top_networksC | Networks generating the most traffic. |
| dnsfilter_get_top_organizations_requestsC | Organizations generating the most request volume. |
| dnsfilter_get_top_usersC | Local users generating the most traffic. |
| dnsfilter_get_total_applications_agents_statsC | Application request counts broken out by client/agent. |
| dnsfilter_get_total_applications_collections_statsC | Application request counts broken out by collection. |
| dnsfilter_get_total_applications_networks_statsB | Application request counts broken out by network. |
| dnsfilter_get_total_applications_statsC | Total application request counts. |
| dnsfilter_get_total_applications_users_statsC | Application request counts broken out by local user. |
| dnsfilter_get_total_categoriesC | Total content-category request counts over time. |
| dnsfilter_get_total_categories_organizationsC | Total content-category request counts broken out by organization. |
| dnsfilter_get_total_category_statsC | Content-category request-count summary. |
| dnsfilter_get_total_client_statsC | Client/agent count summary. |
| dnsfilter_get_total_deploymentsC | Deployed client/network counts. |
| dnsfilter_get_total_domain_statsA | Single-domain request-count summary - use with the domain/fqdn filter. |
| dnsfilter_get_total_domainsD | Total domain request counts over time. |
| dnsfilter_get_total_domains_organizationsD | Total domain request counts broken out by organization. |
| dnsfilter_get_total_domains_usersC | Total domain request counts broken out by local user. |
| dnsfilter_get_total_organizations_requestsC | Total request counts broken out by organization. |
| dnsfilter_get_total_organizations_statsC | Organization-level request-count summary. |
| dnsfilter_get_total_requestsC | Total DNS request counts over time. |
| dnsfilter_get_total_requests_agentsC | Total request counts broken out by client/agent. |
| dnsfilter_get_total_requests_collectionsC | Total request counts broken out by collection. |
| dnsfilter_get_total_requests_geoC | Total request counts broken out by geography. |
| dnsfilter_get_total_requests_organizationsB | Total request counts broken out by organization. |
| dnsfilter_get_total_requests_usersB | Total request counts broken out by local user. |
| dnsfilter_get_total_roaming_clientsB | Count of roaming (off-network) clients. |
| dnsfilter_get_total_threatsC | Total blocked-threat counts over time. |
| dnsfilter_get_total_threats_organizationsC | Total blocked-threat counts broken out by organization. |
| dnsfilter_get_total_threats_usersC | Total blocked-threat counts broken out by local user. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 57 tools
The entity getters are distinct, but the report tools overlap heavily: dnsfilter_get_top_*, dnsfilter_get_total_*, and dnsfilter_get_total_*_organizations/users/agents variants are easy to confuse. For example, dnsfilter_get_total_requests_organizations and dnsfilter_get_total_organizations_requests are nearly indistinguishable from their names alone.
Almost every tool follows a consistent dnsfilter_ + get/list/lookup + snake_case pattern, making the naming highly predictable. Minor inconsistencies exist, such as get_networks_geo being a plural/list-style operation and report names mixing top/total/qps without a strict semantic convention.
57 tools is far above the typical well-scoped MCP surface, and many are minor permutations of the same reporting concept broken out by organization, user, network, collection, or agent. A much smaller set of parameterized report tools could likely cover the same capabilities.
The tool surface is almost entirely read-only: it retrieves organizations, networks, policies, categories, block pages, and extensive traffic reports, but has no create, update, delete, assign, or configuration-management tools. Agents cannot act on DNSFilter settings, only observe them, which is a significant gap for a management-oriented server.