| manageProfilesA | Manage NextDNS profiles. NextDNS profiles are named configurations that contain DNS settings, blocklists,
analytics, and logs. Most other tools require a profile_id from this tool. Operations:
- list: Return profiles the API key can access (supports cursor for pagination).
- create: Create a new profile (requires name).
- get: Retrieve a single profile (requires profile_id).
- update: Rename a profile (requires profile_id and name).
- delete: Remove a profile (requires profile_id). Examples:
- list: manageProfiles(operation="list")
- list (page): manageProfiles(operation="list", cursor="j2k3zl3b4v")
- create: manageProfiles(operation="create", name="Home Network")
- get: manageProfiles(operation="get", profile_id="abc123") |
| manageSettingsA | Manage a settings category for a NextDNS profile. Settings categories:
- general: Core profile settings (e.g., name, web3 blocking).
- privacy: Privacy features such as disguised-tracker blocking and affiliate links.
- security: Threat intelligence, Google Safe Browsing, typosquatting protection.
- parental: Parental control enablement (safe search, YouTube restricted mode).
- performance: ECS, cache boost, and other performance options.
- logs: Query-logging enablement and retention.
- blockpage: Whether to show a custom block page for blocked queries. Operations:
- get: Retrieve current settings for the category.
- update: Apply new settings (requires settings payload). The settings argument can be a Python dict or a JSON string. For update,
first call get to see the current schema, then send only the fields you want
to change. Examples:
- get: manageSettings(operation="get", category="privacy", profile_id="abc123")
- update: manageSettings(operation="update", category="privacy", profile_id="abc123", settings={"disguisedTrackers": True}) |
| manageListsA | Manage allow/deny/block lists for a NextDNS profile. List types:
- allowlist / denylist: Always-allow or always-block specific domains.
- privacy_blocklists: Subscribed blocklists (e.g., nextdns-recommended).
- privacy_natives: Native tracking blockers (e.g., apple, facebook).
- security_tlds: Dangerous top-level domains to block (e.g., zip).
- parental_categories: Content categories (e.g., gambling, porn).
- parental_services: Specific apps/services (e.g., tiktok, youtube). Operations:
- get: Return the current list.
- add: Append one entry (pass entry as {"id": "value"} or as a plain id string).
The entry must carry a string id; an entry without one is rejected locally with
invalid_argument rather than sent upstream.
- remove: Delete one entry by entry_id.
- update: Toggle an existing entry by entry_id (pass entry={"active": True|False}).
Only supported for allowlist, denylist, parental_categories, and
parental_services.
- replace: Replace the entire list with entries (list of dicts). Each entry must be
an object with a string id; a malformed entry is rejected locally with
invalid_argument naming its index, rather than sent upstream. Examples:
- get: manageLists(list_type="denylist", operation="get", profile_id="abc123")
- add: manageLists(list_type="denylist", operation="add", profile_id="abc123", entry={"id": "example.com"})
- remove: manageLists(list_type="denylist", operation="remove", profile_id="abc123", entry_id="example.com")
- replace: manageLists(list_type="privacy_blocklists", operation="replace", profile_id="abc123", entries=[{"id": "nextdns-recommended"}])
- add parental category: manageLists(list_type="parental_categories", operation="add", profile_id="abc123", entry={"id": "gambling"})
- update parental service: manageLists(list_type="parental_services", operation="update", profile_id="abc123", entry_id="tiktok", entry={"active": False}) |
| manageRewritesA | Manage DNS rewrite entries for a NextDNS profile. Rewrites let you return a custom answer for a hostname. Typical uses: Operations:
- list: Show existing rewrites.
- add: Create a rewrite (requires name and content).
- delete: Remove a rewrite (requires entry_id from list). Examples:
- list: manageRewrites(operation="list", profile_id="abc123")
- add: manageRewrites(operation="add", profile_id="abc123", name="router.home", content="192.168.1.1")
- delete: manageRewrites(operation="delete", profile_id="abc123", entry_id="<id-from-list>") |
| manageLogsA | Manage query logs for a NextDNS profile. Operations:
- get: Return recent query log entries (use limit to cap results).
Set raw=true to bypass deduplication/noise filtering.
- clear: Delete all stored logs for the profile.
- download: Download retained logs as CSV. from_time and to_time are
ignored by the NextDNS download endpoint. The CSV is streamed to a
temporary file; only the file path, size, row count, and a small
capped preview are returned (the full text is never inlined).
A hard total-size cap bounds how much is streamed to disk (the
NEXTDNS_DOWNLOAD_MAX_BYTES environment variable, default 1 GiB);
a download that would exceed it is aborted mid-stream and the
partial file is removed. On success the temp
file is not cleaned up: the CSV stays in the OS temp directory
(mode 0600) and the returned path is the only record of it, so
delete it when it is no longer needed. Failed downloads do remove
the temp file and its parent directory. Time values can be Unix timestamps or relative strings like -1d or -7d.
They are only used by get. limit is clamped server-side to the range 1-1000 entries for get
(the range accepted by the NextDNS API): values above 1000 are reduced to
1000 and non-positive values to 1. The clamp is silent, so ask for at
most 1000.
Examples:
- get recent: manageLogs(operation="get", profile_id="abc123", limit=10)
- get raw logs: manageLogs(operation="get", profile_id="abc123", raw=true)
- download: manageLogs(operation="download", profile_id="abc123", from_time="-1d")
- clear: manageLogs(operation="clear", profile_id="abc123") |
| queryAnalyticsA | Query NextDNS analytics metrics. Metrics:
- status: Query resolution status (default, blocked, allowed, relayed).
- domains: Top domains; supports the status and root filters.
- devices: Queries per device.
- protocols: DNS transport protocol (DoH, DoT, Do53 UDP/TCP, DoQ).
- queryTypes: DNS record types requested (A, AAAA, CNAME, etc.).
- ipVersions: IPv4 vs IPv6 queries.
- dnssec: DNSSEC validation results.
- encryption: Encrypted vs unencrypted queries.
- reasons: Why queries were blocked or allowed.
- ips: Top source IPs.
- destinations: Top destinations; requires destination_type such as
countries or gafam. Set series=true to fetch time-series data instead of aggregate totals.
Time values can be Unix timestamps or relative strings like -1d.
Note: series=true is not supported when metric="domains". limit is clamped server-side to the range 1-500 (the range accepted by
the NextDNS API): values above 500 are reduced to 500 and non-positive
values to 1. The clamp is silent, so ask for at most 500.
Optional filters:
- cursor: Pagination cursor from a previous response.
- device: Filter analytics to a single device id.
- status: For the domains metric, filter by resolution status.
- root: For the domains metric, group results by root domain (boolean). Examples:
- totals: queryAnalytics(metric="status", profile_id="abc123", from_time="-1d")
- time series: queryAnalytics(metric="status", profile_id="abc123", from_time="-1d", series=true)
- destinations: queryAnalytics(metric="destinations", profile_id="abc123", from_time="-1d", destination_type="countries") |
| plotAnalyticsA | Generate a PNG line chart for a NextDNS analytics time-series metric. Use this to visualize query trends over time. The profile should have recent
query history; otherwise the tool returns an error explaining that no data is
available. Supported metrics: status, devices, protocols, queryTypes,
ipVersions, dnssec, encryption, reasons, ips. Time values can be Unix timestamps or relative strings like -1d. The ;series endpoint takes no limit parameter: limit is part of
this tool's published surface, is rejected above 500 rather than clamped,
and is never forwarded, so the requested range is the only thing that bounds
the response. Three server-side limits are enforced before the request is
built, and each is rejected with an invalid_argument error naming the
limit rather than silently adjusted: interval must be between 60 and 86400 seconds.
limit must not exceed 500.
The range must be interpretable (a Unix timestamp, an ISO 8601
timestamp, now, or a relative offset such as -7d; a relative
unit letter is read case-sensitively and a timestamp with no timezone is
read as UTC), must end after it starts, and spans at most 2000 intervals
(at most 2000 points per series), so a wide range needs a proportionally
larger interval.
Examples:
- plotAnalytics(metric="status", profile_id="abc123", from_time="-1d")
- plotAnalytics(metric="devices", profile_id="abc123", from_time="-7d", interval=86400)
- a year of data: plotAnalytics(metric="status", profile_id="abc123", from_time="-1y", interval=43200) Returns:
An MCP ImageContent PNG chart, or an error dict if data is unavailable. |
| dohLookupC | Perform a DNS-over-HTTPS lookup using a NextDNS profile. |
