This server does not currently have a deployable release on Glama. Follow the repository's setup instructions to install and configure it for your MCP client, including any required credentials and local dependencies.
Capture the DNS queries leaving your Mac and serve them to Claude over the Model Context Protocol so Claude can analyse your traffic patterns and hand back a structured JSON overview.
It answers questions like:
Which domains does my machine talk to the most?
How much of my traffic is advertising, analytics, or telemetry?
When am I busiest, and were there any unusual bursts of activity?
┌────────────┐ ┌──────────────┐ ┌───────────────┐ ┌────────┐
│ tcpdump │ --> │ capture │ --> │ SQLite db │ <-- │ MCP │ <── Claude
│ (port 53) │ │ daemon │ │ (dns.db) │ │ server │
└────────────┘ └──────────────┘ └───────────────┘ └────────┘A capture daemon runs tcpdump, parses each DNS question off the wire,
and appends it to a local SQLite database.
An MCP server exposes read-only tools over stdio. Claude calls
analyze_patterns (and friends) and receives JSON it can summarise.
The two halves are decoupled through the database: capture is a single writer, the server is a read-only consumer.
Related MCP server: AynOps
Requires Python 3.10+ and the tcpdump that ships with macOS.
git clone https://github.com/luke-nielsen/mcp-dns-insights.git
cd mcp-dns-insights
python3 -m venv .venv && source .venv/bin/activate
pip install -e ".[dev]"Packet capture needs root, so run the daemon under sudo:
sudo -E mcp-dns-insights captureLeave it running in the background (or install it as a launchd job — see below).
Use -i en0 to pin a specific interface; the default any captures all of them.
mcp-dns-insights stats --hours 24 # human-readable summary
mcp-dns-insights stats --hours 24 --json
mcp-dns-insights info # database location & spanThe server speaks MCP over stdio. Register it with Claude Code:
claude mcp add dns-insights -- mcp-dns-insights serveor add it to your MCP host config manually:
{
"mcpServers": {
"dns-insights": {
"command": "mcp-dns-insights",
"args": ["serve"]
}
}
}Then ask Claude: "Analyse my DNS traffic from the last 24 hours and tell me what's noteworthy."
Tool | Purpose |
| Full JSON overview: top domains, categories, temporal, notes. |
| The most recent queries as a JSON list. |
| Find queries whose hostname matches a substring. |
| Database path, size, and time span. |
analyze_patterns{
"summary": { "total_queries": 4213, "unique_hostnames": 612, "unique_domains": 241, "window": { ... } },
"top_hostnames": [ { "name": "api.github.com", "count": 88 }, ... ],
"top_domains": [ { "name": "github.com", "count": 140 }, ... ],
"query_types": { "A": 3100, "AAAA": 980, "HTTPS": 133 },
"clients": [ { "name": "192.168.1.10", "count": 4100 } ],
"resolvers": [ { "name": "1.1.1.1", "count": 4213 } ],
"categories": { "analytics": 210, "advertising": 95, "cdn": 540 },
"flagged_domains": [ { "domain": "doubleclick.net", "category": "advertising", "count": 60 } ],
"temporal": { "by_hour": { ... }, "busiest_hour": { ... }, "peak_queries_per_minute": 47 },
"observations": [ "github.com accounts for 140 queries (3% of the total).", ... ]
}Create ~/Library/LaunchAgents/us.radiusgroup.mcp-dns-insights.plist (capture
needs root, so a LaunchDaemon in /Library/LaunchDaemons is the better fit):
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key><string>us.radiusgroup.mcp-dns-insights</string>
<key>ProgramArguments</key>
<array>
<string>/path/to/.venv/bin/mcp-dns-insights</string>
<string>capture</string>
</array>
<key>RunAtLoad</key><true/>
<key>KeepAlive</key><true/>
</dict>
</plist>sudo cp us.radiusgroup.mcp-dns-insights.plist /Library/LaunchDaemons/
sudo launchctl load /Library/LaunchDaemons/us.radiusgroup.mcp-dns-insights.plistAll settings have sensible defaults and can be overridden via the environment:
Variable | Default |
|
|
| data directory (overrides the default location) |
|
|
|
|
|
|
|
|
|
|
The database contains a record of every hostname your Mac looked up — that is
sensitive. It is stored only on your machine and is never transmitted
anywhere except to the local MCP server you explicitly connect to Claude. The
.gitignore excludes *.db so capture data is never committed.
Note: queries answered by DNS-over-HTTPS/TLS (e.g. some browsers' built-in secure DNS) are encrypted and will not be visible to a port-53 capture.
pip install -e ".[dev]"
pytest # run the test suite
ruff check . # lintMIT — see LICENSE.
This server cannot be deployed
Uptime, SSL, DNS and domain monitoring you can talk to from Claude or any MCP client.
Search, read, and write your Apple Notes from ChatGPT/Claude via a local Mac agent + MCP relay.
AI Visibility and Content Intelligence tools for Claude and MCP-compatible agents.
Query your warehouse or a CSV with Claude/ChatGPT over MCP, governed by table-level ACL + audit.
