technitium-mcp-secure
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| TECHNITIUM_URL | Yes | Server URL (e.g. https://192.168.1.100:5380) | |
| TECHNITIUM_USER | No | Username (default: admin) | |
| TECHNITIUM_TOKEN | No | API token (preferred) | |
| TECHNITIUM_PASSWORD | No | Admin password (token is preferred) | |
| TECHNITIUM_READONLY | No | Set 'true' to hide all write tools | |
| TECHNITIUM_ALLOW_HTTP | No | Set 'true' to allow insecure HTTP connections | |
| TECHNITIUM_TOKEN_FILE | No | Path to file containing token (must be mode 0600) |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| dns_get_statsA | Get DNS query statistics for a time period. Returns total queries, cached, blocked, failure counts, plus top clients, top domains, and top blocked domains. |
| dns_health_checkA | Quick health check of the DNS server. Returns version, uptime, forwarder config, blocking status, and last hour failure rate. |
| dns_check_updateA | Check if a newer version of Technitium DNS Server is available. |
| dns_resolveA | Test DNS resolution for a domain name. Resolves using the Technitium server itself or a specified external server. |
| dns_list_zonesA | List all DNS zones configured on the server. Returns zone name, type (Primary/Secondary/Stub/Forwarder), status, and record count. |
| dns_create_zoneA | Create a new DNS zone. Use 'Primary' for hosting records locally, 'Forwarder' for conditional forwarding. |
| dns_delete_zoneA | Delete a DNS zone and all its records. Requires confirm=true to execute. |
| dns_zone_optionsA | Get the configuration options for a specific zone including DNSSEC, transfer, and notify settings. |
| dns_enable_zoneB | Enable a disabled DNS zone. |
| dns_disable_zoneA | Disable a DNS zone. The zone will stop responding to queries but its records are preserved. |
| dns_set_zone_optionsA | Set configuration options for a zone. Pass the zone name plus any option key/value pairs to update (e.g. notify settings, zone transfer ACLs). |
| dns_export_zoneA | Export a DNS zone file in standard BIND format. Returns the zone file as text. |
| dns_list_recordsA | List DNS records in a zone. Optionally filter by a specific domain name within the zone. When no domain is specified, returns all records across all zones matching the zone name (including subzones like app.example.com when zone=example.com). When domain is specified, returns records for that exact domain only. |
| dns_add_recordA | Add a DNS record to a zone. Creates the zone automatically if it doesn't exist for Primary type. |
| dns_update_recordC | Update an existing DNS record. |
| dns_delete_recordA | Delete a specific DNS record from a zone. Requires confirm=true to execute. |
| dns_list_blockedA | List blocked DNS zones (domains that are denied). Returns a hierarchical tree — call with no domain to see top-level zones, then pass a domain (e.g. 'com') to drill into subdomains. |
| dns_block_domainA | Block a domain name. Queries to this domain will be denied by the DNS server. |
| dns_list_allowedA | List allowed DNS zones (domains that bypass block lists). Returns a hierarchical tree — call with no domain to see top-level zones, then pass a domain (e.g. 'com') to drill into subdomains. |
| dns_allow_domainA | Allow a domain name, bypassing any block lists. Useful for whitelisting false positives. |
| dns_remove_allowedA | Remove a domain from the allow list. The domain will no longer bypass block lists. |
| dns_remove_blockedB | Remove a domain from the block list. The domain will no longer be denied. |
| dns_flush_allowedA | Flush the entire allow list. All allowed domains will be removed. Requires confirm=true to execute. |
| dns_flush_blockedA | Flush the entire custom block list. All manually blocked domains will be removed. Requires confirm=true to execute. |
| dns_flush_cacheA | Flush the entire DNS cache. Forces all subsequent queries to be resolved fresh from upstream. Requires confirm=true to execute. |
| dns_list_cacheA | List zones in the DNS cache. Returns a hierarchical tree — call with no domain to see top-level zones, then pass a domain (e.g. 'com') to drill into cached subdomains. |
| dns_delete_cachedA | Delete a specific domain from the DNS cache. Unlike flush, this only removes the specified domain. |
| dns_get_settingsA | Get the current DNS server settings including forwarders, blocking configuration, protocols, logging, cache settings, and proxy configuration. |
| dns_set_settingsA | Update DNS server settings. Pass key/value pairs for any settings to change (e.g. forwarders, blocking, recursion, cache). Use dns_get_settings first to see current values and available keys. |
| dns_update_blocklistsA | Force an immediate update of all configured block lists. Normally block lists update every 24 hours. |
| dns_temp_disable_blockingA | Temporarily disable domain blocking for a specified number of minutes. Blocking re-enables automatically after the timer expires. |
| dns_query_logsA | Query DNS server logs with optional filters. Returns recent DNS queries and their responses. Requires the Query Logs app to be installed. |
| dns_list_appsA | List installed DNS apps on the server and their current status. |
| dns_list_app_storeA | List all available apps from the Technitium DNS app store with versions and descriptions. |
| dns_install_appA | Download and install a DNS app from the Technitium app store. Use dns_list_app_store to see available apps. |
| dns_uninstall_appA | Uninstall a DNS app from the server. Requires confirm=true to execute. |
| dns_get_app_configB | Get the configuration for an installed DNS app. |
| dns_dnssec_infoB | Get DNSSEC properties for a zone including signing status, key details, and algorithm info. |
| dns_get_dsA | Get the DS (Delegation Signer) records for a DNSSEC-signed zone. These are needed by the parent zone registrar. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 39 tools
Each tool names a distinct resource and action: zones, records, cache, block lists, allow lists, apps, settings, and DNSSEC are cleanly separated. Even similar-looking tools like dns_remove_blocked and dns_flush_blocked differ clearly by single-item versus full-list scope.
The dns_ prefix plus verb_noun pattern is used consistently across nearly all tools, e.g. dns_list_zones, dns_create_zone, dns_delete_record, dns_install_app. A few names break the get_ convention, notably dns_zone_options and dns_dnssec_info, which keeps this from a perfect score.
39 tools is well beyond the ideal 3-15 range and even beyond the 16-25 heavy range. While the Technitium DNS surface is broad, several clusters like block lists, allow lists, cache, and zones could be consolidated into parameterized list/update tools without losing capability.
The toolset covers the core DNS lifecycle: zone and record CRUD, cache management, blocking/allowlisting, server settings, apps, logs, stats, and DNSSEC info. Minor gaps such as missing zone import and no explicit DNSSEC sign/unsign operation are workable around through dns_set_zone_options and existing read tools.