ShieldDNS MCP server
OfficialServer Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| SHIELDDNS_DOH | No | DoH endpoints, tried in order | https://secure2.shielddns.eu/dns-query,https://secure.shielddns.eu/dns-query |
| SHIELDDNS_TIMEOUT | No | Seconds per query (timeout) | 6 |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| check_domainA | Check whether a domain or URL is safe to open, using the ShieldDNS protective resolver. Returns a verdict (blocked, dnssec_invalid, does_not_exist, resolves...), a 0-100 risk score with human-readable reasons (blocklist match, DNSSEC, look-alike of known brands, mixed scripts, random-looking names) and an advice field (ok_to_open, caution, do_not_open). Accepts a bare domain or a full URL. |
| resolveA | Resolve a DNS name through ShieldDNS (DNS-over-HTTPS, DNSSEC validation, threat blocking). record_type is one of: A, AAAA, CNAME, MX, TXT, NS, SOA, CAA, HTTPS, SVCB, TLSA, DS, DNSKEY, PTR, SRV. Returns records, rcode, whether the answer was DNSSEC-validated, whether ShieldDNS blocked the name, and any Extended DNS Errors (RFC 8914). |
| service_statusB | Public status of the two ShieldDNS nodes (each node checks the other every 5 minutes). |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 3 tools
check_domain and resolve are mostly distinct: one gives a safety verdict and advice, the other returns DNS records and resolution metadata. There is some overlap because resolve also reports threat blocking and DNSSEC status, so an agent may occasionally hesitate between them.
The names mix conventions: check_domain is verb_noun, resolve is a bare verb, and service_status is noun_noun. They remain readable and understandable, but the set does not follow a predictable pattern.
Three tools fit the server's focused scope of domain safety checking, DNS resolution, and node status. The surface is small but each tool has a clear role, though it sits at the lower bound of a comfortable set.
The core lifecycle is covered: safety verdicts, raw DNS resolution with DNSSEC and blocking info, and node status. Minor gaps exist, such as no bulk domain check or blocklist/configuration inspection, but the main workflows are supported.