"DNS Doctor" matching MCP tools:

• add_monitored_domainA

  dns-doctorA

  Add a domain to the signed-in user's DNS Doctor monitoring and return the ownership-check TXT record they must publish, plus where their DNS is hosted, a provider-specific guide link and, when their provider supports it, a one-click apply URL. Re-adding a domain they already monitor returns that domain rather than an error. Needs a linked DNS Doctor account: until the human has one, or if the host's connect prompt fails, use start_monitoring_signup and print its link instead. Print every record host and value EXACTLY as returned — never rewrite, reformat or improve a record string. Nothing here is applied to anyone's DNS: a human publishes every record, and you must show them what you are about to add and get their approval before using any DNS tool of your own. When guidance.note is present, relay it as given: it covers edge cases such as a domain on Automatic DMARC.

  ConnectorNo auth

• list_my_domainsA

  dns-doctorA

  Use this when a signed-in operator asks which domains their DNS Doctor account monitors, or what to do next on them. Lists every domain on the caller's account with its state — verified, pending (added, ownership not proven yet) or verification_lapsed (the ownership record was removed, so monitoring is paused for it) — and next_step, the one thing to do next for that domain. Needs a connected DNS Doctor account or an API token. Relay next_step as given.

  ConnectorNo auth

• watch_record_changeA

  dns-doctorA

  Use this when the user asks to be told when a DNS change they are making has finished ("let me know when it's live"). Starts a free watch on ONE record for the signed-in user: DNS Doctor rechecks it every 10 minutes for up to 48 hours with the same verdict as check_record and sends ONE email to the address on their DNS Doctor account: when it is live, when the value has sat at a different name for an hour, when the zone has not served it for 6 hours, or when 48 hours pass. Same arguments as check_record; pass expected_value when the user is publishing a specific value. It reads the record once first and returns that reading: a record that is already live (verdict done), a domain whose nameservers do not answer, or a lookup fault starts nothing. Asking again for the same record returns the running watch, never a second one. Relay `watch.note`. Needs a linked DNS Doctor account; never ask the user for an email address. Nothing is applied to anyone's DNS.

  ConnectorNo auth

• whoamiA

  shiplyA

  Who am I? Returns the signed-in account: email, @handle, plan + limits, counts of sites/domains/drives, and connected DNS providers. Call this first to orient before managing sites or domains.

  ConnectorNo auth

• connect_domainA

  LayeroA

  Connect a custom domain to a site. IMPORTANT: between this call and a working domain stands A PERSON. You get DNS records — show them to the user and explain they go in at their domain registrar. Do not wait for readiness: DNS propagates in minutes to an hour, the platform re-checks on its own, and you check later via `check_domain`. Spinning here burns time and context for nothing. The address can be passed as-is: the platform reduces `https://shop.example.com/page` to `shop.example.com` itself.

  ConnectorAPI key

• set_custom_domainA

  agent4.ioA

  Bind the client's own domain to this tenant's chat pages: `https://chat.client.com/` serves the tenant's branded page (or a specific agent's chat), the address bar keeps the client's domain, and the TLS certificate is issued automatically. **Have the client configure DNS first**: add a CNAME at their DNS provider pointing to the `cname_target` in the response (`endpoint.agent4.io`). Key points: - **Subdomains only** (`chat.client.com`). An apex domain (`client.com`) cannot carry a CNAME — have the client use a subdomain, or a DNS provider with CNAME flattening (Cloudflare etc.). - **Cloudflare users must set the record to DNS only (grey cloud)**. With the proxy on (orange cloud) the name resolves to Cloudflare's addresses, verification fails, and `last_error` says so. - Verification is **asynchronous**: checked once immediately on binding; if DNS hasn't propagated it stays `pending` and is re-checked every 10 minutes (calling this tool again also re-triggers). `status` = `active` means live; the certificate is issued on first visit. - **One** domain per tenant; changing the domain re-runs verification, changing only `agent_alias` does not. - Requires a plan that includes custom domains (403 = upgrade needed). `agent_alias` empty → the domain lands on the tenant's branded page (listing available agents); set to an agent's public alias → lands directly on that agent's chat page.

  ConnectorNo auth

• add_custom_domainA

  GrigoraB

  Connect the owner's custom hostname and return the DNS records they must configure. Requires project administrator access. Pass a unique idempotency_key for this connection attempt; reuse it for retries, and use a new one after cancel/re-add. Call get_custom_domain first. Do not replace an existing domain implicitly. A root domain defaults to www as the primary hostname. Set use_www=False only when the owner explicitly requests the root hostname as primary. Present the returned DNS records exactly. The backend checks DNS automatically and enables SSL; the owner never needs to click Verify or call a validate API.

  Connector

  Destructive

  OAuth

• finalize_certificateA

  TLS RadarA

  Finalize and issue a certificate order in one call: validates the DNS challenges, waits for Let's Encrypt, and returns the issued cert. Step 3 of issuance - call after check_certificate_propagation reports all_found. STRONGLY PREFER passing csr_pem (generate the key + CSR locally with openssl so the private key never leaves the machine). Returns leaf_pem/chain_pem/fullchain_pem. If you must, pass a passphrase instead to get a PKCS#12 bundle - but a CSR is safer. If it replies "still validating", DNS hasn't fully propagated: re-check check_certificate_propagation and call again. Needs a locally-generated CSR (csr_pem) - requires a local shell with openssl. On a surface without one (e.g. a Claude.ai custom connector) this can't complete; it returns guidance to finish in Claude Code/Cowork or the web form. Scanning and monitoring work everywhere. On success the structuredContent carries a `handoff` object - relay `handoff.message` to the user and do NOT separately call add_monitor; the cert→monitoring handoff is automatic and server-side.

  ConnectorNo auth

• renew_certificateA

  TLS RadarA

  Renew a certificate by cloning a recent order (requires the original order_id; Beacon purges orders after ~24h). Returns a new order_id and fresh DNS TXT records - then poll check_certificate_propagation and call finalize_certificate. If you don't have an order_id (the usual case at renewal time), call create_certificate for the domain instead; that IS the renewal.

  ConnectorNo auth

• check_email_domain_securityA

  Tier1 IT AssessmentA

  Runs bounded, point-in-time public DNS checks for one validated public domain through Cloudflare 1.1.1.1 DNS over HTTPS. Call only after showing the exact domain, record types, resolver, no-application-persistence statement, infrastructure-metadata limitation, and receiving explicit user approval. Set approved=true only when that approval exists. Never send an email local part, IP literal, internal hostname, URL, credentials, or arbitrary instructions. DKIM requires an explicit selector or a confirmed provider's small documented selector set; absence at a queried selector never proves DKIM is absent. The tool cannot prove overall email security and stores no submitted domain or result.

  ConnectorNo auth

• lookup_dnsA

  IntoDNS.ai DNS & Email Security ScannerA

  Read-only DNS record lookup via DNS-over-HTTPS. Pass `type` for a single record type or `types` for an array; if both omitted, returns A records. Returns parsed answers with TTL, raw rdata, and DNSSEC AD bit. Use for arbitrary record queries; use validate_dnssec for full DNSSEC chain validation, or check_dns_propagation for multi-resolver consensus. No auth, no rate limits beyond upstream resolver.

  ConnectorNo auth

• check_tlsa_daneA

  IntoDNS.ai DNS & Email Security ScannerA

  Read-only TLSA/DANE DNS record check. With no port, resolves MX hosts and validates their `_25._tcp` TLSA tuple syntax; with an explicit port, queries `_<port>._<protocol>.<domain>`. Returns parsed usage, selector, matching type, certificate data, syntax errors, and best-practice advisories. It does not fetch or cryptographically match the live service certificate, so pair it with check_smtp_tls for SMTP certificate evidence. Use before publishing DANE records or troubleshooting DANE handover. No auth or destructive actions.

  ConnectorNo auth

• create_custom_domainA

  TessryxA

  Claim a custom hostname for this tenant and generate its DNS challenge. The claim alone grants NOTHING until ownership is proven — it returns TWO DNS records (an ownership TXT and a permanent routing CNAME) in dns_records that the customer must add at their DNS provider. Present those records to the human, wait for them to add them, then call verify_custom_domain. slug_prefix/root_endpoint are optional here and are usually set later with update_custom_domain (after the domain verifies).

  ConnectorOAuth

• scan_agent_commerce_readinessA

  AI Agent AnalyticsA

  Inspect a fixed set of public machine-facing surfaces at the HTTPS origin derived from url. Use this before recommending or integrating a public agent-facing product; do not use it for an authorized customer's instrumentation state, use get_connection_health, and never treat the result as a security score. url path/query/fragment are ignored; redirects are not followed, credentials are never sent, direct/private-style or non-public DNS targets are rejected, and response bodies are bounded. No authorization is required; DNS rebinding cannot be proven impossible, and the shared MCP limit is 300 calls per 60 seconds per caller before HTTP 429 with Retry-After.

  ConnectorNo auth

• sites.unlink_domainA

  Resistance ToolsB

  Detach a domain after its DNS site record no longer points to this site (or it changed owner). Confirm site and full domain exactly. Removing the last domain deletes the site and requires confirmDeleteSite plus sites:delete; cleanup of a Storage-hosted site also requires storage:delete and bag delegation. Does not sign or change DNS records.

  Connector

  Destructive

  No auth

• udp_activity_toolA

  HoneyLabsA

  UDP datagrams sent to the sensors: DNS questions, QUIC client fingerprints and other UDP probes, with the ports, networks and countries involved. Use for "who is sending DNS ANY queries", "is anyone querying version.bind", "have you seen this QUIC JA4", "which UDP ports are probed", "what hits 5060/udp". Every other tool reads TCP only, so UDP questions belong here. A UDP source address can be forged: treat each address as claimed, never as evidence against it, and do not feed it to ioc_lookup_tool as proof. query uses the /udp search grammar: 'qtype:ANY', 'qname:version.bind', 'proto:quic', 'port:5060 country:CN', 'ja4:q13d0310h3_55b375c5d22e_cd85d2d88918' or 'quic:3f1a9c2b7d40'; leave it empty for the overview. window: 24h, 7d (default) or 30d, shortened to the plan's query window when that is shorter (window_notice then says so). samples: 0 to 25 example datagrams, default 10.

  ConnectorNo auth

• lavela.provision_domainA

  lavelaA

  Connect a domain the user already owns (lavela doesn't sell domains) and get the DNS records to add at their registrar. target 'hosting' (default) = the web-hosting site, verified and given HTTPS automatically; target 'compute' = a server (`service`), which doesn't verify itself — poll lavela.get_status. The app must be deployed first. Not working yet? lavela.diagnose_domain. Free. Details: https://console.lavela.dev/docs/mcp#domains

  ConnectorAPI key

• list_doc_topicsA

  Porkbun (official)A

  List the available Porkbun API documentation topics. Returns the docs index (Markdown) — every per-topic page (e.g. dns, domain, webhooks, ssl, pricing) with a one-line description and endpoint count, plus links to the full reference and the OpenAPI spec. Use this first to discover what docs exist, then read_doc to read one. Grounds an agent in Porkbun's own docs without leaving the conversation.

  ConnectorOAuth

• update_domainA

  MailercloudA

  Change a sending domain's record host names (tracking_prefix, dkim_selector, dkim2_selector, image_prefix) and/or open tracking. Only the fields given change. A changed selector or prefix breaks the DNS records already published until the user publishes the new ones and runs verify_domain, so it shows a preview first and changes only with confirm: true.

  Connector

  Destructive

  API key

• update_domainA

  MailercloudA

  Change a sending domain's record host names (tracking_prefix, dkim_selector, dkim2_selector, image_prefix) and/or open tracking. Only the fields given change. A changed selector or prefix breaks the DNS records already published until the user publishes the new ones and runs verify_domain, so it shows a preview first and changes only with confirm: true.

  Connector

  Destructive

  API key

• domain_subdomainsA

  Crawlora MCPB

  Returns up to 5,000 indexed subdomain records and names for one registrable domain; use these for name discovery, then call domain_dns_resolve to check live DNS. Names may be historical. The anonymous source limits requests to 100 per source IP per day.

  ConnectorNo auth