Who am I? Returns the signed-in account: email, @handle, plan + limits, counts of sites/domains/drives, and connected DNS providers. Call this first to orient before managing sites or domains.
ConnectorNo auth
777,550 tools. Updated 2026-11-13 17:30
"MCP Cloudflare DNS Server" matching MCP tools:
- Connect a custom domain to a site. IMPORTANT: between this call and a working domain stands A PERSON. You get DNS records — show them to the user and explain they go in at their domain registrar. Do not wait for readiness: DNS propagates in minutes to an hour, the platform re-checks on its own, and you check later via `check_domain`. Spinning here burns time and context for nothing. The address can be passed as-is: the platform reduces `https://shop.example.com/page` to `shop.example.com` itself.ConnectorAPI key
- Bind the client's own domain to this tenant's chat pages: `https://chat.client.com/` serves the tenant's branded page (or a specific agent's chat), the address bar keeps the client's domain, and the TLS certificate is issued automatically. **Have the client configure DNS first**: add a CNAME at their DNS provider pointing to the `cname_target` in the response (`endpoint.agent4.io`). Key points: - **Subdomains only** (`chat.client.com`). An apex domain (`client.com`) cannot carry a CNAME — have the client use a subdomain, or a DNS provider with CNAME flattening (Cloudflare etc.). - **Cloudflare users must set the record to DNS only (grey cloud)**. With the proxy on (orange cloud) the name resolves to Cloudflare's addresses, verification fails, and `last_error` says so. - Verification is **asynchronous**: checked once immediately on binding; if DNS hasn't propagated it stays `pending` and is re-checked every 10 minutes (calling this tool again also re-triggers). `status` = `active` means live; the certificate is issued on first visit. - **One** domain per tenant; changing the domain re-runs verification, changing only `agent_alias` does not. - Requires a plan that includes custom domains (403 = upgrade needed). `agent_alias` empty → the domain lands on the tenant's branded page (listing available agents); set to an agent's public alias → lands directly on that agent's chat page.ConnectorNo auth
- Connect the owner's custom hostname and return the DNS records they must configure. Requires project administrator access. Pass a unique idempotency_key for this connection attempt; reuse it for retries, and use a new one after cancel/re-add. Call get_custom_domain first. Do not replace an existing domain implicitly. A root domain defaults to www as the primary hostname. Set use_www=False only when the owner explicitly requests the root hostname as primary. Present the returned DNS records exactly. The backend checks DNS automatically and enables SSL; the owner never needs to click Verify or call a validate API.ConnectorDestructiveOAuth
- WHAT: Offline email checks: RFC-style syntax + normalization, common domain typo "did you mean" (gmial.com -> gmail.com), disposable/temporary domain (bundled CC0 list, ~thousands of domains), role account (info@, sales@), free webmail provider. WHEN: Fast pre-filtering of signups or lead lists, before paying for email_validate_deliverability. WHEN NOT: Does NOT check DNS/MX, so it cannot tell whether the domain receives mail; use email_validate_deliverability (paid) for MX/SPF/DMARC. COST: Free; no token. RETURNS: Paged "email_check" rows; verdict is invalid | risky | unknown, never valid (dns_checked is always false). BEHAVIOR: Runs on this Fairquery-hosted Worker (Cloudflare), not on the caller's machine; inputs leave the client. This Worker's code is designed not to store inputs, results, or an Apify token. No further network call (no DNS/SMTP); addresses are not forwarded. Synchronous and CPU-bound, no rate limits: 10,000 addresses (the per-call maximum) return in well under a second. PARAMETERS: emails: each element is parsed on its own (one address per element; a comma-separated list in one element is INVALID_SYNTAX, not split). Before checking, "Name <addr>" is reduced to addr, a leading "mailto:" is dropped, the domain is lowercased (local part keeps its case), a trailing dot is removed and IDN domains are converted to punycode; the normalized value is returned as email, the original as input. Duplicates are not merged: every element yields one row, in input order. Role detection ignores +tags (sales+eu@ counts as sales@) and disposable matching also covers subdomains of listed domains. limit/offset page those rows; meta.summary always counts verdicts over ALL rows, not just the current page. EXAMPLE: {"emails":["someone@gmial.com"]} -> verdict "risky", reasons ["POSSIBLE_TYPO","DNS_NOT_CHECKED"], did_you_mean "someone@gmail.com".ConnectorNo auth
- Renew a certificate by cloning a recent order (requires the original order_id; Beacon purges orders after ~24h). Returns a new order_id and fresh DNS TXT records - then poll check_certificate_propagation and call finalize_certificate. If you don't have an order_id (the usual case at renewal time), call create_certificate for the domain instead; that IS the renewal.ConnectorNo auth
Matching MCP Servers
- AlicenseAqualityBmaintenanceEnables AI agents to manage Cloudflare DNS records, including listing, creating, updating, and deleting records for your domains.814 npmGPL 3.0
- AlicenseAqualityDmaintenanceA Model Context Protocol server implementation that allows AI agents to manage DNS records for domains hosted on Cloudflare by providing tools to list, create, update, and delete various types of DNS records.570 npm3GPL 3.0
Matching MCP Connectors
Live DNS & email auth checks
Bypass Cloudflare API: A powerful scraping API designed to bypass Cloudflare protection.
- Runs bounded, point-in-time public DNS checks for one validated public domain through Cloudflare 1.1.1.1 DNS over HTTPS. Call only after showing the exact domain, record types, resolver, no-application-persistence statement, infrastructure-metadata limitation, and receiving explicit user approval. Set approved=true only when that approval exists. Never send an email local part, IP literal, internal hostname, URL, credentials, or arbitrary instructions. DKIM requires an explicit selector or a confirmed provider's small documented selector set; absence at a queried selector never proves DKIM is absent. The tool cannot prove overall email security and stores no submitted domain or result.ConnectorNo auth
- Read-only DNS record lookup via DNS-over-HTTPS. Pass `type` for a single record type or `types` for an array; if both omitted, returns A records. Returns parsed answers with TTL, raw rdata, and DNSSEC AD bit. Use for arbitrary record queries; use validate_dnssec for full DNSSEC chain validation, or check_dns_propagation for multi-resolver consensus. No auth, no rate limits beyond upstream resolver.ConnectorNo auth
- Read-only TLSA/DANE DNS record check. With no port, resolves MX hosts and validates their `_25._tcp` TLSA tuple syntax; with an explicit port, queries `_<port>._<protocol>.<domain>`. Returns parsed usage, selector, matching type, certificate data, syntax errors, and best-practice advisories. It does not fetch or cryptographically match the live service certificate, so pair it with check_smtp_tls for SMTP certificate evidence. Use before publishing DANE records or troubleshooting DANE handover. No auth or destructive actions.ConnectorNo auth
- Claim a custom hostname for this tenant and generate its DNS challenge. The claim alone grants NOTHING until ownership is proven — it returns TWO DNS records (an ownership TXT and a permanent routing CNAME) in dns_records that the customer must add at their DNS provider. Present those records to the human, wait for them to add them, then call verify_custom_domain. slug_prefix/root_endpoint are optional here and are usually set later with update_custom_domain (after the domain verifies).ConnectorOAuth
- Inspect a fixed set of public machine-facing surfaces at the HTTPS origin derived from url. Use this before recommending or integrating a public agent-facing product; do not use it for an authorized customer's instrumentation state, use get_connection_health, and never treat the result as a security score. url path/query/fragment are ignored; redirects are not followed, credentials are never sent, direct/private-style or non-public DNS targets are rejected, and response bodies are bounded. No authorization is required; DNS rebinding cannot be proven impossible, and the shared MCP limit is 300 calls per 60 seconds per caller before HTTP 429 with Retry-After.ConnectorNo auth
- Detach a domain after its DNS site record no longer points to this site (or it changed owner). Confirm site and full domain exactly. Removing the last domain deletes the site and requires confirmDeleteSite plus sites:delete; cleanup of a Storage-hosted site also requires storage:delete and bag delegation. Does not sign or change DNS records.ConnectorDestructiveNo auth
- UDP datagrams sent to the sensors: DNS questions, QUIC client fingerprints and other UDP probes, with the ports, networks and countries involved. Use for "who is sending DNS ANY queries", "is anyone querying version.bind", "have you seen this QUIC JA4", "which UDP ports are probed", "what hits 5060/udp". Every other tool reads TCP only, so UDP questions belong here. A UDP source address can be forged: treat each address as claimed, never as evidence against it, and do not feed it to ioc_lookup_tool as proof. query uses the /udp search grammar: 'qtype:ANY', 'qname:version.bind', 'proto:quic', 'port:5060 country:CN', 'ja4:q13d0310h3_55b375c5d22e_cd85d2d88918' or 'quic:3f1a9c2b7d40'; leave it empty for the overview. window: 24h, 7d (default) or 30d, shortened to the plan's query window when that is shorter (window_notice then says so). samples: 0 to 25 example datagrams, default 10.ConnectorNo auth
- Connect a domain the user already owns (lavela doesn't sell domains) and get the DNS records to add at their registrar. target 'hosting' (default) = the web-hosting site, verified and given HTTPS automatically; target 'compute' = a server (`service`), which doesn't verify itself — poll lavela.get_status. The app must be deployed first. Not working yet? lavela.diagnose_domain. Free. Details: https://console.lavela.dev/docs/mcp#domainsConnectorAPI key
- Check whether this Porkbun account is connected to a Cloudflare account, and which one. THIS IS THE POLL TARGET for the connect flow. Connecting is a HUMAN action: Cloudflare's consent screen must be completed in a browser and the authorization is bound to the Porkbun web session that starts it, so it cannot be driven over the API. When `connected` is false the response includes a `connectUrl` — show that URL to the user, ask them to authorize, then call this tool again every few seconds until `connected` is true. Everything else in the Cloudflare flow is fully automatable once this is true.ConnectorOAuth
- Act on one in-flight durable run: `pause`, `resume`, `terminate` (stops it where it is; completed steps are not undone), or `send_event` to deliver an event to a run parked on a wait or approval, resuming it. For send_event, read get_run first and use one of its `awaitingEvents` as `eventType`: Cloudflare accepts any type, so a wrong one silently does nothing. To run a workflow again from the start, use run_workflow; replaying from a step is not offered because it would repeat effects that already happened.ConnectorDestructiveOAuth
- Call one of the user's deployed agent-tool workflows (those with an MCP Tool trigger) by its tool name or workflow id, with the arguments its schema declares. Use it when the workflow is not in your tool list: one deployed since you connected only appears there after you reconnect, but is callable here at once. It runs for real in the user's Cloudflare account and counts toward this connection's daily limit on workflow calls. list_deployed_tools shows what is callable and the arguments each takes.ConnectorDestructiveOAuth
- Search the Mississippi Code of 1972 BY TOPIC or keyword rather than citation — "security deposit", "concealed carry", "DUI per se limit", "homicide". Matches against every section's official CATCHLINE across the whole Code (not full statutory body text — there is no full-text search anywhere in this source chain; the official LexisNexis tool, Justia, and FindLaw all sit behind the same Cloudflare bot-check, confirmed live). Returns matching citations, titles, and catchlines; call ms_code_section with a citation for the full text. Keyless.ConnectorNo auth
- Change a sending domain's record host names (tracking_prefix, dkim_selector, dkim2_selector, image_prefix) and/or open tracking. Only the fields given change. A changed selector or prefix breaks the DNS records already published until the user publishes the new ones and runs verify_domain, so it shows a preview first and changes only with confirm: true.ConnectorDestructiveAPI key
- Change a sending domain's record host names (tracking_prefix, dkim_selector, dkim2_selector, image_prefix) and/or open tracking. Only the fields given change. A changed selector or prefix breaks the DNS records already published until the user publishes the new ones and runs verify_domain, so it shows a preview first and changes only with confirm: true.ConnectorDestructiveAPI key
- Returns up to 5,000 indexed subdomain records and names for one registrable domain; use these for name discovery, then call domain_dns_resolve to check live DNS. Names may be historical. The anonymous source limits requests to 100 per source IP per day.ConnectorNo auth