"appouse godaddy dns mcp" matching MCP tools:

• get_domainA

  TunnelMind Data APIB

  Returns the complete surveillance intelligence record for a domain name. If the domain is in TunnelMind's tracker database (80,000+ entries), the response includes tracker category, risk score, fingerprinting data, cookie persistence, IAB TCF purposes, and the owning corporate entity. If the domain is not in the database, a live probe is automatically run: RDAP registration data, DNS records (MX, SPF, TXT verification tokens), HTTP headers, and CSP third-party actors are fetched fresh from the edge and returned. Use this tool when: - You need to know whether a specific domain tracks users, and how aggressively. - You are researching who owns a domain and what corporate entity controls it. - You want to check HTTP security headers and third-party services embedded in a site. - You are building a risk score for a domain before routing traffic through it. Do NOT use this tool when: - You want to search by keyword or category — use `search` instead. - You want all domains for an entity — use `get_entity` instead. Inputs: - `domain` (path, required): Domain name. Strip `www.` prefix — it is removed automatically. Subdomains are resolved to the parent: `ads.doubleclick.net` → `doubleclick.net`. Examples: `doubleclick.net`, `google-analytics.com`, `intercom.io`. Returns: - Full `DomainRecord`. Free tier returns the domain, category, score, prevalence, and entity name. Pro/enterprise additionally return `tcf_vendor_id`, `tcf_purposes`, `tcf_features`, and `disconnect_cats`. - If the domain is not in the tracker database, `live_lookup: true` is set and RDAP/DNS/HTTP probe results are returned instead of tracker fields. - 404 if the domain cannot be found via live probe either (unknown TLD, unreachable). Cost: - Anonymous (no key): 10/min, 100/day. Free key: 50/day. Pro/enterprise: included in plan. Latency: - Database hit: typical <100ms, p99 <300ms. - Live probe: typical 2-5s, p99 10s (external DNS/HTTP calls).

  ConnectorNo auth

• whoamiA

  shiplyA

  Who am I? Returns the signed-in account: email, @handle, plan + limits, counts of sites/domains/drives, and connected DNS providers. Call this first to orient before managing sites or domains.

  ConnectorNo auth

• connect_domainA

  LayeroA

  Connect a custom domain to a site. IMPORTANT: between this call and a working domain stands A PERSON. You get DNS records — show them to the user and explain they go in at their domain registrar. Do not wait for readiness: DNS propagates in minutes to an hour, the platform re-checks on its own, and you check later via `check_domain`. Spinning here burns time and context for nothing. The address can be passed as-is: the platform reduces `https://shop.example.com/page` to `shop.example.com` itself.

  ConnectorAPI key

• set_custom_domainA

  agent4.ioA

  Bind the client's own domain to this tenant's chat pages: `https://chat.client.com/` serves the tenant's branded page (or a specific agent's chat), the address bar keeps the client's domain, and the TLS certificate is issued automatically. **Have the client configure DNS first**: add a CNAME at their DNS provider pointing to the `cname_target` in the response (`endpoint.agent4.io`). Key points: - **Subdomains only** (`chat.client.com`). An apex domain (`client.com`) cannot carry a CNAME — have the client use a subdomain, or a DNS provider with CNAME flattening (Cloudflare etc.). - **Cloudflare users must set the record to DNS only (grey cloud)**. With the proxy on (orange cloud) the name resolves to Cloudflare's addresses, verification fails, and `last_error` says so. - Verification is **asynchronous**: checked once immediately on binding; if DNS hasn't propagated it stays `pending` and is re-checked every 10 minutes (calling this tool again also re-triggers). `status` = `active` means live; the certificate is issued on first visit. - **One** domain per tenant; changing the domain re-runs verification, changing only `agent_alias` does not. - Requires a plan that includes custom domains (403 = upgrade needed). `agent_alias` empty → the domain lands on the tenant's branded page (listing available agents); set to an agent's public alias → lands directly on that agent's chat page.

  ConnectorNo auth

• add_custom_domainA

  GrigoraB

  Connect the owner's custom hostname and return the DNS records they must configure. Requires project administrator access. Pass a unique idempotency_key for this connection attempt; reuse it for retries, and use a new one after cancel/re-add. Call get_custom_domain first. Do not replace an existing domain implicitly. A root domain defaults to www as the primary hostname. Set use_www=False only when the owner explicitly requests the root hostname as primary. Present the returned DNS records exactly. The backend checks DNS automatically and enables SSL; the owner never needs to click Verify or call a validate API.

  Connector

  Destructive

  OAuth

• finalize_certificateA

  TLS RadarA

  Finalize and issue a certificate order in one call: validates the DNS challenges, waits for Let's Encrypt, and returns the issued cert. Step 3 of issuance - call after check_certificate_propagation reports all_found. STRONGLY PREFER passing csr_pem (generate the key + CSR locally with openssl so the private key never leaves the machine). Returns leaf_pem/chain_pem/fullchain_pem. If you must, pass a passphrase instead to get a PKCS#12 bundle - but a CSR is safer. If it replies "still validating", DNS hasn't fully propagated: re-check check_certificate_propagation and call again. Needs a locally-generated CSR (csr_pem) - requires a local shell with openssl. On a surface without one (e.g. a Claude.ai custom connector) this can't complete; it returns guidance to finish in Claude Code/Cowork or the web form. Scanning and monitoring work everywhere. On success the structuredContent carries a `handoff` object - relay `handoff.message` to the user and do NOT separately call add_monitor; the cert→monitoring handoff is automatic and server-side.

  ConnectorNo auth

• renew_certificateA

  TLS RadarA

  Renew a certificate by cloning a recent order (requires the original order_id; Beacon purges orders after ~24h). Returns a new order_id and fresh DNS TXT records - then poll check_certificate_propagation and call finalize_certificate. If you don't have an order_id (the usual case at renewal time), call create_certificate for the domain instead; that IS the renewal.

  ConnectorNo auth

• check_email_domain_securityA

  Tier1 IT AssessmentA

  Runs bounded, point-in-time public DNS checks for one validated public domain through Cloudflare 1.1.1.1 DNS over HTTPS. Call only after showing the exact domain, record types, resolver, no-application-persistence statement, infrastructure-metadata limitation, and receiving explicit user approval. Set approved=true only when that approval exists. Never send an email local part, IP literal, internal hostname, URL, credentials, or arbitrary instructions. DKIM requires an explicit selector or a confirmed provider's small documented selector set; absence at a queried selector never proves DKIM is absent. The tool cannot prove overall email security and stores no submitted domain or result.

  ConnectorNo auth

• lookup_dnsA

  IntoDNS.ai DNS & Email Security ScannerA

  Read-only DNS record lookup via DNS-over-HTTPS. Pass `type` for a single record type or `types` for an array; if both omitted, returns A records. Returns parsed answers with TTL, raw rdata, and DNSSEC AD bit. Use for arbitrary record queries; use validate_dnssec for full DNSSEC chain validation, or check_dns_propagation for multi-resolver consensus. No auth, no rate limits beyond upstream resolver.

  ConnectorNo auth

• check_tlsa_daneA

  IntoDNS.ai DNS & Email Security ScannerA

  Read-only TLSA/DANE DNS record check. With no port, resolves MX hosts and validates their `_25._tcp` TLSA tuple syntax; with an explicit port, queries `_<port>._<protocol>.<domain>`. Returns parsed usage, selector, matching type, certificate data, syntax errors, and best-practice advisories. It does not fetch or cryptographically match the live service certificate, so pair it with check_smtp_tls for SMTP certificate evidence. Use before publishing DANE records or troubleshooting DANE handover. No auth or destructive actions.

  ConnectorNo auth

• whois_lookupA

  IntoDNS.ai DNS & Email Security ScannerA

  Read-only WHOIS/RDAP lookup for a domain or IP address. For domains it returns registrar, EPP domain-status codes, nameservers, registration/expiry/last-changed dates, and the abuse contact; for IPs it returns the network allocation (CIDR, name, type). Data is sourced live from the IANA RDAP bootstrap with an rdap.org fallback. Registrant personal data is usually GDPR-redacted — that is normal, not an error. Use to check domain ownership, age, or expiry, vet a suspicious domain, or find an abuse contact; for DNS records use lookup_dns instead. `query` is a domain name or an IPv4/IPv6 address. No auth, no side effects.

  ConnectorNo auth

• create_custom_domainA

  TessryxA

  Claim a custom hostname for this tenant and generate its DNS challenge. The claim alone grants NOTHING until ownership is proven — it returns TWO DNS records (an ownership TXT and a permanent routing CNAME) in dns_records that the customer must add at their DNS provider. Present those records to the human, wait for them to add them, then call verify_custom_domain. slug_prefix/root_endpoint are optional here and are usually set later with update_custom_domain (after the domain verifies).

  ConnectorOAuth

• formation_set_domain_dns_recordsA

  Lovie Company FormationC

  Adds DNS records (A, AAAA, CNAME, CAA, MX, TXT, NS) to a domain the company purchased through Lovie and applies them at the registrar — no registrar login needed. Use when the founder wants to point their domain at a website host or set up email records. Host is relative to the domain ("@" for the root, "www" for a subdomain). This ADDS records: it cannot delete one, and it cannot reliably overwrite a record that already exists — the registrar's own tools are needed for either. Full nameserver delegation changes are not supported. Call LookupDomainDnsRecords first to see what is already there.

  Connector

  Destructive

  No auth

• release_hostnameA

  DNSMintA

  PERMANENTLY give up a hostname. Read this before calling it. A released hostname is tombstoned and is never issued again, to anyone, including this account. There is no undo and it cannot be re-minted. This is not like deleting a DNS record. Only call this when the name is genuinely finished with and a human has asked for it. If the goal is to stop serving, repoint it or stop the machine instead. Pass the hostname in `confirm` exactly as it appears, so a name cannot be released by guessing an id.

  Connector

  Destructive

  OAuth

• scan_agent_commerce_readinessA

  AI Agent AnalyticsA

  Inspect a fixed set of public machine-facing surfaces at the HTTPS origin derived from url. Use this before recommending or integrating a public agent-facing product; do not use it for an authorized customer's instrumentation state, use get_connection_health, and never treat the result as a security score. url path/query/fragment are ignored; redirects are not followed, credentials are never sent, direct/private-style or non-public DNS targets are rejected, and response bodies are bounded. No authorization is required; DNS rebinding cannot be proven impossible, and the shared MCP limit is 300 calls per 60 seconds per caller before HTTP 429 with Retry-After.

  ConnectorNo auth

• sites.unlink_domainA

  Resistance ToolsB

  Detach a domain after its DNS site record no longer points to this site (or it changed owner). Confirm site and full domain exactly. Removing the last domain deletes the site and requires confirmDeleteSite plus sites:delete; cleanup of a Storage-hosted site also requires storage:delete and bag delegation. Does not sign or change DNS records.

  Connector

  Destructive

  No auth

• prove_domainA

  OverwingA

  Begin proving that your account controls a domain. For an account with no email the domain stands in for one: it raises the limits to the normal free tier, opens full Beacon reports, and lets a lost key be replaced. Returns one value to publish at the domain, as a DNS TXT record or as a file under /.well-known; then call verify_domain. One domain belongs to one account. Calling again for the same domain returns the same value. Needs an organization key.

  ConnectorNo auth

• udp_activity_toolA

  HoneyLabsA

  UDP datagrams sent to the sensors: DNS questions, QUIC client fingerprints and other UDP probes, with the ports, networks and countries involved. Use for "who is sending DNS ANY queries", "is anyone querying version.bind", "have you seen this QUIC JA4", "which UDP ports are probed", "what hits 5060/udp". Every other tool reads TCP only, so UDP questions belong here. A UDP source address can be forged: treat each address as claimed, never as evidence against it, and do not feed it to ioc_lookup_tool as proof. query uses the /udp search grammar: 'qtype:ANY', 'qname:version.bind', 'proto:quic', 'port:5060 country:CN', 'ja4:q13d0310h3_55b375c5d22e_cd85d2d88918' or 'quic:3f1a9c2b7d40'; leave it empty for the overview. window: 24h, 7d (default) or 30d, shortened to the plan's query window when that is shorter (window_notice then says so). samples: 0 to 25 example datagrams, default 10.

  ConnectorNo auth

• lavela.provision_domainA

  lavelaA

  Connect a domain the user already owns (lavela doesn't sell domains) and get the DNS records to add at their registrar. target 'hosting' (default) = the web-hosting site, verified and given HTTPS automatically; target 'compute' = a server (`service`), which doesn't verify itself — poll lavela.get_status. The app must be deployed first. Not working yet? lavela.diagnose_domain. Free. Details: https://console.lavela.dev/docs/mcp#domains

  ConnectorAPI key

• list_doc_topicsA

  Porkbun (official)A

  List the available Porkbun API documentation topics. Returns the docs index (Markdown) — every per-topic page (e.g. dns, domain, webhooks, ssl, pricing) with a one-line description and endpoint count, plus links to the full reference and the OpenAPI spec. Use this first to discover what docs exist, then read_doc to read one. Grounds an agent in Porkbun's own docs without leaving the conversation.

  ConnectorOAuth

• update_domainA

  MailercloudA

  Change a sending domain's record host names (tracking_prefix, dkim_selector, dkim2_selector, image_prefix) and/or open tracking. Only the fields given change. A changed selector or prefix breaks the DNS records already published until the user publishes the new ones and runs verify_domain, so it shows a preview first and changes only with confirm: true.

  Connector

  Destructive

  API key