BIND 9 AIops

io.github.AIops-toolsPublished by GitHub account AIops-toolsv0.2.0Updated Nov 5, 2026

Governed BIND 9 DNS operations — 23 MCP tools with audit.

VerifiedSTDIODesktop onlyCloud & InfrastructureSecurity & Monitoring

Overview

AI-generated overview

Governed BIND 9 DNS operations server exposing 23 audited tools that run rndc, named-checkconf and dig against configured DNS targets.

What you can do
  • Inspect named service and zone status, configuration and loaded-zone validation, DNSSEC mode, signing, managed keys and serve-stale state
  • Review recursive fetch-limit hits, trust anchors, TCP timeouts and per-zone signing progress
  • Run DNS queries and report the actual response code, including queries against a selected secondary server
  • Compare primary and secondary SOA serials and run a zone diagnosis that keeps individual probe failures visible
  • Perform guarded secondary retransfer and single-zone NOTIFY resend, plus reload, refresh and cache flush with dry-run and confirmations
When to use it
Useful when an assistant should help operate and troubleshoot an existing BIND 9 deployment: checking zone health, DNSSEC and signing state, comparing SOA serials across primaries and secondaries, or running guarded reload and transfer commands with an audit trail.
Requirements
Runs locally as a Python package (Python 3.11+ and uv) on the operator host, which must have the BIND 9 command utilities installed. Needs a config file specifying targets, paths to the rndc key file and named config, and a DNS server; the process account must be able to read those files.
Before you install
Some tools change state: reload-zone, refresh-zone, flush-name, retransfer-zone and notify-zone are guarded by dry-run and confirmations, but there is no safe undo for a cache flush, retransfer, NOTIFY delivery or externally edited zone file. Accepted rndc commands may report outcomeUnknown because completion is not proven. Zone-file editing, DNSSEC key changes and global restarts are out of scope.

Installation

In SourceWeft

  1. Open BIND 9 AIops in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

BIND 9 AIops

Governed BIND 9 DNS operations with 23 MCP tools and corresponding CLI commands. It executes rndc, named-checkconf and dig as fixed argument lists without a shell. Every call is audited and budgeted by the bundled governance harness.

What it checks

  • Named service and zone status from rndc.
  • Configuration and loaded-zone validation with named-checkconf -z.
  • DNSSEC validation mode.
  • Zone DNSSEC signing, managed-key and serve-stale status; running zone configuration where enabled.
  • Recursive fetch-limit hits, DNSSEC trust anchors, DNS TCP timeouts and per-zone signing progress.
  • DNS queries with their actual DNS response code.
  • Queries against a selected secondary server.
  • Guarded secondary retransfer and single-zone NOTIFY resend.
  • Primary and secondary SOA serial comparison. A failed or unparseable query returns null, never a fabricated zero or match.
  • bind_diagnose_zone keeps individual probe failures visible.

Setup from source

Requires Python 3.11+, uv, and BIND 9 command utilities on the operator host. Run uv sync --dev, uv run bind9-aiops init, then uv run bind9-aiops doctor. A manual ~/.bind9-aiops/config.yaml can specify paths and a DNS server:

yaml
targets:  - name: local    server: 127.0.0.1    dns_port: 53    rndc_config: /etc/bind/rndc.conf    named_config: /etc/bind/named.conf    timeout: 10

Use uv run bind9-aiops diagnose example.org or uv run bind9-aiops compare-soa example.org 192.0.2.2. The MCP entry point is uv run bind9-aiops-mcp. The process account needs access to its rndc key file and BIND config, but no elevated shell is given to the agent.

Scope and verification

reload-zone, refresh-zone, flush-name, retransfer-zone and notify-zone support dry-run and two CLI confirmations. RNDC command acceptance does not prove a queued zone reload or transfer completed, so these writes report outcomeUnknown; a lost command response does too. No safe undo exists for a cache flush, retransfer, NOTIFY delivery or externally edited zone file. Zone-file editing, DNSSEC key changes and global service restarts remain outside this release. See verification. Missing features and live-environment feedback are welcome as issues or PRs.

Source: README.md at commit 54294c2

Tools

0
SourceWeft started this package once in an isolated sandbox, without credentials, to list its tools. That failed: the server did not start.

Version history

1
  1. v0.2.0LatestNov 5, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts