OnlyDNS MCP Server

io.github.OnlydnsPublished by GitHub account Onlydnsv1.0.6Updated Oct 31, 2026

Model Context Protocol server for OnlyDNS to manage DNS zones, records, DNSSEC, and TSIG keys.

Overview

AI-generated overview

Official OnlyDNS MCP server that lets an assistant list and create DNS zones, manage records, and handle DNSSEC and TSIG keys in an OnlyDNS account.

What you can do
  • List managed domains and create new DNS zones
  • Query, add, update and delete DNS records, with filtering by type or hostname
  • Replace all records in a zone in one batch operation
  • Inspect DNSSEC status and keys, and enable or disable DNSSEC signing
  • List, create and inspect TSIG keys, and attach or remove TSIG permissions on a domain
When to use it
Useful when you want an assistant to inspect or change DNS for domains hosted at OnlyDNS — adding or cleaning up records, checking DNSSEC state, or setting up TSIG keys for zone transfers and dynamic updates — without opening the dashboard.
Requirements
Runs locally over stdio, typically via npx or a global npm install (Node.js). Requires an OnlyDNS account and an API bearer token in ONLYDNS_API_TOKEN. ONLYDNS_API_BASE_URL optionally overrides the API endpoint. Network access to the OnlyDNS API.
Before you install
The token grants control over DNS zones in the account, so treat it as a secret. Several tools change live DNS: add_record, update_record, delete_record, create_domain, enable_dnssec, disable_dnssec, create_tsig_key, configure_domain_tsig and remove_domain_tsig. set_records replaces every record in a zone and is destructive if existing records are omitted. Removing DNSSEC or TSIG keys can break resolution or transfers.

Installation

In SourceWeft

  1. Open OnlyDNS MCP Server in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

OnlyDNS MCP Server (@onlydns/mcp)

Official Model Context Protocol (MCP) server for OnlyDNS enabling AI agents (Claude Desktop, Cursor, Devin, LangChain) to inspect and manage DNS zones, records, 1-click DNSSEC, and TSIG keys directly. Learn more on the AI Agent Infrastructure solution page.

bash
npm install -g @onlydns/mcp

Or run instantly: npx -y @onlydns/mcp

Authentication Environment Variable: ONLYDNS_API_TOKEN (see Configuration).


Features

  • 🌐 Domain Management: List all managed domains and create new DNS zones.
  • 📝 DNS Record Operations:
    • list_records: Query DNS records with optional filtering by type (A, AAAA, CNAME, MX, TXT, SRV, CAA, etc.) or hostname.
    • add_record: Create new records or append values to existing record sets with automatic domain normalization.
    • update_record: Modify existing DNS records and update TTLs.
    • delete_record: Delete specific record values or entire record sets.
    • set_records: Batch replace full zone record sets.
  • 🔐 DNSSEC Management: Inspect DNSSEC status, fetch DS/DNSKEY records, enable, and disable DNSSEC signing.
  • 🔑 TSIG Keys: Generate and manage TSIG keys for secondary DNS zone transfers (AXFR) and RFC 2136 dynamic updates.

Installation & Quick Start

1. One-Click Desktop Installation (MCPB Bundle)

Download onlydns-mcp.mcpb directly from the GitHub Releases page. Compatible desktop clients (such as Claude Desktop) allow one-click installation and configure your ONLYDNS_API_TOKEN through a secure settings dialog.

2. Using npx (No installation needed)

You can run the server directly using npx:

bash
export ONLYDNS_API_TOKEN="your_onlydns_api_token"npx -y @onlydns/mcp

3. Global Installation

bash
npm install -g @onlydns/mcp

Configuration

The server requires an OnlyDNS API Bearer Token.

Environment Variables

VariableDescriptionDefault
ONLYDNS_API_TOKENYour OnlyDNS API Bearer Token (Required)-
ONLYDNS_API_BASE_URLOnlyDNS REST API base URLhttps://api.onlydns.com/v1

Client Integration Examples

Claude Desktop

Add the following to your claude_desktop_config.json:

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json
Linux: ~/.config/Claude/claude_desktop_config.json
json
{  "mcpServers": {    "onlydns": {      "command": "npx",      "args": ["-y", "@onlydns/mcp"],      "env": {        "ONLYDNS_API_TOKEN": "YOUR_ONLYDNS_BEARER_TOKEN"      }    }  }}

Cursor (or Windsurf / Claude Code)

Add to your MCP settings or .cursor/mcp.json:

json
{  "mcpServers": {    "onlydns": {      "command": "npx",      "args": ["-y", "@onlydns/mcp"],      "env": {        "ONLYDNS_API_TOKEN": "YOUR_ONLYDNS_BEARER_TOKEN"      }    }  }}

Available MCP Tools

🌐 Domains

  • list_domains(limit?, offset?): Lists all domains in the account.
  • create_domain(domainName): Creates a new DNS zone for a domain.

📝 DNS Records

  • list_records(domainName, type?, name?): Lists DNS records for a domain, with optional filtering.
  • add_record(domainName, name, type, value, ttl?): Adds/appends a DNS record (e.g. A, CNAME, MX, TXT, URL, PROXY).
  • update_record(domainName, name, type, value, ttl?): Replaces values and/or TTL for a record type.
  • delete_record(domainName, name, type, value?): Deletes a record or specific value.
  • set_records(domainName, records): Batch replaces all records for a zone.

🔐 DNSSEC

  • get_dnssec(domainName): Fetches DNSSEC status and keys (DS, DNSKEY).
  • enable_dnssec(domainName): Enables DNSSEC signing for a zone.
  • disable_dnssec(domainName): Disables DNSSEC signing.

🔑 TSIG Keys

  • list_tsig_keys(): Lists all account TSIG keys.
  • get_tsig_key(keyName): Retrieves TSIG key details.
  • create_tsig_key(algorithm?): Generates a new TSIG key (hmac-sha256, hmac-sha512, etc.).
  • get_domain_tsig(domainName): Retrieves TSIG keys and permissions configured on a domain.
  • configure_domain_tsig(domainName, keyName, allowAxfr, allowDnsUpdate, subdomains?): Configures AXFR, DDNS, and optional subdomain restriction permissions for a domain.
  • remove_domain_tsig(domainName): Removes all TSIG keys from a domain.

Development & Testing

bash
# Clone and install dependenciesgit clone https://github.com/Onlydns/onlydns-mcp.gitcd onlydns-mcpnpm install
# Run unit testsnpm test
# Build TypeScriptnpm run build
# Run locally in developmentnpm run dev

License

MIT © 2026 OnlyDNS

Source: README.md at commit fad03e6

Tools

16

list_domains

List all DNS domains managed in the OnlyDNS account.

Parameterslimitoffset

create_domain

Create/add a new DNS zone/domain under the OnlyDNS account.

ParametersdomainNamerequired

list_records

List all DNS records for a domain, with optional filtering by record type (A, AAAA, CNAME, MX, TXT, etc.) or hostname.

ParametersnametypedomainNamerequired

add_record

Add a DNS record to a domain. Accepts relative hostnames (e.g. "testing"), domain-qualified names (e.g. "testing.example.com"), or canonical FQDNs (e.g. "testing.example.com."). If a record with the same name and type already exists, the new value is appended to the record set.

ParametersttlnamerequiredtyperequiredvaluerequireddomainNamerequired

update_record

Update an existing DNS record set for a given name and type, completely replacing its values and/or TTL. Accepts relative names (e.g. "testing"), domain-qualified names (e.g. "testing.example.com"), or canonical FQDNs (e.g. "testing.example.com.").

ParametersttlnamerequiredtyperequiredvaluerequireddomainNamerequired

delete_record

Delete a DNS record or specific value from a domain. Accepts relative names (e.g. "testing"), domain-qualified names (e.g. "testing.example.com"), or canonical FQDNs (e.g. "testing.example.com.").

ParametersnamerequiredtyperequiredvaluedomainNamerequired

set_records

Completely replace ALL DNS records in a zone with a new list of records. Warning: destructive if omitted records are intended to be preserved.

ParametersrecordsrequireddomainNamerequired

get_dnssec

Get DNSSEC configuration status, NSEC3 parameters, and DS / DNSKEY keys for a domain.

ParametersdomainNamerequired

enable_dnssec

Enable DNSSEC signing for a domain in OnlyDNS.

ParametersdomainNamerequired

disable_dnssec

Disable DNSSEC signing and remove DNSSEC keys for a domain in OnlyDNS.

ParametersdomainNamerequired

list_tsig_keys

List all TSIG keys configured for the OnlyDNS account.

Takes no parameters.

get_tsig_key

Get details for a specific TSIG key by name.

ParameterskeyNamerequired

create_tsig_key

Generate a new TSIG key for secondary DNS transfers (AXFR) or dynamic DNS updates.

Parametersalgorithm

get_domain_tsig

Get TSIG keys and permissions (AXFR transfers, dynamic DNS updates, subdomain restrictions) configured for a domain.

ParametersdomainNamerequired

configure_domain_tsig

Attach and configure TSIG permissions (AXFR transfer / dynamic DNS updates / subdomain restrictions) for a domain.

ParameterskeyNamerequiredallowAxfrrequireddomainNamerequiredsubdomainsallowDnsUpdaterequired

remove_domain_tsig

Remove all TSIG keys associated with a domain.

ParametersdomainNamerequired

Version history

2
  1. v1.0.6LatestOct 30, 2026
  2. v1.0.5Oct 29, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts
  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts