dns.lgbt for AI assistants (MCP)
Last updated
dns.lgbt runs an MCP server (Model Context Protocol), so an AI assistant like Claude can look at and change your domains for you: “add the records Fastmail needs”, “why isn’t my domain active yet?”, “set up DNS for my certificate”. It uses the API, with exactly the rights you give it.
The server’s address:
https://dns.lgbt/api/mcpConnecting an assistant
Add the address as a remote MCP server. The first time the assistant uses it, it sends you to dns.lgbt to sign in and choose what it may do.
- Claude (claude.ai and the apps): Settings → Connectors → Add custom connector, with the address above.
- Claude Code: add it, then sign in with
/mcp.
claude mcp add --transport http dns-lgbt https://dns.lgbt/api/mcp- Cursor, in
mcp.json, and VS Code, in.vscode/mcp.json:
{
"mcpServers": {
"dns.lgbt": { "url": "https://dns.lgbt/api/mcp" }
}
}{
"servers": {
"dns.lgbt": { "type": "http", "url": "https://dns.lgbt/api/mcp" }
}
}An assistant that can’t sign in by itself can use an API token instead, sent as Authorization: Bearer dnslgbt_pat_….
claude mcp add --transport http dns-lgbt https://dns.lgbt/api/mcp \
--header "Authorization: Bearer dnslgbt_pat_…"Signing in and what it may do
When an assistant signs in, dns.lgbt shows what it asks for: switch off what it shouldn’t do, and give it all your domains or only some. Afterwards it is listed under Authorized apps on your account page, where you can remove it; we also send you an email. It stays signed in while it is used at least once in 30 days. You can allow up to 20 apps.
Tools
The assistant sees only the tools its rights allow. Each is one call of the API:
| Tool | What it does | Needs |
|---|---|---|
whoami | Who the token belongs to and what it may do (its scopes and limits). | Any rights |
list_domains | The domains this token may see, with whether each is served. | domains:read |
get_domain | One domain: served or not, its SOA serial, pending changes, and the nameservers to set at the registrar. | domains:read |
check_delegation | Ask the registry right now which nameservers the domain is delegated to, and compare them with dns.lgbt's (missing and unexpected ones). Use it after the user changed the nameservers at their registrar. | delegation:read |
list_records | The domain's records, optionally only one name and/or type. Each comes with its id and ETag. | records:read |
get_record | One record by its id, with its ETag. | records:read |
change_records | Create, update and delete records in one go, all or nothing (at most 100 changes). Updates and deletes take the record's id and, to be safe, its etag from list_records. Use dry_run first to see what would change. | records:write |
get_rrset | All records with one name and type (an RRset), with the set's ETag. | records:read |
set_rrset | Replace all records with one name and type by these (an empty list deletes the set). Records whose data stays keep their id. | records:write |
delete_rrset | Delete all records with one name and type. | records:write |
get_dnssec | The domain's DNSSEC status, and the DS record for the registrar once it is needed. | dnssec:read |
set_dnssec | Turn DNSSEC on or off. Turning it off while a DS record is at the registrar keeps the zone signed until the registry has none. | dnssec:write |
export_zone | The domain's records as a zone file (master file format). | records:read |
import_zone | Add the records of a zone file (records dns.lgbt manages and duplicates are skipped). Use dry_run first. | records:write |
check_delegation asks the registry itself, so it can be used 10 times a minute.
The server also offers
dnslgbt://record-types: the record types and the data fields of each, so the assistant writes them right;dnslgbt://domains/<domain>/zone: a domain’s zone file;- the prompts
acme-dns-01(the TXT record of a certificate challenge) anddynamic-dns(point a name at an address).
Changes and safety
- Dry runs: every tool that changes something takes
dry_run. It checks the change like a real one and says what it would do, without changing anything. The server asks assistants to use it and show you the result first. - Nothing overwritten by accident: changes take the ETag the assistant read, so they fail if the record changed in the meantime.
- The same rules and limits as the web app and the API apply, and a change counts against your account’s changes per minute.
- You can tell: changes made through MCP show “via MCP” in your recent activity.
- The assistant can’t add or delete domains, and doesn’t see your proxied names, onion services or account settings.
Over Tor
The onion service has the same server, at http://lgbtdns5pwlmd3owons7dkabgrge7onmisghx42rjoddinndseks6tid.onion/api/mcp, for assistants that reach it through Tor.
Still stuck? Open a support ticket and we’ll help you in the app.