Manage your DNS from Claude, through MCP

Connect in three steps

MCP server URL: https://app.redundantdns.com/mcp

claude mcp add --transport http redundantdns https://app.redundantdns.com/mcp \
  --header "Authorization: Bearer rdns_..."

What an agent can do

Every tool runs the matching API request as you, so validation, role checks and plan limits are exactly the API’s.

• Zones and records

  Create a zone, add, change or delete record sets; every change is written to every provider of the zone.

• Providers

  List and test provider connections, attach two or more providers to a zone, keep one as a standby.

• Delegation

  Read the NS plan, apply it at the registrar for domains held here, and check the delegation at the parent.

• Drift

  Compare every provider with the canonical zone now, then reconcile (the canonical zone wins) or adopt a provider’s changes.

• Standby

  Promote a standby provider to active, or demote one, with the nameservers to add or remove at the registrar.

• Audit and compliance

  Read and export the audit log, verify the tamper-evident audit stream, run the compliance report.

• Domains

  Check availability, register or transfer in, set nameservers, lock or unlock, reveal the auth code, turn WHOIS privacy on or off, hand a domain off to another organization, and make the DS at the registry match what the nameservers serve.

• Alerts and billing

  Read the alert history, resolve an alert, test a channel; read the plan, limits and usage.

Things to ask

• Create example.com, attach my Route 53 and OCI DNS connections, and tell me which nameservers to set at my registrar.
• Check the delegation of example.com: which of the planned nameservers are missing at the parent?
• Point www.example.com to 192.0.2.10 with a TTL of 300 on every provider of the zone.
• Someone edited example.com in the Route 53 console. Show me the drift, then adopt those changes into the canonical zone.
• Cloudflare is having a bad day: promote the Route 53 standby of example.com and list what to change at the registrar.
• Export last month’s audit events for example.com and run the SOC 2 compliance report.

The safety model

An assistant gets no more access than the token you give it. The security page covers the rest of the platform.

Scopes

A token carries only the scopes you grant: zones:read, zones:write, connections:read, connections:write, domains:read, domains:write. A token with read scopes only is a read-only assistant.

Your role in the organization

A tool call needs its scope and the user’s role, the same rule as the API: viewers read, editors change records, admins manage connections, attachments and deletions.

IP allowlists

The organization’s allowlist and the token’s own apply to every MCP request, as they do to the API.

Every call audited

Each tool call is written to the audit log with its arguments summarized, and so is the action it performed. Every audit event also goes to the hash-chained, signed audit stream. Credential values are never logged.

Deletes are spelled out

Deleting a zone, or a provider’s copy of it, needs confirmName: the agent has to repeat the zone name. Provider credentials are never returned by any tool.

Deterministic sync

The agent calls the same API a person uses. Syncing has no model in it: no AI writes a record on its own, and every change is a diff in the zone journal.

Plans and reference

Questions

Which AI assistants work with the RedundantDNS MCP server?

Claude (claude.ai, Claude Desktop and Claude Code) and any MCP client that speaks Streamable HTTP, with OAuth 2.1 or a personal access token in the Authorization header.

Can an assistant change my DNS without me knowing?

It can only do what its scopes and your role allow, and every tool call is in the audit log. Grant read scopes only for a read-only assistant. Deleting a zone needs the agent to repeat the zone name.

Does RedundantDNS use AI to sync my zones?

No. Syncing is deterministic: it compares the zone with each provider and applies only the difference. MCP is a way for your assistant to call the API; it adds no model to the sync path.

Which plans include MCP?

Pro and above. On other plans every request to the MCP server answers 402 plan_limit_reached with the plan that unlocks it.

Does the assistant see my provider credentials?

No. Tools never return provider credentials, and credential values in tool arguments are never written to the audit log.