MCP Server for nslookup.io
DNS lookups, SSL certificate checks, security scanning, GEO (AI readiness) scoring, domain intelligence, and your own monitoring account β via the Model Context Protocol.
Website Β· API Docs Β· npm Β· Contact
## What is this? The nslookup.io MCP server gives any MCP-capable AI assistant (Claude, ChatGPT, Cursor, Windsurf, β¦) direct access to nslookup.io's DNS, certificate, security, and monitoring tools. Ask in plain language β _"Run a DNS health check on github.com"_ or _"Which of my SSL certificates expire soonest?"_ β and the assistant calls the right tool for you. **23 tools total, in two groups:** - **17 public tools** β DNS, SSL, security, GEO, and domain-intelligence lookups that work **anonymously**, with no account and no API key. - **6 `my_` account tools** β read your own [nslookup.io monitoring account](https://www.nslookup.io/portal/) (uptime, DNS, WHOIS, SSL, propagation, BIMI/VMC monitors). These are always listed but require **signing in**. Jump to [Connect](#connect) to get set up, or the [Tool reference](#tool-reference) for the full list. ## Connect There are two ways to connect. **Pick one** β see the [note below](#-use-only-one-nslookup-entry). | | **Hosted (recommended)** | **Local (npx / stdio)** | |---|---|---| | Endpoint | `https://mcp.nslookup.io/mcp` | `npx -y @nslookup-io/mcp-server` | | Transport | Streamable HTTP (remote) | stdio (runs on your machine) | | Install | Nothing to install | Requires Node.js 18+ | | 17 public tools | β Anonymous | β Anonymous | | 6 `my_` account tools | β **Browser sign-in (OAuth)** on first use | β Not available locally β use the hosted connector | **Use the hosted endpoint if you want your own monitoring data** β it's the only mode where the `my_` account tools sign in for you, right in the browser. The local mode is great for the 17 public tools with zero setup. ### Connect for your account (portal) tools To use **your own NsLookup.io monitoring data** (the 6 `my_` account tools), add the **hosted connector** and sign in. **There is no API key** β authentication is a one-time browser sign-in (OAuth) against your nslookup.io account. **Claude Code (CLI)** ```bash claude mcp add --transport http nslookup https://mcp.nslookup.io/mcp ``` Then invoke an account tool β e.g. ask _"show my monitoring overview"_. A browser sign-in window appears; after you sign in once, all 6 `my_` tools work (the client remembers it). **Claude Desktop / claude.ai** β add a custom connector with URL `https://mcp.nslookup.io/mcp`, then sign in when prompted. **`.mcp.json`** (project) or any HTTP-capable client: ```json { "mcpServers": { "nslookup": { "type": "http", "url": "https://mcp.nslookup.io/mcp" } } } ``` The 17 public tools work immediately over this same endpoint β you only sign in the first time you reach for your own data. ### Hosted (recommended) The hosted endpoint is a remote Streamable-HTTP server. Public tools work immediately; the first time you call a `my_` tool, an OAuth-capable client opens a browser window to sign in to your nslookup.io account (see [Signing in](#signing-in)). **Claude Code (CLI)** ```bash claude mcp add --transport http nslookup https://mcp.nslookup.io/mcp ``` **Claude Desktop / claude.ai (custom connector)** 1. Open **Settings β Connectors** 2. Click **Add custom connector** 3. Name: `nslookup` β URL: `https://mcp.nslookup.io/mcp` 4. Click **Add** Or drop it into an `.mcp.json` (project) / your client's MCP config: ```json { "mcpServers": { "nslookup": { "type": "http", "url": "https://mcp.nslookup.io/mcp" } } } ``` **ChatGPT** 1. Open **Settings β Connected apps** (or **Tools & integrations**) 2. Click **Add custom integration** / **Add MCP server** 3. Name: `nslookup` β URL: `https://mcp.nslookup.io/mcp` 4. Save **Cursor / Windsurf (and any HTTP-capable client)** Add to your MCP config (`.cursor/mcp.json`, `~/.codeium/windsurf/mcp_config.json`, etc.): ```json { "mcpServers": { "nslookup": { "type": "http", "url": "https://mcp.nslookup.io/mcp" } } } ``` ### Local (npx / stdio) Runs the server on your machine over stdio. **Public tools only** β all **17 public tools** work with no auth. For your own monitoring data (the `my_` account tools), use the [hosted connector](#connect-for-your-account-portal-tools) and sign in β the account tools are not available on the local transport. **Claude Code (CLI)** ```bash # Global (all projects) claude mcp add nslookup --scope user -- npx -y @nslookup-io/mcp-server # Or for a single project claude mcp add nslookup --scope project -- npx -y @nslookup-io/mcp-server ``` **Claude Desktop** β add to `claude_desktop_config.json`: ```json { "mcpServers": { "nslookup": { "command": "npx", "args": ["-y", "@nslookup-io/mcp-server"] } } } ``` **Cursor** (`.cursor/mcp.json`) / **Windsurf** (`~/.codeium/windsurf/mcp_config.json`): ```json { "mcpServers": { "nslookup": { "command": "npx", "args": ["-y", "@nslookup-io/mcp-server"] } } } ``` ### β οΈ Use only ONE nslookup entry Configure **either** the hosted entry **or** the local entry β not both. If two MCP servers named `nslookup` are registered at once (e.g. a hosted connector plus a local npx entry), tool calls can route to the wrong server and behave unpredictably. Pick the mode you want and remove the other. ## Signing in - **17 public tools** β no account, no key, nothing to sign in for. They call public, stateless, no-auth endpoints. - **6 `my_` account tools** β read your private monitoring data, so they require sign-in: - **Hosted endpoint β browser OAuth.** The server is an OAuth 2.1 resource server. Calling a `my_` tool without credentials returns a `401` with a `WWW-Authenticate` challenge, and OAuth-capable clients (Claude web/desktop, Claude Code, β¦) then walk you through a browser sign-in against the nslookup.io identity provider (Keycloak). **There is no API key** β sign in once and the client remembers it. Everything else keeps working anonymously β you only sign in when you first reach for your own data. See [Connect for your account (portal) tools](#connect-for-your-account-portal-tools). ## Tool reference ### Public tools (17 β anonymous) #### DNS | Tool | Description | |------|-------------| | `dns_lookup` | Look up all common DNS records (A, AAAA, NS, MX, TXT, CNAME, SOA) for a domain | | `dns_record` | Look up a specific DNS record type β supports all 53 types (HTTPS, DNSKEY, TLSA, SPF, etc.) | | `dns_propagation` | Check DNS propagation across 18+ global servers (Cloudflare, Google, Quad9, regional, authoritative) | | `webservers` | Get IPv4 and IPv6 addresses for a domain | | `dns_change_review` | Review proposed DNS changes before applying them: diff vs current DNS, rule-based findings with fixes, and a 0β100 risk score | #### Domain intelligence | Tool | Description | |------|-------------| | `rdap_lookup` | Registration data (RDAP) for an IP, AS number, or domain β owner org, network range, RIR, contacts, dates | | `hosting_report` | Who hosts a website: hosting provider, CDN/proxy, DNS provider, mail servers, server location, SSL issuer | | `status_page` | Read a public status page (by slug or custom domain): overall status, components, active incidents | #### DNS health & security | Tool | Description | |------|-------------| | `dns_health` | Run a DNS health audit (39 checks across DNSSEC, MX, hygiene, TTL, nameservers, CAA, operational maturity) with severity-weighted scoring | | `ssl_certificate` | Check SSL/TLS certificate β issuer, expiry, chain validity, cipher strength, SAN domains, TLS version | | `bimi_vmc` | Check BIMI record and VMC (Verified Mark Certificate) β logo URL, trademark info, certificate expiry | | `bimi_check` | Check only the BIMI DNS record (faster β skips the VMC certificate fetch) | | `security_scan` | Scan a domain for security issues β SPF/DKIM/DMARC, cookie security, DNS misconfigurations | | `domain_scanner` | Scan a domain's email security posture (SPF, DKIM, DMARC, BIMI) with per-indicator scores | | `uptime_check` | One-time HTTP uptime check β status, response time, HTTP status code | | `uptime_check_multi` | Check if a site is up from 7 global locations β Amsterdam, Sydney, London, Frankfurt, Delhi, Warsaw, South Carolina | #### GEO (AI readiness) | Tool | Description | |------|-------------| | `geo_checker` | Check a domain's GEO (Generative Engine Optimization) score β AI crawler access, structured data, entity signals, content extractability, and prioritized recommendations | ### Account tools (6 β require sign-in) These `my_` tools read your own [nslookup.io monitoring account](https://www.nslookup.io/portal/). They are always listed but require [signing in](#signing-in) to call. | Tool | Description | |------|-------------| | `my_overview` | Account health snapshot β aggregated 0β100 score with per-subsystem breakdown, plus your limits/quota | | `my_monitors` | List all your monitors across every type (uptime, API, DNS, WHOIS, propagation, certificates, VMC) | | `my_incidents` | Open (or all recent) incidents across all monitoring types, with a per-status/per-source summary | | `my_uptime_history` | Uptime + response-time history for one monitor (by id or URL) over a configurable window | | `my_dns_changes` | Recent DNS changes on your monitored domains with their risk reviews (0β100 score, severity counts) | | `my_certificates` | SSL certificate expiry overview β alert-level counts and certificates sorted by soonest expiry | ## Supported DNS record types A, AAAA, AFSDB, APL, AXFR, CAA, CDNSKEY, CDS, CERT, CNAME, CSYNC, DHCID, DLV, DNAME, DNSKEY, DS, EUI48, EUI64, HINFO, HIP, HTTPS, IPSECKEY, IXFR, KEY, KX, LOC, MX, NAPTR, NS, NSEC, NSEC3, NSEC3PARAM, NXT, OPENPGPKEY, OPT, PTR, RP, RRSIG, SIG, SMIMEA, SOA, SPF, SRV, SSHFP, SVCB, TA, TKEY, TLSA, TSIG, TXT, URI, ZONEMD ## DNS servers `cloudflare`, `google`, `quad9`, `opendns`, `authoritative`, and regional servers in South Africa, Australia, India, Netherlands, Canada, USA, Brazil, Ukraine, Russia. ## Configuration | Environment Variable | Default | Description | |---------------------|---------|-------------| | `NSLOOKUP_API_URL` | `https://www.nslookup.io` | Base URL for the nslookup.io API | | `MCP_RESOURCE_URL` | *(request-derived)* | (HTTP server) Explicit public origin of this resource server, used as the `issuer`/`resource`/`authorization_servers` value in OAuth metadata. When unset, the origin is derived from the incoming request (`X-Forwarded-Proto` + host). Set it to the fixed public URL (e.g. `https://mcp.nslookup.io`) in production. | | `KEYCLOAK_ISSUER` | `https://auth.nslookup.io/realms/nslookup-io` | (HTTP server) OAuth token issuer used to validate sign-in JWTs (JWKS, issuer, exp) | | `KEYCLOAK_REALM_URL` | *(= `KEYCLOAK_ISSUER`)* | (HTTP server) Keycloak realm base URL whose `/.well-known/openid-configuration` supplies the real `authorization_endpoint`/`token_endpoint`. For Keycloak this equals the issuer, so it rarely needs setting. | | `KEYCLOAK_CLIENT_ID` | `nslookup-io-mcp` | (HTTP server) The pre-registered **public** Keycloak client id returned by the DCR shim. This client must already exist in the realm; no Keycloak DCR is enabled. |