nslookup mcp

MCP Server for nslookup.io
DNS lookups, SSL certificate checks, security scanning, GEO (AI readiness) scoring, domain intelligence, and your own monitoring account — via the Model Context Protocol.

Website · API Docs · npm · Contact

What is this?

The nslookup.io MCP server gives any MCP-capable AI assistant (Claude, ChatGPT, Cursor, Windsurf, …) direct access to nslookup.io's DNS, certificate, security, and monitoring tools. Ask in plain language — "Run a DNS health check on github.com" or "Which of my SSL certificates expire soonest?" — and the assistant calls the right tool for you.

23 tools total, in two groups:

• 17 public tools — DNS, SSL, security, GEO, and domain-intelligence lookups that work anonymously, with no account and no API key.
• 6 my_ account tools — read your own nslookup.io monitoring account (uptime, DNS, WHOIS, SSL, propagation, BIMI/VMC monitors). These are always listed but require signing in.

Jump to Connect to get set up, or the Tool reference for the full list.

Connect

There are two ways to connect. Pick one — see the note below.

Use the hosted endpoint if you want your own monitoring data — it's the only mode where the my_ account tools sign in for you, right in the browser. The local mode is great for the 17 public tools with zero setup.

Connect for your account (portal) tools

To use your own NsLookup.io monitoring data (the 6 my_ account tools), add the hosted connector and sign in. There is no API key — authentication is a one-time browser sign-in (OAuth) against your nslookup.io account.

Claude Code (CLI)

claude mcp add --transport http nslookup https://mcp.nslookup.io/mcp

Then invoke an account tool — e.g. ask "show my monitoring overview". A browser sign-in window appears; after you sign in once, all 6 my_ tools work (the client remembers it).

Claude Desktop / claude.ai — add a custom connector with URL https://mcp.nslookup.io/mcp, then sign in when prompted.

.mcp.json (project) or any HTTP-capable client:

{ "mcpServers": { "nslookup": { "type": "http", "url": "https://mcp.nslookup.io/mcp" } } }

The 17 public tools work immediately over this same endpoint — you only sign in the first time you reach for your own data.

Hosted (recommended)

The hosted endpoint is a remote Streamable-HTTP server. Public tools work immediately; the first time you call a my_ tool, an OAuth-capable client opens a browser window to sign in to your nslookup.io account (see Signing in).

Claude Code (CLI)

claude mcp add --transport http nslookup https://mcp.nslookup.io/mcp

Claude Desktop / claude.ai (custom connector)

1. Open Settings → Connectors
2. Click Add custom connector
3. Name: nslookup — URL: https://mcp.nslookup.io/mcp
4. Click Add

Or drop it into an .mcp.json (project) / your client's MCP config:

{
  "mcpServers": {
    "nslookup": {
      "type": "http",
      "url": "https://mcp.nslookup.io/mcp"
    }
  }
}

ChatGPT

1. Open Settings → Connected apps (or Tools & integrations)
2. Click Add custom integration / Add MCP server
3. Name: nslookup — URL: https://mcp.nslookup.io/mcp
4. Save

Cursor / Windsurf (and any HTTP-capable client)

Add to your MCP config (.cursor/mcp.json, ~/.codeium/windsurf/mcp_config.json, etc.):

{
  "mcpServers": {
    "nslookup": {
      "type": "http",
      "url": "https://mcp.nslookup.io/mcp"
    }
  }
}

Local (npx / stdio)

Runs the server on your machine over stdio. Public tools only — all 17 public tools work with no auth. For your own monitoring data (the my_ account tools), use the hosted connector and sign in — the account tools are not available on the local transport.

Claude Code (CLI)

# Global (all projects)
claude mcp add nslookup --scope user -- npx -y @nslookup-io/mcp-server

# Or for a single project
claude mcp add nslookup --scope project -- npx -y @nslookup-io/mcp-server

Claude Desktop — add to claude_desktop_config.json:

{
  "mcpServers": {
    "nslookup": {
      "command": "npx",
      "args": ["-y", "@nslookup-io/mcp-server"]
    }
  }
}

Cursor (.cursor/mcp.json) / Windsurf (~/.codeium/windsurf/mcp_config.json):

{
  "mcpServers": {
    "nslookup": {
      "command": "npx",
      "args": ["-y", "@nslookup-io/mcp-server"]
    }
  }
}

⚠️ Use only ONE nslookup entry

Configure either the hosted entry or the local entry — not both. If two MCP servers named nslookup are registered at once (e.g. a hosted connector plus a local npx entry), tool calls can route to the wrong server and behave unpredictably. Pick the mode you want and remove the other.

Signing in

• 17 public tools — no account, no key, nothing to sign in for. They call public, stateless, no-auth endpoints.
• 6 my_ account tools — read your private monitoring data, so they require sign-in:
  • Hosted endpoint → browser OAuth. The server is an OAuth 2.1 resource server. Calling a my_ tool without credentials returns a 401 with a WWW-Authenticate challenge, and OAuth-capable clients (Claude web/desktop, Claude Code, …) then walk you through a browser sign-in against the nslookup.io identity provider (Keycloak). There is no API key — sign in once and the client remembers it. Everything else keeps working anonymously — you only sign in when you first reach for your own data. See Connect for your account (portal) tools.

Tool reference

Public tools (17 — anonymous)

DNS

Domain intelligence

DNS health & security

GEO (AI readiness)

Account tools (6 — require sign-in)

These my_ tools read your own nslookup.io monitoring account. They are always listed but require signing in to call.

Supported DNS record types

A, AAAA, AFSDB, APL, AXFR, CAA, CDNSKEY, CDS, CERT, CNAME, CSYNC, DHCID, DLV, DNAME, DNSKEY, DS, EUI48, EUI64, HINFO, HIP, HTTPS, IPSECKEY, IXFR, KEY, KX, LOC, MX, NAPTR, NS, NSEC, NSEC3, NSEC3PARAM, NXT, OPENPGPKEY, OPT, PTR, RP, RRSIG, SIG, SMIMEA, SOA, SPF, SRV, SSHFP, SVCB, TA, TKEY, TLSA, TSIG, TXT, URI, ZONEMD

DNS servers

cloudflare, google, quad9, opendns, authoritative, and regional servers in South Africa, Australia, India, Netherlands, Canada, USA, Brazil, Ukraine, Russia.

Configuration

How hosted OAuth sign-in works under the hood

The hosted server is an OAuth 2.1 resource server: calling a my_ tool without credentials returns a 401 with a WWW-Authenticate challenge pointing at /.well-known/oauth-protected-resource, and OAuth-capable MCP clients then walk you through sign-in against the nslookup.io identity provider.

Sign-in works for DCR-only clients (Claude web/desktop, Claude Code) without enabling Keycloak DCR. The server also acts as its own OAuth authorization server for metadata: GET /.well-known/oauth-authorization-server returns an issuer equal to this server's own origin, with authorization_endpoint/token_endpoint pointing at the real Keycloak endpoints (fetched from the realm's OpenID configuration, cached with a static fallback) and registration_endpoint set to <origin>/register. Because the advertised issuer is this server, clients that compute {issuer}/register hit our Dynamic Client Registration (DCR) shim at POST /register (also POST /oauth/register), which ignores the submitted metadata and returns one pre-registered public Keycloak client (KEYCLOAK_CLIENT_ID, default nslookup-io-mcp) with token_endpoint_auth_method: "none", echoing back the requested redirect URIs. The browser sign-in and the PKCE code→token exchange happen directly on Keycloak. A public client with KEYCLOAK_CLIENT_ID must already exist in the realm; no Keycloak DCR endpoint is used or exposed.

Example prompts

Once connected, try asking your AI assistant:

• "What are the DNS records for github.com?"
• "Check the MX records for google.com"
• "Has the DNS propagated for my-domain.com A record?"
• "What IP addresses does cloudflare.com resolve to?"
• "Show me the DNSKEY records for example.com"
• "Check the SPF record for amazon.com"
• "Run a DNS health check on example.com"
• "What's the DNSSEC status of cloudflare.com?"
• "Check the DNS health score for my-domain.com — are there any critical issues?"
• "Check the SSL certificate for github.com"
• "Does google.com have a BIMI record?"
• "Run a security scan on example.com"
• "Is https://cloudflare.com up right now?"
• "Check if github.com is accessible from all global locations"
• "Check DNS propagation for example.com NS records across all global servers"
• "Check the GEO score for github.com"
• "Is example.com optimized for AI search engines?"
• "Which AI crawlers does cloudflare.com block?"
• "Who owns the IP 8.8.8.8?"
• "Look up registration data for AS13335"
• "Who hosts github.com?"
• "Review this DNS change for example.com before I apply it: ..."
• "Scan example.com's email security (SPF, DKIM, DMARC)"
• "Is the nslookup-io status page reporting any incidents?"

And once signed in to your nslookup.io account:

• "How healthy is my monitoring right now?"
• "List all my monitors — anything down or expiring?"
• "Do I have any open incidents?"
• "Show me the uptime history for https://myapp.com over the last 48 hours"
• "Any risky DNS changes on my domains recently?"
• "Which of my SSL certificates expire soonest?"

Feedback

We'd love to hear from you! At nslookup.io, we're building a fast, reliable, and free DNS lookup tool and monitoring platform for everyone — from developers and sysadmins to everyday internet users.

Your feedback is what helps us improve. Whether you've spotted a bug, have a feature idea, or just want to share your thoughts — we're listening. Contact us.

License

Apache 2.0