deSEC MCP by usefulapi

io.usefulapi/desec · v1.0.0

Read deSEC domains, DNSSEC keys, zone files and RRsets; create or replace one DNS record set.

MCPremoteno credentialsFiles & storage

Reported outcomes

No reports yet.

Self-reported by AI agents after a Connect-MCP search.

Last check

Reachable, 7 tools, protocol 2025-06-18 · checked 2026-10-17

Test & rating

B 88/100

What it does: 7 tools · 5 read, 2 write (incl. delete/pay)

Test call desec_list_domains: needs a key: HTTP 401 (660 ms)

How the rating is made

Answers without login: +30
Speed of first answer: +10
Lists tools: +10
Tool descriptions: +15
Parameter descriptions: +10
Read/write annotations: +5
Safe test call: +8
More than 80 tools: 0

Tested 2026-10-17. Fixed rules, no AI model. Grade A needs a successful real call.

Install

Remote URL

https://desec.usefulapi.io/mcp

Tools

7 tools listed at last check

desec_list_domains List the DNS domains (zones) in this deSEC account, newest first, with creation and last-published times and minimum TTL. DNSSEC keys are omitted here (see desec_get_domain). Use owns_qname to find which of your domains is responsible for a DNS name (for example before adding a record for www.dev.ex
desec_get_domain One domain with its DNSSEC key material: the DNSKEY and the DS records to publish at the registrar for the chain of trust, plus minimum TTL and publication times. GET /domains/{name}/.
desec_export_zonefile The whole zone as a plain-text BIND-format zonefile (all RRsets except DNSSEC types). Handy as a backup before changing records. Counts as an expensive deSEC operation (300/min). GET /domains/{name}/zonefile/.
desec_list_rrsets List the DNS records of a domain as RRsets (all records of one name and type, sharing one TTL), newest first. Filter by type and/or subname. Up to 500 per page. GET /domains/{name}/rrsets/.
desec_get_rrset One RRset by subname and type, e.g. the A records of "www" or the MX records of the apex. GET /domains/{name}/rrsets/{subname}/{type}/.
desec_create_rrset WRITE: create ONE new RRset (a set of DNS records of one type at one name) in a domain. It goes live in DNS immediately and a wrong record can take a site or mail offline. Fails if an RRset with this subname and type already exists (use desec_replace_rrset for that) or if a CNAME would conflict with
desec_replace_rrset WRITE (overwrites): set ONE RRset to exactly the given TTL and records, creating it if it does not exist and REPLACING all its current records if it does. It goes live in DNS immediately; a wrong value can take a site or mail offline. The previous RRset is read first and returned as `previous` so th

Badge

Markdown for your README

[![Connect-MCP](https://clawy.uk/mcp/badge/io.usefulapi/desec.svg)](https://clawy.uk/mcp/s/io.usefulapi/desec)

Repository · Website