◇ /LANDING/MCP · DNS.CLINIC

An MCP server for
the physical layer of the internet.

DNS, domains, certificates, monitors, incidents — every Relays primitive, exposed to Claude Code, Cursor, Windsurf, Zed, and any agent runtime that speaks Model Context Protocol.

Claude CodeCursorWindsurfZedContinueClineONE

MCP tools

MCP resources

∞

audit log

01 · LIVE SESSION

Claude investigates.
Relays has the answers.

Install the MCP once. From then on, every chat, every agent, every pair session has DNS, certs, and monitoring as first-class capabilities.

claude — fish — 118×32

Claude Code v2.1.97Opus 4.6 (1M context) with high effort · Claude Max/Users/cheetahagency/relays

Opus 4.6 (1M context) │ cheetahagency● high · /effort

Seventy-four tools.
Real ones.

Not “return this mock JSON”. Real-world operations with real side effects, rate limits, idempotency, and audit trails.

DNS

25 tools

◆dns_list_zones

Every zone on your account

◆dns_create_zone

Create a zone, get NS delegations

◆dns_list_records

All records for a zone, filterable

◆dns_create_record

Create one or many, DNSSEC-signed

◆dns_update_record

Atomic update with optimistic locking

◆dns_delete_record

Idempotent, soft-delete, restorable

◆dns_bulk_records

Atomic multi-op with transactional rollback

◆dns_export_zone

BIND, JSON, Terraform, Pulumi

◆dns_import_zone

Paste a zone file, any format

◆dns_check_propagation

Global propagation across 8 resolvers

◆dns_trace

Recursive trace from root

◆dns_diff_zone

Live answers vs zone file

◆dns_validate_dnssec

Chain-of-trust validation

◆dns_analytics

Query volume, top names, answer mix

◆dnssec_status

KSK/ZSK, DS records, NSEC3 params

◆dnssec_enable

Sign a zone, publish DS

◆dnssec_disable

Unsigned, with parent DS cleanup

◆dns_resolve_all

Every RRSET for a domain

◆dns_audit_spf

Depth + include chain + void

◆dns_audit_dkim

Selector discovery + key length

◆dns_audit_dmarc

Policy parse + alignment

◆dns_caa_report

Which CAs can issue

◆dns_ns_delegation_check

Parent-child NS match

◆dns_get_mx_topology

Receiver infrastructure

◆dns_whois

Registrar + expiry + lock

Domains

10 tools

◆domain_search

Check availability + price across 1,147 TLDs

◆domain_register

Buy a domain · requires capability token

◆domain_list

All domains on your account

◆domain_get

Full domain details

◆domain_renew

Manual renewal · spend cap enforced

◆domain_transfer

Transfer in with auth code

◆domain_suggest

LLM-assisted name brainstorm

◆domain_push_auth

Generate an auth code

◆domain_set_privacy

Toggle WHOIS privacy

◆domain_set_lock

Transfer lock / server lock

Certificates

8 tools

◆cert_list

All issued certificates

◆cert_get

Full cert details + chain

◆cert_issue

ACME order, DNS-01 challenge

◆cert_upload

Bring-your-own-cert

◆cert_renew

Force renew before expiry

◆cert_revoke

Revoke, reason, CRL update

◆cert_sans

Add/remove Subject Alt Names

◆cert_validate_chain

Trust chain dry-run

Monitoring

8 tools

◆monitor_list

All monitors

◆monitor_create

HTTP/TCP/DNS/ICMP/SSL/keyword/heartbeat

◆monitor_pause

Pause without losing history

◆monitor_tail

Latest N checks · p50/p95/p99

◆monitor_history

Time-range series

◆monitor_test

One-shot check from selected regions

◆monitor_rtt_trace

Traceroute on failure

◆monitor_playwright_run

Synthetic browser check

Incidents

7 tools

◆incident_list

Open and historical

◆incident_create

Manual incident declare

◆incident_ack

Acknowledge, start clock

◆incident_update

Timeline note, status change

◆incident_resolve

Close + cause-code

◆incident_escalate

Manual escalation

◆incident_postmortem

Draft a template

Status pages

5 tools

◆status_page_list

All status pages

◆status_page_create

New page with components

◆status_page_post_update

Post an incident update

◆status_page_subscribe

Add a subscriber

◆status_page_component_update

Change component status

03 · CAPABILITIES

Give the keys.
Keep the spend.

Every MCP connection is issued a capability token with a scope, spend cap, rate limit, and expiry. Agents can only do what you explicitly allowed, within the budget you set.

• Fine-grained scopes (dns:read · dns:write · domain:buy)
• Spend caps per capability (daily / monthly / total)
• Approval policies: auto / email / slack / webhook
• Audit log with content-addressed receipts
• Token rotation + just-in-time revocation

◆ capability · cap_9fe2

{
  "id": "cap_9fe2",
  "issued_to": "ONE (did:oas:one:agent:mira)",
  "scopes": [
    "dns:read",
    "dns:write",
    "domain:search",
    "domain:buy"
  ],
  "constraints": {
    "spend_cap_monthly": { "USD": 500.00 },
    "domain_tld_allowlist": ["com", "io", "ai", "run"],
    "zones_allowlist": ["acme-ai.run", "*.relays.internal"],
    "rate_limit": "60rpm",
    "approval": {
      "domain:buy": "auto_if_under $100, else slack #ops"
    }
  },
  "expires_at": "2026-05-11T00:00:00Z",
  "audit_webhook": "https://hooks.example.com/ops"
}

04 · AUDIT

Every call.
Hash-chained.

The audit log is a Merkle-chained append-only sequence. Export to SIEM. Prove to auditors. Replay an incident.

mcp · audit · 2026-04-11 · hash-root: 8f3c…22bcLIVE

T	Actor	Tool	Argument	Result	Hash
14:02:11	ONE	dns_list_records	acme-ai.run	✓ 200	…7996
14:02:14	ONE	dns_create_record	A api → 142.93.18.201	✓ 200	…0533
14:02:14	ONE	dns_create_record	CNAME www → @	✓ 200	…4922
14:02:15	ONE	cert_issue	*.acme-ai.run	✓ 200	…3329
14:02:22	cheetah	dns_update_record	TTL 1h → 5m	✓ 200	…2499
14:02:48	ONE	domain_register	driftsense.io $49.00	✓ 200	…0018
14:03:02	mira	monitor_create	https://api.acme-ai.run	✓ 200	…3560
14:03:10	ONE	domain_register	super-pricey.ai $899	✗ 402 spend-cap	…7453

05 · KEYS

Rotate keys
every morning.

Capability tokens are disposable. Relays can rotate them daily, on a schedule, or after every session. Old tokens are revoked atomically — your agents automatically pick up fresh ones through MCP resource updates.

Install the MCP.
Forget it exists.

Drop one line in your Claude Code config. Your agents start making real DNS changes in the next turn.

~/.claude.json

{
  "mcpServers": {
    "relays": {
      "command": "npx",
      "args": ["-y", "@relays/mcp"],
      "env": {
        "RELAYS_API_KEY": "rk_live_…",
        "RELAYS_CAPABILITY": "cap_9fe2"
      }
    }
  }
}

Create an API key →MCP reference

An MCP server forthe physical layer of the internet.

Claude investigates.Relays has the answers.

Seventy-four tools.Real ones.

DNS