Read deSEC domains, DNSSEC keys, zone files and RRsets; create or replace one DNS record set. Hosted by usefulapi — connect from Claude, Cursor, or any MCP client.
Team and Enterprise: an Owner adds the connector for the organization first.
Run this command, then run /mcp in Claude Code to log in:
Add to Cursor or add this to ~/.cursor/mcp.json:
{
"mcpServers": {
"desec": {
"url": "https://desec.usefulapi.io/mcp"
}
}
}Add to VS Code or add this to .vscode/mcp.json:
{
"servers": {
"desec": {
"type": "http",
"url": "https://desec.usefulapi.io/mcp"
}
}
}Other MCP clients (Windsurf, Cline, Zed and more): add the URL as a remote MCP server (Streamable HTTP). The client then opens the login page in your browser. Do not add an Authorization header: see Before you connect.
The login page asks for your deSEC API token.
Create it in the deSEC console under Token Management and copy the secret value (shown only once). Leave the allowed subnets open to all addresses. Changing records needs a token that may write DNS, and DNS changes go live immediately. For a safer setup create a dedicated token with a scoping policy limited to the domains you want to manage. deSEC limits each account to 2000 requests a day. Your token is used only to call the deSEC API on your behalf; it is never shown to anyone.
Add only the URL. Do not add an Authorization header or an API key to the client config. The server signs you in with OAuth: the login page asks for your deSEC API token. If the config has such a header, remove it: some clients then send that header instead of the login token, and every call fails with 401.
| Tool | Type | What it does |
|---|---|---|
desec_list_domains | read | List domains List the DNS domains (zones) in this deSEC account, newest first, with creation and last-published times and minimum TTL. DNSSEC keys are omitted here (see desec_get_domain). Use owns_qname to find which of your domains is responsible for a DNS name (for example before adding a record for www.dev.example.net). Up to 500 per page. GET /domains/. |
desec_get_domain | read | Get domain One domain with its DNSSEC key material: the DNSKEY and the DS records to publish at the registrar for the chain of trust, plus minimum TTL and publication times. GET /domains/{name}/. |
desec_export_zonefile | read | Export zonefile The whole zone as a plain-text BIND-format zonefile (all RRsets except DNSSEC types). Handy as a backup before changing records. Counts as an expensive deSEC operation (300/min). GET /domains/{name}/zonefile/. |
desec_list_rrsets | read | List RRsets List the DNS records of a domain as RRsets (all records of one name and type, sharing one TTL), newest first. Filter by type and/or subname. Up to 500 per page. GET /domains/{name}/rrsets/. |
desec_get_rrset | read | Get RRset One RRset by subname and type, e.g. the A records of "www" or the MX records of the apex. GET /domains/{name}/rrsets/{subname}/{type}/. |
desec_create_rrset | write | Create RRset WRITE: create ONE new RRset (a set of DNS records of one type at one name) in a domain. It goes live in DNS immediately and a wrong record can take a site or mail offline. Fails if an RRset with this subname and type already exists (use desec_replace_rrset for that) or if a CNAME would conflict with other records. Never touches the apex NS or DNSSEC records and cannot delete anything. Subject to deSEC's write limits (15/min, 300/day per domain). POST /domains/{name}/rrsets/. |
desec_replace_rrset | write | Replace RRset WRITE (overwrites): set ONE RRset to exactly the given TTL and records, creating it if it does not exist and REPLACING all its current records if it does. It goes live in DNS immediately; a wrong value can take a site or mail offline. The previous RRset is read first and returned as `previous` so the change can be undone with another call. An empty record list is refused (this tool never deletes), and the apex NS and DNSSEC records cannot be changed. Subject to deSEC's write limits (15/min, 300/day per domain). PUT /domains/{name}/rrsets/ with a one-element array. |
desec_usage_status | Usage status (free-tier meter) Report the caller's current free-tier usage this month: calls used, monthly limit, remaining, and whether the cap is reached. Read-only; does not count against the meter. | |
desec_request_feature | Request a missing feature Tell usefulapi that the user needs something the deSEC tools cannot do yet (a missing tool, field or filter). Call it only when the user asks for something none of the tools can do, and tell the user that you send the request. Do not call it for errors or for normal requests. Do not include personal data, credentials or customer records. Stored with the product name and the client type (for example Claude or Cursor), without the user's account. At most 5 requests per day. Does not count against the meter. | |
desec_upgrade | Upgrade to Pro (unlimited) Subscribe to the Pro plan for UNLIMITED deSEC tool calls (the free tier caps monthly usage). Choose monthly ($9/month) or yearly ($90/year — 2 months free) billing. Returns a Stripe Checkout link to open in your browser; after payment your account upgrades automatically. Does not count against the meter. | |
desec_cancel_subscription | Cancel the Pro subscription Cancel the caller's deSEC Pro subscription at the end of the paid period (no refund for the current period; unlimited calls continue until then, then the free tier applies). Requires confirm: true. Run desec_upgrade later to undo the cancel before the period ends. Does not count against the meter. |
| Plan | Price | Limit |
|---|---|---|
| Free | $0 | 100 tool calls / month |
| Proper user | $9/mo · $90/yr | Unlimited |
Pro covers this deSEC server only. Subscribe with desec_upgrade (it returns a Stripe Checkout link). Cancel any time with desec_cancel_subscription: Pro continues to the end of the paid period, with no refund for the current period, and running desec_upgrade before then undoes the cancel. Or write to [email protected].
No. usefulapi is an independent service. It is not affiliated with or endorsed by deSEC. The server calls the deSEC API with your own deSEC access, so it sees only the data that your account can see.
The login page asks for your deSEC API token. See Before you connect for where to find it.
No. Add only the URL. Do not add an Authorization header or an API key to the client config. The server signs you in with OAuth: the login page asks for your deSEC API token. If the config has such a header, remove it: some clients then send that header instead of the login token, and every call fails with 401.
The login stores them encrypted in the authorization grant of your connection. The server uses them to call the deSEC API for you and to derive a private account id for usage metering. usefulapi does not show them on any page or in any reply. To stop all access, remove the connector and change or delete these credentials in deSEC.
Yes, if you approve it. 2 of the 7 deSEC tools can create or change data. The other 5 are marked read-only. Most MCP clients ask you to approve a tool call before it runs.
The Free plan gives 100 tool calls / month. Pro costs $9/mo or $90/yr, with unlimited tool calls, for this deSEC server only. Run desec_usage_status to see how many calls you used.
Ask the AI to run desec_upgrade: it returns a Stripe Checkout link. To cancel, run desec_cancel_subscription. Pro continues to the end of the paid period.
Tell the AI what you wanted to do. It can send the request with desec_request_feature. We store the text with the server name, the type of AI client and the tool you tried, not with your account, and read every request when we plan new tools. You can send up to 5 requests per day.
Any client that supports remote MCP servers (Streamable HTTP) with OAuth login: Claude (web and desktop), Claude Code, Cursor, VS Code, Windsurf and others.
This is a Model Context Protocol endpoint — meant to be connected from an AI client, not opened in a browser. An invalid_token response at the URL is the auth gate working as designed; clients authenticate automatically.