Read NS1 zones, records, monitors, data feeds and usage; create or update one DNS record. Hosted by usefulapi — connect from Claude, Cursor, or any MCP client.
Team and Enterprise: an Owner adds the connector for the organization first.
Run this command, then run /mcp in Claude Code to log in:
Add to Cursor or add this to ~/.cursor/mcp.json:
{
"mcpServers": {
"ns1": {
"url": "https://ns1.usefulapi.io/mcp"
}
}
}Add to VS Code or add this to .vscode/mcp.json:
{
"servers": {
"ns1": {
"type": "http",
"url": "https://ns1.usefulapi.io/mcp"
}
}
}Other MCP clients (Windsurf, Cline, Zed and more): add the URL as a remote MCP server (Streamable HTTP). The client then opens the login page in your browser. Do not add an Authorization header: see Before you connect.
The login page asks for your NS1 Connect API key secret.
In NS1 Connect open User Settings → Users & teams → API keys → Create API key, grant only the permissions you need (for read-only use: view zones, view monitoring jobs, view data sources), and copy the key secret (it is shown once). Create a new key only for this server: IBM advises not to share API key secrets between multiple users or third-party integrations. A key with an IP allow list may connect but then fail on every call, because this server's address is not on the list. Your key is used only to call the NS1 API on your behalf; it is never shown to anyone.
Add only the URL. Do not add an Authorization header or an API key to the client config. The server signs you in with OAuth: the login page asks for your NS1 Connect API key secret. If the config has such a header, remove it: some clients then send that header instead of the login token, and every call fails with 401.
| Tool | Type | What it does |
|---|---|---|
ns1_list_zones | read | List zones List the DNS zones in the account: name, id, TTL/SOA settings, primary/secondary setup, linked zones and tags. If next_page is not null, call again with its after/offset to get more. GET /v1/zones. |
ns1_get_zone | read | Get zone One zone with its settings and its record list (each record: domain, type, TTL, short answers, linked/tier info). Large zones are paged: if next_page is not null, call again with its after/offset to get the next records. TSIG secrets are redacted. GET /v1/zones/{zone}. |
ns1_get_record | read | Get record One DNS record by zone, domain and type: TTL, answers (with per-answer metadata), filter chain (traffic steering), linked record and region settings. GET /v1/zones/{zone}/{domain}/{type}. |
ns1_search | read | Search zones and records Search the account's zones and records by name (substring match). Returns matching zones and/or records with their answers when expand is true. GET /v1/search. |
ns1_list_monitoring_jobs | read | List monitoring jobs List the account's NS1 monitoring jobs (health checks that feed traffic steering): id, name, type, regions, frequency, rules, current status, active flag and notify list id. Request header values and credentials are redacted. GET /v1/monitoring/jobs. |
ns1_get_monitoring_job | read | Get monitoring job One monitoring job by id with its configuration, rules, regions and status. Header values and credentials are redacted. GET /v1/monitoring/jobs/{id}. |
ns1_list_notify_lists | read | List notifier lists List the notifier lists that monitoring alerts are sent to: id, name and the notifier types and labels (email, Slack, PagerDuty, webhook). Notifier settings (webhook URLs, tokens, service keys, addresses) are redacted. GET /v1/lists. |
ns1_list_data_sources | read | List data sources List the data sources (connections to third-party monitoring or custom push sources used for traffic steering): id, name, source type, status and their feeds. Connection settings and credentials are redacted. GET /v1/data/sources. |
ns1_get_data_source | read | Get data source One data source by id with its feeds. Connection settings and credentials are redacted. GET /v1/data/sources/{id}. |
ns1_list_data_feeds | read | List data feeds of a source List the feeds of one data source (each feed is one monitored item, e.g. one server's health) with id, name and settings. GET /v1/data/feeds/{source_id}. |
ns1_get_data_feed | read | Get data feed One data feed of a source by id. GET /v1/data/feeds/{source_id}/{feed_id}. |
ns1_get_account_summary | read | Get account summary The account's subscription, resources and utilization (queries, records, filter chains, monitors, ... against the plan limits). GET /v1/account/summary. |
ns1_get_usage_stats | read | Get query usage statistics DNS query counts for the whole account, one zone, or one record (give zone, or zone + domain + type). period is 1h, 24h or 30d; aggregate, expand, limit and after apply to the account and zone levels only (a record takes just period). If next_page is not null, call again with its after/limit. GET /v1/stats/usage[/{zone}[/{domain}/{type}]]. |
ns1_get_qps_stats | read | Get queries per second Current queries per second for the whole account, one zone, or one record (give zone, or zone + domain + type). GET /v1/stats/qps[/{zone}[/{domain}/{type}]]. |
ns1_get_billing_records | read | Get records usage (billing) How many DNS records the account uses against its plan limit in the current billing cycle. GET /billing-usage/v1/records. |
ns1_get_billing_queries | read | Get query usage (billing) Billable DNS query usage between two Unix timestamps. GET /billing-usage/v1/queries?from=&to=. |
ns1_create_record | write | Create DNS record WRITE: creates ONE new DNS record and CHANGES LIVE DNS for that name as soon as NS1 serves it; a wrong answer can take a site or mail offline. Plain records only (A, AAAA, ALIAS, CAA, CNAME, MX, PTR, SRV, TXT; no NS/SOA, no traffic-steering filters or metadata). Refuses when the record already exists (use ns1_update_record). Answers are lists of rdata fields: A ["192.0.2.10"], MX [10, "mail.example.com."], TXT ["v=spf1 -all"], SRV [10, 5, 5060, "sip.example.com."], CAA [0, "issue", "letsencrypt.org"]. PUT /v1/zones/{zone}/{domain}/{type}. |
ns1_update_record | write | Update DNS record WRITE: changes ONE existing DNS record and CHANGES LIVE DNS for that name immediately. Giving answers REPLACES all current answers of the record (send the complete new set); giving only ttl changes just the TTL. Plain records only (A, AAAA, ALIAS, CAA, CNAME, MX, PTR, SRV, TXT): when answers are given, a record that uses traffic-steering filters, links or per-answer metadata is refused (edit it in the NS1 portal). Fails if the record does not exist. POST /v1/zones/{zone}/{domain}/{type}. |
ns1_usage_status | Usage status (free-tier meter) Report the caller's current free-tier usage this month: calls used, monthly limit, remaining, and whether the cap is reached. Read-only; does not count against the meter. | |
ns1_request_feature | Request a missing feature Tell usefulapi that the user needs something the NS1 Connect tools cannot do yet (a missing tool, field or filter). Call it only when the user asks for something none of the tools can do, and tell the user that you send the request. Do not call it for errors or for normal requests. Do not include personal data, credentials or customer records. Stored with the product name and the client type (for example Claude or Cursor), without the user's account. At most 5 requests per day. Does not count against the meter. | |
ns1_upgrade | Upgrade to Pro (unlimited) Subscribe to the Pro plan for UNLIMITED NS1 Connect tool calls (the free tier caps monthly usage). Choose monthly ($9/month) or yearly ($90/year — 2 months free) billing. Returns a Stripe Checkout link to open in your browser; after payment your account upgrades automatically. Does not count against the meter. | |
ns1_cancel_subscription | Cancel the Pro subscription Cancel the caller's NS1 Connect Pro subscription at the end of the paid period (no refund for the current period; unlimited calls continue until then, then the free tier applies). Requires confirm: true. Run ns1_upgrade later to undo the cancel before the period ends. Does not count against the meter. |
| Plan | Price | Limit |
|---|---|---|
| Free | $0 | 100 tool calls / month |
| Proper user | $9/mo · $90/yr | Unlimited |
Pro covers this NS1 server only. Subscribe with ns1_upgrade (it returns a Stripe Checkout link). Cancel any time with ns1_cancel_subscription: Pro continues to the end of the paid period, with no refund for the current period, and running ns1_upgrade before then undoes the cancel. Or write to [email protected].
No. usefulapi is an independent service. It is not affiliated with or endorsed by NS1. The server calls the NS1 API with your own NS1 access, so it sees only the data that your account can see.
The login page asks for your NS1 Connect API key secret. See Before you connect for where to find it.
No. Add only the URL. Do not add an Authorization header or an API key to the client config. The server signs you in with OAuth: the login page asks for your NS1 Connect API key secret. If the config has such a header, remove it: some clients then send that header instead of the login token, and every call fails with 401.
The login stores them encrypted in the authorization grant of your connection. The server uses them to call the NS1 API for you and to derive a private account id for usage metering. usefulapi does not show them on any page or in any reply. To stop all access, remove the connector and change or delete these credentials in NS1.
Yes, if you approve it. 2 of the 18 NS1 tools can create or change data. The other 16 are marked read-only. Most MCP clients ask you to approve a tool call before it runs.
The Free plan gives 100 tool calls / month. Pro costs $9/mo or $90/yr, with unlimited tool calls, for this NS1 server only. Run ns1_usage_status to see how many calls you used.
Ask the AI to run ns1_upgrade: it returns a Stripe Checkout link. To cancel, run ns1_cancel_subscription. Pro continues to the end of the paid period.
Tell the AI what you wanted to do. It can send the request with ns1_request_feature. We store the text with the server name, the type of AI client and the tool you tried, not with your account, and read every request when we plan new tools. You can send up to 5 requests per day.
Any client that supports remote MCP servers (Streamable HTTP) with OAuth login: Claude (web and desktop), Claude Code, Cursor, VS Code, Windsurf and others.
This is a Model Context Protocol endpoint — meant to be connected from an AI client, not opened in a browser. An invalid_token response at the URL is the auth gate working as designed; clients authenticate automatically.