deSEC MCP server

Read deSEC domains, DNSSEC keys, zone files and RRsets; create or replace one DNS record set. Hosted by usefulapi: connect it to Claude, ChatGPT, Cursor or any MCP client.

Connect deSEC50 free tool calls a month

What can I ask?

Turn on the deSEC connector, then ask in plain words. The AI picks the tools.

What you can do with deSEC in Claude and ChatGPT

For domain owners and admins who host their DNS on deSEC.

See all DNS records of a domain

The AI lists the records of a domain as RRsets, filtered by type or subname, and opens one set such as the MX records of the apex.

List your domains and when they last changed

The AI lists the domains (zones) in your account with creation time, last-published time and minimum TTL.

Get the DNSSEC records to publish at your registrar

The AI reads a domain's DNSKEY and DS records, which you publish at the registrar for the chain of trust.

Back up a zone before you change records

The AI exports the whole zone as a BIND-format zonefile, so you keep a copy of all records except the DNSSEC ones.

Create or replace a DNS record set

The AI creates a new RRset or replaces all records of an existing one with a TTL and values you give. It goes live at once, so check the values first.

Changes data

How do I connect deSEC?

Before you connect

The login page asks for your deSEC API token.

Create it in the deSEC console under Token Management and copy the secret value (shown only once). Leave the allowed subnets open to all addresses. Changing records needs a token that may write DNS, and DNS changes go live immediately. For a safer setup create a dedicated token with a scoping policy limited to the domains you want to manage. deSEC limits each account to 2000 requests a day. Your token is used only to call the deSEC API on your behalf; it is never shown to anyone.

Claude claude.ai · Desktop

  1. Open Customize → Connectors, then click + Add → Add custom connector.
  2. Enter the name deSEC and this URL, then click Add:
    https://desec.usefulapi.io/mcp
  3. Claude opens the login page: enter your deSEC API token.
  4. In a chat, click + → Connectors and turn on deSEC.

Team and Enterprise: an Owner adds the connector for the organization first.

ChatGPT chatgpt.com

  1. Open Plugins, click +, then Add custom MCP server.
  2. Enter the name deSEC and this URL, choose OAuth as the authentication, confirm the warning and create it:
    https://desec.usefulapi.io/mcp
  3. ChatGPT opens the login page: enter your deSEC API token.
  4. In Plugins, install deSEC, then choose it in a chat.

No Add custom MCP server option? It depends on your account or workspace settings: see OpenAI's guide.

Claude Code

Run this command, then run /mcp in Claude Code to log in:

claude mcp add --transport http desec https://desec.usefulapi.io/mcp

Cursor

Add to Cursor or add this to ~/.cursor/mcp.json:

{
  "mcpServers": {
    "desec": {
      "url": "https://desec.usefulapi.io/mcp"
    }
  }
}

VS Code

Add to VS Code or add this to .vscode/mcp.json:

{
  "servers": {
    "desec": {
      "type": "http",
      "url": "https://desec.usefulapi.io/mcp"
    }
  }
}

Codex

Run these commands. The second one opens the login page:

codex mcp add desec --url https://desec.usefulapi.io/mcp
codex mcp login desec

Other clients

Windsurf, Cline, Zed and other MCP clients: add this URL as a remote MCP server (Streamable HTTP). The client then opens the login page in your browser.

https://desec.usefulapi.io/mcp

Add only the URL. Do not add an Authorization header or an API key to the client config. The server signs you in with OAuth: the login page asks for your deSEC API token. If the config has such a header, remove it: some clients then send that header instead of the login token, and every call fails with 401.

Pricing

PlanPriceLimit
Free$050 tool calls / month
Proper user$9/mo · $90/yr10,000 tool calls / month
Pro+per user$39/mo · $390/yr100,000 tool calls / month

Each paid plan covers this deSEC server only. Ask your AI to run desec_upgrade and choose Pro or Pro+, billed monthly or yearly (it returns a Stripe Checkout link). If you already have Pro, ask to change it to Pro+. The change requires your confirmation, keeps your billing interval and charges the price difference for the rest of the period immediately. Cancel any time with desec_cancel_subscription: your paid plan continues to the end of the paid period, with no refund for the current period, and asking to resume the same plan with desec_upgrade before then undoes the cancel. Or write to support@usefulapi.io.

Tools 11

Show all 11 tools (the AI picks them for you)

Read only · 5

  • List domainsdesec_list_domains
    List the DNS domains (zones) in this deSEC account, newest first, with creation and last-published times and minimum TTL. DNSSEC keys are omitted here (see desec_get_domain). Use owns_qname to find which of your domains is responsible for a DNS name (for example before adding a record for www.dev.example.net). Up to 500 per page.
  • Get domaindesec_get_domain
    One domain with its DNSSEC key material: the DNSKEY and the DS records to publish at the registrar for the chain of trust, plus minimum TTL and publication times.
  • Export zonefiledesec_export_zonefile
    The whole zone as a plain-text BIND-format zonefile (all RRsets except DNSSEC types). Handy as a backup before changing records. Counts as an expensive deSEC operation (300/min).
  • List RRsetsdesec_list_rrsets
    List the DNS records of a domain as RRsets (all records of one name and type, sharing one TTL), newest first. Filter by type and/or subname. Up to 500 per page.
  • Get RRsetdesec_get_rrset
    One RRset by subname and type, e.g. the A records of "www" or the MX records of the apex.

Changes data · 2

  • Create RRsetdesec_create_rrset
    WRITE: create ONE new RRset (a set of DNS records of one type at one name) in a domain. It goes live in DNS immediately and a wrong record can take a site or mail offline. Fails if an RRset with this subname and type already exists (use desec_replace_rrset for that) or if a CNAME would conflict with other records. Never touches the apex NS or DNSSEC records and cannot delete anything. Subject to deSEC's write limits (15/min, 300/day per domain).
  • Replace RRsetdesec_replace_rrset
    WRITE (overwrites): set ONE RRset to exactly the given TTL and records, creating it if it does not exist and REPLACING all its current records if it does. It goes live in DNS immediately; a wrong value can take a site or mail offline. The previous RRset is read first and returned as `previous` so the change can be undone with another call. An empty record list is refused (this tool never deletes), and the apex NS and DNSSEC records cannot be changed. Subject to deSEC's write limits (15/min, 300/day per domain). PUT /domains/{name}/rrsets/ with a one-element array.

Your usefulapi plan · 4

  • Usage status (free-tier meter)desec_usage_status
    Report the caller's current usage: the plan, calls used this month, the limit of the plan (the free monthly cap or the Pro fair use limit), remaining, and whether the limit is reached. Read-only; does not count against the meter.
  • Request a missing featuredesec_request_feature
    Tell usefulapi that the user needs something the deSEC tools cannot do yet (a missing tool, field or filter). Call it only when the user asks for something none of the tools can do, and tell the user that you send the request. Do not call it for errors or for normal requests. Do not include personal data, credentials or customer records. Stored with the product name and the client type (for example Claude or Cursor), without the user's account. At most 5 requests per day. Does not count against the meter.
  • Upgrade to Pro or Pro+desec_upgrade
    Get a paid plan for deSEC (the free tier caps monthly usage). Pro: 10,000 tool calls a month, for normal use — plan "monthly" ($9/month) or "yearly" ($90/year, 2 months free). Pro+: 100,000 tool calls a month, for automations and heavy use — plan "plus" ($39/month) or "plus_yearly" ($390/year). Without a plan it returns both Pro and Pro+, each with a payment link, for the user to choose; with a plan, one link. An existing Pro subscription changes to Pro+ in place: call without confirm first, as the reply states the exact charge for this account (the price difference for the rest of the period, or in a free Pro trial the full Pro+ price, as the trial ends); then call with confirm: true. Cancel any time: the plan then runs to the end of the paid period, so it also suits a one-time job. A link opens Stripe Checkout in the browser; after payment the account upgrades automatically. Does not count against the meter.
  • Cancel the Pro subscriptiondesec_cancel_subscription
    Cancel the caller's deSEC Pro subscription at the end of the paid period (no refund for the current period; Pro continues until then, then the free tier applies). Requires confirm: true. Run desec_upgrade later to undo the cancel before the period ends. Does not count against the meter.

FAQ

What can I do with deSEC in Claude or ChatGPT?

See all DNS records of a domain. List your domains and when they last changed. Get the DNSSEC records to publish at your registrar. Back up a zone before you change records. Create or replace a DNS record set. See what you can do for the details.

Is this an official deSEC product?

No. usefulapi is an independent service. It is not affiliated with or endorsed by deSEC. The server calls the deSEC API with your own deSEC access, so it sees only the data that your account can see.

Can I connect deSEC to Claude or ChatGPT?

Yes. In Claude, add this server's URL as a custom connector. In ChatGPT, add it as a custom MCP server in Plugins. Then log in once. Cursor, VS Code, Claude Code and Codex work too. See the setup steps.

What do I need to connect?

The login page asks for your deSEC API token. See Before you connect for where to find it.

Do I put my deSEC key or an Authorization header in the client config?

No. Add only the URL. Do not add an Authorization header or an API key to the client config. The server signs you in with OAuth: the login page asks for your deSEC API token. If the config has such a header, remove it: some clients then send that header instead of the login token, and every call fails with 401.

How do you keep my deSEC credentials?

The login stores them encrypted in the authorization grant of your connection. The server uses them to call the deSEC API for you and to derive a private account id for usage metering. usefulapi does not show them on any page or in any reply. To stop all access, remove the connector and change or delete these credentials in deSEC.

Can the AI change my deSEC data?

Yes, if you approve it. 2 of the 7 deSEC tools can create or change data. The other 5 are marked read-only. Most MCP clients ask you to approve a tool call before it runs.

What does it cost?

The Free plan gives 50 tool calls / month. Pro costs $9/mo or $90/yr, with 10,000 tool calls / month. Pro+ costs $39/mo or $390/yr, with 100,000 tool calls / month. Each subscription covers this deSEC server only. Cancel any time: your paid plan then runs to the end of the paid period. Run desec_usage_status to see how many calls you used.

How do I subscribe or cancel?

Ask the AI to run desec_upgrade and choose Pro or Pro+, billed monthly or yearly: it returns a Stripe Checkout link. If you already have Pro, ask to change it to Pro+. After you confirm, your existing subscription changes in place, keeps its billing interval and charges the price difference for the rest of the period immediately. To cancel, run desec_cancel_subscription. Your paid plan continues to the end of the paid period.

What if a deSEC tool that I need is missing?

Tell the AI what you wanted to do. It can send the request with desec_request_feature. We store the text with the server name, the type of AI client and the tool you tried, not with your account, and read every request when we plan new tools. You can send up to 5 requests per day.

Which AI clients can I use?

Any client that supports remote MCP servers (Streamable HTTP) with OAuth login: Claude (web and desktop), Claude Code, ChatGPT, Codex, Cursor, VS Code, Windsurf and others.

This is a Model Context Protocol endpoint — meant to be connected from an AI client, not opened in a browser. An invalid_token response at the URL is the auth gate working as designed; clients authenticate automatically.

Need a tool this server does not have, or a connection to another system? We build custom integrations and MCP servers.

More Developer Tools & Infrastructure MCP servers

AblyAction1ApiFlashbunny.netButterCMSCaisyCivoClouDNSCodecovCodemagicComet BackupCrowdinDepotDNSimpleDubEstuary FlowExoscaleGandiGeoapifyHetzner CloudHexnodeHypertuneInngestINWXipapi.isKindeKinstaKisiKnackLaravel ForgeLingoHubLocalazyMapTilerNorthflankNS1 ConnectpackagecloudPlay SystemsQuickbaseRealtime RegisterRelease RadarRunCloudScalefusionScalingoSpinupWPSvixTailscaleTreePlotterTrigger.devUnkeyUpCloudWakaTimeWeblate

All Developer Tools & Infrastructure servers →