CustomDomain™

CustomDomain™ MCP Server: custom domains for AI agents

This is the official CustomDomain™ product MCP server. Its only endpoint is https://mcp.customdomain.ai/mcp, listed in the official MCP registry as ai.customdomain/mcp, with the OAuth scopes domains:read, domains:connect, domains:disconnect and domains:purchase. No other host serves it, so a server at any other address that presents itself as CustomDomain™ is not this one.

The MCP server for custom domains: let Claude and other AI agents find, connect, diagnose and manage domains.

Status: Production · server 0.6.0 · release v0.6.0

Website · Docs · Console · Product page · MCP docs · Tool reference · Provider coverage · Pricing

Install:

· Claude Code, Claude Desktop and Cursor: Quickstart · GitHub Copilot cloud agent: configuration

Stars are how other developers find this server on GitHub. If it is useful to you, star the repository.

CustomDomain™ MCP is a hosted Model Context Protocol server that lets an AI agent put a person on their own domain: connect a domain they already own, set up its email records, watch it go live with HTTPS, and find out why it has not. It replaces the part of that job a human normally does by hand in a DNS control panel. There is nothing to install and nothing to keep running: point your MCP client at the endpoint above.

flowchart LR

A["Agent Claude · Cursor · ChatGPT"] -->|"JSON-RPC over HTTPS"| M["mcp.customdomain.ai 20 tools"] M -->|"credential forwarded"| C["Control plane api.customdomain.ai"] C --> R["Registrars search · price"] C --> D["DNS providers 178 catalogued · 62 automatic"] C --> E["Edge TLS issued"]

---

The problem

Every SaaS product eventually needs a customer on their own domain: a white-label app host, a vanity link, a sending domain for email. The work is small and it is always the same: figure out who runs the customer's DNS, write the right records in the right shapes, wait for them to propagate, then get a certificate. Done by hand it is a support ticket. Done in code it is a DNS provider integration you did not want to own, times sixty.

Agents make this worse before they make it better. The obvious way to let an agent do the job is to give it DNS credentials and a way to write records, which means one confused turn or one poisoned web page can now edit a customer's zone. Nobody wants to hand a language model a SetRecords call on a production domain, and the alternative (an agent that reads instructions aloud and asks the user to go type them somewhere) is the support ticket again, with extra steps. That is not a permissions problem you can prompt your way out of; it is an argument-list problem, and it gets solved by changing what the agent is able to say.

Who it's for

• Teams building agents that ship things. A coding agent, a site builder, a deploy bot: anything whose output is a running app that needs an address a person will actually type. The agent connects the domain and polls it to live instead of stopping at the last mile with a paragraph of DNS instructions.
• SaaS platforms with tenant domains. If your customers connect their own domain to your product, this is the same engine the CustomDomain™ widget and REST API run on, reached through the protocol your agents already speak.
• Email and messaging platforms. Getting a sending domain authenticated (MX, SPF, DKIM, DMARC, in the right shapes, at the customer's provider) is one call here instead of a documentation page and a support queue.
• Anyone with a domain portfolio to keep alive. Connections drift, certificates need records that still resolve, and an agent that can list, diagnose, recheck and re-apply is cheaper than a person doing it quarterly.

What it does

Twenty tools, one credential, no DNS records in any argument. Each of these is a tool call, not a workflow you have to assemble:

• Check whether a domain can be registered, with live purchase and renewal pricing: search-domain-availability
• Suggest names that are actually free, deterministically, from a set of keywords: generate-domain-suggestions
• Register a domain through the resolved registrar, behind a fail-closed authorization gate. Currently off on the hosted service: create-domain-order
• Connect a domain the customer already owns and get back the exact records that must exist: connect-domain
• Detect the DNS provider before you ask anyone for anything, with per-rail verdicts and conflict and CAA pre-flight: discover-provider
• Poll a connection to completion, from records written to certificate issued: check-connection-status
• Explain why a domain is not live, record by record: diagnose-connection
• Re-run the DNS check now once the person has fixed it: recheck-connection
• Read the HTTPS certificate (expiry, failing renewals): check-certificate-status
• Poll a registration order across two different ledgers without guessing which one applies: check-order-status
• List the purchases made through the account: list-domain-orders
• Set up email in one call (MX, SPF, DKIM and DMARC from a server-side template): add-email
• Point a domain somewhere permanently with a 301: forward-domain
• Repair a domain that drifted out of live, using a stored grant: reapply-connection
• Take a domain down, after the person confirms which one: disconnect-domain
• Inventory the whole account, page by page, so an agent can reconcile a portfolio, not just the job it started: list-connections
• Check whether the workspace may connect new domains before a batch, or after a billing_required refusal: check-billing-status
• Move a domain's nameservers to the application's DNS host, records copied first, mail included, so its records are kept correct from then on: migrate-nameservers
• Follow that move to the end, and relay the step a person has to take: check-nameserver-status
• Move the nameservers back, to the old ones or to the registrar's own DNS: rollback-nameservers

Full arguments, scopes and response shapes: [TOOLS.md](./TOOLS.md).

The receipts, all verifiable from outside: the server is published in the official MCP registry as ai.customdomain/mcp at 0.6.0, speaks protocol revision 2025-06-18, lists its version and tools without authentication at /.well-known/agent/mcp.json, and answers an unauthenticated call with a RFC 9728 challenge that names its own metadata document rather than a bare 401. Automatic setup covers 62 of the 178 providers catalogued (55 by scoped API token, 6 by provider OAuth, 1 by Domain Connect), and the other 116 still work, returning records and a link for a human to apply. The live split is at /v1/providers/census.

Every one of those tools was built against the same lesson: an agent that returns a console link and stops has not done the job. The tools return the authoritative record set itself, so the agent can tell a person exactly what to add, and the completion signal is a boolean rather than a status string an integration can misread.

Use cases

• A coding agent shipping a side project. "Point my domain at this app." discover-provider, connect-domain, then check-connection-status until connected is true. The one human step is authorizing at the DNS provider, or adding the returned records.
• A SaaS onboarding an enterprise customer. The agent calls discover-provider first, sees the customer runs a provider that cannot hold a root-domain alias, and warns before anyone authorizes anything.
• An email platform. add-email writes MX, SPF, DKIM and DMARC from a template; the agent supplies the per-domain DKIM selector and nothing else.
• A platform with a thousand tenant domains. list-connections with status=failed (following nextCursor until the list is complete), keep the rows with managed: true, reapply-connection on those, diagnose-connection on the rest and hand them to a human. That is a reconciliation loop an agent can run on a schedule, and it is the reason the inventory tool exists at all.
• A support agent answering "why is my domain not working yet". diagnose-connection says which record is missing or wrong and why (a hostname typed into the Name field, a proxy in front), and recheck-connection confirms the fix without waiting for the next scheduled check.
• A platform that keeps its users' domains working. When the application maintains domains, the agent asks the person, calls migrate-nameservers with confirm: true, and polls check-nameserver-status until done, relaying nextStep whenever the person has to act at their registrar. rollback-nameservers undoes it.

Buying a domain through MCP is built but not available on the hosted service: purchases are authorization-gated, and no purchase authorization callback is configured there, so create-domain-order answers rejected. Buy in the console, then connect the domain here.

Why an MCP server and not a REST API

There is a REST API, and it is the thing this server calls. The difference is what an agent is allowed to say. The REST API accepts DNS records; the MCP tools do not. Every record value is computed by the control plane from a vetted template, so the worst thing a prompt-inject