Nslookup

MCP Server for nslookup.io

DNS lookups, SSL certificate checks, security scanning, GEO (AI readiness) scoring, domain intelligence, and your own monitoring account — via the Model Context Protocol.

Website · API Docs · npm · Contact

What is this?

The nslookup.io MCP server gives any MCP-capable AI assistant (Claude, ChatGPT, Cursor, Windsurf, …) direct access to nslookup.io's DNS, certificate, security, and monitoring tools. Ask in plain language — _"Run a DNS health check on github.com"_ or _"Which of my SSL certificates expire soonest?"_ — and the assistant calls the right tool for you.

23 tools total, in two groups:

• 17 public tools — DNS, SSL, security, GEO, and domain-intelligence lookups that work anonymously, with no account and no API key.
• 6 `my_` account tools — read your own nslookup.io monitoring account (uptime, DNS, WHOIS, SSL, propagation, BIMI/VMC monitors). These are always listed but require signing in.

Jump to Connect to get set up, or the Tool reference for the full list.

Connect

There are two ways to connect. Pick one — see the note below.

Use the hosted endpoint if you want your own monitoring data — it's the only mode where the my_ account tools sign in for you, right in the browser. The local mode is great for the 17 public tools with zero setup.

Connect for your account (portal) tools

To use your own NsLookup.io monitoring data (the 6 my_ account tools), add the hosted connector and sign in. There is no API key — authentication is a one-time browser sign-in (OAuth) against your nslookup.io account.

Claude Code (CLI)

claude mcp add --transport http nslookup https://mcp.nslookup.io/mcp

Then invoke an account tool — e.g. ask _"show my monitoring overview"_. A browser sign-in window appears; after you sign in once, all 6 my_ tools work (the client remembers it).

Claude Desktop / claude.ai — add a custom connector with URL https://mcp.nslookup.io/mcp, then sign in when prompted.

`.mcp.json` (project) or any HTTP-capable client:

{ "mcpServers": { "nslookup": { "type": "http", "url": "https://mcp.nslookup.io/mcp" } } }

The 17 public tools work immediately over this same endpoint — you only sign in the first time you reach for your own data.

Hosted (recommended)

The hosted endpoint is a remote Streamable-HTTP server. Public tools work immediately; the first time you call a my_ tool, an OAuth-capable client opens a browser window to sign in to your nslookup.io account (see Signing in).

Claude Code (CLI)

claude mcp add --transport http nslookup https://mcp.nslookup.io/mcp

Claude Desktop / claude.ai (custom connector)

1. Open Settings → Connectors
2. Click Add custom connector
3. Name: nslookup — URL: https://mcp.nslookup.io/mcp
4. Click Add

Or drop it into an .mcp.json (project) / your client's MCP config:

{

"mcpServers": { "nslookup": { "type": "http", "url": "https://mcp.nslookup.io/mcp" } } }

ChatGPT

1. Open Settings → Connected apps (or Tools & integrations)
2. Click Add custom integration / Add MCP server
3. Name: nslookup — URL: https://mcp.nslookup.io/mcp
4. Save

Cursor / Windsurf (and any HTTP-capable client)

Add to your MCP config (.cursor/mcp.json, ~/.codeium/windsurf/mcp_config.json, etc.):

{

"mcpServers": { "nslookup": { "type": "http", "url": "https://mcp.nslookup.io/mcp" } } }

Local (npx / stdio)

Runs the server on your machine over stdio. Public tools only — all 17 public tools work with no auth. For your own monitoring data (the my_ account tools), use the hosted connector and sign in — the account tools are not available on the local transport.

Claude Code (CLI)

# Global (all projects)

claude mcp add nslookup --scope user -- npx -y @nslookup-io/mcp-server

Or for a single project

claude mcp add nslookup --scope project -- npx -y @nslookup-io/mcp-server

Claude Desktop — add to claude_desktop_config.json:

{

"mcpServers": { "nslookup": { "command": "npx", "args": ["-y", "@nslookup-io/mcp-server"] } } }

Cursor (.cursor/mcp.json) / Windsurf (~/.codeium/windsurf/mcp_config.json):

{

"mcpServers": { "nslookup": { "command": "npx", "args": ["-y", "@nslookup-io/mcp-server"] } } }

⚠️ Use only ONE nslookup entry

Configure either the hosted entry or the local entry — not both. If two MCP servers named nslookup are registered at once (e.g. a hosted connector plus a local npx entry), tool calls can route to the wrong server and behave unpredictably. Pick the mode you want and remove the other.

Signing in

• 17 public tools — no account, no key, nothing to sign in for. They call public, stateless, no-auth endpoints.
• 6 `my_` account tools — read your private monitoring data, so they require sign-in:
• Hosted endpoint → browser OAuth. The server is an OAuth 2.1 resource server. Calling a my_ tool without credentials returns a 401 with a WWW-Authenticate challenge, and OAuth-capable clients (Claude web/desktop, Claude Code, …) then walk you through a browser sign-in against the nslookup.io identity provider (Keycloak). There is no API key — sign in once and the client remembers it. Everything else keeps working anonymously — you only sign in when you first reach for your own data. See Connect for your account (portal) tools.

Tool reference

Public tools (17 — anonymous)

DNS

Domain intelligence

DNS health & security

GEO (AI readiness)

Account tools (6 — require sign-in)

These my_ tools read your own nslookup.io monitoring account. They are always listed but require signing in to call.

Supported DNS record types

A, AAAA, AFSDB, APL, AXFR, CAA, CDNSKEY, CDS, CERT, CNAME, CSYNC, DHCID, DLV, DNAME, DNSKEY, DS, EUI48, EUI64, HINFO, HIP, HTTPS, IPSECKEY, IXFR, KEY, KX, LOC, MX, NAPTR, NS, NSEC, NSEC3, NSEC3PARAM, NXT, OPENPGPKEY, OPT, PTR, RP, RRSIG, SIG, SMIMEA, SOA, SPF, SRV, SSHFP, SVCB, TA, TKEY, TLSA, TSIG, TXT, URI, ZONEMD

DNS servers

cloudflare, google, quad9, opendns, authoritative, and regional servers in South Africa, Australia, India, Netherlands, Canada, USA, Brazil, Ukraine, Russia.

Configuration

How hosted OAuth sign-in works under the hood

The hosted server is an OAuth 2.1 *resource server*: calling a my_ tool without credentials returns a 401 with a WWW-Authenticate challenge pointing at `/.well-known/oauth-protected-