NS1 Connect MCP by usefulapi

by usefulapi.io · remote · no sign-in to list tools · v1.3.3 · published by io.usefulapi

Read NS1 zones, records, monitors, data feeds and usage; create or update one DNS record.

Deletes · 2

Compare Registry entry

18 tools: 2 can delete or cancel things and 16 only read.

Scanned Oct 21, 2026

Deletes or cancels2Claude Code: deny: see these tools
Can't be undone0Claude Code: ask
Changes things0Claude Code: ask
Only reads16Claude Code: allow: see these tools

4 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http ns1 https://ns1.usefulapi.io/mcp

Findings

Matches of fixed checks, with the text they matched.

4 info

Infons1_list_monitoring_jobs
The description mentions "credentials".
Matched text
description: "...tify list id. Request header values and credentials are redacted. GET /v1/monitoring/jobs."
What this check looks for
Infons1_get_monitoring_job
The description mentions "credentials".
Matched text
description: "..., regions and status. Header values and credentials are redacted. GET /v1/monitoring/jobs/{..."
What this check looks for
Infons1_list_data_sources
The description mentions "credentials".
Matched text
description: "...nd their feeds. Connection settings and credentials are redacted. GET /v1/data/sources."
What this check looks for
Infons1_get_data_source
The description mentions "credentials".
Matched text
description: "...with its feeds. Connection settings and credentials are redacted. GET /v1/data/sources/{id}..."
What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

18 tools

Deletes or cancels 2Removes, cancels or revokes something.Claude Code: deny

ns1_create_recordWRITE: creates ONE new DNS record and CHANGES LIVE DNS for that name as soon as NS1 serves it; a wrong answer can take a site or mail offline.No findings
Why it is in this group
- The name "ns1_create_record" says "create": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
WRITE: creates ONE new DNS record and CHANGES LIVE DNS for that name as soon as NS1 serves it; a wrong answer can take a site or mail offline. Plain records only (A, AAAA, ALIAS, CAA, CNAME, MX, PTR, SRV, TXT; no NS/SOA, no traffic-steering filters or metadata). Refuses when the record already exists (use ns1_update_record). Answers are lists of rdata fields: A ["192.0.2.10"], MX [10, "mail.example.com."], TXT ["v=spf1 -all"], SRV [10, 5, 5060, "sip.example.com."], CAA [0, "issue", "letsencrypt.org"]. PUT /v1/zones/{zone}/{domain}/{type}.
Annotations the server declares
- title: Create DNS record
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true
ns1_update_recordWRITE: changes ONE existing DNS record and CHANGES LIVE DNS for that name immediately.No findings
Why it is in this group
- The name "ns1_update_record" says "update": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
WRITE: changes ONE existing DNS record and CHANGES LIVE DNS for that name immediately. Giving answers REPLACES all current answers of the record (send the complete new set); giving only ttl changes just the TTL. Plain records only (A, AAAA, ALIAS, CAA, CNAME, MX, PTR, SRV, TXT): when answers are given, a record that uses traffic-steering filters, links or per-answer metadata is refused (edit it in the NS1 portal). Fails if the record does not exist. POST /v1/zones/{zone}/{domain}/{type}.
Annotations the server declares
- title: Update DNS record
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true

Only reads 16Looks things up and changes nothing.Claude Code: allow

ns1_get_account_summaryThe account's subscription, resources and utilization (queries, records, filter chains, monitors, ...No findings
Why it is in this group
- The name "ns1_get_account_summary" says "get": a word for reading.
Description, as the server wrote it
The account's subscription, resources and utilization (queries, records, filter chains, monitors, ... against the plan limits). GET /v1/account/summary.
Annotations the server declares
- title: Get account summary
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
ns1_get_billing_queriesBillable DNS query usage between two Unix timestamps.No findings
Why it is in this group
- The name "ns1_get_billing_queries" says "get": a word for reading.
Description, as the server wrote it
Billable DNS query usage between two Unix timestamps. GET /billing-usage/v1/queries?from=&to=.
Annotations the server declares
- title: Get query usage (billing)
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
ns1_get_billing_recordsHow many DNS records the account uses against its plan limit in the current billing cycle.No findings
Why it is in this group
- The name "ns1_get_billing_records" says "get": a word for reading.
Description, as the server wrote it
How many DNS records the account uses against its plan limit in the current billing cycle. GET /billing-usage/v1/records.
Annotations the server declares
- title: Get records usage
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
ns1_get_data_feedOne data feed of a source by id.No findings
Why it is in this group
- The name "ns1_get_data_feed" says "get": a word for reading.
Description, as the server wrote it
One data feed of a source by id. GET /v1/data/feeds/{source_id}/{feed_id}.
Annotations the server declares
- title: Get data feed
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
ns1_get_data_sourceOne data source by id with its feeds.1 finding
Why it is in this group
- The name "ns1_get_data_source" says "get": a word for reading.
Findings
- Info
  The description mentions "credentials".
  Matched text
  description: "...with its feeds. Connection settings and credentials are redacted. GET /v1/data/sources/{id}..."
  What this check looks for
Description, as the server wrote it
One data source by id with its feeds. Connection settings and credentials are redacted. GET /v1/data/sources/{id}.
Annotations the server declares
- title: Get data source
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
ns1_get_monitoring_jobOne monitoring job by id with its configuration, rules, regions and status.1 finding
Why it is in this group
- The name "ns1_get_monitoring_job" says "get": a word for reading.
Findings
- Info
  The description mentions "credentials".
  Matched text
  description: "..., regions and status. Header values and credentials are redacted. GET /v1/monitoring/jobs/{..."
  What this check looks for
Description, as the server wrote it
One monitoring job by id with its configuration, rules, regions and status. Header values and credentials are redacted. GET /v1/monitoring/jobs/{id}.
Annotations the server declares
- title: Get monitoring job
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
ns1_get_qps_statsCurrent queries per second for the whole account, one zone, or one record (give zone, or zone + domain + type).No findings
Why it is in this group
- The name "ns1_get_qps_stats" says "get": a word for reading.
Description, as the server wrote it
Current queries per second for the whole account, one zone, or one record (give zone, or zone + domain + type). GET /v1/stats/qps[/{zone}[/{domain}/{type}]].
Annotations the server declares
- title: Get queries per second
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
ns1_get_recordOne DNS record by zone, domain and type: TTL, answers (with per-answer metadata), filter chain (traffic steering), linked record and region settings.No findings
Why it is in this group
- The name "ns1_get_record" says "get": a word for reading.
Description, as the server wrote it
One DNS record by zone, domain and type: TTL, answers (with per-answer metadata), filter chain (traffic steering), linked record and region settings. GET /v1/zones/{zone}/{domain}/{type}.
Annotations the server declares
- title: Get record
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
ns1_get_usage_statsDNS query counts for the whole account, one zone, or one record (give zone, or zone + domain + type).No findings
Why it is in this group
- The name "ns1_get_usage_stats" says "get": a word for reading.
Description, as the server wrote it
DNS query counts for the whole account, one zone, or one record (give zone, or zone + domain + type). period is 1h, 24h or 30d; aggregate, expand, limit and after apply to the account and zone levels only (a record takes just period). If next_page is not null, call again with its after/limit. GET /v1/stats/usage[/{zone}[/{domain}/{type}]].
Annotations the server declares
- title: Get query usage statistics
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
ns1_get_zoneOne zone with its settings and its record list (each record: domain, type, TTL, short answers, linked/tier info).No findings
Why it is in this group
- The name "ns1_get_zone" says "get": a word for reading.
Description, as the server wrote it
One zone with its settings and its record list (each record: domain, type, TTL, short answers, linked/tier info). Large zones are paged: if next_page is not null, call again with its after/offset to get the next records. TSIG secrets are redacted. GET /v1/zones/{zone}.
Annotations the server declares
- title: Get zone
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
ns1_list_data_feedsList the feeds of one data source (each feed is one monitored item, e.g.No findings
Why it is in this group
- The name "ns1_list_data_feeds" says "list": a word for reading.
Description, as the server wrote it
List the feeds of one data source (each feed is one monitored item, e.g. one server's health) with id, name and settings. GET /v1/data/feeds/{source_id}.
Annotations the server declares
- title: List data feeds
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
ns1_list_data_sourcesList the data sources (connections to third-party monitoring or custom push sources used for traffic steering): id, name, source type, status and their feeds.1 finding
Why it is in this group
- The name "ns1_list_data_sources" says "list": a word for reading.
Findings
- Info
  The description mentions "credentials".
  Matched text
  description: "...nd their feeds. Connection settings and credentials are redacted. GET /v1/data/sources."
  What this check looks for
Description, as the server wrote it
List the data sources (connections to third-party monitoring or custom push sources used for traffic steering): id, name, source type, status and their feeds. Connection settings and credentials are redacted. GET /v1/data/sources.
Annotations the server declares
- title: List data sources
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
ns1_list_monitoring_jobsList the account's NS1 monitoring jobs (health checks that feed traffic steering): id, name, type, regions, frequency, rules, current status, active flag and notify list id.1 finding
Why it is in this group
- The name "ns1_list_monitoring_jobs" says "list": a word for reading.
Findings
- Info
  The description mentions "credentials".
  Matched text
  description: "...tify list id. Request header values and credentials are redacted. GET /v1/monitoring/jobs."
  What this check looks for
Description, as the server wrote it
List the account's NS1 monitoring jobs (health checks that feed traffic steering): id, name, type, regions, frequency, rules, current status, active flag and notify list id. Request header values and credentials are redacted. GET /v1/monitoring/jobs.
Annotations the server declares
- title: List monitoring jobs
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
ns1_list_notify_listsList the notifier lists that monitoring alerts are sent to: id, name and the notifier types and labels (email, Slack, PagerDuty, webhook).No findings
Why it is in this group
- The name "ns1_list_notify_lists" says "list": a word for reading.
Description, as the server wrote it
List the notifier lists that monitoring alerts are sent to: id, name and the notifier types and labels (email, Slack, PagerDuty, webhook). Notifier settings (webhook URLs, tokens, service keys, addresses) are redacted. GET /v1/lists.
Annotations the server declares
- title: List notifier lists
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
ns1_list_zonesList the DNS zones in the account: name, id, TTL/SOA settings, primary/secondary setup, linked zones and tags.No findings
Why it is in this group
- The name "ns1_list_zones" says "list": a word for reading.
Description, as the server wrote it
List the DNS zones in the account: name, id, TTL/SOA settings, primary/secondary setup, linked zones and tags. If next_page is not null, call again with its after/offset to get more. GET /v1/zones.
Annotations the server declares
- title: List zones
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
ns1_searchSearch the account's zones and records by name (substring match).No findings
Why it is in this group
- The name "ns1_search" says "search": a word for reading.
Description, as the server wrote it
Search the account's zones and records by name (substring match). Returns matching zones and/or records with their answers when expand is true. GET /v1/search.
Annotations the server declares
- title: Search zones and records
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.3.3. Values in angle brackets are yours to fill in.

claude mcp add --transport http ns1 https://ns1.usefulapi.io/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__ns1__ns1_list_zones",
      "mcp__ns1__ns1_get_zone",
      "mcp__ns1__ns1_get_record",
      "mcp__ns1__ns1_search",
      "mcp__ns1__ns1_list_monitoring_jobs",
      "mcp__ns1__ns1_get_monitoring_job",
      "mcp__ns1__ns1_list_notify_lists",
      "mcp__ns1__ns1_list_data_sources",
      "mcp__ns1__ns1_get_data_source",
      "mcp__ns1__ns1_list_data_feeds",
      "mcp__ns1__ns1_get_data_feed",
      "mcp__ns1__ns1_get_account_summary",
      "mcp__ns1__ns1_get_usage_stats",
      "mcp__ns1__ns1_get_qps_stats",
      "mcp__ns1__ns1_get_billing_records",
      "mcp__ns1__ns1_get_billing_queries"
    ],
    "ask": [],
    "deny": [
      "mcp__ns1__ns1_create_record",
      "mcp__ns1__ns1_update_record"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as ns1. Review it before you use it.

Keep track

Get told when this server's tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.usefulapi/ns1/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Anlyon alternative

2 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Compare with other servers for the same product.

Source: MCP Registry · repository. Synced Oct 21, 2026, 19:23 UTC.

For agents: Markdown · JSON · report this listing