mcp server

dns-mcp

Multi-provider DNS MCP server (Aliyun first). Takes raw AccessKey — no IMS/OAuth detour. Least-privilege DNS-only AK is enough.

liguanglai/dns-mcpcommunitylistedunreviewed

Use tool

Set up

Runs on your computer. Pick your agent and operating system.

Before you start

uv (`curl -LsSf https://astral.sh/uv/install.sh | sh`)

~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "liguanglai-dns-mcp": {
      "command": "uvx",
      "args": [
        "dns-mcp"
      ]
    }
  }
}

same format Cursor, GitHub Copilot CLI, Junie, JetBrains AI Assistant, Augment (Auggie CLI), Factory Droid, Kiro, Devin CLI +12

Values in angle brackets are placeholders. Restart Claude Desktop after editing its config.Claude Desktop docs

README

synced Oct 23, 2026

dns-mcp

中文 | English

一个直接吃供应商 AK 的 DNS MCP 服务器。当前支持 阿里云 DNS (alidns)，按 Provider 接口设计，方便后续接入 Cloudflare / DNSPod / AWS Route53 等。

为什么不用阿里云官方 MCP

阿里云官方的 alibabacloud-api-mcp-server 通过 IMS GenerateAccessToken 把 AK 换成短时 token，要求 AK 挂上 AliyunOpenAPIMCPServerStaticCredentialAccess 等较宽的 RAM 策略。

如果你只想给 AI 一个最小权限的 DNS AK（只有 alidns:Describe* / alidns:AddDomainRecord / alidns:UpdateDomainRecord / alidns:DeleteDomainRecord），官方那套用不了。本项目就是为这个场景写的——直接用 AK 签 alidns RPC 请求，不走 IMS。

安装

通过 uvx（推荐，零安装）

uvx --from git+https://github.com/liguanglai/dns-mcp dns-mcp

通过 pip

pip install git+https://github.com/liguanglai/dns-mcp
dns-mcp

要求 Python ≥ 3.10。

在 Claude Code 中配置

claude mcp add dns-mcp \
  -e ALIYUN_ACCESS_KEY_ID=<your_ak> \
  -e ALIYUN_ACCESS_KEY_SECRET=<your_sk> \
  -- uvx --from git+https://github.com/liguanglai/dns-mcp dns-mcp

或者在 claude_desktop_config.json / ~/.claude.json 里手动加：

{
  "mcpServers": {
    "dns-mcp": {
      "command": "uvx",
      "args": ["--from", "git+https://github.com/liguanglai/dns-mcp", "dns-mcp"],
      "env": {
        "ALIYUN_ACCESS_KEY_ID": "...",
        "ALIYUN_ACCESS_KEY_SECRET": "..."
      }
    }
  }
}

环境变量：

Var	必填	说明
`ALIYUN_ACCESS_KEY_ID`	✓	阿里云 AccessKey ID（也接受 `ALIBABA_CLOUD_ACCESS_KEY_ID`）
`ALIYUN_ACCESS_KEY_SECRET`	✓	AccessKey Secret（也接受 `ALIBABA_CLOUD_ACCESS_KEY_SECRET`）

工具

Tool	作用	主要参数
`list_records`	列出域名下所有解析	`domain`, `rr_keyword?`
`add_record`	新增一条解析	`domain, rr, type, value, ttl=600`
`update_record`	改一条已有解析	`record_id, rr, type, value, ttl=600`
`delete_record`	删一条解析	`record_id`
`set_records`	批量改 IP（按 RR 名匹配）	`domain, subdomains[], value, type="A", ttl=600`

set_records 是最常用的——比如把 ai.qdmbjy.com 和 aimp.qdmbjy.com 一起从老 IP 改到新 IP：

set_records(domain="qdmbjy.com", subdomains=["ai", "aimp"], value="47.93.86.207")

它只改已有的记录，不会自动创建。要创建走 add_record，保持调用方对"是否新增解析"是显式的。

RAM 最小权限策略

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "alidns:DescribeDomainRecords",
        "alidns:DescribeDomainRecordInfo",
        "alidns:AddDomainRecord",
        "alidns:UpdateDomainRecord",
        "alidns:DeleteDomainRecord"
      ],
      "Resource": "acs:alidns:*:*:domain/<your-domain>"
    }
  ]
}

把 <your-domain> 换成你的域名（如 example.com），可以把 AK 锁到单个域名上。

添加新 Provider

继承 providers/base.py 的 DNSProvider Protocol：

class CloudflareProvider:
    name = "cloudflare"

    def list_records(self, domain, rr_keyword=None, page_size=100): ...
    def add_record(self, domain, rr, rtype, value, ttl=600): ...
    def update_record(self, record_id, rr, rtype, value, ttl=600): ...
    def delete_record(self, record_id): ...

然后在 server.py 里根据 env 选择哪个 provider，或者把 provider 作为工具参数暴露。

开发

git clone https://github.com/liguanglai/dns-mcp
cd dns-mcp
uv venv
uv pip install -e .[dev]
pytest

也可以从本地路径直接给 Claude Code 用：

uvx --from /path/to/dns-mcp dns-mcp

License

MIT

English

A DNS MCP server that takes the provider's raw API key directly. Currently ships an Aliyun (alidns) provider; designed so Cloudflare / DNSPod / Route53 can be plugged in later.

Why not the official Alibaba Cloud MCP

Aliyun's official alibabacloud-api-mcp-server swaps your AK for a short-lived token via IMS, which requires the RAM policy AliyunOpenAPIMCPServerStaticCredentialAccess or equivalent — i.e. a fairly broad AK. If you'd rather give your AI assistant a least-privilege DNS-only AK (just alidns:Describe* / Add / Update / Delete), the official one won't work. This project signs alidns RPC calls directly with that AK, no IMS hop.

Install

uvx --from git+https://github.com/liguanglai/dns-mcp dns-mcp

Configure in Claude Code

claude mcp add dns-mcp \
  -e ALIYUN_ACCESS_KEY_ID=... \
  -e ALIYUN_ACCESS_KEY_SECRET=... \
  -- uvx --from git+https://github.com/liguanglai/dns-mcp dns-mcp

Tools

list_records(domain, rr_keyword?) — list records.
add_record(domain, rr, type, value, ttl=600) — create.
update_record(record_id, rr, type, value, ttl=600) — update by RecordId.
delete_record(record_id) — delete.
set_records(domain, subdomains[], value, type="A", ttl=600) — batch-update existing records by RR (does not auto-create; missing RRs are reported).

Minimum RAM policy

See the JSON in the Chinese section above; scope it to a single domain by setting Resource to acs:alidns:*:*:domain/<your-domain>.

Adding a provider

Implement the DNSProvider Protocol in src/dns_mcp/providers/base.py and wire it up in server.py.

License

MIT