The DNS filtering service trusted by 57,000+ organizations. DNSFilter
This listing identifies a third-party MCP server. MCPBundles is not affiliated with, sponsored by, or endorsed by the service or its operator unless stated on this page.
This server may ask you to sign in when your AI client connects.
Last probed Nov 3, 2026 · mcp.dnsfilter.com
107tools discovered
For AI agents — MCPBundles Directory API
For MCP client apps (human connect):
MCP connect URL: https://mcp.dnsfilter.com/mcp
Skill page: https://www.mcpbundles.com/skills/dnsfilter-mcp-9bf7c0ef3e
Explore capabilities (107)
read 23
write 2
Showing 25 of 107
Showing 25 of 107 tools from the public preview. Connect the server to inspect the full live tool list.
List7
Get5
Top2
Total2
Other capabilities9
Authenticate
write
authenticate
Start re-authentication to sign in or switch accounts. On a local server this launches a browser sign-in window automatically; on a hosted server it returns instructions for re-authenticating from your MCP client, where the credentials are stored. Use this to start a new session, change accounts, or refresh credentials. After the user completes sign-in, call get_current_user to confirm the session.
Authenticate — Start re-authentication to sign in or switch accounts. On a local server this launches a browser sign-in window automatically; on a hosted server it returns instructions for re-authenticating from your MCP client, where the credentials are stored. Use this to start a new session, change accounts, or refresh credentials. After the user completes sign-in, call get_current_user to confirm the session.
Get Current User — Get the AUTHENTICATED SESSION OWNER's own profile (you, the caller): name, email, verification status, creation date. Also useful as a session probe after authenticate. NOT a lookup of other people — for another member use user_lookup (by email) or list_users (the org roster).
Logout — Revoke the current OAuth session so a different user can authenticate. After calling this, the MCP client must re-run the OAuth flow to obtain a new token. Use when you need to switch accounts or end a session.
Lookup Domain — Get DNSFilter's GLOBAL categorization for one domain. Returns the domain's matched category IDs (under `relationships.categories.data[].id`). To interpret threat status, cross-reference category IDs against list_categories — categories with `security: true` (Malware, Phishing, Botnet, Cryptomining, Suspicious & Deceptive, etc.) indicate threats. Fast (~50-300ms). This does NOT tell you whether YOUR org blocks the domain — for 'is/why was X blocked for us?' use explain_query_decision (recent real
Bulk Lookup Domains — Batched lookup_domain for up to 100 FQDNs at once. Strongly prefer this over looping lookup_domain — the per-org rate limit is 2,000 req / 300s.
Search Query Logs — Raw DNS query log search — individual records with full decision context.
Returns one record per DNS query matching the filters, with millisecond-precision timestamps and full policy decision detail. The most granular tool in the reporting suite: use for forensics, threat hunting, policy-action attribution, and per-device investigation when you need actual query records rather than aggregated counts.
## When to use
- "Who queried evil.com and when?"
- "Is github.com actually being blocked for
Get your MCP into directories
A working endpoint is step one. Directory coverage is the coordinated launch across ChatGPT, Claude, Cursor, the MCP Registry, and community indexes.
The DNS filtering service trusted by 57,000+ organizations. DNSFilter
How do I connect DNSFilter to my AI agent?
Use the MCP endpoint listed on this page in your MCP client configuration. One-click install pills support Claude, Cursor, VS Code, and other hosts. Copy the remote MCP URL if your client needs a manual entry.
How many tools does DNSFilter provide?
Operate this server?
Request removal if you do not want DNSFilter listed here, or claim the listing if you want to manage it on MCPBundles.
Operate DNSFilter?
This server appears in the MCPBundles directory. Verify you operate it to take over the listing — name, description, logo, contact email, and skill content. We email a 6-digit code to a maintainer address your server publishes in /.well-known/security.txt or /.well-known/mcpbundles.json. Free, takes about a minute.
MCPBundles publishes this directory for MCP discovery. Except where we host or operate an offering, third-party services run under their own terms. Product and company names on this page are used in a descriptive, identifying way (including under nominative fair use where applicable); they remain the property of their owners. Nothing here grants you rights in those marks, and nothing here is an offer to sell a third party's services. Terms · Request removal
More in security
Other MCP servers in this category from the directory index
Explain Query Decision — Answers "is/was domain X blocked for this org, and why?" from recent real query logs. This is the right tool when asked whether a domain is blocked or allowed for the account — `lookup_domain` only returns DNSFilter's global categorization and says nothing about your policies. If nobody queried the domain recently (~9-day log window), check configuration instead via `get_policy`/`get_global_lists`.
Returns the most recent DNS query records for that domain, each annotated with a plain-english `d
Get Blocked Traffic — Top blocked domains and categories for an org over a time window. Reports what WAS blocked (observed traffic), not what IS configured to be blocked — for configuration use `get_policy`/`get_global_lists`/`policy_audit`. Org-level only: accepts NO user/device filter — for "blocked sites for a specific user/device" use `search_query_logs` with `result: 'blocked'` plus `user_id` (from `top_users`) or `agent_id` (from `list_user_agents`).
Combines `top_domains` and `top_categories` results in a sin
Analyze Query Patterns — Top queried domains for a specific device, site, or org over a time window — aggregated from raw DNS query logs.
Paginates through `search_query_logs` (up to 10 pages × 100 records = 1,000 queries scanned), groups by domain, and returns a ranked list with blocked and allowed breakdowns. This is the right tool when you need per-device or per-site domain analysis, since the `top_domains` endpoint only supports org-level scoping.
## When to use
- "What has this device been querying most in the l
Detect Traffic Anomalies — Surfaces unusual DNS traffic patterns by comparing a time window against an equally-sized prior baseline period.
Makes 4 parallel API calls: `total_requests` for both the current and baseline windows (volume comparison), and `top_domains` for both windows (new domain detection). Results include a plain-english `summary` alongside structured anomaly data.
## When to use
- "Did anything unusual happen in my network this week?"
- "Was there a DNS traffic spike yesterday?"
- "Are there any new do
Top Domains — Top requested domains by DNS query volume in a time window. DNS-LAYER metric: query COUNTS (includes automated/background lookups like telemetry and CDNs). NOT human time-on-site — for focus time use `cs_top_websites` (CyberSight).
Returns one row per domain ranked by total query count across the organization. The most direct answer to "what are users hitting most?" — and the primary sweep tool for spotting high-traffic domains that are also being blocked.
## When to use
- "What are the most-
Top Categories — Top content categories by DNS query volume in a time window. DNS-LAYER metric: query COUNTS (includes automated/background lookups). NOT time spent browsing — for focus-time by category use `cs_top_categories` (CyberSight).
Returns one row per category showing total queries and how those queries were handled. The best "what are my users doing at a glance" overview. Use `list_categories` to explore all 56 available categories with their `security` flag and descriptions.
## When to use
- "What
Total Threats — Threat trend over a time window (DNS-layer threat-query COUNTS per time bucket). NOT threat dwell/browsing time on monitored endpoints — use `cs_observed_threat_trend` (CyberSight).
Returns one row per time bucket (15-minute, daily, or weekly depending on window length — see Time buckets and granularity) with threat query counts and the policies that detected them. A "threat" is any query resolved to a security category (Malware, Phishing, Botnet, Cryptomining, Suspicious & Deceptive, etc.). Us
Total Requests — DNS query volume over a time window.
Returns one row per time bucket (15-minute, daily, or weekly depending on window length — see Time buckets and granularity) containing total query counts split by source type. Use as a volume baseline — understanding normal traffic levels makes spikes and drops meaningful.
## When to use
- "How many DNS queries did we process this week?"
- "What's our normal daily query volume?"
- "Did traffic drop after the maintenance window?"
- "Show me query volume for
List Organizations — List organizations the authenticated user can access. By default each row is summarized to: id, uuid, name, role (administrator/super_administrator), managed_by_msp_id (if a sub-org), owned_msp_id (if an MSP parent), current_license, current_mrr — full records for large accounts exceed MCP response limits, so pass summary: false only with a name filter or small page size. The org UUID (needed for CyberSight cs_* tools) is in the top-level data[].uuid field — NOT inside data[].attributes. Use to
List Networks — List networks (sites/locations) for an organization. Each network has a name, attached policy_id, block_page_id, secret_key (for auth), local_domains, local_resolvers, deployment IPs, and stats. Default pagination 25 per page — networks are heavy records; for one network's full detail use get_network instead.
List Policies — List DNS filtering policies OWNED by the account or a given organization. MSP global policies are NOT included by default — pass include_global_policies: true to add them (marked is_global_policy: true in the results). If the result is still empty, find the effective policy via list_networks → policy_id (or a device's policy_id) and fetch it with get_policy.
Get Policy — Get full details for one policy by ID: allowlist, blocklist, blocked categories/apps, safe-search settings.
Get Organization Usage — TRAFFIC usage for one organization over a time window: DNS query counts, threat counts, deployment counts. Use for 'how much traffic/how many queries did org X do'. NOT license/seat consumption ('are we over our seat limit?') — use seat_usage_summary. Defaults to the last 30 days when from/to are omitted (the API requires an explicit window).
List Block Pages — List block pages configured for the account (the branded page shown when DNS resolution is blocked).
List Categories — List all DNSFilter content categories. Returns ~56 categories total with `id`, `name`, `description`, `webshrinker_name`, and crucially `security: true|false` — categories with security:true (Malware, Phishing, Botnet, Cryptomining, Suspicious & Deceptive, Proxy & Filter Avoidance, Malicious Domain Protection, New Domains, Newly Observed Domains, Very New Domains, Translation Sites) are threat-class. Also includes Generative AI Tools (id 77) for blocking AI services. Stable taxonomy — cache and
List Applications — List applications DNSFilter recognizes (100+ apps incl. ChatGPT, Claude AI, CharacterAI, Beautiful AI, Discord, Dropbox, Box, TikTok, AnyDesk, BitTorrent Client, Apple iCloud Private Relay, CyberGhost VPN). Each app has id, name (slug like `chatgpt`), display_name, description, home_page_url, and an `application_category` (GenAI & ML / VPN And Proxy / File Sharing / VoIP/Conferencing / Remote Desktop / Ecosystem Applications / Portal). Use IDs in policy edit tools and search filters. This is a S
Get Network — Get full details for one network (site/location) by ID: IP allowlist, policy attached, secret key state, geo, etc.
List User Agents — List the DEVICE fleet. 'User agents' are roaming clients — the DNSFilter software installed on endpoint devices — NOT people and NOT browser User-Agent strings. Use for 'what devices/endpoints do we have?', the device roster, or filtering the fleet by state/version/policy. Each agent returns: client_id (UUID), hostname, agent_type (windows/ios/macos/android), agent_version, agent_state (protected/unprotected/bypassed/pending_uninstall/uninstalled), current_user.login (the OS login currently sign
User Agent Counts — DEVICE fleet health COUNTS only (roaming clients, not people). Returns the UNION of both server-side state taxonomies: `{deployed_total, protected, unprotected, offline, bypassed, pending_uninstall, uninstalled}`. This is the one call that answers 'how many Roaming Clients are deployed / Protected / Unprotected / offline?' — protected/unprotected/offline partition the fleet and sum to deployed_total, while bypassed/pending_uninstall/uninstalled come from the older taxonomy and must not be added
Showing the first 25 tools — full list and schemas: Directory API.
MCPBundles probed 107 tools on the live server. The tool list on this page reflects what was discovered at the last refresh — connect your client to see the full set available to your session.
What authentication does DNSFilter require?
DNSFilter may require signing in to the provider before tools can run. Connect through MCPBundles or your MCP client and complete any provider login when prompted.
Don't want this listed?
Request removal from the MCPBundles directory. We stop publishing this listing on mcpbundles.com.
MCPBundles is an independent platform built on the open Model Context Protocol standard. MCPBundles is not affiliated with, sponsored by, or endorsed by Anthropic PBC.