Domainee MCP Server

Custom domains API for SaaS, exposed as Model Context Protocol tools. Connect,verify, and manage your customers' domains, SSL, and DNS from any MCP client.20 domains free.

License

Domainee is a custom domains API for SaaS with a native MCP server, 20 domains and100 GB free. This is the hosted, stateless Model Context Protocolserver that lets AI agents (Claude, Cursor, Windsurf, and any MCP-aware client) drivethe Domainee API directly: onboard a customer's hostname, hand them DNS steps writtenfor their actual DNS provider (or a one-click approval link when their DNS is onCloudflare), force DNS and SSL probes, debug "my domain isn't working" tickets, and manage webhookendpoints. Same Bearer key, rate limits, and workspace as the REST API. Nothing to deploy.

This is not a registrar MCP server

Most domain MCP servers wrap a registrar's API so an agent can manage domains youown — search, buy, renew, edit nameservers at GoDaddy / Namecheap / Dynadot / NameSilo.

Domainee solves the other problem: letting your customers point their own domains atyour app. You're a SaaS, your customer owns shop.acme.com, and you need it servingtheir storefront over HTTPS in a minute without them touching your infrastructure. Thatmeans custom-hostname routing, automatic certificate issuance and renewal, DNSverification, and a webhook when it goes live — the "Cloudflare for SaaS" shape, not theregistrar shape.

If you want an agent to buy you a domain, use a registrar server. If you want an agentto onboard a customer's domain into your product, this is the one.

Endpoint

https://mcp.domainee.dev/mcp

Remote, streamable HTTP, stateless. No install, no local process, nothing to deploy.

Auth is optional for discovery. initialize, tools/list, and all 18 freediagnostic tools answer anonymously. A Domainee API key (sk_live_…, minted athttps://domainee.dev/developers) unlocks the 15 workspace tools; calling one without akey returns 401 plus a WWW-Authenticate header pointing at our OAuth metadata, whichis what starts the OAuth flow in MCP clients. OAuth is also supported end to end(RFC 9728 protected-resource metadata + RFC 8414 authorization-server metadata).

Install

Claude Code / CLI:

claude mcp add --transport http domainee https://mcp.domainee.dev/mcp \
  --header "Authorization: Bearer sk_live_YOUR_KEY"

Claude Desktop / Cursor / Windsurf (any HTTP-transport client):

{
  "mcpServers": {
    "domainee": {
      "url": "https://mcp.domainee.dev/mcp",
      "headers": { "Authorization": "Bearer sk_live_YOUR_KEY" }
    }
  }
}

Try it with no key at all — this returns the 18 free tools as a text/event-streamresponse:

curl -s https://mcp.domainee.dev/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' \
  | grep '^data: ' | sed 's/^data: //' | jq '.result.tools | length'
# 18

Tools

33 tools in two tiers. The 18 free diagnostic tools need no key; the 15 workspacetools require a Bearer and are only registered when a token is present, so anunauthenticated tools/list returns 18 and an authenticated one returns 33.

Workspace tools (15, Bearer API key required)

Tool	What it does	Key arguments
`list_domains`	List custom domains in the workspace. Cursor-paginated.	`status` (`pending`/`verified`/`failed`/`expired`), `hostname` (exact match), `limit`, `cursor`
`get_domain`	Full Domain object: hostname, originUrl, status, monitorStatus, dnsRecords.	`id`
`create_domain`	Register a customer hostname for proxy or redirect through the edge. Returns preflight warnings (CAA, unreachable origin).	`hostname`, `originUrl`, `mode` (`proxy`/`redirect`), `keepHost`, `redirectWww`, `redirectStatus`, `metadata`
`update_domain`	Edit a domain. Hostname is immutable — delete and recreate to change it.	`id` + any of `originUrl`, `mode`, `keepHost`, `redirectWww`, `redirectStatus`, `metadata`
`delete_domain`	Stop routing a hostname; the edge stops serving within ~60s.	`id`
`get_connect_instructions`	DNS setup steps for the provider actually serving the customer's domain: exact record type and name, where the record editor is, provider gotchas (Cloudflare proxy, GoDaddy parked A record). Also returns `domainConnect`: a one-click link where the DNS provider has enabled Domainee's Domain Connect templates (live at Cloudflare for all accounts, and Glauca Digital), otherwise a `reason`. Call `check_domain` once the customer approves.	`id`
`check_domain`	Force an immediate DNS/SSL probe instead of waiting for the next monitor tick. Flips `pending` → `verified`.	`id`
`list_webhook_endpoints`	List webhook endpoints. Signing secrets are never included — they are revealed once, at create time.	—
`create_webhook_endpoint`	Register an HTTPS URL that Domainee POSTs domain events to. Returns the signing secret once.	`url`, `events[]` (empty = all)
`delete_webhook_endpoint`	Stop sending events; in-flight retries are dropped.	`id`
`dns_check_records_exist`	Per record, `match: true` if at least one DNS value equals the expected one. Tolerates extra records alongside the CNAME. Up to 50 per call.	`records[]` of `{ address, type, match_against }`
`dns_check_records_match_exactly`	Stricter: `match: true` only if every returned value matches. Use when the customer must point only at you.	`records[]`
`get_origin_secret`	Whether the workspace's origin secret is on. When it is, proxied requests carry it in the `x-domainee-origin-secret` header so the origin can reject traffic that didn't come through Domainee.	—
`rotate_origin_secret`	Turn the origin secret on, or replace it. Returns the new secret once. Origins checking the old one reject requests once the edge picks up the new one, within about a minute.	—
`disable_origin_secret`	Turn the origin secret off. Origins that require it start rejecting traffic within about a minute.	—

type accepts a, aaaa, cname, mx, txt, ns, caa. Comparison iscase-insensitive and trailing dots are stripped. Webhook events aredomain.created, domain.verified, domain.failed, domain.expired,domain.deleted, domain.monitor_updated.

Free diagnostic tools (18, no key, no signup)

Read-only SSL / DNS / WHOIS lookups, usable by any agent against any domain:

tools_ssl_check, tools_dns_provider_lookup, tools_domain_connect_checker,tools_dns_record_lookup, tools_whois_lookup,tools_cname_lookup, tools_http_header_checker, tools_dns_propagation_checker,tools_redirect_checker, tools_spf_record_checker, tools_dkim_record_checker,tools_dmarc_record_checker, tools_txt_record_lookup, tools_domain_age_checker,tools_domain_availability_checker, tools_subdomain_finder,tools_reverse_ip_lookup, tools_website_status_checker.

The same 18 are available as keyless REST endpoints athttps://api.domainee.dev/v1/tools/<name> — see https://domainee.dev/free-apis.

What agents do with it

Onboard a customer domain. "Connect shop.acme.com to https://acme.myapp.com."The agent calls create_domain, then get_connect_instructions to tell the customerexactly what to publish, in the words their DNS provider's panel uses. If their DNS is onCloudflare, it can hand them a one-click link instead: they approve the records onCloudflare's own screen and type nothing. Once they're done, it calls check_domain toverify immediately rather than waiting for the monitor.

Debug a broken domain. "Why is shop.acme.com showing a certificate error?" Theagent calls get_domain for our view of the status, then tools_cname_lookup andtools_ssl_check for ground truth from public DNS, and can tell the difference between"the customer never published the record", "it's published but not propagated yet", and"there's a CAA record blocking issuance".

Audit the fleet. "Which customer domains are failing?" — list_domains withstatus: "failed", then dns_check_records_exist across the results in one batchedcall of up to 50 records.

Pricing

Free tier: 20 custom domains + 100 GB bandwidth/month, with no expiry. You add a cardwhen you connect your first domain; it's charged $0 inside the free tier. Usage pricingbeyond that at https://domainee.dev/pricing. The 18 diagnostic tools are free andkeyless regardless.

Listings

MCP Registry — dev.domainee/domainee on https://registry.modelcontextprotocol.io
Glama —
Claude connector directory — listed as a community connector; find it in Claude underSettings → Connectors

About this repo

Discovery and documentation only — the server is hosted, so there is nothing to cloneor run. It holds the server.json that the MCP Registry reads and this README. Theimplementation lives in the Domainee monorepo.

Issues and questions are welcome here.

License

MIT — see LICENSE.

Domainee MCP Server