DocsMCP server
Let AI agents connect domains for you.
DoDomain ships a remote MCP (Model Context Protocol) server, so AI assistants and agents — Claude, coding agents, anything that speaks MCP — can check a domain's DNS provider, mint a connect session, hand your user the hosted connect link, and verify DNS, using the same REST API and permissions your integration already has.
One URL, nothing else to configure
The server lives at https://app.dodomain.io/api/mcp (Streamable HTTP, stateless). It authenticates with OAuth 2.1 — PKCE plus dynamic client registration — and publishes the standard discovery documents (RFC 9728 protected-resource and RFC 8414 authorization-server metadata), so MCP clients find the authorization server, register themselves, and start the sign-in flow automatically. You add the URL, sign in with your DoDomain account, and approve the requested scopes on the consent page. No API keys, no manual client setup.
Quick start — Claude Code
One command, then approve the browser sign-in on first use:
claude mcp add --transport http dodomain https://app.dodomain.io/api/mcpQuick start — Claude.ai (custom connector)
In Claude's web or desktop app, open Settings → Connectors → Add custom connector and paste https://app.dodomain.io/api/mcp as the remote MCP server URL. Claude walks you through the DoDomain sign-in and consent screen, then the tools appear in your conversations.
Quick start — any MCP client
Any client that supports remote MCP servers over Streamable HTTP with OAuth works the same way — MCP Inspector, ChatGPT connector settings, or your own agent built on an MCP SDK. The URL is the only configuration; everything else (authorization endpoints, client registration, token exchange) is discovered from the .well-known documents.
The seven tools
Every tool calls the same /api/v1 REST surface documented in the API reference, under the signed-in user's team. None of them are destructive — nothing an agent can call deletes apps, connections, or DNS records.
| Tool | What it does | Scope | Access |
|---|---|---|---|
check_domain | Pre-flight a domain before connecting it: which DNS provider manages it, the registrable zone, the connect tier it will get (one-click, Domain Connect, or guided manual), nameservers, and a provider-specific setup guide. | domains:read | Read-only |
list_apps | List the apps in your team — id, name, public (widget) key, sandbox flag. Never returns secret keys. The source of the appId other tools take. | apps:read | Read-only |
list_connections | List verified domain connections and their live DNS health (active vs broken), filterable by app or domain. | connections:read | Read-only |
get_connect_session | Fetch one connect session's state by its token: domain, requested DNS records, status, detected provider, expiry. Poll it to see whether the end user finished. | sessions:read | Read-only |
create_connect_session | Start a connect session for a domain. Returns a connectUrl the agent hands your end user to finish DNS setup in the browser; counts toward the plan's monthly connection quota. | sessions:write | Writes |
verify_connect_session | Trigger a live DNS check of a session's expected records against authoritative nameservers. When every record matches, the connection is finalized and webhooks fire. | sessions:write | Writes |
reverify_connection | Queue an on-demand DNS health recheck of one existing connection. The result arrives asynchronously as a connection.verified / connection.failed webhook and on the dashboard. | connections:write | Writes |
Scopes & consent
Access is scoped. When a client connects, the consent page lists exactly what it asked for, and the token it receives carries only the scopes you approve. The tool list an agent sees is filtered to its granted scopes — a client granted only read scopes never even sees create_connect_session.
| Scope | Grants |
|---|---|
domains:read | Check which DNS provider manages a domain and how it can connect |
apps:read | List the apps in your team |
connections:read | List verified domain connections |
connections:write | Request re-verification of an existing connection |
sessions:read | Read the status of domain-connect sessions |
sessions:write | Create domain-connect sessions and trigger DNS verification |
Revoking access
Every connected client is listed in the dashboard under Connected apps. Revoking one takes effect immediately: both its access and refresh tokens stop working on the next request.
Rate limits & pricing
MCP access is included on every plan — there is no separate SKU. Requests ride the same per-minute plan meters as the REST API (Free 60, Pro 300, Scale 1,200 requests/min per team), and create_connect_sessioncounts toward the plan's monthly connection quota exactly like a session minted over REST.
Security
MCP callers authenticate exclusively with OAuth 2.1: PKCE on every flow, short-lived access tokens, and refresh only for clients granted it at consent. Your dd_sk_ secret keys are never exposed to agents — the MCP endpoint does not accept them. Grants are per-user, per-client, scope-limited, and revocable instantly from the dashboard.