> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dnzwithazee.com/llms.txt
> Use this file to discover all available pages before exploring further.

# MCP server

> Run DNZ's MCP server over stdio for AI assistants, and manage the assistants signed in over OAuth.

`dnz mcp` is DNZ's [MCP](https://modelcontextprotocol.io) server for AI assistants that start a command:
Claude Desktop, Claude Code, Cursor, VS Code. Assistants that connect to a URL use the server's `/mcp`
endpoint and sign in with OAuth instead; that endpoint is off until a superadmin turns it on. Client configs and the tool list are in
[AI assistants (MCP)](https://docs.dnzwithazee.com/integrations/ai-assistants.md).

## Serve over stdio

```bash theme={null}
dnz mcp
dnz mcp --allow-writes
DNZ_SERVER=https://dns.example.com DNZ_TOKEN=dnz_… dnz mcp
```

It reads JSON-RPC on stdin and answers on stdout (notes go to stderr), and talks to the server with the
session from `dnz login` or `--token` / `DNZ_TOKEN`, so the tools see and change what that account or
token may. History and the audit log show its changes as made through MCP.

| Option | What it does |
| - | - |
| `--allow-writes` | Also offer the tools that change DNS: create, update and delete records, create zones, clear the cache. Without it the connection is read only |
| `-s`, `--server` | The DNZ server (`DNZ_SERVER`; default: the one you signed in to last) |
| `--token` | An API token instead of the saved session (`DNZ_TOKEN`) |
| `--ca-cert` | CA certificates for a server signed by a private CA (`DNZ_CA_CERT`) |

In an assistant's config:

```json theme={null}
{
  "mcpServers": {
    "dnz": {
      "command": "dnz",
      "args": ["mcp", "--server", "https://dns.example.com"],
      "env": { "DNZ_TOKEN": "dnz_…" }
    }
  }
}
```

## Turn the endpoint on

```bash theme={null}
dnz settings mcp
dnz settings mcp on
dnz settings mcp off
```

Shows or switches the server's `/mcp` endpoint and its OAuth sign-in (superadmins). It is off by default
(`DNZ_MCP`), takes effect at once on every server of a cluster, and turning it off also shuts out the
apps already signed in. `dnz mcp` over stdio doesn't need it.

## Connected apps

```bash theme={null}
dnz mcp apps
dnz mcp revoke 3
```

`apps` lists the assistants you allowed at `/mcp`: their access (read only, or read and change), where
they return to after signing in, and when and from where they were last used. `revoke` signs one out;
it has to sign in again. Both need a normal sign-in (`dnz login`), not an API token. The same list is
under **Account → Connected apps** in the dashboard.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.