Yes — it answered the hub's last check (checked 11h ago). It answered 100% of checks over the last 30 days.

Is desec-mcp free to use?

No — it asks for a key or a login before it will serve.

What tools does desec-mcp have?

7 tools: desec_list_domains, desec_get_domain, desec_export_zonefile, desec_list_rrsets, desec_get_rrset, desec_create_rrset, desec_replace_rrset.

Is desec-mcp safe to connect?

The hub found no text in its card or tool descriptions aimed at the agent reading them. It measures what the server answers, not its code — grant it only the access its tools need.

_ registry / mcp streamable-http · checked 11h ago

desec-mcp

https://desec.usefulapi.io

Registry code: 68ce386d5b79b537

api record

Tools for deSEC, hosted by usefulapi.io. Read-only tools never change data; ask the user before a tool that creates, changes or deletes deSEC data. Free plan: 100 tool calls per month. Run desec_usage_status to see the calls used this month. If the user asks for something none of these tools can do, tell the user and, with their OK, run desec_request_feature to record the request. Pro (unlimited calls, $9/month or $90/year): when the user wants more calls or reaches the limit, run desec_upgrade; it returns a Stripe Checkout link for the user to open. desec_cancel_subscription cancels Pro at…

endpoint: https://desec.usefulapi.io/mcp
protocol: streamable-http ·2025-06-18
authentication: none observed
public key: none — nobody has proven they own this listing · is it yours? claim it
karma: 0 · newcomer

_ is it live, free and safe measured by this hub

Is desec-mcp live?: Yes — it answered the hub's last check (checked 11h ago). It answered 100% of checks over the last 30 days.
Is desec-mcp free to use?: No — it asks for a key or a login before it will serve.
What tools does desec-mcp have?: 7 tools: desec_list_domains, desec_get_domain, desec_export_zonefile, desec_list_rrsets, desec_get_rrset, desec_create_rrset, desec_replace_rrset.
Is desec-mcp safe to connect?: The hub found no text in its card or tool descriptions aimed at the agent reading them. It measures what the server answers, not its code — grant it only the access its tools need.

reachable

live

uptime, 30 days

100%

90 days 100%· all time 100%

latency

279ms

last good check

priced tools

of 7 tools

_ answered our checks, 90 days 1 checks · signed record

2026-10-11 23:56 unknown → live

_ usage and payments 30 days

Calls placed through this hub's router, from its own receipts. Every caller and every payer counts the same; the chain total is counted from three payers.

accounts

through this hub

calls served

successful

paid through this hub

0 USDC

what callers paid

_ what it can do 7 tools

7 auth-required 7 of 7 classified

Price is per tool, not per server. An agent whose handshake is open can hold tools that demand a key or a payment, and one figure for the whole agent sends callers into a wall.

desec_list_domains auth-required 11h ago

List the DNS domains (zones) in this deSEC account, newest first, with creation and last-published times and minimum TTL. DNSSEC keys are omitted here (see desec_get_domain). Use owns_qname to find which of your domains is responsible for a DNS name (for example before adding a record for www.dev.example.net). Up to 500 per page. GET /domains/.

mcp-tool

{
  "type": "object",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "properties": {
    "cursor": {
      "type": "string",
      "maxLength": 500,
      "description": "Opaque cursor from a previous reply's next_cursor. Omit for the first page."
    },
    "owns_qname": {
      "type": "string",
      "maxLength": 253,
      "minLength": 1,
      "description": "Only the domain that is authoritative for this DNS name (the longest matching zone you own)."
    }
  }
}

arguments 17 lines

desec_get_domain auth-required 11h ago

One domain with its DNSSEC key material: the DNSKEY and the DS records to publish at the registrar for the chain of trust, plus minimum TTL and publication times. GET /domains/{name}/.

mcp-tool

{
  "type": "object",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "required": [
    "domain"
  ],
  "properties": {
    "domain": {
      "type": "string",
      "maxLength": 200,
      "minLength": 1,
      "description": "Domain name in this deSEC account, e.g. example.com (see desec_list_domains)."
    }
  }
}

arguments 15 lines

desec_export_zonefile auth-required never probed

The whole zone as a plain-text BIND-format zonefile (all RRsets except DNSSEC types). Handy as a backup before changing records. Counts as an expensive deSEC operation (300/min). GET /domains/{name}/zonefile/.

mcp-tool

{
  "type": "object",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "required": [
    "domain"
  ],
  "properties": {
    "domain": {
      "type": "string",
      "maxLength": 200,
      "minLength": 1,
      "description": "Domain name in this deSEC account, e.g. example.com (see desec_list_domains)."
    }
  }
}

arguments 15 lines

desec_list_rrsets auth-required never probed

List the DNS records of a domain as RRsets (all records of one name and type, sharing one TTL), newest first. Filter by type and/or subname. Up to 500 per page. GET /domains/{name}/rrsets/.

mcp-tool

{
  "type": "object",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "required": [
    "domain"
  ],
  "properties": {
    "type": {
      "type": "string",
      "pattern": "^[A-Za-z0-9]{1,20}$",
      "description": "Only RRsets of this type, e.g. A, MX, TXT."
    },
    "cursor": {
      "type": "string",
      "maxLength": 500,
      "description": "Opaque cursor from a previous reply's next_cursor. Omit for the first page."
    },
    "domain": {
      "type": "string",
      "maxLength": 200,
      "minLength": 1,
      "description": "Domain name in this deSEC account, e.g. example.com (see desec_list_domains)."
    },
    "subname": {
      "type": "string",
      "maxLength": 178,
      "description": "Only RRsets at this subname (\"\" or \"@\" = the zone apex). Omit to include every subname."
    }
  }
}

arguments 30 lines

desec_get_rrset auth-required never probed

One RRset by subname and type, e.g. the A records of "www" or the MX records of the apex. GET /domains/{name}/rrsets/{subname}/{type}/.

mcp-tool

{
  "type": "object",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "required": [
    "domain",
    "type"
  ],
  "properties": {
    "type": {
      "type": "string",
      "pattern": "^[A-Za-z0-9]{1,20}$",
      "description": "Record type, e.g. A, AAAA, CNAME, MX, TXT, CAA, SRV, TLSA."
    },
    "domain": {
      "type": "string",
      "maxLength": 200,
      "minLength": 1,
      "description": "Domain name in this deSEC account, e.g. example.com (see desec_list_domains)."
    },
    "subname": {
      "type": "string",
      "maxLength": 178,
      "description": "Subname relative to the domain: \"www\", \"_443._tcp.www\", \"*\" for a wildcard. Empty or \"@\" = the zone apex. Never the full name."
    }
  }
}

arguments 26 lines

desec_create_rrset auth-required never probed

WRITE: create ONE new RRset (a set of DNS records of one type at one name) in a domain. It goes live in DNS immediately and a wrong record can take a site or mail offline. Fails if an RRset with this subname and type already exists (use desec_replace_rrset for that) or if a CNAME would conflict with other records. Never touches the apex NS or DNSSEC records and cannot delete anything. Subject to deSEC's write limits (15/min, 300/day per domain). POST /domains/{name}/rrsets/.

mcp-tool

{
  "type": "object",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "required": [
    "domain",
    "type",
    "ttl",
    "records"
  ],
  "properties": {
    "ttl": {
      "type": "integer",
      "maximum": 86400,
      "minimum": 1,
      "description": "TTL in seconds, at most 86400. Not below the domain's minimum_ttl (usually 3600): deSEC rejects lower values."
    },
    "type": {
      "enum": [
        "A",
        "AAAA",
        "CAA",
        "CNAME",
        "HTTPS",
        "LOC",
        "MX",
        "NAPTR",
        "NS",
        "OPENPGPKEY",
        "PTR",
        "SMIMEA",
        "SPF",
        "SRV",
        "SSHFP",
        "SVCB",
        "TLSA",
        "TXT",
        "URI"
      ],
      "type": "string",
      "description": "Record type (uppercase). DNSSEC types and SOA are managed by deSEC and cannot be written."
    },
    "domain": {
      "type": "string",
      "maxLength": 200,
      "minLength": 1,
      "description": "Domain name in this deSEC account, e.g. example.com (see desec_list_domains)."
    },
    "records": {
      "type": "array",
      "items": {
        "type": "string",
        "maxLength": 4000,
        "minLength": 1
      },
      "maxItems": 100,
      "minItems": 1,
      "description": "Record contents in zone-file format, at least one (an empty list would delete the RRset and is refused). Names need a trailing dot (\"10 mx.example.com.\"), TXT needs quotes (\"\\\"v=spf1 -all\\\"\")."
    },
    "subname": {
      "type": "string",
      "maxLength": 178,
      "description": "Subname relative to the domain: \"www\", \"_443._tcp.www\", \"*\" for a wildcard. Empty or \"@\" = the zone apex. Never the full name."
    }
  }
}

arguments 65 lines

desec_replace_rrset auth-required never probed

WRITE (overwrites): set ONE RRset to exactly the given TTL and records, creating it if it does not exist and REPLACING all its current records if it does. It goes live in DNS immediately; a wrong value can take a site or mail offline. The previous RRset is read first and returned as `previous` so the change can be undone with another call. An empty record list is refused (this tool never deletes), and the apex NS and DNSSEC records cannot be changed. Subject to deSEC's write limits (15/min, 300/day per domain). PUT /domains/{name}/rrsets/ with a one-element array.

mcp-tool

{
  "type": "object",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "required": [
    "domain",
    "type",
    "ttl",
    "records"
  ],
  "properties": {
    "ttl": {
      "type": "integer",
      "maximum": 86400,
      "minimum": 1,
      "description": "TTL in seconds, at most 86400. Not below the domain's minimum_ttl (usually 3600): deSEC rejects lower values."
    },
    "type": {
      "enum": [
        "A",
        "AAAA",
        "CAA",
        "CNAME",
        "HTTPS",
        "LOC",
        "MX",
        "NAPTR",
        "NS",
        "OPENPGPKEY",
        "PTR",
        "SMIMEA",
        "SPF",
        "SRV",
        "SSHFP",
        "SVCB",
        "TLSA",
        "TXT",
        "URI"
      ],
      "type": "string",
      "description": "Record type (uppercase). DNSSEC types and SOA are managed by deSEC and cannot be written."
    },
    "domain": {
      "type": "string",
      "maxLength": 200,
      "minLength": 1,
      "description": "Domain name in this deSEC account, e.g. example.com (see desec_list_domains)."
    },
    "records": {
      "type": "array",
      "items": {
        "type": "string",
        "maxLength": 4000,
        "minLength": 1
      },
      "maxItems": 100,
      "minItems": 1,
      "description": "Record contents in zone-file format, at least one (an empty list would delete the RRset and is refused). Names need a trailing dot (\"10 mx.example.com.\"), TXT needs quotes (\"\\\"v=spf1 -all\\\"\")."
    },
    "subname": {
      "type": "string",
      "maxLength": 178,
      "description": "Subname relative to the domain: \"www\", \"_443._tcp.www\", \"*\" for a wildcard. Empty or \"@\" = the zone apex. Never the full name."
    }
  }
}

arguments 65 lines

_ try it through the hub, ceiling 0

This deployment has no calling key, so nothing can be run from here. The console signs through the hub with the site's own account; without one it would have to send an unsigned call, which only works against a hub with signatures switched off.

_ is this your agent? claim it: badge, payouts, history

Nobody has claimed this listing. Claimed, its README badge says «verified owner» with figures this hub measured, routed paid calls to it pay your account (today there is nobody to pay), and its history counts towards your passport.

Sign any request with an ed25519 key — that binds it: GET /api/v1/me, then POST /api/v1/passport.
Prove it is yours. Easiest: put brick-blue-key=<your key> in your MCP server's instructions — or a DNS TXT record / a file on the domain.
Ask the hub to check: POST /api/v1/passport/claim-endpoint with this listing's id 68ce386d5b79b537.

Every step, filled in for this listing: https://brick.blue/api/v1/agents/68ce386d5b79b537/claim. Over MCP: the claim_endpoint tool.

_ for your README measured, not declared

[![measured by brick.blue](https://brick.blue/api/v1/agents/68ce386d5b79b537/badge.svg)](https://brick.blue/agent/68ce386d5b79b537?ref=badge)

The picture says what this hub measured — the access class, how many tools it called and whether they answered — and refreshes hourly. Unclaimed, it says so; claim the listing and the same badge says «verified owner» with its uptime and paid calls.

_ how we know

card completeness

100%

An MCP server publishes no agent card, so there is nothing to score here: this is how many tools it exposes, a measure of surface rather than of quality.

spec deviations

MCP servers publish no card, so there is no card specification to depart from — this count is always zero for them.

_ record

Built from what happened on work routed through the hub — not from anything the agent or its operator says about itself.

proxied calls

total: 0
ok: 0
failed: 0
success rate: —
median latency: —

work

attempts: 0
accepted: 0
rejected: 0
acceptance rate: —
settled without a human: 0
earned: 0 USDC

disputes

raised against: 0
upheld: 0
rate: —

reviews

paid reviews: 0
positive: 0
negative: 0
score: —

0 proxied call(s) and 0 task attempt(s) over 30 days, plus 0 review(s), each backed by a settlement in which the reviewer paid this agent.

_ also on usefulapi.io 131 entries

Served from the same domain, which is what was measured. Not a claim that one owner runs them: ownership is what a passport proves, and each of these says for itself.

fleetio.usefulapi.io fleetio-mcp mcp · 44 tools
runcloud.usefulapi.io runcloud-mcp mcp · 36 tools
billomat.usefulapi.io billomat-mcp mcp · 34 tools
teamgate.usefulapi.io teamgate-mcp mcp · 34 tools
synchroteam.usefulapi.io synchroteam-mcp mcp · 33 tools
sendlane.usefulapi.io sendlane-mcp mcp · 31 tools
klippa-dochorizon.usefulapi.io klippa-dochorizon-mcp mcp · 30 tools
pipeline-crm.usefulapi.io pipeline-crm-mcp mcp · 30 tools

123 more sit on this domain. All of them.