Connecting an AI assistant

This platform speaks the Model Context Protocol, so an AI assistant can read and manage your DNS filtering directly — with access you grant explicitly and can withdraw at any moment.

The usual way: let the assistant authorise itself

Point your client at the endpoint. It will discover the authorisation server, register itself, and open your browser so you can approve it. Nothing is copied by hand.

claude mcp add --transport http decloudus-dns https://api.decloudus.com/mcp

Clients that run on your own machine work without any setup on our side: they redirect to a loopback address, which is always permitted. Hosted clients redirect to their own domain, which has to be on our allowlist — ask if yours is not. Native apps using a private-use URI scheme are supported for: claude://, cursor://, vscode:// .

The fallback: a token you paste in

For a client that cannot open a browser — a script, or anything without a callback we permit — create a connection in Account › AI Connections and paste the token it gives you. It is shown once.

Authorization: Bearer <your token>

What you are granting

You choose at the moment you approve, not the assistant. Two things are decided:

• View only — read profiles, rules, schedules and query history. The assistant cannot see any tool that changes something; they do not exist for that connection.
• View and change — the above, plus creating and changing profiles, rules and schedules, and deleting query history.
• Which profiles — all of them, or a named few. A profile outside the list is indistinguishable from one that does not exist.

Limits

• 60 calls a minute per connection, and 30 writes a minute.
• 20 destructive calls per hour — deletion is rare and never bursty.
• 10 query-log searches a minute, capped at 100 rows each.
• Access tokens last 60 minutes and refresh automatically. Revoking a connection stops it on its next call.

Deleting things

Tools that destroy something require the profile's full hostname to be passed back as confirmation. The assistant has to have read the profile to know it, so a deletion cannot come from a guessed identifier — and you see the hostname in the call before approving it.

Managing what is connected

Account › AI Connections lists everything currently authorised, what each may do, and which profiles it can reach. Revoking takes one click and takes effect immediately, even mid-conversation.

The REST API this is built on is documented at /developer.