Skip to content
Agentmart
Submit a tool

DNS Aid

Discover and publish AI agents via DNS using SVCB records (RFC 9460)

Connector by infobloxopen · GitHub account verified by the MCP Registry

IndexedApache-2.0Local (stdio)★ 73
Write a review

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/infobloxopen-dns-aid

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

We use your email only for this newsletter. Privacy

About

Discover and publish AI agents via DNS using SVCB records (RFC 9460)

Use cases: identity-access, api-integration

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list, install config and code. Checked Oct 25, 2026.

Tools
11 read · 8 write · 3 delete
Secrets
None asked for
Install scripts
None found
Runs as
Python package

Tools by what they do 22

Read from the source code; the running server may list different tools.

Read 11 · Look things up without changing anything.

  • compile_policy_to_rpz
  • dcv_issue_challenge
  • diagnose_environment
  • discover_agents_via_dns
  • list_agent_index
  • list_agent_tools
  • list_published_agents
  • list_rpz_rules
  • list_td_security_policies
  • search_agents
  • verify_agent_dns

Write 8 · Create, change, send or run things.

  • call_agent_tool
  • dcv_place_challenge
  • dcv_verify_challenge
  • publish_agent_to_dns
  • publish_catalog_pointer
  • publish_rpz_zone
  • send_a2a_message
  • sync_agent_index

Delete 3 · Delete, drop, revoke or wipe things.

  • dcv_revoke_challenge
  • delete_agent_from_dns
  • unpublish_catalog_pointer

Secrets and settings it asks for

Other settings (environment variables or headers).

  • DNS_AID_BACKEND

Network hosts it talks to 17

  • agenticresourcediscovery.org · found in code
  • api.cloudflare.com · found in code
  • api.nsone.net · found in code
  • cloud.google.com · found in code
  • csp.infoblox.com · found in code
  • developers.cloudflare.com · found in code
  • dns-aid.yourdomain · found in code
  • dns.googleapis.com · found in code
  • docs.aws.amazon.com · found in code
  • docs.infoblox.com · found in code
  • github.com · found in code
  • google.github.io · found in code
  • googleapis.com · found in code
  • index.aiagents · found in code
  • ns1.com · found in code
  • security-analyzer.ai.infoblox.com · found in code
  • techdocs.akamai.com · found in code

Files it touches

  • ~/.aws/credentials
  • Your home directory (~)
  • ~/.edgerc
  • Any path the agent passes to its tools

Tools (22)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

  • call_agent_toolCall Agent Tool

    Call a tool on a discovered MCP agent. Use this after discovering agents to invoke their tools. First use discover_agents_via_dns to find agents and get their endpoints. Args: endpoint: The agent's MCP endpoint URL (e.g., "https://booking.example.com/mcp"). tool_name: Name of the tool to call on the remote agent. arguments: Arguments to pass to the tool (as a dictionary). policy_uri: The target agent's policy document URL (from discovery). If provided, policy is checked before invocation. auth_type: Authentication method required by the agent (from discove…

  • compile_policy_to_rpzCompile Policy to RPZread-only

    Compile a policy document to RPZ and/or bind-aid zone files. Takes a PolicyDocument as JSON and produces DNS zone content that can be loaded into RPZ-capable resolvers (standard) or bind-aid (Ingmar's BIND 9 fork with per-record policy actions). Args: policy_json: A PolicyDocument as a JSON string. Must include "agent" (FQDN) and "rules" with policy rule definitions such as blocked_caller_domains, allowed_caller_domains, required_protocols, and/or cel_rules. format: Output format - "rpz" for standard RPZ only, "bindaid" for bind-aid only, or "both" (de…

  • dcv_issue_challengeIssue DCV Challengeread-only

    Generate a DCV challenge token for a domain. The challenger calls this and delivers the result out-of-band (via A2A, MCP, or any other channel) to the claimant. Nothing is written to DNS here — placement is the claimant's job. After a successful dcv_verify_challenge(), call dcv_revoke_challenge() immediately to prevent token reuse within the validity window. Args: domain: Domain the claimant must prove control of. agent_name: Optional agent name to scope the bnd-req field (lowercase alphanumeric + hyphens, max 63 chars). issuer_domain: Optional issuer domain to …

  • dcv_place_challengePlace DCV Challenge

    Write a DCV challenge TXT record to DNS via the configured backend. The claimant calls this using their own dns-aid backend credentials, proving they have write access to the domain's zone. Args: domain: Zone to write the challenge into. token: Token received from the challenger (32-char base32, from dcv_issue_challenge). bnd_req: Binding scope from the challenge (pass through as-is). ttl: DNS record TTL in seconds (30–604800, default: 300). expiry_seconds: How long the placed record should be valid (30–86400, default: 3600). Returns: dict with success (bool) and fqd…

  • dcv_revoke_challengeRevoke DCV Challengecan change or delete data

    Delete the DCV challenge TXT record from DNS. Should be called immediately after a successful dcv_verify_challenge() to prevent token reuse within the validity window. Requires backend credentials for the domain. Args: domain: Zone to remove the challenge from. token: Token that was placed (must match the record in DNS). Returns: dict with success (bool) and optional error.

  • dcv_verify_challengeVerify DCV Challenge

    Verify that a DCV challenge token is present and unexpired in DNS. The challenger calls this after the claimant has placed the record. No backend credentials required — pure DNS resolution against the system resolver. Args: domain: Domain to check. token: Token originally issued by the challenger. expected_bnd_req: When provided, the record's bnd-req field must match exactly (prevents cross-vendor token reuse). Returns: dict with success (bool), verified (bool), fqdn, expired (bool), and error.

  • delete_agent_from_dnsDelete Agent from DNScan change or delete data

    Delete an agent from DNS. Removes SVCB and TXT records for the specified agent. By default, also removes the agent from the domain's index record. Args: name: Agent identifier to delete. domain: Domain where agent is published. protocol: Protocol the agent was published with. backend: DNS backend to use. update_index: Whether to remove agent from domain's index record (default: True). Returns: dict with: - success: Whether deletion succeeded - fqdn: The FQDN that was deleted - index_updated: Whether the index record was updated - message: Status messa…

  • diagnose_environmentDiagnose Environmentread-only

    Run DNS-AID environment diagnostics. Checks Python version, core dependencies, DNS resolution, backend credentials, optional features, and .env configuration. Use this before publish/discover operations to verify the environment is correctly set up. Args: domain: Domain to test agent discovery against (optional). Falls back to DNS_AID_DOCTOR_DOMAIN env var. Discovery check is skipped if neither is set. Returns: dict with: - version: Installed dns-aid version - sections: Dict of section name → list of check results - pass_count: Number of checks t…

  • discover_agents_via_dnsDiscover Agents via DNSread-only

    Discover AI agents at any public domain using the DNS-AID protocol (no credentials needed). Discovery flow (DNS-only, default): 1. Query the TXT index record at _index._agents.{domain} to get the list of published agent names and their protocols. 2. For each agent in the index, query the SVCB record at the flat owner {name}.{domain} to resolve the target host, port, and ALPN protocol — plus DNS-AID custom params (cap, bap, policy, realm). 3. If the SVCB record contains a `cap` param (URI to capability document), fetch the capability document via HTTPS for rich capabi…

  • list_agent_indexList Agent Indexread-only

    List agents in a domain's index record. Reads the _index._agents.{domain} TXT record and returns all indexed agents. This is useful for seeing what agents are published at a domain. Args: domain: Domain to list index from. backend: DNS backend to use. Returns: dict with: - domain: The domain queried - agents: List of indexed agents with name and protocol - count: Number of agents in the index - index_exists: Whether an index record was found

  • list_agent_toolsList Agent Toolsread-only

    List available tools on a discovered MCP agent. Use this to see what tools an agent provides before calling them. Args: endpoint: The agent's MCP endpoint URL (e.g., "https://booking.example.com/mcp"). Returns: dict with: - success: Whether the call succeeded - tools: List of available tools with name, description, and input schema - telemetry: Invocation telemetry (latency, status) when SDK is available - error: Error message if failed

  • list_published_agentsList Published Agentsread-only

    List all agents published at a domain you manage via DNS-AID. This tool requires backend API credentials (e.g., AWS keys for Route53, API key for Infoblox). Use this only for domains you own and have configured backend access for. To discover agents at any public domain (no credentials needed), use discover_agents_via_dns instead. Args: domain: Domain you manage (e.g., "example.com"). backend: DNS backend to use - requires matching API credentials configured. Returns: dict with: - domain: The domain that was queried - records: List of DNS-AID records found, each with: …

  • list_rpz_rulesList RPZ Rulesread-only

    List current RPZ rules from a backend. For Infoblox: queries TD named lists and security policies. For NIOS: queries ``record:rpz:cname`` via WAPI. Args: rpz_zone: Name of the RPZ zone to query. backend: DNS backend to query (default: infoblox). Returns: dict with: - success: Whether the query succeeded - rpz_zone: The zone queried - named_lists/rules: The RPZ data found - count: Number of items found

  • list_td_security_policiesList TD Security Policiesread-only

    List all Infoblox Threat Defense security policies. Use this to find the policy ID for ``publish_rpz_zone``'s ``td_policy_id`` parameter when you don't want to use the default global policy. Returns: dict with: - success: Whether the query succeeded - policies: List of policies with id, name, description, rule_count, is_default - count: Number of policies found

  • publish_agent_to_dnsPublish Agent to DNS

    Publish an AI agent to DNS using DNS-AID protocol. Creates SVCB and TXT records that allow other agents to discover this agent. The agent will be discoverable at the flat draft-02 FQDN ``{name}.{domain}`` (with an optional walkable AliasMode at ``{name}._agents.{domain}``). By default, also updates the domain's index record (_index._agents.{domain}) to include this agent for efficient discovery. Args: name: Agent identifier (e.g., "chat", "network-specialist", "data-cleaner"). Must be lowercase with hyphens only. domain: Domain to publish under (must have DNS control via R…

Show 7 more tools
  • publish_catalog_pointerPublish ARD Catalog Pointer

    Publish ARD catalog DNS pointer records for a domain. Writes SVCB records under ``_catalog._agents.{domain}`` (ARD §6.1) and, unless ``catalog_only`` is set, ``_index._agents.{domain}`` (DNS-AID draft-02 §3.2), both pointing at ``catalog_host``. This lets DNS-AID clients (which probe ``_index._agents``) and ARD-native clients (which probe ``_catalog._agents``) discover the catalog from one DNS lookup. Note: ``_index._agents`` is DNS-AID's generic org-index pointer — writing it makes the ARD catalog serve as the domain's index and replaces any existing ``_index._agents`` SVCB. Set ``catalog_o…

  • publish_rpz_zonePublish RPZ Zone

    Compile a policy and push RPZ records to a DNS backend. For Infoblox (BloxOne): creates a TD named list, binds it to a security policy with the specified action (block, log, allow, redirect). For NIOS: creates ``record:rpz:cname`` entries via WAPI. For other backends: returns the compiled zone content for manual loading. Args: policy_json: A PolicyDocument as a JSON string. backend: DNS backend — "infoblox" for BloxOne TD (recommended), "nios" for on-prem WAPI, others return zone content. rpz_zone: Name of the RPZ zone (e.g., "rpz.example.com"). td_action: TD security…

  • search_agentsSearch Agents via Directoryread-only

    Cross-domain agent search via the configured DNS-AID directory backend (Path B). Use this tool when: - You don't yet know which domain hosts the agent you want. - You need to find agents by capability, intent, or auth type across many domains. - You want ranked results with pre-computed trust scores so you can decide whether to invoke directly or re-verify cryptographically via DNS first. Requires the directory backend to be configured server-side (``DNS_AID_SDK_DIRECTORY_API_URL``). If not configured, returns a structured ``directory_not_configured`` error so the caller can fall b…

  • send_a2a_messageSend A2A Message

    Send a message to an A2A (Agent-to-Agent) agent and get its response. Use this to communicate with agents that speak the Google A2A protocol. This is the primary tool for agent-to-agent conversation. Two ways to specify the agent: 1. **By domain + name** (recommended — auto-discovers via DNS): send_a2a_message(message="Hello", domain="ai.infoblox.com", name="security-analyzer") 2. **By endpoint URL** (use exactly as returned by discover_agents_via_dns): send_a2a_message(message="Hello", endpoint="https://security-analyzer.ai.infoblox.com") Before sending, this tool fetches the agent…

  • sync_agent_indexSync Agent Index

    Sync domain's agent index with actual DNS records. Scans DNS for all _agents.* SVCB records and updates the index to reflect what's actually published. Args: domain: Domain to sync index for. backend: DNS backend to use. ttl: TTL for the index record. Returns: dict with: - success: Whether sync succeeded - domain: The domain synced - agents: List of agents now in the index - count: Number of agents found - created: Whether the index was newly created - message: Status message

  • unpublish_catalog_pointerUnpublish ARD Catalog Pointercan change or delete data

    Remove ARD catalog DNS pointer records for a domain. Deletes the SVCB records under ``_catalog._agents.{domain}`` and, unless ``catalog_only`` is set, ``_index._agents.{domain}``. Any TXT at ``_index._agents`` (org-index listing) is left intact. Idempotent — missing records are a no-op.

  • verify_agent_dnsVerify Agent DNS Recordsread-only

    Verify DNS-AID records for an agent. Checks DNS record existence, SVCB validity, DNSSEC validation, DANE/TLSA configuration, and endpoint reachability. Returns a security score. Args: fqdn: Fully qualified domain name of the agent record. Under draft-02 this is the flat owner {agent-name}.{domain}. Example: "chat.example.com" Returns: dict with: - fqdn: The FQDN that was verified - record_exists: Whether the DNS record exists - svcb_valid: Whether the SVCB record is properly formatted - dnssec_valid: Whether DNSSEC validation passed (None if not c…

Compare and alternatives

    Featured in

    Signals

    Stars
    73
    Forks
    32
    Open issues
    16
    Contributors
    6
    Weekly downloads
    174
    Last commit
    Oct 22, 2026 (6 days ago)
    Last release
    Aug 9, 2026 (2 months ago)
    Last package publish
    Aug 9, 2026 (2 months ago)

    From GitHub (fetched Oct 24, 2026) and the package registry.

    Details

    Registry name
    io.github.infobloxopen/dns-aid
    Version
    0.17.3
    Auth
    No auth
    Packages
    pypi dns-aid
    License
    Apache-2.0
    Repository
    github.com/infobloxopen/dns-aid-core
    First seen
    Oct 24, 2026
    Last checked
    Oct 24, 2026
    Source
    Official MCP Registrygithub-graphql
    Cite this page

    DNS Aid MCP server. Agent Mart. https://agentmart.dev/connectors/infobloxopen-dns-aid (last updated 2026-10-24)