Connect dremaxx to your AI
One token, one config file, done.
dremaxx exposes every module as a Model Context Protocol (MCP) server. Connect any MCP-capable client and let it manage zones, records, DynDNS hostnames and monitoring checks for you — with exactly the permissions you grant.
One server per module
Each module has its own endpoint and its own token. Only wire up the modules you actually need.
| Module | Endpoint | Tools |
|---|---|---|
| DNS Toolsno token | https://dremaxx.de/api/mcp/dns-tools | 10 |
| DNS Hosting | https://dremaxx.de/api/mcp/dns-hosting | 17 |
| DynDNS | https://dremaxx.de/api/mcp/dyn-dns | 11 |
| Monitoring | https://dremaxx.de/api/mcp/monitoring | 25 |
| Account | https://dremaxx.de/api/mcp/user | 12 |
The DNS Tools are pure diagnostics against the public DNS — they read no account data at all. That endpoint is therefore open and can be wired up without signing up:
1claude mcp add --transport http dremaxx-dns-tools https://dremaxx.de/api/mcp/dns-toolsAll endpoints speak Streamable HTTP. Apart from the DNS Tools they expect the token in the Authorization header. There is no OAuth flow — a personal access token is all it takes.
For the DNS Tools a token is optional but useful: without one a caller is identified by IP, which many people share behind NAT. A token with the dns-tools:read scope puts the caller straight into the highest priority tier — worth doing for anything running unattended or on a schedule.
Create an access token
The token decides what your AI is allowed to do. It is stored as a hash only and shown exactly once after creation.
Store the token in an environment variable rather than writing it into a config file. That keeps the file safe to commit to a repository.
Create a token in the consoleConnect your client
Every example uses the DNS hosting module. For further modules simply add another entry with the matching endpoint and token.
Claude Code
Place the file in your project root. On the next start Claude Code asks once to approve the server.
File.mcp.json
1{
2 "mcpServers": {
3 "dremaxx-dns-hosting": {
4 "type": "http",
5 "url": "https://dremaxx.de/api/mcp/dns-hosting",
6 "headers": { "Authorization": "Bearer ${DREMAXX_DNS_PAT}" }
7 }
8 }
9}Alternatively from the command line, without a file:
1claude mcp add --transport http dremaxx-dns-hosting \
2 https://dremaxx.de/api/mcp/dns-hosting \
3 --header "Authorization: Bearer $DREMAXX_DNS_PAT"Verify the connection with the /mcp command — the server has to show up as “connected”.
VS Code (GitHub Copilot)
VS Code uses its own “servers” section and can prompt for the token on first start instead of storing it in the file.
File.vscode/mcp.json
1{
2 "servers": {
3 "dremaxx-dns-hosting": {
4 "type": "http",
5 "url": "https://dremaxx.de/api/mcp/dns-hosting",
6 "headers": { "Authorization": "Bearer ${input:dremaxx-dns-pat}" }
7 }
8 },
9 "inputs": [
10 {
11 "id": "dremaxx-dns-pat",
12 "type": "promptString",
13 "description": "dremaxx DNS Hosting token",
14 "password": true
15 }
16 ]
17}Then open the chat view in agent mode; the tools appear in the tool picker.
Cursor
Per project in .cursor/mcp.json or globally in ~/.cursor/mcp.json.
File.cursor/mcp.json
1{
2 "mcpServers": {
3 "dremaxx-dns-hosting": {
4 "url": "https://dremaxx.de/api/mcp/dns-hosting",
5 "headers": { "Authorization": "Bearer ${env:DREMAXX_DNS_PAT}" }
6 }
7 }
8}Cursor resolves ${env:...} from your environment.
Windsurf
For remote servers Windsurf expects the field serverUrl instead of url.
File~/.codeium/windsurf/mcp_config.json
1{
2 "mcpServers": {
3 "dremaxx-dns-hosting": {
4 "serverUrl": "https://dremaxx.de/api/mcp/dns-hosting",
5 "headers": { "Authorization": "Bearer ${env:DREMAXX_DNS_PAT}" }
6 }
7 }
8}After saving, reload the MCP servers in Cascade.
Zed
Add it to your Zed settings under context_servers.
Filesettings.json
1{
2 "context_servers": {
3 "dremaxx-dns-hosting": {
4 "url": "https://dremaxx.de/api/mcp/dns-hosting",
5 "headers": { "Authorization": "Bearer <TOKEN>" }
6 }
7 }
8}Without an Authorization header Zed falls back to an OAuth flow, which dremaxx does not offer — so the token belongs in the configuration.
Claude Desktop
Claude Desktop is not configured through a file but through the interface: Settings → Connectors → “Add custom connector”. Enter the endpoint there and add a request header “Authorization” with the value “Bearer <your-token>”.
Header authentication for custom connectors is still in beta at Anthropic and may not be available in every account.
Any other MCP client
Nothing special is required: a Streamable HTTP transport, the endpoint URL and an Authorization header. Whether the connection works can be checked on the command line, independently of any client.
1curl -sS -X POST https://dremaxx.de/api/mcp/dns-hosting \
2 -H "Authorization: Bearer $DREMAXX_DNS_PAT" \
3 -H "Content-Type: application/json" \
4 -H "Accept: application/json, text/event-stream" \
5 -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'If that call returns the tool list, the problem is with the client rather than with the token or the endpoint.
When it does not work right away
401 – “A Dremaxx personal access token is required”
The Authorization header is missing entirely. Usually the environment variable is not set in the running process: the client has to be restarted after setting it, a window reload is not enough.
401 – “Invalid personal access token”
The token is wrong, revoked or expired. A valid token is 88 characters long and starts with “drx_pat.”. The most common cause is a placeholder copied by accident or a trailing newline.
403 – “insufficient scope”
The token carries too few permissions for that module. A read token cannot create records. Revoke it and create a new one at the right level.
The client shows no tools
Almost always the config file was not re-read. Quit the client completely and start it again, then check the client’s server list.
What your AI can do — and what it cannot
The same rules as the console
A tool call runs through exactly the same permission checks, the same quotas and the same audit log as a click in the console. A client can never reach more than you could yourself through the interface.
Permissions per module
Every token carries a level per module: read, write or full access. A monitoring token cannot touch your DNS zones.
Deletion requires confirmation
Tools that remove data irreversibly or act on the outside world refuse to run without an explicit confirmation in the call.
Revocable at any time
One click in your profile ends the access immediately. The same overview shows when a token was last used.