DNSFilter

OCI · GHCR.IO/WYRE-AI/DNSFILTER-MCP:V1.0.0 · SCANNED SEP 21

MCP server for DNSFilter's DNS security/filtering API.

Available components

oci · ghcr.io/wyre-ai/dnsfilter-mcp:v1.0.0 36

36 36 Trust /100

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security0

Malware scan not yet available for this package.Unverified
Known CVEs could not be checked: this artifact ships no SBOM, so there is no dependency list to read. Publishing one would let us assess it.Unverified
Install-script risk not yet assessed.Unverified
Dependency health could not be checked: this artifact ships no SBOM, so there is no dependency list to read. Publishing one would let us assess it.Unverified

Provenance & Transparency32

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
License check failed: the license (NOASSERTION) isn't a recognized OSI-approved license. See how to fix → Fail
Actively maintained (last published 0 days ago).Pass
Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail

Schema Quality & AI Usability62

AI-judged instruction clarity (excellent).Pass
Context-footprint check failed: tool/resource definitions use about 16922 tokens (~296/item across 57 items; 57 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management0

Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified

Tool Coverage100

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
100% of tool parameters carry a description.Pass

Tool Safety100

No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
We read all 57 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
An AI judge read all 57 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass

Capabilities100

Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Unverified: 2 categories

Categories scored 0 because we could not verify them: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

Install

How do I install the DNSFilter MCP server?

DNSFilter runs locally as a container image, launched with docker run --rm -i ghcr.io/wyre-ai/dnsfilter-mcp:v1.0.0. Ready-made configuration for Claude, Cursor, VS Code, Codex and 3 more is on this page, copied from each client's own documentation.

oci · ghcr.io/wyre-ai/dnsfilter-mcp:v1.0.0

Claude Cursor VS Code Codex opencode Hermes Netclaw Other

# add to Claude Code

claude mcp add wyre-ai-dnsfilter-mcp -- docker run --rm -i ghcr.io/wyre-ai/dnsfilter-mcp:v1.0.0

// .cursor/mcp.json

{
  "mcpServers": {
    "wyre-ai-dnsfilter-mcp": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "ghcr.io/wyre-ai/dnsfilter-mcp:v1.0.0"
      ]
    }
  }
}

// .vscode/mcp.json

{
  "servers": {
    "wyre-ai-dnsfilter-mcp": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "ghcr.io/wyre-ai/dnsfilter-mcp:v1.0.0"
      ]
    }
  }
}

# add to Codex CLI

codex mcp add wyre-ai-dnsfilter-mcp -- docker run --rm -i ghcr.io/wyre-ai/dnsfilter-mcp:v1.0.0

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "wyre-ai-dnsfilter-mcp": {
      "type": "local",
      "command": [
        "docker",
        "run",
        "--rm",
        "-i",
        "ghcr.io/wyre-ai/dnsfilter-mcp:v1.0.0"
      ],
      "enabled": true
    }
  }
}

# ~/.hermes/config.yaml

mcp_servers:
  wyre-ai-dnsfilter-mcp:
    command: "docker"
    args: ["run", "--rm", "-i", "ghcr.io/wyre-ai/dnsfilter-mcp:v1.0.0"]

// ~/.netclaw/config/netclaw.json

{
  "McpServers": {
    "wyre-ai-dnsfilter-mcp": {
      "Transport": "stdio",
      "Command": "docker",
      "Arguments": [
        "run",
        "--rm",
        "-i",
        "ghcr.io/wyre-ai/dnsfilter-mcp:v1.0.0"
      ]
    }
  }
}

// mcp.json

{
  "mcpServers": {
    "wyre-ai-dnsfilter-mcp": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "ghcr.io/wyre-ai/dnsfilter-mcp:v1.0.0"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

20 Sept 26 36

First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 21 Sept 2026 · Analysed oci/ghcr.io/wyre-ai/dnsfilter-mcp:v1.0.0

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result	No attestation
Ecosystem	oci
Reason	No attestation published

Background: How many MCP packages publish verified provenance →

MCP tools · 57 exposed · ~16,922 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens

dnsfilter_get_application_category ~47

Get one application category's details. Requires an application category ID from dnsfilter_list_application_categories.

Input Output Examples

Name	Type	Req	Description
id	number	yes	Application category ID, from dnsfilter_list_application_categories.

No output schema declared.

No examples provided.

dnsfilter_get_application_policies ~93

Get which policies in an organization allow or block a specific application. Requires an application ID and organization ID.

Input Output Examples

Name	Type	Req	Description
application_id	number	yes	Application ID to look up.
name	string	–	Filter to policies whose name matches (or partially matches).
organization_id	number	yes	Organization ID to scope the search to.
policy_ids	array	–	Limit the search to these policy IDs.

No output schema declared.

No examples provided.

dnsfilter_get_block_page ~81

Get one custom block page's configuration: branding (org name, logo), contact email, and appearance settings. Requires a block page ID from dnsfilter_list_block_pages.

Input Output Examples

Name	Type	Req	Description
id	number	yes	Block page ID, from dnsfilter_list_block_pages.
include_relationships	boolean	–	Include related resources in the response. Defaults to true.

No output schema declared.

No examples provided.

dnsfilter_get_category ~49

Get one content category's details and hierarchy (parent/child categories). Requires a category ID from dnsfilter_list_categories.

Input Output Examples

Name	Type	Req	Description
id	number	yes	Category ID, from dnsfilter_list_categories.

No output schema declared.

No examples provided.

dnsfilter_get_network ~64

Get one network's basic information. Requires a network ID from dnsfilter_list_networks.

Input Output Examples

Name	Type	Req	Description
count_network_ips	boolean	–	Include a count of associated IP addresses. Defaults to false.
id	number	yes	Network ID, from dnsfilter_list_networks.

No output schema declared.

No examples provided.

dnsfilter_get_networks_geo ~45

Get every visible network's geo/location metadata only (name, lat/long, physical address) - a lighter-weight variant of dnsfilter_list_networks for mapping.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

dnsfilter_get_organization ~64

Get one organization's basic information. Requires an organization ID from dnsfilter_list_organizations.

Input Output Examples

Name	Type	Req	Description
id	number	yes	Organization ID, from dnsfilter_list_organizations.
include_current_mrr	boolean	–	Include current MRR (monthly recurring revenue) information.

No output schema declared.

No examples provided.

dnsfilter_get_organization_settings ~80

Get organization-level settings, optionally scoped to a specific organization or MSP.

Input Output Examples

Name	Type	Req	Description
msp_id	number	–	MSP ID to scope to.
name	string	–	Filter by organization name.
organization_id	number	–	Organization ID to scope to.
organization_ids	string	–	Comma-separated organization IDs to scope to.

No output schema declared.

No examples provided.

dnsfilter_get_organization_usage ~132

Get usage information (plan, term, user/wifi counts, total requests, estimated users) for an organization over a date range. Maximum range is 365 days. Requires an organization ID from dnsfilter_list_organizations.

Input Output Examples

Name	Type	Req	Description
from	string	yes	Range start date, ISO 8601 (e.g. "2026-08-01").
id	number	yes	Organization ID, from dnsfilter_list_organizations.
to	string	yes	Range end date, ISO 8601 (e.g. "2026-09-01"). Maximum range is 365 days.

No output schema declared.

No examples provided.

dnsfilter_get_organization_usage_detailed ~125

Get the detailed (per-metric) breakdown of an organization's usage over a date range. Maximum range is 365 days. Requires an organization ID from dnsfilter_list_organizations.

Input Output Examples

Name	Type	Req	Description
from	string	yes	Range start date, ISO 8601 (e.g. "2026-08-01").
id	number	yes	Organization ID, from dnsfilter_list_organizations.
to	string	yes	Range end date, ISO 8601 (e.g. "2026-09-01"). Maximum range is 365 days.

No output schema declared.

No examples provided.

dnsfilter_get_policy ~90

Get one policy's full configuration: allow/block domain lists, allow/block category rules, allowed/blocked applications, and which networks it's assigned to. Requires a policy ID from dnsfilter_list_policies.

Input Output Examples

Name	Type	Req	Description
id	number	yes	Policy ID, from dnsfilter_list_policies.
include_relationships	boolean	–	Include related resources (organization, networks) in the response. Defaults to true.

No output schema declared.

No examples provided.

dnsfilter_get_policy_permissive_mode ~60

Get whether a policy currently has permissive (monitor-only, non-blocking) mode enabled. Requires a policy ID from dnsfilter_list_policies.

Input Output Examples

Name	Type	Req	Description
id	number	yes	Policy ID, from dnsfilter_list_policies.

No output schema declared.

No examples provided.

dnsfilter_get_qps ~488

Queries-per-second time series - the closest thing to a live traffic pulse.

Input Output Examples

Name	Type	Req	Description
agent_ids	string	–	Comma-separated user-agent (client) UUIDs. Defaults to all.
agent_types	string	–	Comma-separated agent/client types.
application_ids	string	–	Comma-separated application IDs to filter to.
bucket_size	string	–	Time-bucket size: 'auto' (default), '15min', or '1day'. Auto picks 15min for a <24h range and 1day for a >=24h range.
collection_ids	string	–	Comma-separated collection (roaming-client group) IDs.
from	string	–	Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago.
mac_addresses	string	–	Comma-separated MAC addresses to filter to.
msp_id	number	–	MSP ID to scope the report to.
nat_ips	string	–	Comma-separated NAT IP addresses to filter to.
network_ids	string	–	Comma-separated network (site) IDs. Defaults to all.
organization_ids	string	–	Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403.
private_ip	string	–	Filter to a specific private/internal IP address.
private_ip_from	string	–	Lower bound of a private/internal IP address range.
private_ip_to	string	–	Upper bound of a private/internal IP address range.
security_report	string	–	Threat-only report. 'all' returns both threats and non-threats.
show_individual_networks	boolean	–	Group results by individual network ID. Defaults to false.
source	string	–	Comma-separated traffic source. Defaults to all.
to	string	–	Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now.
type	string	–	Report type. Defaults to all.
user_ids	string	–	Comma-separated local user IDs. Defaults to all.

No output schema declared.

No examples provided.

dnsfilter_get_qps_active_agents ~400

Queries-per-second broken out by active client/agent.

Input Output Examples

Name	Type	Req	Description
agent_ids	string	–	Comma-separated user-agent (client) UUIDs. Defaults to all.
agent_types	string	–	Comma-separated agent/client types.
application_ids	string	–	Comma-separated application IDs to filter to.
collection_ids	string	–	Comma-separated collection (roaming-client group) IDs.
from	string	–	Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago.
mac_addresses	string	–	Comma-separated MAC addresses to filter to.
nat_ips	string	–	Comma-separated NAT IP addresses to filter to.
network_ids	string	–	Comma-separated network (site) IDs. Defaults to all.
organization_ids	string	–	Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403.
private_ip	string	–	Filter to a specific private/internal IP address.
private_ip_from	string	–	Lower bound of a private/internal IP address range.
private_ip_to	string	–	Upper bound of a private/internal IP address range.
security_report	string	–	Threat-only report. 'all' returns both threats and non-threats.
source	string	–	Comma-separated traffic source. Defaults to all.
to	string	–	Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now.
type	string	–	Report type. Defaults to all.
user_ids	string	–	Comma-separated local user IDs. Defaults to all.

No output schema declared.

No examples provided.

dnsfilter_get_qps_active_organizations ~415

Queries-per-second broken out by active organization.

Input Output Examples

Name	Type	Req	Description
agent_ids	string	–	Comma-separated user-agent (client) UUIDs. Defaults to all.
agent_types	string	–	Comma-separated agent/client types.
application_ids	string	–	Comma-separated application IDs to filter to.
collection_ids	string	–	Comma-separated collection (roaming-client group) IDs.
from	string	–	Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago.
mac_addresses	string	–	Comma-separated MAC addresses to filter to.
msp_id	number	–	MSP ID to scope the report to.
nat_ips	string	–	Comma-separated NAT IP addresses to filter to.
network_ids	string	–	Comma-separated network (site) IDs. Defaults to all.
organization_ids	string	–	Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403.
private_ip	string	–	Filter to a specific private/internal IP address.
private_ip_from	string	–	Lower bound of a private/internal IP address range.
private_ip_to	string	–	Upper bound of a private/internal IP address range.
security_report	string	–	Threat-only report. 'all' returns both threats and non-threats.
source	string	–	Comma-separated traffic source. Defaults to all.
to	string	–	Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now.
type	string	–	Report type. Defaults to all.
user_ids	string	–	Comma-separated local user IDs. Defaults to all.

No output schema declared.

No examples provided.

dnsfilter_get_query_logs ~623

Raw DNS query log entries - domain queried, requester, category, and allow/block result. The most granular, PII-bearing report this connector exposes.

Input Output Examples

Name	Type	Req	Description
agent_id	string	–	Comma-separated user-agent (client) UUIDs. Defaults to all.
agent_ids	string	–	Comma-separated user-agent (client) UUIDs. Defaults to all.
application_category_ids	string	–	Comma-separated application category IDs to filter to.
application_ids	string	–	Comma-separated application IDs to filter to.
category_ids	string	–	Comma-separated content-category IDs to filter to.
collection_id	string	–	Comma-separated collection (roaming-client group) IDs.
collection_ids	string	–	Comma-separated collection (roaming-client group) IDs.
domain	string	–	Filter to a specific domain.
exclude_category_ids	string	–	Comma-separated content-category IDs to exclude.
fqdn	string	–	Filter to a specific fully-qualified domain name.
from	string	–	Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago.
mac_addresses	string	–	Comma-separated MAC addresses to filter to.
nat_ips	string	–	Comma-separated NAT IP addresses to filter to.
network_id	string	–	Comma-separated network (site) IDs. Defaults to all.
network_ids	string	–	Comma-separated network (site) IDs. Defaults to all.
organization_id	number	–	Organization ID.
page	object	–	Pagination, e.g. { "number": 1, "size": 10 }. 'size' defaults to 10 (max 100).
policy_ids	string	–	Comma-separated policy IDs to filter to.
private_ip	string	–	Filter to a specific private/internal IP address.
private_ip_from	string	–	Lower bound of a private/internal IP address range.
private_ip_to	string	–	Upper bound of a private/internal IP address range.
question_type	string	–	Filter to a specific DNS question (record) type, e.g. A, AAAA, CNAME.
result	string	–	Filter to a specific query result.
security_report	string	–	Threat-only report. 'all' returns both threats and non-threats.
source	string	–	Comma-separated traffic source. Defaults to all.
to	string	–	Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now.
user_id	string	–	Comma-separated local user IDs. Defaults to all.
user_ids	string	–	Comma-separated local user IDs. Defaults to all.

No output schema declared.

No examples provided.

dnsfilter_get_top_agents ~458

Clients/agents generating the most traffic.

Input Output Examples

Name	Type	Req	Description
agent_ids	string	–	Comma-separated user-agent (client) UUIDs. Defaults to all.
agent_types	string	–	Comma-separated agent/client types.
application_ids	string	–	Comma-separated application IDs to filter to.
collection_ids	string	–	Comma-separated collection (roaming-client group) IDs.
from	string	–	Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago.
mac_addresses	string	–	Comma-separated MAC addresses to filter to.
msp_id	number	–	MSP ID to scope the report to.
name	string	–	Filter/search by name.
nat_ips	string	–	Comma-separated NAT IP addresses to filter to.
network_ids	string	–	Comma-separated network (site) IDs. Defaults to all.
organization_ids	string	–	Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403.
page	object	–	Pagination, e.g. { "number": 1, "size": 10 }. 'size' defaults to 10 (max 100).
private_ip	string	–	Filter to a specific private/internal IP address.
private_ip_from	string	–	Lower bound of a private/internal IP address range.
private_ip_to	string	–	Upper bound of a private/internal IP address range.
security_report	string	–	Threat-only report. 'all' returns both threats and non-threats.
source	string	–	Comma-separated traffic source. Defaults to all.
to	string	–	Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now.
type	string	–	Report type. Defaults to all.
user_ids	string	–	Comma-separated local user IDs. Defaults to all.

No output schema declared.

No examples provided.

dnsfilter_get_top_application_categories ~441

Application categories generating the most traffic.

Input Output Examples

Name	Type	Req	Description
agent_ids	string	–	Comma-separated user-agent (client) UUIDs. Defaults to all.
agent_types	string	–	Comma-separated agent/client types.
application_ids	string	–	Comma-separated application IDs to filter to.
collection_ids	string	–	Comma-separated collection (roaming-client group) IDs.
from	string	–	Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago.
mac_addresses	string	–	Comma-separated MAC addresses to filter to.
msp_id	number	–	MSP ID to scope the report to.
name	string	–	Filter/search by name.
network_ids	string	–	Comma-separated network (site) IDs. Defaults to all.
organization_ids	string	–	Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403.
page	object	–	Pagination, e.g. { "number": 1, "size": 10 }. 'size' defaults to 10 (max 100).
private_ip	string	–	Filter to a specific private/internal IP address.
private_ip_from	string	–	Lower bound of a private/internal IP address range.
private_ip_to	string	–	Upper bound of a private/internal IP address range.
security_report	string	–	Threat-only report. 'all' returns both threats and non-threats.
source	string	–	Comma-separated traffic source. Defaults to all.
to	string	–	Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now.
type	string	–	Report type. Defaults to all.
user_ids	string	–	Comma-separated local user IDs. Defaults to all.

No output schema declared.

No examples provided.

dnsfilter_get_top_categories ~440

Content categories generating the most traffic.

Input Output Examples

Name	Type	Req	Description
agent_ids	string	–	Comma-separated user-agent (client) UUIDs. Defaults to all.
agent_types	string	–	Comma-separated agent/client types.
application_ids	string	–	Comma-separated application IDs to filter to.
collection_ids	string	–	Comma-separated collection (roaming-client group) IDs.
from	string	–	Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago.
mac_addresses	string	–	Comma-separated MAC addresses to filter to.
msp_id	number	–	MSP ID to scope the report to.
name	string	–	Filter/search by name.
network_ids	string	–	Comma-separated network (site) IDs. Defaults to all.
organization_ids	string	–	Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403.
page	object	–	Pagination, e.g. { "number": 1, "size": 10 }. 'size' defaults to 10 (max 100).
private_ip	string	–	Filter to a specific private/internal IP address.
private_ip_from	string	–	Lower bound of a private/internal IP address range.
private_ip_to	string	–	Upper bound of a private/internal IP address range.
security_report	string	–	Threat-only report. 'all' returns both threats and non-threats.
source	string	–	Comma-separated traffic source. Defaults to all.
to	string	–	Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now.
type	string	–	Report type. Defaults to all.
user_ids	string	–	Comma-separated local user IDs. Defaults to all.

No output schema declared.

No examples provided.

dnsfilter_get_top_collections ~464

Collections (roaming-client groupings) generating the most traffic.

Input Output Examples

Name	Type	Req	Description
agent_ids	string	–	Comma-separated user-agent (client) UUIDs. Defaults to all.
agent_types	string	–	Comma-separated agent/client types.
application_ids	string	–	Comma-separated application IDs to filter to.
collection_ids	string	–	Comma-separated collection (roaming-client group) IDs.
from	string	–	Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago.
mac_addresses	string	–	Comma-separated MAC addresses to filter to.
msp_id	number	–	MSP ID to scope the report to.
name	string	–	Filter/search by name.
nat_ips	string	–	Comma-separated NAT IP addresses to filter to.
network_ids	string	–	Comma-separated network (site) IDs. Defaults to all.
organization_ids	string	–	Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403.
page	object	–	Pagination, e.g. { "number": 1, "size": 10 }. 'size' defaults to 10 (max 100).
private_ip	string	–	Filter to a specific private/internal IP address.
private_ip_from	string	–	Lower bound of a private/internal IP address range.
private_ip_to	string	–	Upper bound of a private/internal IP address range.
security_report	string	–	Threat-only report. 'all' returns both threats and non-threats.
source	string	–	Comma-separated traffic source. Defaults to all.
to	string	–	Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now.
type	string	–	Report type. Defaults to all.
user_ids	string	–	Comma-separated local user IDs. Defaults to all.

No output schema declared.

No examples provided.

dnsfilter_get_top_domains ~472

Domains queried most often.

Input Output Examples

Name	Type	Req	Description
agent_ids	string	–	Comma-separated user-agent (client) UUIDs. Defaults to all.
agent_types	string	–	Comma-separated agent/client types.
application_ids	string	–	Comma-separated application IDs to filter to.
category_ids	string	–	Comma-separated content-category IDs to filter to.
collection_ids	string	–	Comma-separated collection (roaming-client group) IDs.
domain	string	–	Filter to a specific domain.
fqdn	string	–	Filter to a specific fully-qualified domain name.
from	string	–	Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago.
mac_addresses	string	–	Comma-separated MAC addresses to filter to.
msp_id	number	–	MSP ID to scope the report to.
network_ids	string	–	Comma-separated network (site) IDs. Defaults to all.
organization_ids	string	–	Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403.
page	object	–	Pagination, e.g. { "number": 1, "size": 10 }. 'size' defaults to 10 (max 100).
private_ip	string	–	Filter to a specific private/internal IP address.
private_ip_from	string	–	Lower bound of a private/internal IP address range.
private_ip_to	string	–	Upper bound of a private/internal IP address range.
security_report	string	–	Threat-only report. 'all' returns both threats and non-threats.
source	string	–	Comma-separated traffic source. Defaults to all.
to	string	–	Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now.
type	string	–	Report type. Defaults to all.
user_ids	string	–	Comma-separated local user IDs. Defaults to all.

No output schema declared.

No examples provided.

dnsfilter_get_top_networks ~441

Networks generating the most traffic.

Input Output Examples

Name	Type	Req	Description
agent_ids	string	–	Comma-separated user-agent (client) UUIDs. Defaults to all.
agent_types	string	–	Comma-separated agent/client types.
application_ids	string	–	Comma-separated application IDs to filter to.
collection_ids	string	–	Comma-separated collection (roaming-client group) IDs.
from	string	–	Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago.
mac_addresses	string	–	Comma-separated MAC addresses to filter to.
name	string	–	Filter/search by name.
nat_ips	string	–	Comma-separated NAT IP addresses to filter to.
network_ids	string	–	Comma-separated network (site) IDs. Defaults to all.
organization_ids	string	–	Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403.
page	object	–	Pagination, e.g. { "number": 1, "size": 10 }. 'size' defaults to 10 (max 100).
private_ip	string	–	Filter to a specific private/internal IP address.
private_ip_from	string	–	Lower bound of a private/internal IP address range.
private_ip_to	string	–	Upper bound of a private/internal IP address range.
security_report	string	–	Threat-only report. 'all' returns both threats and non-threats.
source	string	–	Comma-separated traffic source. Defaults to all.
to	string	–	Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now.
type	string	–	Report type. Defaults to all.
user_ids	string	–	Comma-separated local user IDs. Defaults to all.

No output schema declared.

No examples provided.

dnsfilter_get_top_organizations_requests ~232

Organizations generating the most request volume.

Input Output Examples

Name	Type	Req	Description
bucket_size	string	–	Time-bucket size: 'auto' (default), '15min', or '1day'. Auto picks 15min for a <24h range and 1day for a >=24h range.
from	string	–	Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago.
msp_id	number	–	MSP ID to scope the report to.
organization_id	number	–	Organization ID.
page	object	–	Pagination, e.g. { "number": 1, "size": 10 }. 'size' defaults to 10 (max 100).
to	string	–	Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now.

No output schema declared.

No examples provided.

dnsfilter_get_top_users ~457

Local users generating the most traffic.

Input Output Examples

Name	Type	Req	Description
agent_ids	string	–	Comma-separated user-agent (client) UUIDs. Defaults to all.
agent_types	string	–	Comma-separated agent/client types.
application_ids	string	–	Comma-separated application IDs to filter to.
collection_ids	string	–	Comma-separated collection (roaming-client group) IDs.
from	string	–	Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago.
mac_addresses	string	–	Comma-separated MAC addresses to filter to.
msp_id	number	–	MSP ID to scope the report to.
name	string	–	Filter/search by name.
nat_ips	string	–	Comma-separated NAT IP addresses to filter to.
network_ids	string	–	Comma-separated network (site) IDs. Defaults to all.
organization_ids	string	–	Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403.
page	object	–	Pagination, e.g. { "number": 1, "size": 10 }. 'size' defaults to 10 (max 100).
private_ip	string	–	Filter to a specific private/internal IP address.
private_ip_from	string	–	Lower bound of a private/internal IP address range.
private_ip_to	string	–	Upper bound of a private/internal IP address range.
security_report	string	–	Threat-only report. 'all' returns both threats and non-threats.
source	string	–	Comma-separated traffic source. Defaults to all.
to	string	–	Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now.
type	string	–	Report type. Defaults to all.
user_ids	string	–	Comma-separated local user IDs. Defaults to all.

No output schema declared.

No examples provided.

dnsfilter_get_total_applications_agents_stats ~429

Application request counts broken out by client/agent.

Input Output Examples

Name	Type	Req	Description
agent_ids	string	–	Comma-separated user-agent (client) UUIDs. Defaults to all.
agent_types	string	–	Comma-separated agent/client types.
application_category_ids	string	–	Comma-separated application category IDs to filter to.
application_ids	string	–	Comma-separated application IDs to filter to.
collection_ids	string	–	Comma-separated collection (roaming-client group) IDs.
from	string	–	Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago.
mac_addresses	string	–	Comma-separated MAC addresses to filter to.
name	string	–	Filter/search by name.
nat_ips	string	–	Comma-separated NAT IP addresses to filter to.
network_ids	string	–	Comma-separated network (site) IDs. Defaults to all.
organization_ids	string	–	Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403.
private_ip	string	–	Filter to a specific private/internal IP address.
private_ip_from	string	–	Lower bound of a private/internal IP address range.
private_ip_to	string	–	Upper bound of a private/internal IP address range.
security_report	string	–	Threat-only report. 'all' returns both threats and non-threats.
source	string	–	Comma-separated traffic source. Defaults to all.
to	string	–	Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now.
type	string	–	Report type. Defaults to all.
user_ids	string	–	Comma-separated local user IDs. Defaults to all.

No output schema declared.

No examples provided.

dnsfilter_get_total_applications_collections_stats ~428

Application request counts broken out by collection.

Input Output Examples

Name	Type	Req	Description
agent_ids	string	–	Comma-separated user-agent (client) UUIDs. Defaults to all.
agent_types	string	–	Comma-separated agent/client types.
application_category_ids	string	–	Comma-separated application category IDs to filter to.
application_ids	string	–	Comma-separated application IDs to filter to.
collection_ids	string	–	Comma-separated collection (roaming-client group) IDs.
from	string	–	Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago.
mac_addresses	string	–	Comma-separated MAC addresses to filter to.
name	string	–	Filter/search by name.
nat_ips	string	–	Comma-separated NAT IP addresses to filter to.
network_ids	string	–	Comma-separated network (site) IDs. Defaults to all.
organization_ids	string	–	Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403.
private_ip	string	–	Filter to a specific private/internal IP address.
private_ip_from	string	–	Lower bound of a private/internal IP address range.
private_ip_to	string	–	Upper bound of a private/internal IP address range.
security_report	string	–	Threat-only report. 'all' returns both threats and non-threats.
source	string	–	Comma-separated traffic source. Defaults to all.
to	string	–	Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now.
type	string	–	Report type. Defaults to all.
user_ids	string	–	Comma-separated local user IDs. Defaults to all.

No output schema declared.

No examples provided.

dnsfilter_get_total_applications_networks_stats ~428

Application request counts broken out by network.

Input Output Examples

Name	Type	Req	Description
agent_ids	string	–	Comma-separated user-agent (client) UUIDs. Defaults to all.
agent_types	string	–	Comma-separated agent/client types.
application_category_ids	string	–	Comma-separated application category IDs to filter to.
application_ids	string	–	Comma-separated application IDs to filter to.
collection_ids	string	–	Comma-separated collection (roaming-client group) IDs.
from	string	–	Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago.
mac_addresses	string	–	Comma-separated MAC addresses to filter to.
name	string	–	Filter/search by name.
nat_ips	string	–	Comma-separated NAT IP addresses to filter to.
network_ids	string	–	Comma-separated network (site) IDs. Defaults to all.
organization_ids	string	–	Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403.
private_ip	string	–	Filter to a specific private/internal IP address.
private_ip_from	string	–	Lower bound of a private/internal IP address range.
private_ip_to	string	–	Upper bound of a private/internal IP address range.
security_report	string	–	Threat-only report. 'all' returns both threats and non-threats.
source	string	–	Comma-separated traffic source. Defaults to all.
to	string	–	Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now.
type	string	–	Report type. Defaults to all.
user_ids	string	–	Comma-separated local user IDs. Defaults to all.

No output schema declared.

No examples provided.

dnsfilter_get_total_applications_stats ~439

Total application request counts.

Input Output Examples

Name	Type	Req	Description
agent_ids	string	–	Comma-separated user-agent (client) UUIDs. Defaults to all.
agent_types	string	–	Comma-separated agent/client types.
application_category_ids	string	–	Comma-separated application category IDs to filter to.
application_ids	string	–	Comma-separated application IDs to filter to.
collection_ids	string	–	Comma-separated collection (roaming-client group) IDs.
from	string	–	Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago.
mac_addresses	string	–	Comma-separated MAC addresses to filter to.
msp_id	number	–	MSP ID to scope the report to.
name	string	–	Filter/search by name.
nat_ips	string	–	Comma-separated NAT IP addresses to filter to.
network_ids	string	–	Comma-separated network (site) IDs. Defaults to all.
organization_ids	string	–	Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403.
private_ip	string	–	Filter to a specific private/internal IP address.
private_ip_from	string	–	Lower bound of a private/internal IP address range.
private_ip_to	string	–	Upper bound of a private/internal IP address range.
security_report	string	–	Threat-only report. 'all' returns both threats and non-threats.
source	string	–	Comma-separated traffic source. Defaults to all.
to	string	–	Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now.
type	string	–	Report type. Defaults to all.
user_ids	string	–	Comma-separated local user IDs. Defaults to all.

No output schema declared.

No examples provided.

dnsfilter_get_total_applications_users_stats ~428

Application request counts broken out by local user.

Input Output Examples

Name	Type	Req	Description
agent_ids	string	–	Comma-separated user-agent (client) UUIDs. Defaults to all.
agent_types	string	–	Comma-separated agent/client types.
application_category_ids	string	–	Comma-separated application category IDs to filter to.
application_ids	string	–	Comma-separated application IDs to filter to.
collection_ids	string	–	Comma-separated collection (roaming-client group) IDs.
from	string	–	Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago.
mac_addresses	string	–	Comma-separated MAC addresses to filter to.
name	string	–	Filter/search by name.
nat_ips	string	–	Comma-separated NAT IP addresses to filter to.
network_ids	string	–	Comma-separated network (site) IDs. Defaults to all.
organization_ids	string	–	Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403.
private_ip	string	–	Filter to a specific private/internal IP address.
private_ip_from	string	–	Lower bound of a private/internal IP address range.
private_ip_to	string	–	Upper bound of a private/internal IP address range.
security_report	string	–	Threat-only report. 'all' returns both threats and non-threats.
source	string	–	Comma-separated traffic source. Defaults to all.
to	string	–	Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now.
type	string	–	Report type. Defaults to all.
user_ids	string	–	Comma-separated local user IDs. Defaults to all.

No output schema declared.

No examples provided.

dnsfilter_get_total_categories ~464

Total content-category request counts over time.

Input Output Examples

Name	Type	Req	Description
agent_ids	string	–	Comma-separated user-agent (client) UUIDs. Defaults to all.
agent_types	string	–	Comma-separated agent/client types.
application_ids	string	–	Comma-separated application IDs to filter to.
bucket_size	string	–	Time-bucket size: 'auto' (default), '15min', or '1day'. Auto picks 15min for a <24h range and 1day for a >=24h range.
collection_ids	string	–	Comma-separated collection (roaming-client group) IDs.
from	string	–	Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago.
mac_addresses	string	–	Comma-separated MAC addresses to filter to.
msp_id	number	–	MSP ID to scope the report to.
network_ids	string	–	Comma-separated network (site) IDs. Defaults to all.
organization_ids	string	–	Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403.
private_ip	string	–	Filter to a specific private/internal IP address.
private_ip_from	string	–	Lower bound of a private/internal IP address range.
private_ip_to	string	–	Upper bound of a private/internal IP address range.
security_report	string	–	Threat-only report. 'all' returns both threats and non-threats.
show_individual_networks	boolean	–	Group results by individual network ID. Defaults to false.
source	string	–	Comma-separated traffic source. Defaults to all.
to	string	–	Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now.
type	string	–	Report type. Defaults to all.
user_ids	string	–	Comma-separated local user IDs. Defaults to all.

No output schema declared.

No examples provided.

dnsfilter_get_total_categories_organizations ~452

Total content-category request counts broken out by organization.

Input Output Examples

Name	Type	Req	Description
agent_ids	string	–	Comma-separated user-agent (client) UUIDs. Defaults to all.
agent_types	string	–	Comma-separated agent/client types.
application_ids	string	–	Comma-separated application IDs to filter to.
bucket_size	string	–	Time-bucket size: 'auto' (default), '15min', or '1day'. Auto picks 15min for a <24h range and 1day for a >=24h range.
collection_ids	string	–	Comma-separated collection (roaming-client group) IDs.
from	string	–	Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago.
mac_addresses	string	–	Comma-separated MAC addresses to filter to.
network_ids	string	–	Comma-separated network (site) IDs. Defaults to all.
organization_ids	string	–	Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403.
private_ip	string	–	Filter to a specific private/internal IP address.
private_ip_from	string	–	Lower bound of a private/internal IP address range.
private_ip_to	string	–	Upper bound of a private/internal IP address range.
security_report	string	–	Threat-only report. 'all' returns both threats and non-threats.
show_individual_organizations	boolean	–	Group results by individual organization ID. Defaults to false.
source	string	–	Comma-separated traffic source. Defaults to all.
to	string	–	Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now.
type	string	–	Report type. Defaults to all.
user_ids	string	–	Comma-separated local user IDs. Defaults to all.

No output schema declared.

No examples provided.

dnsfilter_get_total_category_stats ~182

Content-category request-count summary.

Input Output Examples

Name	Type	Req	Description
category_ids	string	–	Comma-separated content-category IDs to filter to.
from	string	–	Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago.
msp_id	number	–	MSP ID to scope the report to.
network_ids	string	–	Comma-separated network (site) IDs. Defaults to all.
organization_id	number	–	Organization ID.
to	string	–	Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now.

No output schema declared.

No examples provided.

dnsfilter_get_total_client_stats ~165

Client/agent count summary.

Input Output Examples

Name	Type	Req	Description
from	string	–	Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago.
msp_id	number	–	MSP ID to scope the report to.
network_ids	string	–	Comma-separated network (site) IDs. Defaults to all.
organization_id	number	–	Organization ID.
to	string	–	Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now.

No output schema declared.

No examples provided.

dnsfilter_get_total_deployments ~65

Deployed client/network counts.

Input Output Examples

Name	Type	Req	Description
msp_id	number	–	MSP ID to scope the report to.
network_ids	string	–	Comma-separated network (site) IDs. Defaults to all.
organization_id	number	–	Organization ID.

No output schema declared.

No examples provided.

dnsfilter_get_total_domain_stats ~202

Single-domain request-count summary - use with the domain/fqdn filter.

Input Output Examples

Name	Type	Req	Description
domain	string	–	Filter to a specific domain.
fqdn	string	–	Filter to a specific fully-qualified domain name.
from	string	–	Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago.
msp_id	number	–	MSP ID to scope the report to.
network_ids	string	–	Comma-separated network (site) IDs. Defaults to all.
organization_id	number	–	Organization ID.
to	string	–	Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now.

No output schema declared.

No examples provided.

dnsfilter_get_total_domains ~476

Total domain request counts over time.

Input Output Examples

Name	Type	Req	Description
agent_ids	string	–	Comma-separated user-agent (client) UUIDs. Defaults to all.
agent_types	string	–	Comma-separated agent/client types.
application_ids	string	–	Comma-separated application IDs to filter to.
bucket_size	string	–	Time-bucket size: 'auto' (default), '15min', or '1day'. Auto picks 15min for a <24h range and 1day for a >=24h range.
category_ids	string	–	Comma-separated content-category IDs to filter to.
collection_ids	string	–	Comma-separated collection (roaming-client group) IDs.
domain	string	–	Filter to a specific domain.
from	string	–	Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago.
mac_addresses	string	–	Comma-separated MAC addresses to filter to.
network_ids	string	–	Comma-separated network (site) IDs. Defaults to all.
organization_ids	string	–	Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403.
private_ip	string	–	Filter to a specific private/internal IP address.
private_ip_from	string	–	Lower bound of a private/internal IP address range.
private_ip_to	string	–	Upper bound of a private/internal IP address range.
security_report	string	–	Threat-only report. 'all' returns both threats and non-threats.
show_individual_networks	boolean	–	Group results by individual network ID. Defaults to false.
source	string	–	Comma-separated traffic source. Defaults to all.
to	string	–	Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now.
type	string	–	Report type. Defaults to all.
user_ids	string	–	Comma-separated local user IDs. Defaults to all.

No output schema declared.

No examples provided.

dnsfilter_get_total_domains_organizations ~480

Total domain request counts broken out by organization.

Input Output Examples

Name	Type	Req	Description
agent_ids	string	–	Comma-separated user-agent (client) UUIDs. Defaults to all.
agent_types	string	–	Comma-separated agent/client types.
application_ids	string	–	Comma-separated application IDs to filter to.
bucket_size	string	–	Time-bucket size: 'auto' (default), '15min', or '1day'. Auto picks 15min for a <24h range and 1day for a >=24h range.
category_ids	string	–	Comma-separated content-category IDs to filter to.
collection_ids	string	–	Comma-separated collection (roaming-client group) IDs.
domain	string	–	Filter to a specific domain.
from	string	–	Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago.
mac_addresses	string	–	Comma-separated MAC addresses to filter to.
network_ids	string	–	Comma-separated network (site) IDs. Defaults to all.
organization_ids	string	–	Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403.
private_ip	string	–	Filter to a specific private/internal IP address.
private_ip_from	string	–	Lower bound of a private/internal IP address range.
private_ip_to	string	–	Upper bound of a private/internal IP address range.
security_report	string	–	Threat-only report. 'all' returns both threats and non-threats.
show_individual_organizations	boolean	–	Group results by individual organization ID. Defaults to false.
source	string	–	Comma-separated traffic source. Defaults to all.
to	string	–	Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now.
type	string	–	Report type. Defaults to all.
user_ids	string	–	Comma-separated local user IDs. Defaults to all.

No output schema declared.

No examples provided.

Common questions

What is the DNSFilter MCP server?

DNSFilter is an MCP server listed in the public MCP registry as io.github.WYRE-AI/dnsfilter-mcp. MCP server for DNSFilter's DNS security/filtering API. This page covers its container image (ghcr.io/wyre-ai/dnsfilter-mcp:v1.0.0).

Is the DNSFilter MCP server safe to use?

DNSFilter scores 36 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the DNSFilter MCP server expose?

DNSFilter exposes 57 tools: dnsfilter_list_organizations, dnsfilter_get_organization, dnsfilter_get_organization_settings, dnsfilter_list_networks, dnsfilter_get_network, and 52 more. Their descriptions and schemas cost roughly 16,922 tokens of context every time the server is loaded.

Is the DNSFilter MCP server still maintained?

DNSFilter is still listed as active in the MCP registry. We last reached this channel on 21 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the DNSFilter MCP server under?

DNSFilter declares the NOASSERTION licence, which is not on the OSI-approved list. Read the terms before using it at work, and note this covers the source only, not the cost of any service it calls.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Badge

Put this score in your README. The image is served from a stable URL, updates when the score does, and links back to the evidence on this page. It shows nothing that is not already published here.

Score Verified Plain

The two-cell badge: our name, and this channel's current score out of 100.

Markdown

 [![VerifyMCP trust score for DNSFilter](https://verifymcp.io/badge/wyre-ai-dnsfilter-mcp/ghcr-io-wyre-ai-dnsfilter-mcp-v1-0-0.svg)](https://verifymcp.io/servers/wyre-ai-dnsfilter-mcp/ghcr-io-wyre-ai-dnsfilter-mcp-v1-0-0)

HTML

 <a href="https://verifymcp.io/servers/wyre-ai-dnsfilter-mcp/ghcr-io-wyre-ai-dnsfilter-mcp-v1-0-0"><img src="https://verifymcp.io/badge/wyre-ai-dnsfilter-mcp/ghcr-io-wyre-ai-dnsfilter-mcp-v1-0-0.svg" alt="VerifyMCP trust score for DNSFilter" height="20"></a>

A single cell stating that the server is listed here. Carries no number.

Markdown

 [![VerifyMCP trust score for DNSFilter](https://verifymcp.io/badge/wyre-ai-dnsfilter-mcp/ghcr-io-wyre-ai-dnsfilter-mcp-v1-0-0.svg?variant=verified)](https://verifymcp.io/servers/wyre-ai-dnsfilter-mcp/ghcr-io-wyre-ai-dnsfilter-mcp-v1-0-0)

HTML

 <a href="https://verifymcp.io/servers/wyre-ai-dnsfilter-mcp/ghcr-io-wyre-ai-dnsfilter-mcp-v1-0-0"><img src="https://verifymcp.io/badge/wyre-ai-dnsfilter-mcp/ghcr-io-wyre-ai-dnsfilter-mcp-v1-0-0.svg?variant=verified" alt="VerifyMCP trust score for DNSFilter" height="20"></a>

The score alone, tier-coloured, for a badge row that is already crowded.

Markdown

 [![VerifyMCP trust score for DNSFilter](https://verifymcp.io/badge/wyre-ai-dnsfilter-mcp/ghcr-io-wyre-ai-dnsfilter-mcp-v1-0-0.svg?variant=plain)](https://verifymcp.io/servers/wyre-ai-dnsfilter-mcp/ghcr-io-wyre-ai-dnsfilter-mcp-v1-0-0)

HTML

 <a href="https://verifymcp.io/servers/wyre-ai-dnsfilter-mcp/ghcr-io-wyre-ai-dnsfilter-mcp-v1-0-0"><img src="https://verifymcp.io/badge/wyre-ai-dnsfilter-mcp/ghcr-io-wyre-ai-dnsfilter-mcp-v1-0-0.svg?variant=plain" alt="VerifyMCP trust score for DNSFilter" height="20"></a>

Score history · last 30 days

20 Sept 21 Sept