DNSFilter

OCI · GHCR.IO/WYRE-AI/DNSFILTER-MCP:V1.0.0 · SCANNED SEP 21

MCP server for DNSFilter's DNS security/filtering API.

Available components

oci · ghcr.io/wyre-ai/dnsfilter-mcp:v1.0.0 36

36 36 Trust /100

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security0

Malware scan not yet available for this package.Unverified
Known CVEs could not be checked: this artifact ships no SBOM, so there is no dependency list to read. Publishing one would let us assess it.Unverified
Install-script risk not yet assessed.Unverified
Dependency health could not be checked: this artifact ships no SBOM, so there is no dependency list to read. Publishing one would let us assess it.Unverified

Provenance & Transparency32

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
License check failed: the license (NOASSERTION) isn't a recognized OSI-approved license. See how to fix → Fail
Actively maintained (last published 0 days ago).Pass
Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail

Schema Quality & AI Usability62

AI-judged instruction clarity (excellent).Pass
Context-footprint check failed: tool/resource definitions use about 16922 tokens (~296/item across 57 items; 57 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management0

Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified

Tool Coverage100

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
100% of tool parameters carry a description.Pass

Tool Safety100

No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
We read all 57 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
An AI judge read all 57 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass

Capabilities100

Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Unverified: 2 categories

Categories scored 0 because we could not verify them: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

Install

How do I install the DNSFilter MCP server?

DNSFilter runs locally as a container image, launched with docker run --rm -i ghcr.io/wyre-ai/dnsfilter-mcp:v1.0.0. Ready-made configuration for Claude, Cursor, VS Code, Codex and 3 more is on this page, copied from each client's own documentation.

oci · ghcr.io/wyre-ai/dnsfilter-mcp:v1.0.0

Claude Cursor VS Code Codex opencode Hermes Netclaw Other

# add to Claude Code

claude mcp add wyre-ai-dnsfilter-mcp -- docker run --rm -i ghcr.io/wyre-ai/dnsfilter-mcp:v1.0.0

// .cursor/mcp.json

{
  "mcpServers": {
    "wyre-ai-dnsfilter-mcp": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "ghcr.io/wyre-ai/dnsfilter-mcp:v1.0.0"
      ]
    }
  }
}

// .vscode/mcp.json

{
  "servers": {
    "wyre-ai-dnsfilter-mcp": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "ghcr.io/wyre-ai/dnsfilter-mcp:v1.0.0"
      ]
    }
  }
}

# add to Codex CLI

codex mcp add wyre-ai-dnsfilter-mcp -- docker run --rm -i ghcr.io/wyre-ai/dnsfilter-mcp:v1.0.0

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "wyre-ai-dnsfilter-mcp": {
      "type": "local",
      "command": [
        "docker",
        "run",
        "--rm",
        "-i",
        "ghcr.io/wyre-ai/dnsfilter-mcp:v1.0.0"
      ],
      "enabled": true
    }
  }
}

# ~/.hermes/config.yaml

mcp_servers:
  wyre-ai-dnsfilter-mcp:
    command: "docker"
    args: ["run", "--rm", "-i", "ghcr.io/wyre-ai/dnsfilter-mcp:v1.0.0"]

// ~/.netclaw/config/netclaw.json

{
  "McpServers": {
    "wyre-ai-dnsfilter-mcp": {
      "Transport": "stdio",
      "Command": "docker",
      "Arguments": [
        "run",
        "--rm",
        "-i",
        "ghcr.io/wyre-ai/dnsfilter-mcp:v1.0.0"
      ]
    }
  }
}

// mcp.json

{
  "mcpServers": {
    "wyre-ai-dnsfilter-mcp": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "ghcr.io/wyre-ai/dnsfilter-mcp:v1.0.0"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

20 Sept 26 36

First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 21 Sept 2026 · Analysed oci/ghcr.io/wyre-ai/dnsfilter-mcp:v1.0.0

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result	No attestation
Ecosystem	oci
Reason	No attestation published

Background: How many MCP packages publish verified provenance →

MCP tools · 57 exposed · ~16,922 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens

dnsfilter_get_total_domains_users ~480

Total domain request counts broken out by local user.

Input Output Examples

Name	Type	Req	Description
agent_ids	string	–	Comma-separated user-agent (client) UUIDs. Defaults to all.
agent_types	string	–	Comma-separated agent/client types.
application_ids	string	–	Comma-separated application IDs to filter to.
bucket_size	string	–	Time-bucket size: 'auto' (default), '15min', or '1day'. Auto picks 15min for a <24h range and 1day for a >=24h range.
category_ids	string	–	Comma-separated content-category IDs to filter to.
collection_ids	string	–	Comma-separated collection (roaming-client group) IDs.
domain	string	–	Filter to a specific domain.
from	string	–	Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago.
mac_addresses	string	–	Comma-separated MAC addresses to filter to.
network_ids	string	–	Comma-separated network (site) IDs. Defaults to all.
organization_ids	string	–	Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403.
private_ip	string	–	Filter to a specific private/internal IP address.
private_ip_from	string	–	Lower bound of a private/internal IP address range.
private_ip_to	string	–	Upper bound of a private/internal IP address range.
security_report	string	–	Threat-only report. 'all' returns both threats and non-threats.
show_individual_users	boolean	–	Group results by individual local user ID. Defaults to false.
source	string	–	Comma-separated traffic source. Defaults to all.
to	string	–	Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now.
type	string	–	Report type. Defaults to all.
user_ids	string	–	Comma-separated local user IDs. Defaults to all.

No output schema declared.

No examples provided.

dnsfilter_get_total_organizations_requests ~427

Total request counts broken out by organization.

Input Output Examples

Name	Type	Req	Description
agent_ids	string	–	Comma-separated user-agent (client) UUIDs. Defaults to all.
agent_types	string	–	Comma-separated agent/client types.
application_ids	string	–	Comma-separated application IDs to filter to.
bucket_size	string	–	Time-bucket size: 'auto' (default), '15min', or '1day'. Auto picks 15min for a <24h range and 1day for a >=24h range.
category_ids	string	–	Comma-separated content-category IDs to filter to.
collection_ids	string	–	Comma-separated collection (roaming-client group) IDs.
domain	string	–	Filter to a specific domain.
fqdn	string	–	Filter to a specific fully-qualified domain name.
from	string	–	Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago.
msp_id	number	–	MSP ID to scope the report to.
name	string	–	Filter/search by name.
network_ids	string	–	Comma-separated network (site) IDs. Defaults to all.
organization_id	number	–	Organization ID.
organization_ids	string	–	Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403.
security_report	string	–	Threat-only report. 'all' returns both threats and non-threats.
to	string	–	Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now.
type	string	–	Report type. Defaults to all.
user_ids	string	–	Comma-separated local user IDs. Defaults to all.

No output schema declared.

No examples provided.

dnsfilter_get_total_organizations_stats ~332

Organization-level request-count summary.

Input Output Examples

Name	Type	Req	Description
agent_ids	string	–	Comma-separated user-agent (client) UUIDs. Defaults to all.
agent_types	string	–	Comma-separated agent/client types.
application_category_ids	string	–	Comma-separated application category IDs to filter to.
bucket_size	string	–	Time-bucket size: 'auto' (default), '15min', or '1day'. Auto picks 15min for a <24h range and 1day for a >=24h range.
collection_ids	string	–	Comma-separated collection (roaming-client group) IDs.
from	string	–	Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago.
msp_id	number	–	MSP ID to scope the report to.
name	string	–	Filter/search by name.
organization_id	number	–	Organization ID.
security_report	string	–	Threat-only report. 'all' returns both threats and non-threats.
to	string	–	Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now.
type	string	–	Report type. Defaults to all.
user_ids	string	–	Comma-separated local user IDs. Defaults to all.

No output schema declared.

No examples provided.

dnsfilter_get_total_requests ~480

Total DNS request counts over time.

Input Output Examples

Name	Type	Req	Description
agent_ids	string	–	Comma-separated user-agent (client) UUIDs. Defaults to all.
agent_types	string	–	Comma-separated agent/client types.
application_ids	string	–	Comma-separated application IDs to filter to.
bucket_size	string	–	Time-bucket size: 'auto' (default), '15min', or '1day'. Auto picks 15min for a <24h range and 1day for a >=24h range.
collection_ids	string	–	Comma-separated collection (roaming-client group) IDs.
from	string	–	Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago.
mac_addresses	string	–	Comma-separated MAC addresses to filter to.
msp_id	number	–	MSP ID to scope the report to.
nat_ips	string	–	Comma-separated NAT IP addresses to filter to.
network_ids	string	–	Comma-separated network (site) IDs. Defaults to all.
organization_ids	string	–	Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403.
private_ip	string	–	Filter to a specific private/internal IP address.
private_ip_from	string	–	Lower bound of a private/internal IP address range.
private_ip_to	string	–	Upper bound of a private/internal IP address range.
security_report	string	–	Threat-only report. 'all' returns both threats and non-threats.
show_individual_networks	boolean	–	Group results by individual network ID. Defaults to false.
source	string	–	Comma-separated traffic source. Defaults to all.
to	string	–	Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now.
type	string	–	Report type. Defaults to all.
user_ids	string	–	Comma-separated local user IDs. Defaults to all.

No output schema declared.

No examples provided.

dnsfilter_get_total_requests_agents ~485

Total request counts broken out by client/agent.

Input Output Examples

Name	Type	Req	Description
agent_ids	string	–	Comma-separated user-agent (client) UUIDs. Defaults to all.
agent_types	string	–	Comma-separated agent/client types.
application_ids	string	–	Comma-separated application IDs to filter to.
bucket_size	string	–	Time-bucket size: 'auto' (default), '15min', or '1day'. Auto picks 15min for a <24h range and 1day for a >=24h range.
collection_ids	string	–	Comma-separated collection (roaming-client group) IDs.
from	string	–	Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago.
mac_addresses	string	–	Comma-separated MAC addresses to filter to.
msp_id	number	–	MSP ID to scope the report to.
nat_ips	string	–	Comma-separated NAT IP addresses to filter to.
network_ids	string	–	Comma-separated network (site) IDs. Defaults to all.
organization_ids	string	–	Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403.
private_ip	string	–	Filter to a specific private/internal IP address.
private_ip_from	string	–	Lower bound of a private/internal IP address range.
private_ip_to	string	–	Upper bound of a private/internal IP address range.
security_report	string	–	Threat-only report. 'all' returns both threats and non-threats.
show_individual_agents	boolean	–	Group results by individual client/agent ID. Defaults to false.
source	string	–	Comma-separated traffic source. Defaults to all.
to	string	–	Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now.
type	string	–	Report type. Defaults to all.
user_ids	string	–	Comma-separated local user IDs. Defaults to all.

No output schema declared.

No examples provided.

dnsfilter_get_total_requests_collections ~467

Total request counts broken out by collection.

Input Output Examples

Name	Type	Req	Description
agent_ids	string	–	Comma-separated user-agent (client) UUIDs. Defaults to all.
agent_types	string	–	Comma-separated agent/client types.
application_ids	string	–	Comma-separated application IDs to filter to.
bucket_size	string	–	Time-bucket size: 'auto' (default), '15min', or '1day'. Auto picks 15min for a <24h range and 1day for a >=24h range.
collection_ids	string	–	Comma-separated collection (roaming-client group) IDs.
from	string	–	Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago.
mac_addresses	string	–	Comma-separated MAC addresses to filter to.
nat_ips	string	–	Comma-separated NAT IP addresses to filter to.
network_ids	string	–	Comma-separated network (site) IDs. Defaults to all.
organization_ids	string	–	Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403.
private_ip	string	–	Filter to a specific private/internal IP address.
private_ip_from	string	–	Lower bound of a private/internal IP address range.
private_ip_to	string	–	Upper bound of a private/internal IP address range.
security_report	string	–	Threat-only report. 'all' returns both threats and non-threats.
show_individual_collections	boolean	–	Group results by individual collection ID. Defaults to false.
source	string	–	Comma-separated traffic source. Defaults to all.
to	string	–	Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now.
type	string	–	Report type. Defaults to all.
user_ids	string	–	Comma-separated local user IDs. Defaults to all.

No output schema declared.

No examples provided.

dnsfilter_get_total_requests_geo ~180

Total request counts broken out by geography.

Input Output Examples

Name	Type	Req	Description
from	string	–	Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago.
limit	number	yes	Limit the number of results returned.
msp_id	number	–	MSP ID to scope the report to.
organization_ids	string	–	Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403.
to	string	–	Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now.

No output schema declared.

No examples provided.

dnsfilter_get_total_requests_organizations ~483

Total request counts broken out by organization.

Input Output Examples

Name	Type	Req	Description
agent_ids	string	–	Comma-separated user-agent (client) UUIDs. Defaults to all.
agent_types	string	–	Comma-separated agent/client types.
application_ids	string	–	Comma-separated application IDs to filter to.
bucket_size	string	–	Time-bucket size: 'auto' (default), '15min', or '1day'. Auto picks 15min for a <24h range and 1day for a >=24h range.
collection_ids	string	–	Comma-separated collection (roaming-client group) IDs.
from	string	–	Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago.
mac_addresses	string	–	Comma-separated MAC addresses to filter to.
msp_id	number	–	MSP ID to scope the report to.
nat_ips	string	–	Comma-separated NAT IP addresses to filter to.
network_ids	string	–	Comma-separated network (site) IDs. Defaults to all.
organization_ids	string	–	Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403.
private_ip	string	–	Filter to a specific private/internal IP address.
private_ip_from	string	–	Lower bound of a private/internal IP address range.
private_ip_to	string	–	Upper bound of a private/internal IP address range.
security_report	string	–	Threat-only report. 'all' returns both threats and non-threats.
show_individual_organizations	boolean	–	Group results by individual organization ID. Defaults to false.
source	string	–	Comma-separated traffic source. Defaults to all.
to	string	–	Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now.
type	string	–	Report type. Defaults to all.
user_ids	string	–	Comma-separated local user IDs. Defaults to all.

No output schema declared.

No examples provided.

dnsfilter_get_total_requests_users ~483

Total request counts broken out by local user.

Input Output Examples

Name	Type	Req	Description
agent_ids	string	–	Comma-separated user-agent (client) UUIDs. Defaults to all.
agent_types	string	–	Comma-separated agent/client types.
application_ids	string	–	Comma-separated application IDs to filter to.
bucket_size	string	–	Time-bucket size: 'auto' (default), '15min', or '1day'. Auto picks 15min for a <24h range and 1day for a >=24h range.
collection_ids	string	–	Comma-separated collection (roaming-client group) IDs.
from	string	–	Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago.
mac_addresses	string	–	Comma-separated MAC addresses to filter to.
msp_id	number	–	MSP ID to scope the report to.
nat_ips	string	–	Comma-separated NAT IP addresses to filter to.
network_ids	string	–	Comma-separated network (site) IDs. Defaults to all.
organization_ids	string	–	Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403.
private_ip	string	–	Filter to a specific private/internal IP address.
private_ip_from	string	–	Lower bound of a private/internal IP address range.
private_ip_to	string	–	Upper bound of a private/internal IP address range.
security_report	string	–	Threat-only report. 'all' returns both threats and non-threats.
show_individual_users	boolean	–	Group results by individual local user ID. Defaults to false.
source	string	–	Comma-separated traffic source. Defaults to all.
to	string	–	Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now.
type	string	–	Report type. Defaults to all.
user_ids	string	–	Comma-separated local user IDs. Defaults to all.

No output schema declared.

No examples provided.

dnsfilter_get_total_roaming_clients ~48

Count of roaming (off-network) clients.

Input Output Examples

Name	Type	Req	Description
msp_id	number	–	MSP ID to scope the report to.
organization_id	number	–	Organization ID.

No output schema declared.

No examples provided.

dnsfilter_get_total_threats ~427

Total blocked-threat counts over time.

Input Output Examples

Name	Type	Req	Description
agent_ids	string	–	Comma-separated user-agent (client) UUIDs. Defaults to all.
agent_types	string	–	Comma-separated agent/client types.
application_ids	string	–	Comma-separated application IDs to filter to.
bucket_size	string	–	Time-bucket size: 'auto' (default), '15min', or '1day'. Auto picks 15min for a <24h range and 1day for a >=24h range.
collection_ids	string	–	Comma-separated collection (roaming-client group) IDs.
from	string	–	Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago.
mac_addresses	string	–	Comma-separated MAC addresses to filter to.
network_ids	string	–	Comma-separated network (site) IDs. Defaults to all.
organization_ids	string	–	Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403.
private_ip	string	–	Filter to a specific private/internal IP address.
private_ip_from	string	–	Lower bound of a private/internal IP address range.
private_ip_to	string	–	Upper bound of a private/internal IP address range.
show_individual_networks	boolean	–	Group results by individual network ID. Defaults to false.
source	string	–	Comma-separated traffic source. Defaults to all.
to	string	–	Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now.
type	string	–	Report type. Defaults to all.
user_ids	string	–	Comma-separated local user IDs. Defaults to all.

No output schema declared.

No examples provided.

dnsfilter_get_total_threats_organizations ~431

Total blocked-threat counts broken out by organization.

Input Output Examples

Name	Type	Req	Description
agent_ids	string	–	Comma-separated user-agent (client) UUIDs. Defaults to all.
agent_types	string	–	Comma-separated agent/client types.
application_ids	string	–	Comma-separated application IDs to filter to.
bucket_size	string	–	Time-bucket size: 'auto' (default), '15min', or '1day'. Auto picks 15min for a <24h range and 1day for a >=24h range.
collection_ids	string	–	Comma-separated collection (roaming-client group) IDs.
from	string	–	Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago.
mac_addresses	string	–	Comma-separated MAC addresses to filter to.
network_ids	string	–	Comma-separated network (site) IDs. Defaults to all.
organization_ids	string	–	Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403.
private_ip	string	–	Filter to a specific private/internal IP address.
private_ip_from	string	–	Lower bound of a private/internal IP address range.
private_ip_to	string	–	Upper bound of a private/internal IP address range.
show_individual_organizations	boolean	–	Group results by individual organization ID. Defaults to false.
source	string	–	Comma-separated traffic source. Defaults to all.
to	string	–	Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now.
type	string	–	Report type. Defaults to all.
user_ids	string	–	Comma-separated local user IDs. Defaults to all.

No output schema declared.

No examples provided.

dnsfilter_get_total_threats_users ~431

Total blocked-threat counts broken out by local user.

Input Output Examples

Name	Type	Req	Description
agent_ids	string	–	Comma-separated user-agent (client) UUIDs. Defaults to all.
agent_types	string	–	Comma-separated agent/client types.
application_ids	string	–	Comma-separated application IDs to filter to.
bucket_size	string	–	Time-bucket size: 'auto' (default), '15min', or '1day'. Auto picks 15min for a <24h range and 1day for a >=24h range.
collection_ids	string	–	Comma-separated collection (roaming-client group) IDs.
from	string	–	Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago.
mac_addresses	string	–	Comma-separated MAC addresses to filter to.
network_ids	string	–	Comma-separated network (site) IDs. Defaults to all.
organization_ids	string	–	Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403.
private_ip	string	–	Filter to a specific private/internal IP address.
private_ip_from	string	–	Lower bound of a private/internal IP address range.
private_ip_to	string	–	Upper bound of a private/internal IP address range.
show_individual_users	boolean	–	Group results by individual local user ID. Defaults to false.
source	string	–	Comma-separated traffic source. Defaults to all.
to	string	–	Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now.
type	string	–	Report type. Defaults to all.
user_ids	string	–	Comma-separated local user IDs. Defaults to all.

No output schema declared.

No examples provided.

dnsfilter_list_application_categories ~90

List application categories, used for the application allow/block surface of a policy (distinct from content categories). IDs from this response are required by dnsfilter_get_application_category and can filter traffic-report tools via application_category_ids.

Input Output Examples

Name	Type	Req	Description
page	object	–	Pagination, e.g. { "number": 1, "size": 10 }. 'size' defaults to 10 (max 100).

No output schema declared.

No examples provided.

dnsfilter_list_block_pages ~101

List the custom block pages configured for the current user/organization (shown to end users when a request is filtered). Block page IDs from this response are required by dnsfilter_get_block_page.

Input Output Examples

Name	Type	Req	Description
organization_id	number	–	Filter to block pages belonging to this organization.
page	object	–	Pagination, e.g. { "number": 1, "size": 10 }. 'size' defaults to 10 (max 100).

No output schema declared.

No examples provided.

dnsfilter_list_categories ~97

List DNSFilter's content-filtering categories (e.g. Malware, Gambling, Social Networking) used to build allow/block rules in a policy. Category IDs from this response are required by dnsfilter_get_category and can filter traffic-report tools via category_ids.

Input Output Examples

Name	Type	Req	Description
page	object	–	Pagination, e.g. { "number": 1, "size": 10 }. 'size' defaults to 10 (max 100).

No output schema declared.

No examples provided.

dnsfilter_list_networks ~203

List the networks (sites/locations) visible to this API key, with basic info and whether a filtering policy is assigned. Network IDs from this response are required by dnsfilter_get_network and can scope most traffic-report tools via network_ids.

Input Output Examples

Name	Type	Req	Description
basic_info	boolean	–	Return only the most basic network info. Defaults to false.
count_network_ips	boolean	–	Include a count of associated IP addresses. Defaults to false.
force_truncate_ips	boolean	–	Omit IP address details from the response. Defaults to false.
page	object	–	Pagination, e.g. { "number": 1, "size": 10 }. 'size' defaults to 10 (max 100).
protected	boolean	–	Filter to networks with an assigned policy.
search	string	–	Search by network name, hostname, IP address, etc.
unprotected	boolean	–	Filter to networks without an assigned policy.

No output schema declared.

No examples provided.

dnsfilter_list_organizations ~220

List the organizations visible to this API key, with basic info (name, type, MSP relationships). Organization IDs from this response are required by dnsfilter_get_organization, dnsfilter_list_networks/policies/block_pages (via organization_id), and every traffic-report tool.

Input Output Examples

Name	Type	Req	Description
basic_info	boolean	–	Return only the most basic organization info. Defaults to false.
exclude_inherit_privacy_mode	boolean	–	Exclude organizations that have inherit privacy mode.
managed_by_msp_id	number	–	Filter to sub-organizations managed by this MSP's ID.
name	string	–	Filter by organization name.
owned_msp_id	number	–	Filter to parent organizations owned by this MSP's ID.
page	object	–	Pagination, e.g. { "number": 1, "size": 10 }. 'size' defaults to 10 (max 100).
pii_grid_search	string	–	Filter by organization name or privacy mode.
type	string	–	Filter by organization type.

No output schema declared.

No examples provided.

dnsfilter_list_policies ~112

List filtering policies visible to this API key. Policy IDs from this response are required by dnsfilter_get_policy and dnsfilter_get_policy_permissive_mode.

Input Output Examples

Name	Type	Req	Description
include_global_policies	boolean	–	Include global (template) policies in the listing.
organization_id	number	–	Filter to policies belonging to this organization.
page	object	–	Pagination, e.g. { "number": 1, "size": 10 }. 'size' defaults to 10 (max 100).

No output schema declared.

No examples provided.

dnsfilter_lookup_network_by_ip ~46

Find the network associated with a given source IP address, along with that network's block-page branding.

Input Output Examples

Name	Type	Req	Description
requesting_ip_address	string	yes	IP address to look up.

No output schema declared.

No examples provided.

Common questions

What is the DNSFilter MCP server?

DNSFilter is an MCP server listed in the public MCP registry as io.github.WYRE-AI/dnsfilter-mcp. MCP server for DNSFilter's DNS security/filtering API. This page covers its container image (ghcr.io/wyre-ai/dnsfilter-mcp:v1.0.0).

Is the DNSFilter MCP server safe to use?

DNSFilter scores 36 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the DNSFilter MCP server expose?

DNSFilter exposes 57 tools: dnsfilter_list_organizations, dnsfilter_get_organization, dnsfilter_get_organization_settings, dnsfilter_list_networks, dnsfilter_get_network, and 52 more. Their descriptions and schemas cost roughly 16,922 tokens of context every time the server is loaded.

Is the DNSFilter MCP server still maintained?

DNSFilter is still listed as active in the MCP registry. We last reached this channel on 21 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the DNSFilter MCP server under?

DNSFilter declares the NOASSERTION licence, which is not on the OSI-approved list. Read the terms before using it at work, and note this covers the source only, not the cost of any service it calls.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Badge

Put this score in your README. The image is served from a stable URL, updates when the score does, and links back to the evidence on this page. It shows nothing that is not already published here.

Score Verified Plain

The two-cell badge: our name, and this channel's current score out of 100.

Markdown

 [![VerifyMCP trust score for DNSFilter](https://verifymcp.io/badge/wyre-ai-dnsfilter-mcp/ghcr-io-wyre-ai-dnsfilter-mcp-v1-0-0.svg)](https://verifymcp.io/servers/wyre-ai-dnsfilter-mcp/ghcr-io-wyre-ai-dnsfilter-mcp-v1-0-0)

HTML

 <a href="https://verifymcp.io/servers/wyre-ai-dnsfilter-mcp/ghcr-io-wyre-ai-dnsfilter-mcp-v1-0-0"><img src="https://verifymcp.io/badge/wyre-ai-dnsfilter-mcp/ghcr-io-wyre-ai-dnsfilter-mcp-v1-0-0.svg" alt="VerifyMCP trust score for DNSFilter" height="20"></a>

A single cell stating that the server is listed here. Carries no number.

Markdown

 [![VerifyMCP trust score for DNSFilter](https://verifymcp.io/badge/wyre-ai-dnsfilter-mcp/ghcr-io-wyre-ai-dnsfilter-mcp-v1-0-0.svg?variant=verified)](https://verifymcp.io/servers/wyre-ai-dnsfilter-mcp/ghcr-io-wyre-ai-dnsfilter-mcp-v1-0-0)

HTML

 <a href="https://verifymcp.io/servers/wyre-ai-dnsfilter-mcp/ghcr-io-wyre-ai-dnsfilter-mcp-v1-0-0"><img src="https://verifymcp.io/badge/wyre-ai-dnsfilter-mcp/ghcr-io-wyre-ai-dnsfilter-mcp-v1-0-0.svg?variant=verified" alt="VerifyMCP trust score for DNSFilter" height="20"></a>

The score alone, tier-coloured, for a badge row that is already crowded.

Markdown

 [![VerifyMCP trust score for DNSFilter](https://verifymcp.io/badge/wyre-ai-dnsfilter-mcp/ghcr-io-wyre-ai-dnsfilter-mcp-v1-0-0.svg?variant=plain)](https://verifymcp.io/servers/wyre-ai-dnsfilter-mcp/ghcr-io-wyre-ai-dnsfilter-mcp-v1-0-0)

HTML

 <a href="https://verifymcp.io/servers/wyre-ai-dnsfilter-mcp/ghcr-io-wyre-ai-dnsfilter-mcp-v1-0-0"><img src="https://verifymcp.io/badge/wyre-ai-dnsfilter-mcp/ghcr-io-wyre-ai-dnsfilter-mcp-v1-0-0.svg?variant=plain" alt="VerifyMCP trust score for DNSFilter" height="20"></a>

Score history · last 30 days

20 Sept 21 Sept