一个安全加固的模型上下文协议(MCP)服务器,用于通过其HTTP API管理Technium DNS服务器.

与Claude Code和其他与MCP相容的客户端一起为使用而建造.

□ 特性

• 39个工具 涵盖DNS区域、记录、屏蔽、缓存、设置、应用程序、DNSSEC、日志和诊断
• ** 在所有参数(RFC 1035域检查、IP验证、enum允许列表)上输入验证**
• HTTPS执行,明确HTTP选择进入当地网络
• ** 只读模式** 只披露安全查询工具
• ** 破坏性行动需要确认**(删除区、删除记录、冲出缓存/充值/屏蔽、未安装应用程序)
• ** 限制时间**,更严格地限制破坏行动
• ** 审计记录**作为结构化的JSONL进行
• ** 响应消毒** 以去除信号、密码、堆栈痕迹和敏感路径
• ** 防止错误信息中证书/路径泄漏的误入分泌**
• ** 用于安全证书存储的文件支持**
• ** 防止同时进行认证竞赛的自动变种**
• ** 仅限 API 调用 ** 用于所有变异操作; 区导出用途 GET( 由 Technitium API 要求) 带有短寿命会话符

□ 快开始

technitium-mcp-secure

A security-hardened Model Context Protocol (MCP) server for managing Technitium DNS Server via its HTTP API.

Built for use with Claude Code and other MCP-compatible clients.

Features

• 39 tools covering DNS zones, records, blocking, cache, settings, apps, DNSSEC, logs, and diagnostics
• Input validation on all parameters (RFC 1035 domain checks, IP validation, enum allowlists)
• HTTPS enforcement with explicit HTTP opt-in for local networks
• Read-only mode to expose only safe query tools
• Confirmation required for destructive operations (delete zone, delete record, flush cache/allow/block, uninstall app)
• Rate limiting with stricter limits on destructive operations
• Audit logging as structured JSONL to stderr
• Response sanitization to strip tokens, passwords, stack traces, and sensitive paths
• Error sanitization to prevent credential/path leakage in error messages
• Token file support for secure credential storage
• Auth mutex to prevent concurrent authentication races
• POST-only API calls for all mutating operations; zone export uses GET (required by Technitium API) with short-lived session tokens

Quick Start

# Clone and build
git clone https://github.com/rosschurchill/technitium-mcp-secure.git
cd technitium-mcp-secure
npm install
npm run build

# Register with Claude Code (see "Generating an API Token" below first)
claude mcp add technitium-dns \
  --env TECHNITIUM_URL=https://your-server-ip:5380 \
  --env TECHNITIUM_TOKEN=your-api-token \
  -- node /path/to/technitium-mcp-secure/dist/index.js

Configuration

All configuration is via environment variables:

Authentication priority: TECHNITIUM_TOKEN > TECHNITIUM_TOKEN_FILE > TECHNITIUM_PASSWORD

Sensitive environment variables are cleared from process.env after being read.

Tools

Read-only (18 tools)