Manages BIND 9 DNS operations through 23 audited tools for zone validation, DNSSEC status, and service monitoring.
Also known as AIops-tools/BIND9-AIops, bind9-aiops
- Stars
- 0
- Tools
- —
- Downloads, 30 days
- 321
- Latest version
- 0.2.2
- Last commit
- Nov 14, 2026
- License
- MIT
What is BIND 9 AIops MCP?
BIND 9 AIops manages BIND 9 DNS operations through 23 audited tools for zone validation, DNSSEC status, and service monitoring.
Summary generated from the project's README
About BIND 9 AIops MCP server
BIND 9 AIops provides a controlled interface for managing DNS operations through 23 audited tools. It is designed for operators who need to monitor and validate BIND 9 services without granting an AI agent full shell access. The server executes specific commands like rndc, named-checkconf, and dig using fixed argument lists to maintain security. Every operation is tracked and budgeted by an integrated governance harness to prevent uncontrolled execution.
To use this server, you must have Python 3.11+, uv, and the BIND 9 command utilities installed on the host machine. Setup involves running the init and doctor commands, and you can configure specific paths for rndc and named configurations in a yaml file. The system handles tasks such as checking DNSSEC status, comparing SOA serials between primary and secondary servers, and validating zone configurations. While it supports actions like reloading or flushing zones, these operations include dry-run modes and require CLI confirmations to ensure safety.
What you can do with it
- 1Validate DNS configurationsAsk the AI to verify that the current BIND configuration and loaded zones are valid.
- 2Compare SOA serialsRequest a comparison of SOA serial numbers between a primary and a secondary DNS server.
- 3Monitor DNSSEC statusCheck the current DNSSEC validation mode and the progress of zone signing.
- 4Diagnose zone issuesUse a diagnostic tool to identify specific probe failures within a particular zone.
Written from the project's README. Every use case is checked against a quote from it.
How to install BIND 9 AIops MCP
Formats verified 10 Nov 2026Add to CursorAdd to GooseInstall BIND 9 AIops MCP in Claude Code
$ claude mcp add bind9-aiops -- uvx bind9-aiopsInstall BIND 9 AIops MCP in Cursor
~/.cursor/mcp.json
{
"mcpServers": {
"bind9-aiops": {
"command": "uvx",
"args": [
"bind9-aiops"
]
}
}
}Install BIND 9 AIops MCP in VS Code
.vscode/mcp.json
{
"servers": {
"bind9-aiops": {
"type": "stdio",
"command": "uvx",
"args": [
"bind9-aiops"
]
}
}
}Install BIND 9 AIops MCP in VS Code CLI
$ code --add-mcp '{"name":"bind9-aiops","type":"stdio","command":"uvx","args":["bind9-aiops"]}'Install BIND 9 AIops MCP in Claude Desktop
claude_desktop_config.json
{
"mcpServers": {
"bind9-aiops": {
"command": "uvx",
"args": [
"bind9-aiops"
]
}
}
}Install BIND 9 AIops MCP in Codex
$ codex mcp add bind9-aiops -- uvx bind9-aiopsInstall BIND 9 AIops MCP in Codex config.toml
~/.codex/config.toml
[mcp_servers.bind9-aiops] command = "uvx" args = ["bind9-aiops"]
Install BIND 9 AIops MCP in Gemini CLI
$ gemini mcp add -s user bind9-aiops uvx -- bind9-aiopsInstall BIND 9 AIops MCP in Gemini settings.json
~/.gemini/settings.json
{
"mcpServers": {
"bind9-aiops": {
"command": "uvx",
"args": [
"bind9-aiops"
]
}
}
}Automated checks
Ran Nov 14, 2026Full report →Passed our automated checks. That is not a security audit: read the code and give the server the narrowest access it needs. How checks work
- Source repository linked and reachableaiops-tools/bind9-aiops is public and reachablegithub.com/aiops-tools/bind9-aiops ↗Pass
- Package names this repository as its sourceNot checked
- Build provenance (Sigstore attestation)Sigstore attestation for bind9-aiopspypi.org/project/bind9-aiops/ ↗Pass
- Open source license (OSI)MITspdx.org/licenses/MIT.html ↗Pass
- Commit or release in the last yearLast commit or release 2026-11-14github.com/aiops-tools/bind9-aiops ↗Pass
- OpenSSF ScorecardNot checked
- Package name not close to a popular packageNo popular package one edit away from bind9-aiopsPass
- No critical advisory in the package or its dependenciesthe package checked; no critical advisoryosv.dev ↗Pass
- No hidden instructions to the model0 tool descriptions and the README read; no override phrases, credential paths or hidden charactersPass
- Destructive tools are labelledNot checked
- Remote endpoint answers the MCP handshakeNot checked
README
View on GitHubBIND 9 AIops
Governed BIND 9 DNS operations with 23 MCP tools and corresponding CLI commands. It executes rndc, named-checkconf and dig as fixed argument lists without a shell. Every call is audited and budgeted by the bundled governance harness.
What it checks
- Named service and zone status from
rndc. - Configuration and loaded-zone validation with
named-checkconf -z. - DNSSEC validation mode.
- Zone DNSSEC signing, managed-key and serve-stale status; running zone configuration where enabled.
- Recursive fetch-limit hits, DNSSEC trust anchors, DNS TCP timeouts and per-zone signing progress.
- DNS queries with their actual DNS response code.
- Queries against a selected secondary server.
- Guarded secondary retransfer and single-zone NOTIFY resend.
- Primary and secondary SOA serial comparison. A failed or unparseable query returns
null, never a fabricated zero or match. bind_diagnose_zonekeeps individual probe failures visible.
Setup from source
Requires Python 3.11+, uv, and BIND 9 command utilities on the operator host. Run uv sync --dev, uv run bind9-aiops init, then uv run bind9-aiops doctor. A manual ~/.bind9-aiops/config.yaml can specify paths and a DNS server:
targets:
- name: local
server: 127.0.0.1
dns_port: 53
rndc_config: /etc/bind/rndc.conf
named_config: /etc/bind/named.conf
timeout: 10
Use uv run bind9-aiops diagnose example.org or uv run bind9-aiops compare-soa example.org 192.0.2.2. The MCP entry point is uv run bind9-aiops-mcp. The process account needs access to its rndc key file and BIND config, but no elevated shell is given to the agent.
Scope and verification
reload-zone, refresh-zone, flush-name, retransfer-zone and notify-zone support dry-run and two CLI confirmations. RNDC command acceptance does not prove a queued zone reload or transfer completed, so these writes report outcomeUnknown; a lost command response does too. No safe undo exists for a cache flush, retransfer, NOTIFY delivery or externally edited zone file. Zone-file editing, DNSSEC key changes and global service restarts remain outside this release. See verification. Missing features and live-environment feedback are welcome as issues or PRs.
BIND 9 AIops MCP questions
How do I add BIND 9 AIops MCP to Claude Code?
Run claude mcp add bind9-aiops -- uvx bind9-aiops in your terminal. Add --scope user to make it available in every project.
How do I add BIND 9 AIops MCP to Cursor?
Open ~/.cursor/mcp.json and add the server under mcpServers, using the Cursor config shown in the install section above.
What commands does the server execute?
The server executes rndc, named-checkconf, and dig as fixed argument lists without using a shell.
Can I perform zone-file editing or global service restarts?
No, zone-file editing, DNSSEC key changes, and global service restarts are not supported in this release.
How can I verify the setup?
You can run the doctor command using uv to check the installation.
Does the server provide a way to undo actions like cache flushes?
There is no safe undo mechanism for cache flushes, zone retransfers, NOTIFY delivery, or externally edited zone files.