Enterprise and Pro
Connect Claude to your domains
Our MCP server lets Claude read your DomainGuard account: what is broken, when it broke, and what fixing it involves. Enterprise keys can also start scans and update records.
Built on the Model Context Protocol, the open standard for connecting AI assistants to outside systems.
What this does
DomainGuard already checks your domains every day: DNS, SSL, SPF, DKIM, DMARC, HTTP headers, blacklists, vulnerabilities, and SEO. The dashboard shows you the findings. The MCP server hands those same findings to Claude, so you can ask about them in plain language instead of reading panels.
You can ask which of your sites has a certificate expiring soon, why your invoices are landing in spam, what changed on a domain since last month, or what a specific vulnerability finding means for your business. Claude reads the actual scan data from your account, so the answers are about your domains rather than websites in general.
One thing worth being clear about: we monitor your domains, we do not host them. Claude can tell you a DMARC record is missing and what it should say. Publishing it still happens at your registrar or DNS provider.
Setting it up
Create an API key
In the dashboard, go to Settings, then API Keys. Pick the scopes the key should reach — domains, scans, SEO, vulnerability, compliance, status — and copy the key when it is shown. It is shown once. On Enterprise you can also tick write access; leave it off for a key that should only ever report.
Add the server
# Claude Code
claude mcp add --transport http domainguard https://nhmohio.com/api/mcp \
--header "Authorization: Bearer nhm_your_key_here"Any MCP client that supports a remote server over HTTP with a custom header works the same way. The endpoint is https://nhmohio.com/api/mcp and the key goes in the Authorization header as a Bearer token.
Ask it something
"Which of my domains have SSL certificates expiring in the next 30 days?"
"Why might email from my domain be going to spam?"
"Compare this month's SEO results against last month and tell me what regressed."What Claude can call
A key only exposes the tools its scopes allow. A read-only key on the domains scope shows four tools, not twenty, so an assistant cannot reach for something it was never given.
Reading — Pro and Enterprise
| list_domains | Every domain on the account with its health score and last scan |
| get_domain_history | How a domain's results have changed over time |
| get_checkup_history | Past security checkups with each finding and its severity |
| run_domain_checkup | A live checkup of any hostname, on the account or not |
| get_seo_results | The latest SEO and accessibility scan for a domain |
| get_seo_history | SEO scores over time |
| get_vuln_scan_latest | The most recent vulnerability scan and its findings |
| get_vuln_scan_results | Findings for one scan by id |
| get_compliance_records | PCI, HIPAA, and cyber-insurance controls and their status |
| list_status_checks | Custom endpoint checks and their most recent result |
| get_status_services | Current status of the third-party providers you track |
Changing things — Enterprise only
| add_domain | Start monitoring a new domain |
| update_domain | Change a domain's group, notes, or which checks it skips |
| delete_domain | Stop monitoring a domain and delete its history |
| run_domain_scan | Run a full scan now instead of waiting for the daily one |
| run_seo_scan | Re-score a site after publishing changes |
| start_vuln_scan | Start a vulnerability scan |
| update_compliance_item | Set the status and notes on a compliance control |
| create_status_check | Add a custom endpoint check |
| run_status_check | Run a saved check immediately |
How access is limited
Your account only
Every tool runs through the same ownership checks as the dashboard. A key reaches the domains on its own account and nothing else.
Scopes decide the tool list
Tools outside a key's scopes are not offered and cannot be called. Mint one key per use and give each only what it needs.
Read-only means read-only
Without the write scope, nothing an assistant does can change or delete your data. Write access is a separate tick box, and only on Enterprise.
Revocable and rate limited
Revoke a key in the dashboard and it stops working immediately. Each key carries its own hourly request limit, and you can set an expiry date when you create it.
Point Claude at your domains
Pro reads your account. Enterprise reads it and acts on it. Both take about a minute to set up.