In this article

The DNSFilter MCP connector enables natural language interaction with DNSFilter data and configuration directly inside an AI assistant. A single connector provides access to three capability areas: administrative operations, DNS reporting, and CyberSight behavioral telemetry. All access is governed by per-user OAuth, privacy settings enforced at the session level, and a confirmation gate on all write operations.

IT admins, security analysts, MSP partners, and enterprise compliance teams connect and use the DNSFilter MCP connector with ChatGPT, Claude, Microsoft Copilot Studio, and other MCP-compatible AI assistants.

Prerequisites

The following requirements apply before connecting the DNSFilter MCP connector:

• A DNSFilter account with admin permissions or higher
• A Core, Plus, or Enterprise plan. Pro plan accounts do not have access to the MCP connector
• An MCP-compatible AI assistant (ChatGPT, Claude, Microsoft Copilot Studio, or equivalent)
• A CyberSight subscription to access CyberSight behavioral telemetry 

AI assistant permissions

Permission requirements vary by assistant.

• Claude. Admin permissions to add connectors. If this permission is not available, contact a Claude admin to complete the connection setup.
• ChatGPT. On Business and Enterprise accounts, a workspace admin must enable developer mode, and the admin controls who can add custom MCP connectors and who can use each one once published. On personal Plus and Pro plans, users can add their own.
• Microsoft Copilot. Admin or maker permissions allowed by the tenant. There is no self-service path for regular users.

Connect the DNSFilter MCP connector

To connect the DNSFilter MCP connector, copy the MCP Server URL from the DNSFilter dashboard and then add it in the AI assistant.

Copy the MCP Server URL

To copy the MCP Server URL:

1. From the DNSFilter dashboard, navigate to Integrations.
2. Under AI Connectors, select DNSFilter MCP Server.
3. Copy the MCP Server URL: https://mcp.dnsfilter.com/mcp

Connect with ChatGPT

To connect the DNSFilter MCP connector with ChatGPT:

1. In ChatGPT, navigate to Plugins. 

   Depending on the account, access Plugins from the sidebar or from Settings.

2. Select Browse directory.
3. Select Add, and then select Add custom MCP server.
4. In the Add custom MCP server dialog, configure the following:
   • Icon: Optional. Add an icon for the connector.
   • Name: Enter the MCP server name to display in ChatGPT.
   • Description: Optional. Enter a description for the connector.
   • Connection: Paste the MCP Server URL.
   • Authentication: Leave set to OAuth.
5. Select I understand and want to continue.
6. Select Create as a plugin.

7. Select Continue. 

   The DNSFilter sign-in page opens.

8. Sign in with DNSFilter account credentials. 

   If the DNSFilter account uses SSO, enter only the SSO key in the sign-in field, not the full SSO URL. For example, for the SSO URL https://app.dnsfilter.com/login/1234567890, enter 1234567890 only.

Connect with Claude

To connect the DNSFilter MCP connector with Claude:

1. In Claude, navigate to Customize and select Connectors.
2. Select + Add and then select Add custom connector. 
3. Paste the MCP Server URL.

4. Sign in with DNSFilter account credentials via OAuth.

   If the DNSFilter account uses SSO, enter only the SSO key in the sign-in field, not the full SSO URL. For example, for the SSO URL https://app.dnsfilter.com/login/1234567890, enter 1234567890 only.

Connect with Microsoft Copilot Studio

To connect the DNSFilter MCP connector with Microsoft Copilot Studio:

1. From the Copilot Studio home page, select Other ways to build.
2. Select Agent.
3. Enter a name for the agent and then select Create.
4. Select the Tools tab.
5. Select + Add a tool.
6. Under Create new, select Model Context Protocol.
7. Configure the following:
   • Server name: Enter a name for the MCP server.
   • Server description: Enter a description.
   • Server URL: Paste the MCP Server URL.
   • Authentication: Select OAuth 2.0.
   • Type: Leave set to Dynamic discovery.

8. Select Create. 

   The Add tool dialog displays.

9. Select Not connected, and then select Create new connection.
10. Optional: Enter a display name for the connection.

11. Select Create. 

    The DNSFilter sign-in page opens.

12. Sign in with DNSFilter account credentials. 

    If the DNSFilter account uses SSO, enter only the SSO key in the sign-in field, not the full SSO URL. For example, for the SSO URL https://app.dnsfilter.com/login/1234567890, enter 1234567890 only.

13. On the Add tool dialog, select Add and configure.

The connector is now active. All three capability areas are available within the same session.

To confirm the connection with the assistant, use one of the following prompts:

• “Confirm successful connection”
• “Pull a list of users from the account”
• “How many seats are available in our account?”

Admin capability

The Admin capability provides natural language access to administrative operations in the DNSFilter account. Use this to look up organizations, configure policies, manage users and seats, update block page settings, troubleshoot deployments, and monitor account health.

Write operations require confirmation. Every admin action that modifies data, such as policy changes, Block List updates, or user management, displays a confirmation prompt before the change is made. No write operation runs without explicit approval in the conversation.

The Admin capability does not support the following actions: billing changes, SSO or SAML configuration, and organization creation or deletion.

Example prompts:

• "Why was this domain blocked for user@example.com?"
• "Add domain.com to the Block List for the Acme organization"
• "Show me all Roaming Clients that haven't checked in for more than 7 days"
• "How many seats are available in our account?"
• "Update the block page message for the Acme organization"

DNS Reporting capability

The DNS Reporting capability provides natural language investigation and reporting over DNS query logs. Use this to look up recent query history by user or device, explain why a query was blocked or allowed, analyze query patterns, surface blocked request volume, and identify DNS anomalies.

The DNS Reporting capability is read-only. No write operations are available.

Example prompts:

• "Show me DNS traffic for user@example.com over the last 7 days"
• "Why was this domain blocked for device LAPTOP-001?"
• "What are the top blocked domains across the organization this month?"
• "Are there any unusual query patterns for this site in the last 24 hours?"
• "Show me the top categories for Site: HQ Network over the last 7 days"

CyberSight Reporting capability

The CyberSight Reporting capability provides natural language investigation and reporting over CyberSight behavioral telemetry. Use this to look up user and device activity, investigate traffic patterns, surface behavioral anomalies, and generate investigation summaries.

The following conditions apply to the CyberSight Reporting capability:

• CyberSight subscription required. The connector checks for an active CyberSight entitlement on connection. CyberSight tools are not available to organizations without an active subscription.

• Privacy mode is enforced automatically. The organization's privacy setting (Full Visibility, Device-Only, or Maximum Privacy) is applied on connection and enforced on every query. Privacy settings cannot be bypassed or overridden through the connector.

• Query depth. DNS query log and CyberSight data is available for up to 30 days. Queries beyond 30 days may have degraded performance due to index lifecycle limits.

Example prompts:

• "What applications has this device been using most this week?"
• "Are there any users showing unusual after-hours activity?"
• "Generate an investigation summary for device: LAPTOP-001"
• "Show me streaming activity for user@example.com over the last 7 days"
• "Which users are showing the most risk this week?"

Governance and compliance

All access through the DNSFilter MCP connector is governed by an AI-approved endpoint model. Only endpoints explicitly approved for AI access are reachable through the connector. No other API surface is accessible.

The connector enforces the following governance and compliance behaviors:

• Auditability. All read operations are instrumented. All write operations are logged and attributable to the authenticated user.

• Write confirmation gate. No write operation runs without explicit in-conversation confirmation from the authenticated user. This applies to every Admin capability action, without exception.

• Privacy enforcement. Privacy settings are applied on every connection. There are no exceptions, overrides, or elevated access paths through the connector.

• MSP scoping. Each session is scoped to a single organization. MSP admins must select an organization context before querying data for that organization.