Connect an AI agent
Use this guide to connect an MCP-compatible AI client to Domain Chief and control which teams it may use and what it may read or change.
Choose your task
- Connect an AI client
- Choose one team or all your teams
- Try a request
- Review the available tools
- Change the connection's permissions
- Fix a connection or permission problem
Connect an AI client
Before you connect
Your AI client must support remote MCP servers and browser-based sign-in. Use this server URL:
Code
Connect a client
Look for MCP or integrations in your client's settings, then:
- Open the client's MCP or integrations settings.
- Add a remote MCP server with the URL above.
- Sign in with your Chief account.
- Under Select a team, choose the team the agent may use, or All my teams.
- Review the requested scopes and select Authorize.
Domain Chief asks for read access when you first connect. The agent can then list TLDs, contacts, domains, DNS records, and redirects, and check domain availability, but it cannot change anything.
Review the requested access
The authorization screen presents all requested scopes as one set. You must approve the full set or cancel the connection.
Choose one team or all your teams
The team you select in step 4 decides which domains, contacts, DNS records, and redirects the agent can reach.
| Choice | What the agent can use |
|---|---|
| A single team | Only that team. The agent never has to pick a team. |
| All my teams | Every team you belong to, including teams you join later. The agent picks a team for each request. |
With All my teams, the agent gets the same scopes in every team. Name the team in your request, such as "In the Agency team, list the domains that expire this month", so the agent does not have to guess. It should ask you when the team is unclear and tell you which team it used. Before you approve a change, check that the agent named the right team.
To switch between one team and all teams, reconnect the client and make a different choice.
What happens next
After connecting, give the client a specific task. For example:
- Check whether
copper-lantern.comis available. - List the DNS records for one of my domains.
- Change the
tagmetadata on this domain tostaging. - Create a redirect from
wwwto the root domain.
The last two examples change data, so the agent needs a write scope first. See Change permissions. Review proposed write operations before allowing the agent to continue.
Available tools
Your client may list every tool, but each tool only works when the connection has its required scope. A higher-level scope also works. For example, domainchief:dns:write covers domainchief:dns:read.
Teams
| Tool | Action | Required scope |
|---|---|---|
list-teams | List the teams the connection can use and mark your default team | None |
list-teams is only available to connections authorized for All my teams. These connections name a team on every other tool call. Your default team is a hint for the agent, not an automatic choice.
TLDs and contacts
| Tool | Action | Required scope |
|---|---|---|
list-tlds | List supported TLDs and indicative pricing | domainchief:tlds:read |
get-tld | Retrieve one TLD | domainchief:tlds:read |
list-contacts | List team contacts | domainchief:contacts:read |
get-contact | Retrieve one contact | domainchief:contacts:read |
Domains
| Tool | Action | Required scope |
|---|---|---|
list-domains | List team domains | domainchief:domains:read |
update-domain | Update an existing domain | domainchief:domains:write |
check-domain-availability | Check whether a domain can be registered or transferred | domainchief:domains:read:availability |
DNS records
These tools work only with domains using Domain Chief hosted DNS.
| Tool | Action | Required scope |
|---|---|---|
get-dns-record | Retrieve one DNS record | domainchief:dns:read |
list-dns-records | List DNS records | domainchief:dns:read |
create-dns-record | Create a DNS record | domainchief:dns:write |
update-dns-record | Update a DNS record | domainchief:dns:write |
delete-dns-record | Delete a DNS record | domainchief:dns:write |
clear-dns-records | Remove DNS records except records managed by redirects | domainchief:dns:write |
reset-dns-records | Restore the Domain Chief default records | domainchief:dns:write |
Web redirects
| Tool | Action | Required scope |
|---|---|---|
get-web-redirect | Retrieve one web redirect | domainchief:redirects_web:read |
list-web-redirects | List web redirects | domainchief:redirects_web:read |
create-web-redirect | Create a web redirect | domainchief:redirects_web:write |
update-web-redirect | Update a web redirect | domainchief:redirects_web:write |
delete-web-redirect | Delete a web redirect | domainchief:redirects_web:write |
Manage the connection
Change permissions
Start with read access. When the agent needs a write tool, such as create-dns-record or update-domain, some clients ask you to approve the extra scope at that moment. If yours does not, reconnect the client and approve the write scope. Domain Chief cannot add scopes to an existing connection without another authorization step.
See Domain Chief API scopes for the full scope hierarchy.
Choose MCP or REST
Use MCP when an AI client needs to choose and call Domain Chief tools. Use the REST API for application code, fixed workflows, or endpoints that the MCP server does not expose.
Troubleshooting
Why can't the client connect?
Confirm that the client supports remote MCP servers and browser-based authorization. Copy the server URL exactly, then reconnect and complete the Chief sign-in flow.
Why does a tool report insufficient scope?
The connection does not have the tool's required scope. Compare the tool with the tables above, then approve the additional scope when your client asks, or reconnect the client and approve it.
Why can't the agent see one of my teams?
The connection is limited to the team you selected when you connected. Reconnect the client and choose that team or All my teams. With All my teams, the agent can only use teams you are a member of.
Why did the agent use the wrong team?
With All my teams, the agent picks a team for each request. Name the team in your request and ask the agent which team it used. If you only work in one team, reconnect and select that team instead.
Why can't the agent manage DNS records?
DNS tools work only for domains using Domain Chief hosted DNS. The connection also needs the matching domainchief:dns:read or domainchief:dns:write scope.
Why does the authorization screen request unexpected access?
Cancel the connection and review which tools or integration the client is trying to enable. Domain Chief approves or rejects the requested scopes as one set.