SaaS Custom Domains

npx add-mcp 'https://mcp.saascustomdomains.com/mcp'

MCP server

The SaaS Custom Domains MCP server lets AI assistants and coding agents manage your custom domains. Ask your assistant to add a customer's domain, tell you which DNS records they need, check why a domain isn't live yet, or show last month's traffic.

The server is remote, so there's nothing to install. Point your MCP client at this URL:

https://mcp.saascustomdomains.com/mcp

It uses the Streamable HTTP transport. There are two ways to connect:

• Sign in with your SaaS Custom Domains account (OAuth). Every client on this page supports this, and there's no token to copy.
• Send an API token as Authorization: Bearer <token>. This works in every client that lets you set a request header.

What it can do

Tools take hostnames, like app.customer.com, rather than UUIDs. Tools that work in one account take an optional account (its name or UUID). You only need to pass it if you have more than one account.

Tool	What it does
list_accounts	Lists the accounts your token can access.
list_upstreams	Lists an account's upstreams.
list_custom_domains	Lists custom domains across your accounts, filtered by account, upstream or DNS status.
get_custom_domain	Shows a domain's DNS, certificate and deployment status, and the DNS records it needs.
list_redirects	Lists an account's redirects.
list_rules	Lists the rules of a custom domain or an upstream, in the order they run.
list_custom_certificates	Lists the TLS certificates an account uploaded in the dashboard.
get_traffic_stats	Shows requests, data transfer, response time and response codes for a domain.
get_web_analytics	Shows visitors, pageviews, visits, top pages and top sources for a domain.
get_analytics_over_time	Shows one metric per day, week or month, such as visitors, requests or response time.
get_analytics_breakdown	Breaks traffic down by pages, sources, locations, devices, UTM parameters, bots, datacenters or response times.
create_upstream	Creates an upstream.
add_custom_domain	Adds a custom domain to an upstream and returns the DNS records to add. Also takes a www redirect, a path prefix and Bubble settings.
verify_dns	Checks a domain's DNS records right away.
purge_cache	Purges a domain's HTTP cache.
create_redirect	Creates a redirect.
update_redirect	Changes a redirect.
create_rule	Creates a rule on a custom domain or an upstream.
update_rule	Changes a rule.
reorder_rules	Changes the order rules run in, for example to move a new rule first.
delete_custom_domain	Deletes a custom domain.
delete_redirect	Deletes a redirect.
delete_rule	Deletes a rule.
delete_custom_certificate	Deletes an uploaded certificate.
delete_upstream	Deletes an upstream that has no custom domains left.

The list and get tools only read data. The delete tools are marked as destructive, so most clients ask you to confirm before running them. delete_upstream refuses an upstream that still has custom domains, because deleting it would delete them too.

The four analytics tools need the Domain Analytics add-on. They cover up to 90 days and default to the last 30.

Set up your client

Claude Code, Codex and VS Code can also install the SaaS Custom Domains plugin, which connects this server and adds the agent skill in one step. For step-by-step setup in each agent, see Agent setup.

claude.ai

1. Go to Customize → Connectors and click Add custom connector. On Team and Enterprise plans, an owner adds it under Organization settings → Connectors, and members then click Connect.
2. Enter https://mcp.saascustomdomains.com/mcp and connect.
3. Approve the connection, sign in to SaaS Custom Domains, and click Continue.

ChatGPT

Add https://mcp.saascustomdomains.com/mcp as a custom MCP server with OAuth authentication, then approve the connection, sign in to SaaS Custom Domains, and click Continue. Custom MCP servers depend on your ChatGPT plan; see OpenAI's guide to connecting a custom MCP server.

Claude Code

To sign in, add the server without a header:

Terminal

claude mcp add --transport http saas-custom-domains https://mcp.saascustomdomains.com/mcp --scope user

Then run /mcp in Claude Code, pick saas-custom-domains and choose Authenticate. Your browser opens to approve the connection and sign in.

To use an API token instead, add the header:

Terminal

claude mcp add --transport http saas-custom-domains https://mcp.saascustomdomains.com/mcp \
  --header "Authorization: Bearer YOUR_API_TOKEN" --scope user

--scope user makes the server available in every project. Leave it out to add it to the current project only.

Cursor, VS Code, Windsurf, Cline and Codex can sign in too: add the server without the Authorization header, and the client opens the sign-in page when it first connects. The configs below send an API token instead, which also works where nobody can sign in, such as CI. Create one in Settings » API first. The assistant can do anything the token can, so treat the token like a password.

Cursor

Add the server to ~/.cursor/mcp.json, or to .cursor/mcp.json in a project. This reads the token from the SCD_API_TOKEN environment variable:

~/.cursor/mcp.json

{
  "mcpServers": {
    "saas-custom-domains": {
      "url": "https://mcp.saascustomdomains.com/mcp",
      "headers": {
        "Authorization": "Bearer ${env:SCD_API_TOKEN}"
      }
    }
  }
}

VS Code

Add this to .vscode/mcp.json. VS Code asks for the token the first time the server starts and stores it securely:

.vscode/mcp.json

{
  "inputs": [
    {
      "type": "promptString",
      "id": "scd-api-token",
      "description": "SaaS Custom Domains API token",
      "password": true
    }
  ],
  "servers": {
    "saasCustomDomains": {
      "type": "http",
      "url": "https://mcp.saascustomdomains.com/mcp",
      "headers": {
        "Authorization": "Bearer ${input:scd-api-token}"
      }
    }
  }
}

Windsurf (Devin Desktop)

Add the server to ~/.config/devin/mcp_config.json. Older Windsurf versions use ~/.codeium/windsurf/mcp_config.json:

mcp_config.json

{
  "mcpServers": {
    "saas-custom-domains": {
      "url": "https://mcp.saascustomdomains.com/mcp",
      "headers": {
        "Authorization": "Bearer ${env:SCD_API_TOKEN}"
      }
    }
  }
}

Cline

Open MCP Servers → Configure → Configure MCP Servers and add the server to cline_mcp_settings.json. Set type to streamableHttp, otherwise Cline uses the older SSE transport:

cline_mcp_settings.json

{
  "mcpServers": {
    "saas-custom-domains": {
      "type": "streamableHttp",
      "url": "https://mcp.saascustomdomains.com/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_API_TOKEN"
      },
      "disabled": false
    }
  }
}

Codex CLI

To sign in, add the server without a token, then log in. Your browser opens to approve the connection and sign in:

Terminal

codex mcp add saas-custom-domains --url https://mcp.saascustomdomains.com/mcp
codex mcp login saas-custom-domains

To use an API token instead, this reads it from the SCD_API_TOKEN environment variable:

Terminal

codex mcp add saas-custom-domains --url https://mcp.saascustomdomains.com/mcp \
  --bearer-token-env-var SCD_API_TOKEN

Or add it to ~/.codex/config.toml:

~/.codex/config.toml

[mcp_servers.saas-custom-domains]
url = "https://mcp.saascustomdomains.com/mcp"
bearer_token_env_var = "SCD_API_TOKEN"

Other clients

Any client that supports remote MCP servers over Streamable HTTP works. Use the URL above, and either sign in when the client asks (OAuth, with Client ID Metadata Documents or dynamic client registration) or send Authorization: Bearer <token>.

What signing in does

When a client connects by signing in, you approve it on our consent page, sign in to SaaS Custom Domains (with two-factor authentication if you use it), and click Continue. The client can then do anything you can, in all of your accounts.

We create an API token named after the client, for example MCP: Claude. It's listed under Settings » API. Delete it to disconnect the client; the client then asks you to sign in again. A sign-in lasts 30 days.

Limits

The MCP server calls the SaaS Custom Domains API with your token, so the API rate limits apply: 360 requests per minute per token, and 5 per minute for DNS checks. Each tool call makes one to a few API requests. A token you send in the header isn't stored. A token created when you sign in is stored encrypted and only used for your requests.