MCP Server

Nexus GSLB MCP Server

gslb-mcp is a Model Context Protocol server that exposes Nexus GSLB cluster state and configuration to AI platforms. Operators can query the live topology, get AI-assisted recommendations, and (optionally) apply configuration changes — all from tools like Claude Desktop, Cursor, or Zed.

Installation

Build from source alongside the other Nexus binaries:

CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -ldflags="-s -w" \
  -o gslb-mcp-linux-amd64 ./cmd/gslb-mcp

Or run locally (macOS/Linux, native arch):

go build -o gslb-mcp ./cmd/gslb-mcp

Configuration

Flag	Env var	Required	Description
`--api-url`	`NEXUS_API_URL`	Yes	Base URL of the Nexus GSLB API, e.g. `https://gslb.example.com`
`--api-key`	`NEXUS_API_KEY`	Yes	API key with at least read access
`--allow-writes`	—	No (default: off)	Enable service-affecting write tools

Claude Desktop setup

Add to ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "nexus-gslb": {
      "command": "/usr/local/bin/gslb-mcp",
      "args": [],
      "env": {
        "NEXUS_API_URL": "https://gslb.example.com",
        "NEXUS_API_KEY": "your-api-key-here"
      }
    }
  }
}

To enable write tools, add "--allow-writes" to the args array. See the write tools warning before doing so.

Read tools (always available)

These tools are safe to expose to any operator. They are read-only and have no effect on live traffic.

Core topology

Tool	Description
`get_topology`	Full cluster snapshot: services, pools, members, health. Start here.
`get_dashboard_stats`	High-level health summary and counts
`list_services`	All GSLB services with domain and algorithm
`get_service`	Single service details (pool, algorithm, filter chain, TTL)
`list_pools`	All member pools
`get_pool`	Single pool details
`get_pool_status`	Live health status for all members in a pool
`list_members`	All members in a pool (IP, port, weight, region, enabled)
`get_member`	Single member details
`get_member_status`	Live health score for a member (0.0–1.0)
`get_health_check`	Health check config for a pool
`list_geo_rules`	Geo-routing rules for a pool

Observability

Tool	Description
`get_metrics_summary`	Per-service QPS and average latency from the last 60-second window

Cluster & infrastructure

Tool	Description
`get_cluster_status`	NATS cluster status, peer nodes, and JetStream metrics
`get_cluster_report`	Detailed NATS cluster report: routes, streams, consumers, raft state
`get_bgp_status`	BGP RHI advertisement status and prefix list
`get_tls_status`	TLS mode, certificate subject/SANs/expiry, ACME config

DNS configuration

Tool	Description
`list_domains`	All delegated DNS zones
`list_redirects`	All HTTP redirect rules
`list_txt_records`	All static TXT DNS records
`list_tsig_keys`	All TSIG keys for RFC 2136 dynamic DNS (secrets redacted)
`list_rrl_allowlist`	All RRL-exempt CIDRs

DNSSEC

Tool	Description
`get_dnssec_status`	Signing status: active key IDs, rollover state
`list_dnssec_keys`	All ZSK/KSK keys, algorithm, state, and expiry
`get_dnssec_ds`	DS records for the active KSK (paste into parent zone)
`get_dnssec_rollover_status`	Current rollover phase (pre-publish / double-signing / done)

Alerting

Tool	Description
`list_alert_channels`	All alert channels (SMTP, PagerDuty, OpsGenie, Webhook)
`get_alert_channel`	Single channel details

Identity & access

Tool	Description
`list_users`	All user accounts (email, role, TOTP status)
`list_roles`	All RBAC roles and permission sets
`list_tenants`	All tenants
`get_usage`	Resource counts vs. license limits for the current tenant
`get_license`	License tier, feature limits, and expiry

Write tools

⚠️ WARNING — service-affecting

Write tools modify live cluster configuration. Changes take effect immediately in the DNS rotation and can cause traffic shifts, service disruptions, or member outages. Only enable --allow-writes if:

You have reviewed what each tool does

Your API key belongs to an account with appropriate permissions

Operators understand that the AI may make mistakes and should review actions before confirming them

Write tools are not registered unless the server is started with --allow-writes. This is intentional: the default mode is an AI assistant that helps operators understand the cluster and plan changes, not an autonomous agent that applies them.

Traffic management

Tool	Impact
`set_member_weight`	Shifts traffic distribution immediately
`enable_member`	Adds a member back into the DNS rotation
`disable_member`	Removes a member from the DNS rotation (no connection draining)
`create_member`	Adds a new backend to a pool
`delete_member`	Permanently removes a member (irreversible)
`create_pool`	Creates an empty pool (no traffic impact until assigned to a service)
`update_service`	Reassigns pool or changes algorithm for a service
`upsert_health_check`	Creates or updates health check parameters for a pool

Alerting

Tool	Impact
`test_alert_channel`	Sends a test notification to verify channel delivery
`create_alert_channel`	Creates a new notification channel
`delete_alert_channel`	Permanently deletes a notification channel

DNS management

Tool	Impact
`create_txt_record`	Creates a static TXT record served immediately
`delete_txt_record`	Deletes a TXT record (stops being served immediately)
`create_redirect`	Creates an HTTP redirect rule (active immediately)
`delete_redirect`	Deletes an HTTP redirect rule

Recommended usage pattern

Ask the AI to call get_topology to load the current cluster state
Describe what you want to achieve ("I want to shift all EU traffic to the new pool")
The AI will analyse the topology and recommend the specific configuration steps
Review the recommendation, then either apply it manually via the WebUI/TUI or ask the AI to apply it (write tools required)

This keeps the AI in an advisory role by default and makes human review an explicit step.