Nymwell MCP Server

Checks, read-only. kind "dns": website, www, email (MX/SPF/DKIM/DMARC) and DNSSEC findings with one-step fixes. kind "ssl": does HTTPS work, which certificate authorities issued certificates (certificate transparency logs), CAA suggestions. kind "transfer": can these names (domains, up to 20) move to Nymwell now, grouped ready / needs action / not possible, with reasons.

Before a sensitive action, ask whether it can happen now. For transfer_out, renew and cancel it returns state (eligible, action_required, blocked, in_progress), reasons with a code, the source (registry, namecom, nymwell), an until date when the block ends, the next action, and what the action requires (roles, Google confirmation, approval, payment). Staging checks the same rules again.

Everything public about one domain, wherever it is registered: registry record (registrar, created, expires, statuses, transfer lock, DNSSEC), DNS (nameservers and where it is hosted, A/AAAA, MX, SPF, DMARC, parked for sale), whether HTTPS answers, and the next step: a buy_url for a name with no record, or a transfer_url (and when a transfer becomes possible) for a registered one. No sign-in needed.

Move a domain to another Nymwell workspace (it stays at the registrar). action "list" (incoming and outgoing); "request" with domain and to_email (an owner or admin there accepts within 5 days; possible 10 days after registration); "accept" or "decline" an incoming move (id) sent to the person you act for; "cancel" an outgoing one (id).

The domain's own page: "for_sale" (price, minimum offer, offers reach the owner) or "parked". action "get" shows it and the offers; "save" turns it on or off (enabled) and changes mode, price_minor, min_offer_minor, headline or message; fields left out keep what is saved.

Live state of a domain this organization holds through Nymwell: expiry, renewal price, transfer lock, WHOIS privacy, registry locks, nameservers, contact verification and any transfer in progress.

Read DNSSEC DS records, URL forwarding, email forwarding or branded (vanity) nameservers for a domain, live from the registrar.

Add or remove tags on up to 500 domains at once (tags filter the domain list).

Change WHOIS privacy or the transfer lock. Applies at once when you act for an owner or admin and the workspace lets agents apply changes (the default); otherwise it waits in list_approvals. workflow.state says which.

Saved DNS templates. action "list"; "save" with name and records (or from_domain to copy a domain's records); "delete" with id.

action "export": the domain's records as a BIND zone file. action "import": a zone file becomes one change set of creates and deletes (dry_run: true only shows the plan).

List the DNS presets purchase_domain and apply_dns_preset accept (Vercel, Netlify, GitHub Pages, Cloudflare Pages, Agent Lab Deploy, Google Workspace email). No sign-in needed.

List DNS records for a managed domain. refresh: true first pulls the records from the registrar (including ones changed outside Nymwell).

Add a preset's DNS records to one domain this organization manages (records that already exist are skipped). Applies at once when you act for an owner or admin and the workspace lets agents apply changes (the default); otherwise it waits in list_approvals. workflow.state says which. undo_dns_apply takes it back.

Apply a DNS preset (list_dns_presets) or a saved template (tpl_…) to up to 100 domains at once; existing records are skipped. dry_run: true shows what each domain would get. Applies at once when you act for an owner or admin and the workspace lets agents apply changes.

Cancel a registration made in the last few days (the registry's add grace period, about 5 days): the domain is deleted and the payment refunded. Applies at once when you act for an owner or admin and the workspace lets agents apply changes (the default); otherwise it waits in list_approvals. workflow.state says which.

Cancel a transfer: direction "in" stops one coming to Nymwell (the payment is refunded), "out" stops a domain leaving for another registrar. Applies at once when you act for an owner or admin and the workspace lets agents apply changes (the default); otherwise it waits in list_approvals. workflow.state says which.

List domains visible to the signed-in Nymwell organization.

The authoritative check: which domain names can be registered and what they cost, from the live registrar (not DNS or RDAP). Call it on the few names you will offer, right before get_quote; for many names, run screen_domains first (it is free and wide). Up to 20 names: exact domains, or a name plus endings. If Nymwell is not connected to a live registrar, this tool refuses sandbox data; use screen_domains for a public-record first pass. Prices are USD for the minimum term; get_quote gives the exact price for a chosen term. Each name has tier (standard or premium) when it can be registered, or reason (domain_unavailable, extension_not_supported, extension_disallows_registration) when it cannot. No sign-in needed.

API keys of this workspace. action "list" (metadata only, never secrets); "create" with name, scopes (no wider than yours), expires_in_days (1-90), optional domain_allowlist and ip_allowlist; the secret is returned once. "revoke" with id. create and revoke need account:manage.

action "list" members and pending invitations; "invite" email with role (admin, billing_admin, domain_manager, dns_operator, viewer). Inviting needs account:manage.

Changes waiting for approval, and the ones already decided, each with workflow.state (action_required, in_progress, succeeded, failed). decide_approval approves or rejects one when you act for an owner or admin.

Read recent immutable audit evidence for the signed-in Nymwell organization: who (person, API key, OAuth app, schedule, registrar), how (console, API, MCP) and the outcome, with a summary. Reads are left out unless include_reads is true.

Turn Nymwell's auto-renew on or off for a domain. When it is on and the workspace has a saved card, Nymwell charges that card for a one-year renewal from 14 days before expiry (retrying 7, 3 and 1 day before); without a card it sends reminders instead. The answer says which applies. The registrar's own auto-renew always stays off.

Change DNSSEC, URL forwarding, email forwarding or a vanity nameserver. Applies at once when you act for an owner or admin and the workspace lets agents apply changes (the default); otherwise it waits in list_approvals. workflow.state says which. data: dnssec {key_tag, algorithm, digest_type, digest} (delete: digest); url_forwarding {host, forwards_to, type: masked|redirect|302, title?, meta?} (delete: host); email_forwarding {email_box, email_to} (delete: email_box); vanity_nameservers {hostname, ips} (delete: hostname).

AI apps connected over OAuth. action "list"; "revoke" with id disconnects one (needs account:manage).

Send Nymwell support a message (category: domain, dns, billing, transfer, account, other; optional domain). The team is alerted at once and replies to the email of the person you act for. action "notices" lists what Nymwell told the workspace (security changes, renewals, price changes).

Change contacts. registrant is required (it is the legal holder); admin, tech and billing are optional. A new registrant must confirm by email within 15 days or the domain stops resolving. Applies at once when you act for an owner or admin and the workspace lets agents apply changes (the default); otherwise it waits in list_approvals. workflow.state says which.

One look at the workspace: domain counts, what needs attention, recent notices, whether a card is saved, and the agent policy (do your changes apply at once, and how much you may charge to the saved card per order and per 30 days).

Approve or reject a change waiting in list_approvals (one prepared by a teammate or another agent). Needs the account:manage scope and an owner or admin behind you. An approved change is applied at once and recorded in the person's name, with you named.

List invoice metadata for the signed-in Nymwell organization.

The optional Managed Domain plan (managed DNS, SSL for secure redirects, renewal management; yearly on the saved card). action "get" shows price, status and the consent text; "enable" charges the first year (send accept_charge: true after the person agreed to the consent text; within the agent spending limits); "disable" stops renewal (no refund).

List members and roles for the signed-in Nymwell organization.

Change nameservers: 2 to 13 hostnames, or "default" to return to Nymwell DNS. Pointing elsewhere means the records in Nymwell stop applying. Applies at once when you act for an owner or admin and the workspace lets agents apply changes (the default); otherwise it waits in list_approvals. workflow.state says which.

Read Nymwell backend, database and provider-adapter readiness.

Read where a purchase is: awaiting_payment, registering, registered, needs_attention or failed_refunded, with the DNS records that were created. workflow.state says what to do: in_progress or blocked = check again later; action_required = give workflow.action.url to the person; succeeded or failed = stop (failed carries workflow.error).

Recent orders (registrations, renewals, transfers) with status, amount, how they were paid and by whom.

Buy what a quote priced (registration, renewal or transfer). You act for the person who connected you: when the workspace has a saved card and the amount is inside the agent spending limits (get_dashboard shows them), the card is charged at once and the order runs; the person is told. Otherwise (no card, over a limit, or pay_with "checkout") it returns a checkout_url and checkout_reason: give the link to the person to pay. The registrar call (and, for a registration, the DNS records you pass) then runs on its own. Poll get_order for the result. Nobody but a person can add or change the card.

Lock the exact price for one domain: action "register" (default) for an available name, "renew" for a domain this organization holds, or "transfer" to bring one from another registrar (adds one year; the owner then submits the auth code in the console). Valid for 40 minutes; purchase_domain charges exactly this.

Write a note on one DNS record (what it is for), shown next to it in the console. Empty note clears it.

Whether this organization has its registrant on file, and its details. The customer is the legal holder of every domain; save_registrant sets it and accepts the registration terms for the person you act for, before the first registration or transfer.

Unlock a domain and get its transfer auth code, to move it to another registrar. When applied, the code is in the result (shown once; owners get a notice). Not possible within 60 days of a registration or transfer. Applies at once when you act for an owner or admin and the workspace lets agents apply changes (the default); otherwise it waits in list_approvals. workflow.state says which.

Send the ICANN verification email again for one verification_id from list_unverified_contacts.

Set who every new domain is registered to (the legal holder) and accept the registration terms for the person you act for. Read links from get_registrant first and tell the person. contact: firstName, lastName, companyName?, address1, address2?, city, state?, zip?, country (2 letters), email, phone (+886.912345678). Needs account:manage.

The fast lookup, for many names at once (up to 500, or one name across every ending with tlds ["all"]): taken or not from DNS and public registry records (RDAP), with registrar and expiry, parked-for-sale, and for names with no record the ending's list price and a buy_url. Costs no registrar call, so use it first and widely; it is NOT availability, so confirm the names you will offer with search_domains (the registrar's answer and exact price). If the call runs out of lookups, pending lists the names to send again. No sign-in needed.

Change DNS records (create, update, delete), applied at the registrar in order. Applies at once when you act for an owner or admin and the workspace lets agents apply changes (the default); otherwise it waits in list_approvals. workflow.state says which. Values are checked first (invalid_record names the change and field). For update and delete, pass record_id from list_dns_records when a name has more than one record of that type.

Start a transfer in: give the auth code from the current registrar. Nymwell seals the code at rest, checks the name is held elsewhere, and returns a transfer quote; then call purchase_domain with its quote_id. A name nobody holds returns domain_not_exists (register it instead).

Names a live registrar can sell now that fit a keyword, with prices (registration inventory only). Sandbox suggestions are refused; use screen_domains until nymwell_status reports a live registrar. No sign-in needed.

What an ending costs (registration, renewal, transfer) and its rules: allowed terms, days left to renew after expiry, WHOIS privacy, DNSSEC, HSTS preload. Pass up to 10 tlds for live answers, or none for every ending Nymwell sells (the same list as https://nymwell.com/tlds.json). No sign-in needed.

Track a domain registered elsewhere (expiry, registrar, DNS) without moving it. Nymwell reads public registry data daily and reminds you before it expires.

Transfers into Nymwell for this organization and where each one is.

Take back the records the last preset or template added to a domain (only those still there).

Registrant emails still waiting for ICANN verification on this organization's domains, with the deadline. A domain whose registrant misses it stops resolving.

What every new domain starts with: auto_renew, transfer_lock, privacy, dns_preset {preset, target}, forward_to, tags. action "get"; "save" (fields left out keep what is saved); "apply" puts them on the given domains now.