THE NYMWELL FOUNDATION
Give agents tools.
Keep human authority.
A hosted MCP server with 30 tools: search, buy, renew, transfer and run domains, with a person approving every change.
Connect to
/mcp (Streamable HTTP, JSON-RPC). Sites-authenticated callers and scoped X-Nymwell-Key agent keys are isolated per organization. Registration, renewal, transfers and domain changes run only where the server has a registrar and a payment provider configured; nymwell_status and GET /api/v1/status say which. Without them those calls answer integration_not_configured and nothing is charged.| Tool | Access | What it does |
|---|---|---|
nymwell_status | Public | Read Nymwell backend, database and provider-adapter readiness. |
list_domains | Read / scoped | List domains visible to the signed-in Nymwell organization. |
list_dns_records | Read / scoped | List DNS records for a managed domain. refresh: true first pulls the records from the registrar (including ones changed outside Nymwell). |
list_invoices | Read / scoped | List invoice metadata for the signed-in Nymwell organization. |
list_members | Read / scoped | List members and roles for the signed-in Nymwell organization. |
list_audit_events | Read / scoped | Read recent immutable audit evidence for the signed-in Nymwell organization. |
stage_dns_change | Needs approval | Prepare DNS changes (create, update, delete) for review. Nothing is written until an owner or admin approves; then Nymwell applies them at the registrar in order. For update and delete, pass record_id from list_dns_records when a name has more than one record of that type. |
search_domains | Public | Check which domain names can be registered and what they cost, from the registrar itself (not DNS or RDAP). Pass exact domains, or a name plus endings. Prices are USD for the minimum term; get_quote gives the exact price for a chosen term. No sign-in needed. |
screen_domains | Public | Fast first pass over many names: is there a registration record, since when, with which registrar, is it parked for sale. Uses public RDAP and DNS, so it works before any registrar is configured. It is NOT availability: no_record still has to be confirmed with search_domains or get_quote. No sign-in needed. |
get_quote | Paid by the person | Lock the exact price for one domain: action "register" (default) for an available name, "renew" for a domain this organization holds, or "transfer" to bring one from another registrar (adds one year; the owner then submits the auth code in the console). Valid for 40 minutes; purchase_domain charges exactly this. |
purchase_domain | Paid by the person | Start paying for a quote (registration, renewal or transfer). Returns a checkout_url: give it to the person, who pays once; paying is their approval. The registrar call (and, for a registration, the DNS records you pass) then runs on its own. Poll get_order for the result. An agent never pays by itself. |
get_order | Read / scoped | Read where a purchase is: awaiting_payment, registering, registered, needs_attention or failed_refunded, with the DNS records that were created. |
list_dns_presets | Public | List the DNS presets purchase_domain and apply_dns_preset accept (Vercel, Netlify, GitHub Pages, Cloudflare Pages, Agent Lab Deploy, Google Workspace email). No sign-in needed. |
apply_dns_preset | Needs approval | Prepare DNS records for a domain this organization already manages. It creates a change set a person approves in the console; nothing is written before that. |
suggest_domains | Public | Names the registrar can sell now that fit a keyword, with prices (registration inventory only). No sign-in needed. |
get_tld_info | Public | What an ending costs (registration, renewal, transfer) and its rules: allowed terms, days left to renew after expiry, WHOIS privacy, DNSSEC, HSTS preload. No sign-in needed. |
get_domain | Read / scoped | Live state of a domain this organization holds through Nymwell: expiry, renewal price, transfer lock, WHOIS privacy, registry locks, nameservers, contact verification and any transfer in progress. |
set_auto_renew | Read / scoped | Record whether this domain should be renewed. No money moves; Nymwell reminds the workspace 30 and 7 days before expiry, and every renewal is a checkout the person pays. The registrar's own auto-renew always stays off. |
update_domain_settings | Needs approval | Prepare a WHOIS privacy or transfer lock change. An owner or admin approves it in the console before the registrar is touched. |
set_nameservers | Needs approval | Prepare a nameserver change: 2 to 13 hostnames, or "default" to return to Nymwell DNS. Pointing elsewhere means the records in Nymwell stop applying. Needs approval. |
set_contacts | Needs approval | Prepare a contact change. registrant is required (it is the legal holder); admin, tech and billing are optional. A new registrant must confirm by email within 15 days or the domain stops resolving. Needs approval. |
request_auth_code | Needs approval | Prepare unlocking a domain and revealing its transfer auth code, to move it to another registrar. After approval the code is shown once to the approving person; an agent never sees it. Not possible within 60 days of a registration or transfer. |
cancel_registration | Needs approval | Prepare cancelling a registration made in the last few days (the registry's add grace period, about 5 days). Once approved the domain is deleted and the payment refunded. |
list_domain_services | Read / scoped | Read DNSSEC DS records, URL forwarding, email forwarding or branded (vanity) nameservers for a domain, live from the registrar. |
change_domain_service | Needs approval | Prepare a DNSSEC, URL forwarding, email forwarding or vanity nameserver change. Needs approval. data: dnssec {key_tag, algorithm, digest_type, digest} (delete: digest); url_forwarding {host, forwards_to, type: masked|redirect|302, title?, meta?} (delete: host); email_forwarding {email_box, email_to} (delete: email_box); vanity_nameservers {hostname, ips} (delete: hostname). |
list_transfers | Read / scoped | Transfers into Nymwell for this organization and where each one is. |
cancel_transfer | Needs approval | Prepare cancelling a transfer: direction "in" stops one coming to Nymwell (the payment is refunded), "out" stops a domain leaving for another registrar. Needs approval. |
list_unverified_contacts | Read / scoped | Registrant emails still waiting for ICANN verification on this organization's domains, with the deadline. A domain whose registrant misses it stops resolving. |
list_approvals | Read / scoped | Changes waiting for a person to approve, and the ones already decided. Approving is done by a person in the console, never through MCP. |
resend_contact_verification | Read / scoped | Send the ICANN verification email again for one verification_id from list_unverified_contacts. |
Hosted authorization
Sites authenticates the MCP caller and forwards the signed-in user identity; agent keys carry scopes, a domain allowlist and an expiry. Nymwell applies the same server-side boundary as the REST API. External OAuth client registration is not enabled.
Secrets stay outside the model
A transfer auth code is entered by the signed-in owner (POST /api/v1/transfers), sealed with AES-GCM and wiped once the transfer is submitted; it is never a tool argument. An outgoing auth code is shown once, to the person who approved revealing it.
Approval cannot come from the model
Agents prepare; people decide. Buying, renewing and transferring are approved by paying the checkout. Settings, nameservers, contacts, DNS, forwarding, DNSSEC and cancellations wait for an owner or admin to approve in the console; list_approvals shows where each one is. There is no approval tool.