---
title: MCP and sign-in
description: Connect claude.ai, ChatGPT, Claude Code, Codex or any MCP client to Nymwell, with or without the person's Google sign-in.
---

# MCP and sign-in

Nymwell runs a hosted MCP server: Streamable HTTP, JSON-RPC over POST. A GET answers 405; there is no SSE stream. Two addresses serve the same tools.

| Address | Sign-in | What works |
| --- | --- | --- |
| `https://nymwell.com/mcp` | None | Search, prices, endings, DNS presets and buy links. Account tools answer with how to sign in. |
| `https://nymwell.com/mcp/account` | Google, once (OAuth 2.1) | Everything above, plus quotes, checkouts the person pays, renewals, transfers and DNS changes the person approves. |

## Connect with sign-in

- **claude.ai or Claude Desktop:** Settings → Connectors → Add custom connector, and paste `https://nymwell.com/mcp/account`.
- **ChatGPT:** add a connector in developer mode with `https://nymwell.com/mcp/account` and OAuth.
- **Claude Code:** run the command below, then `/mcp` and choose Authenticate.
- **Codex:** run the commands below.

```bash
claude mcp add --transport http nymwell https://nymwell.com/mcp/account

codex mcp add nymwell --url https://nymwell.com/mcp/account
codex mcp login nymwell
```

Other clients: `{"mcpServers": {"nymwell": {"url": "https://nymwell.com/mcp/account"}}}`.

The person sees a Nymwell page that names the app, the workspace and what the app may do, and allows it. Only a workspace owner or admin can. They can disconnect the app any time in AI Agents.

## Connect without sign-in

```bash
claude mcp add --transport http nymwell https://nymwell.com/mcp
```

`search_domains` returns a `buy_url` for every name that can be registered; the person opens it, signs in and pays. When an agent calls an account tool here, the answer says to use `buy_url` or connect to `/mcp/account`, and carries a `mcp/www_authenticate` challenge that ChatGPT uses to link the account.

## How sign-in works

For client developers. Nymwell is its own OAuth 2.1 authorization server, issuer `https://nymwell.com`.

| What | Where |
| --- | --- |
| Protected resource metadata | https://nymwell.com/.well-known/oauth-protected-resource/mcp/account |
| Authorization server metadata | https://nymwell.com/.well-known/oauth-authorization-server |
| Authorization | `https://nymwell.com/oauth/authorize` (code flow, PKCE S256 required) |
| Token | `https://nymwell.com/oauth/token` (authorization_code, refresh_token) |
| Dynamic client registration | `https://nymwell.com/oauth/clients` |
| Revocation | `https://nymwell.com/oauth/revoke` |

- Clients identify themselves with a Client ID Metadata Document (an https `client_id`) or by dynamic registration.
- Send `resource` (RFC 8707) as `https://nymwell.com/mcp/account`. Responses carry `iss` (RFC 9207).
- Scope: `account`. Access tokens last an hour; refresh tokens rotate and last 60 days.
- Without a token, `/mcp/account` answers 401 with `WWW-Authenticate: Bearer resource_metadata="…", scope="account"`.
- Tokens work on MCP only, never on the REST API. A grant stops working if the person who allowed it is no longer an owner or admin.

## Agent keys, for scripts

Scripts and servers can send an agent key instead of signing in: `X-Nymwell-Key: nw_live_…` or `Authorization: Bearer nw_live_…`. A signed-in owner creates it in AI Agents, or with `POST /api/v1/api-keys` (scopes, an optional domain allowlist, an expiry of up to 90 days). It is shown once. Never ask a person to paste it into a conversation.

## Tools

`tools/list` marks each tool with `securitySchemes`: `noauth` for the public ones, `oauth2` for the rest.

| Tool | Access | What it does |
| --- | --- | --- |
| `nymwell_status` | Public | Read Nymwell backend, database and provider-adapter readiness. |
| `list_domains` | Signed in | List domains visible to the signed-in Nymwell organization. |
| `list_dns_records` | Signed in | List DNS records for a managed domain. refresh: true first pulls the records from the registrar (including ones changed outside Nymwell). |
| `list_invoices` | Signed in | List invoice metadata for the signed-in Nymwell organization. |
| `list_members` | Signed in | List members and roles for the signed-in Nymwell organization. |
| `list_audit_events` | Signed in | Read recent immutable audit evidence for the signed-in Nymwell organization: who (person, API key, OAuth app, schedule, registrar), how (console, API, MCP) and the outcome, with a summary. Reads are left out unless include_reads is true. |
| `check_domain_eligibility` | Signed in | Before a sensitive action, ask whether it can happen now. For transfer_out, renew and cancel it returns state (eligible, action_required, blocked, in_progress), reasons with a code, the source (registry, namecom, nymwell), an until date when the block ends, the next action, and what the action requires (roles, Google confirmation, approval, payment). Staging checks the same rules again. |
| `stage_dns_change` | Signed in | Prepare DNS changes (create, update, delete) for review. Nothing is written until an owner or admin approves; then Nymwell applies them at the registrar in order. For update and delete, pass record_id from list_dns_records when a name has more than one record of that type. |
| `search_domains` | Public | Check which domain names can be registered and what they cost from a live registrar (not DNS or RDAP). Pass exact domains, or a name plus endings. If Nymwell is not connected to a live registrar, this tool refuses sandbox data; use screen_domains for a public-record first pass. Prices are USD for the minimum term; get_quote gives the exact price for a chosen term. Each name has tier (standard or premium) when it can be registered, or reason (domain_unavailable, extension_not_supported, extension_disallows_registration) when it cannot. No sign-in needed. |
| `screen_domains` | Public | Fast first pass over many names: is there a registration record, since when, with which registrar, is it parked for sale. Uses public RDAP and DNS, so it works before any registrar is configured. It is NOT availability: no_record still has to be confirmed with search_domains or get_quote after nymwell_status reports a live registrar. No sign-in needed. |
| `get_quote` | Signed in | Lock the exact price for one domain: action "register" (default) for an available name, "renew" for a domain this organization holds, or "transfer" to bring one from another registrar (adds one year; the owner then submits the auth code in the console). Valid for 40 minutes; purchase_domain charges exactly this. |
| `purchase_domain` | Signed in | Start paying for a quote (registration, renewal or transfer). Returns a checkout_url: give it to the person, who pays once; paying is their approval. The registrar call (and, for a registration, the DNS records you pass) then runs on its own. Poll get_order for the result. An agent never pays by itself. |
| `get_order` | Signed in | Read where a purchase is: awaiting_payment, registering, registered, needs_attention or failed_refunded, with the DNS records that were created. workflow.state says what to do: in_progress or blocked = check again later; action_required = give workflow.action.url to the person; succeeded or failed = stop (failed carries workflow.error). |
| `list_dns_presets` | Public | List the DNS presets purchase_domain and apply_dns_preset accept (Vercel, Netlify, GitHub Pages, Cloudflare Pages, Agent Lab Deploy, Google Workspace email). No sign-in needed. |
| `apply_dns_preset` | Signed in | Prepare DNS records for a domain this organization already manages. It creates a change set a person approves in the console; nothing is written before that. |
| `suggest_domains` | Public | Names a live registrar can sell now that fit a keyword, with prices (registration inventory only). Sandbox suggestions are refused; use screen_domains until nymwell_status reports a live registrar. No sign-in needed. |
| `get_tld_info` | Public | What an ending costs (registration, renewal, transfer) and its rules: allowed terms, days left to renew after expiry, WHOIS privacy, DNSSEC, HSTS preload. No sign-in needed. |
| `get_domain` | Signed in | Live state of a domain this organization holds through Nymwell: expiry, renewal price, transfer lock, WHOIS privacy, registry locks, nameservers, contact verification and any transfer in progress. |
| `set_auto_renew` | Signed in | Turn Nymwell's auto-renew on or off for a domain. When it is on and the workspace has a saved card, Nymwell charges that card for a one-year renewal from 14 days before expiry (retrying 7, 3 and 1 day before); without a card it sends reminders instead. The answer says which applies. The registrar's own auto-renew always stays off. |
| `update_domain_settings` | Signed in | Prepare a WHOIS privacy or transfer lock change. An owner or admin approves it in the console before the registrar is touched. |
| `set_nameservers` | Signed in | Prepare a nameserver change: 2 to 13 hostnames, or "default" to return to Nymwell DNS. Pointing elsewhere means the records in Nymwell stop applying. Needs approval. |
| `set_contacts` | Signed in | Prepare a contact change. registrant is required (it is the legal holder); admin, tech and billing are optional. A new registrant must confirm by email within 15 days or the domain stops resolving. Needs approval. |
| `request_auth_code` | Signed in | Prepare unlocking a domain and revealing its transfer auth code, to move it to another registrar. After approval the code is shown once to the approving person; an agent never sees it. Not possible within 60 days of a registration or transfer. |
| `cancel_registration` | Signed in | Prepare cancelling a registration made in the last few days (the registry's add grace period, about 5 days). Once approved the domain is deleted and the payment refunded. |
| `list_domain_services` | Signed in | Read DNSSEC DS records, URL forwarding, email forwarding or branded (vanity) nameservers for a domain, live from the registrar. |
| `change_domain_service` | Signed in | Prepare a DNSSEC, URL forwarding, email forwarding or vanity nameserver change. Needs approval. data: dnssec {key_tag, algorithm, digest_type, digest} (delete: digest); url_forwarding {host, forwards_to, type: masked/redirect/302, title?, meta?} (delete: host); email_forwarding {email_box, email_to} (delete: email_box); vanity_nameservers {hostname, ips} (delete: hostname). |
| `list_transfers` | Signed in | Transfers into Nymwell for this organization and where each one is. |
| `cancel_transfer` | Signed in | Prepare cancelling a transfer: direction "in" stops one coming to Nymwell (the payment is refunded), "out" stops a domain leaving for another registrar. Needs approval. |
| `list_unverified_contacts` | Signed in | Registrant emails still waiting for ICANN verification on this organization's domains, with the deadline. A domain whose registrant misses it stops resolving. |
| `get_registrant` | Signed in | Whether this organization has its registrant on file. The customer is the legal holder of every domain; a signed-in person enters the registrant and accepts the terms in the console before the first registration or transfer. |
| `list_approvals` | Signed in | Changes waiting for a person to approve, and the ones already decided, each with workflow.state (action_required, in_progress, succeeded, failed). Approving is done by a person in the console, never through MCP. |
| `resend_contact_verification` | Signed in | Send the ICANN verification email again for one verification_id from list_unverified_contacts. |

Schemas: https://nymwell.com/mcp-tools.json · Server card: https://nymwell.com/.well-known/mcp/server-card.json · Official MCP Registry: `com.nymwell/mcp`