NYMWELL 的基礎
交給 Agent 工具，
把決策權留給人。
託管 MCP 伺服器提供 30 個工具：搜尋、購買、續約、轉入與管理網域，每項變更都由人核准。
連線到
/mcp（Streamable HTTP、JSON-RPC）。Sites 驗證身分的呼叫者與限定範圍的 X-Nymwell-Key agent key 都按組織隔離。 註冊、續約、轉入與網域變更，只在伺服器已設定註冊商與金流時執行；nymwell_status 與 GET /api/v1/status 會說明目前狀態。未設定時這些呼叫回傳 integration_not_configured，不會收費。| Tool | 權限 | 用途 |
|---|---|---|
nymwell_status | 公開 | Read Nymwell backend, database and provider-adapter readiness. |
list_domains | 讀取／限定範圍 | List domains visible to the signed-in Nymwell organization. |
list_dns_records | 讀取／限定範圍 | List DNS records for a managed domain. refresh: true first pulls the records from the registrar (including ones changed outside Nymwell). |
list_invoices | 讀取／限定範圍 | List invoice metadata for the signed-in Nymwell organization. |
list_members | 讀取／限定範圍 | List members and roles for the signed-in Nymwell organization. |
list_audit_events | 讀取／限定範圍 | Read recent immutable audit evidence for the signed-in Nymwell organization. |
stage_dns_change | 需人工核准 | Prepare DNS changes (create, update, delete) for review. Nothing is written until an owner or admin approves; then Nymwell applies them at the registrar in order. For update and delete, pass record_id from list_dns_records when a name has more than one record of that type. |
search_domains | 公開 | Check which domain names can be registered and what they cost, from the registrar itself (not DNS or RDAP). Pass exact domains, or a name plus endings. Prices are USD for the minimum term; get_quote gives the exact price for a chosen term. No sign-in needed. |
screen_domains | 公開 | Fast first pass over many names: is there a registration record, since when, with which registrar, is it parked for sale. Uses public RDAP and DNS, so it works before any registrar is configured. It is NOT availability: no_record still has to be confirmed with search_domains or get_quote. No sign-in needed. |
get_quote | 由本人付款 | Lock the exact price for one domain: action "register" (default) for an available name, "renew" for a domain this organization holds, or "transfer" to bring one from another registrar (adds one year; the owner then submits the auth code in the console). Valid for 40 minutes; purchase_domain charges exactly this. |
purchase_domain | 由本人付款 | Start paying for a quote (registration, renewal or transfer). Returns a checkout_url: give it to the person, who pays once; paying is their approval. The registrar call (and, for a registration, the DNS records you pass) then runs on its own. Poll get_order for the result. An agent never pays by itself. |
get_order | 讀取／限定範圍 | Read where a purchase is: awaiting_payment, registering, registered, needs_attention or failed_refunded, with the DNS records that were created. |
list_dns_presets | 公開 | List the DNS presets purchase_domain and apply_dns_preset accept (Vercel, Netlify, GitHub Pages, Cloudflare Pages, Agent Lab Deploy, Google Workspace email). No sign-in needed. |
apply_dns_preset | 需人工核准 | Prepare DNS records for a domain this organization already manages. It creates a change set a person approves in the console; nothing is written before that. |
suggest_domains | 公開 | Names the registrar can sell now that fit a keyword, with prices (registration inventory only). No sign-in needed. |
get_tld_info | 公開 | What an ending costs (registration, renewal, transfer) and its rules: allowed terms, days left to renew after expiry, WHOIS privacy, DNSSEC, HSTS preload. No sign-in needed. |
get_domain | 讀取／限定範圍 | Live state of a domain this organization holds through Nymwell: expiry, renewal price, transfer lock, WHOIS privacy, registry locks, nameservers, contact verification and any transfer in progress. |
set_auto_renew | 讀取／限定範圍 | Record whether this domain should be renewed. No money moves; Nymwell reminds the workspace 30 and 7 days before expiry, and every renewal is a checkout the person pays. The registrar's own auto-renew always stays off. |
update_domain_settings | 需人工核准 | Prepare a WHOIS privacy or transfer lock change. An owner or admin approves it in the console before the registrar is touched. |
set_nameservers | 需人工核准 | Prepare a nameserver change: 2 to 13 hostnames, or "default" to return to Nymwell DNS. Pointing elsewhere means the records in Nymwell stop applying. Needs approval. |
set_contacts | 需人工核准 | Prepare a contact change. registrant is required (it is the legal holder); admin, tech and billing are optional. A new registrant must confirm by email within 15 days or the domain stops resolving. Needs approval. |
request_auth_code | 需人工核准 | Prepare unlocking a domain and revealing its transfer auth code, to move it to another registrar. After approval the code is shown once to the approving person; an agent never sees it. Not possible within 60 days of a registration or transfer. |
cancel_registration | 需人工核准 | Prepare cancelling a registration made in the last few days (the registry's add grace period, about 5 days). Once approved the domain is deleted and the payment refunded. |
list_domain_services | 讀取／限定範圍 | Read DNSSEC DS records, URL forwarding, email forwarding or branded (vanity) nameservers for a domain, live from the registrar. |
change_domain_service | 需人工核准 | Prepare a DNSSEC, URL forwarding, email forwarding or vanity nameserver change. Needs approval. data: dnssec {key_tag, algorithm, digest_type, digest} (delete: digest); url_forwarding {host, forwards_to, type: masked|redirect|302, title?, meta?} (delete: host); email_forwarding {email_box, email_to} (delete: email_box); vanity_nameservers {hostname, ips} (delete: hostname). |
list_transfers | 讀取／限定範圍 | Transfers into Nymwell for this organization and where each one is. |
cancel_transfer | 需人工核准 | Prepare cancelling a transfer: direction "in" stops one coming to Nymwell (the payment is refunded), "out" stops a domain leaving for another registrar. Needs approval. |
list_unverified_contacts | 讀取／限定範圍 | Registrant emails still waiting for ICANN verification on this organization's domains, with the deadline. A domain whose registrant misses it stops resolving. |
list_approvals | 讀取／限定範圍 | Changes waiting for a person to approve, and the ones already decided. Approving is done by a person in the console, never through MCP. |
resend_contact_verification | 讀取／限定範圍 | Send the ICANN verification email again for one verification_id from list_unverified_contacts. |
託管身分驗證
Sites 驗證 MCP 呼叫者並轉送已登入身分；agent key 帶有 scopes、網域允許清單與期限。Nymwell 套用與 REST API 相同的伺服器端界線。外部 OAuth client 註冊尚未啟用。
秘密不進入模型
轉入授權碼由已登入的持有人輸入（POST /api/v1/transfers），以 AES-GCM 加密保存，送出轉移後即刪除，絕不作為工具參數。轉出授權碼只在核准後顯示一次給核准者本人。
模型不能替人核准
Agent 負責準備，人負責決定。購買、續約與轉入由付款完成核准；設定、名稱伺服器、聯絡人、DNS、轉址、DNSSEC 與取消，都等待擁有者或管理員在控制台核准；list_approvals 可查進度。MCP 沒有核准工具。