MCP 與登入

Nymwell 提供託管的 MCP 伺服器：Streamable HTTP，以 POST 傳 JSON-RPC（GET 會回 405，沒有 SSE 串流）。兩個位址提供同一組工具。

位址	登入	可以做什麼
`https://nymwell.com/mcp`	不需要	查詢、價格、結尾規則、DNS 預設與購買連結。帳戶工具會回覆如何登入。
`https://nymwell.com/mcp/account`	Google 登入一次（OAuth 2.1）	以上全部，另外可報價、建立由使用者付款的結帳、續約、轉入，以及等使用者核准的 DNS 變更

登入後連線

claude.ai 或 Claude Desktop： 設定 → Connectors → 新增自訂 connector，貼上 https://nymwell.com/mcp/account。
ChatGPT： 以開發者模式新增 connector，填 https://nymwell.com/mcp/account，驗證選 OAuth。
Claude Code： 執行下方指令，再執行 /mcp 選 Authenticate。
Codex： 執行下方指令。

claude mcp add --transport http nymwell https://nymwell.com/mcp/account

codex mcp add nymwell --url https://nymwell.com/mcp/account
codex mcp login nymwell

其他 client：{"mcpServers": {"nymwell": {"url": "https://nymwell.com/mcp/account"}}}。

使用者會看到 Nymwell 的授權頁，上面寫著是哪個應用程式、哪個工作空間、可以做什麼，按「允許」即可。只有工作空間的擁有者或管理員能允許，之後隨時可在「AI Agents」中斷連接。

不登入連線

claude mcp add --transport http nymwell https://nymwell.com/mcp

search_domains 會為每個可註冊的網域附上 buy_url，使用者打開後登入付款即可。在這個位址呼叫帳戶工具時，回覆會說明改用 buy_url 或連到 /mcp/account，並附上 ChatGPT 用來連結帳號的 mcp/www_authenticate 挑戰。

登入流程（給 client 開發者）

Nymwell 自己就是 OAuth 2.1 授權伺服器，issuer 為 https://nymwell.com。

項目	位址
Protected resource metadata	https://nymwell.com/.well-known/oauth-protected-resource/mcp/account
Authorization server metadata	https://nymwell.com/.well-known/oauth-authorization-server
授權	`https://nymwell.com/oauth/authorize`（authorization code，必須用 PKCE S256）
Token	`https://nymwell.com/oauth/token`（authorization_code、refresh_token）
動態註冊 client	`https://nymwell.com/oauth/clients`
撤銷	`https://nymwell.com/oauth/revoke`

Client 可用 Client ID Metadata Document（https 形式的 client_id）或動態註冊識別自己。
resource（RFC 8707）請送 https://nymwell.com/mcp/account；回應都帶 iss（RFC 9207）。
Scope 為 account。Access token 效期一小時；refresh token 每次輪替、效期 60 天。
沒有 token 時，/mcp/account 回 401 與 WWW-Authenticate: Bearer resource_metadata="…", scope="account"。
Token 只能用在 MCP，不能用在 REST API。允許授權的人若不再是擁有者或管理員，授權即失效。

Agent key（給腳本用）

腳本與伺服器可以不登入，改送 agent key：X-Nymwell-Key: nw_live_… 或 Authorization: Bearer nw_live_…。由已登入的擁有者在「AI Agents」或用 POST /api/v1/api-keys 建立（可設權限範圍、網域允許清單、最長 90 天），只會顯示一次。絕不要請使用者把 key 貼進對話。

工具

tools/list 會用 securitySchemes 標示每個工具：公開工具為 noauth，其餘為 oauth2。

Tool	權限	用途
`nymwell_status`	公開	Read Nymwell backend, database and provider-adapter readiness.
`list_domains`	需登入	List domains visible to the signed-in Nymwell organization.
`list_dns_records`	需登入	List DNS records for a managed domain. refresh: true first pulls the records from the registrar (including ones changed outside Nymwell).
`list_invoices`	需登入	List invoice metadata for the signed-in Nymwell organization.
`list_members`	需登入	List members and roles for the signed-in Nymwell organization.
`list_audit_events`	需登入	Read recent immutable audit evidence for the signed-in Nymwell organization: who (person, API key, OAuth app, schedule, registrar), how (console, API, MCP) and the outcome, with a summary. Reads are left out unless include_reads is true.
`check_domain_eligibility`	需登入	Before a sensitive action, ask whether it can happen now. For transfer_out, renew and cancel it returns state (eligible, action_required, blocked, in_progress), reasons with a code, the source (registry, namecom, nymwell), an until date when the block ends, the next action, and what the action requires (roles, Google confirmation, approval, payment). Staging checks the same rules again.
`stage_dns_change`	需登入	Prepare DNS changes (create, update, delete) for review. Nothing is written until an owner or admin approves; then Nymwell applies them at the registrar in order. For update and delete, pass record_id from list_dns_records when a name has more than one record of that type.
`search_domains`	公開	Check which domain names can be registered and what they cost from a live registrar (not DNS or RDAP). Pass exact domains, or a name plus endings. If Nymwell is not connected to a live registrar, this tool refuses sandbox data; use screen_domains for a public-record first pass. Prices are USD for the minimum term; get_quote gives the exact price for a chosen term. Each name has tier (standard or premium) when it can be registered, or reason (domain_unavailable, extension_not_supported, extension_disallows_registration) when it cannot. No sign-in needed.
`screen_domains`	公開	Fast first pass over many names: is there a registration record, since when, with which registrar, is it parked for sale. Uses public RDAP and DNS, so it works before any registrar is configured. It is NOT availability: no_record still has to be confirmed with search_domains or get_quote after nymwell_status reports a live registrar. No sign-in needed.
`get_quote`	需登入	Lock the exact price for one domain: action "register" (default) for an available name, "renew" for a domain this organization holds, or "transfer" to bring one from another registrar (adds one year; the owner then submits the auth code in the console). Valid for 40 minutes; purchase_domain charges exactly this.
`purchase_domain`	需登入	Start paying for a quote (registration, renewal or transfer). Returns a checkout_url: give it to the person, who pays once; paying is their approval. The registrar call (and, for a registration, the DNS records you pass) then runs on its own. Poll get_order for the result. An agent never pays by itself.
`get_order`	需登入	Read where a purchase is: awaiting_payment, registering, registered, needs_attention or failed_refunded, with the DNS records that were created. workflow.state says what to do: in_progress or blocked = check again later; action_required = give workflow.action.url to the person; succeeded or failed = stop (failed carries workflow.error).
`list_dns_presets`	公開	List the DNS presets purchase_domain and apply_dns_preset accept (Vercel, Netlify, GitHub Pages, Cloudflare Pages, Agent Lab Deploy, Google Workspace email). No sign-in needed.
`apply_dns_preset`	需登入	Prepare DNS records for a domain this organization already manages. It creates a change set a person approves in the console; nothing is written before that.
`suggest_domains`	公開	Names a live registrar can sell now that fit a keyword, with prices (registration inventory only). Sandbox suggestions are refused; use screen_domains until nymwell_status reports a live registrar. No sign-in needed.
`get_tld_info`	公開	What an ending costs (registration, renewal, transfer) and its rules: allowed terms, days left to renew after expiry, WHOIS privacy, DNSSEC, HSTS preload. No sign-in needed.
`get_domain`	需登入	Live state of a domain this organization holds through Nymwell: expiry, renewal price, transfer lock, WHOIS privacy, registry locks, nameservers, contact verification and any transfer in progress.
`set_auto_renew`	需登入	Turn Nymwell's auto-renew on or off for a domain. When it is on and the workspace has a saved card, Nymwell charges that card for a one-year renewal from 14 days before expiry (retrying 7, 3 and 1 day before); without a card it sends reminders instead. The answer says which applies. The registrar's own auto-renew always stays off.
`update_domain_settings`	需登入	Prepare a WHOIS privacy or transfer lock change. An owner or admin approves it in the console before the registrar is touched.
`set_nameservers`	需登入	Prepare a nameserver change: 2 to 13 hostnames, or "default" to return to Nymwell DNS. Pointing elsewhere means the records in Nymwell stop applying. Needs approval.
`set_contacts`	需登入	Prepare a contact change. registrant is required (it is the legal holder); admin, tech and billing are optional. A new registrant must confirm by email within 15 days or the domain stops resolving. Needs approval.
`request_auth_code`	需登入	Prepare unlocking a domain and revealing its transfer auth code, to move it to another registrar. After approval the code is shown once to the approving person; an agent never sees it. Not possible within 60 days of a registration or transfer.
`cancel_registration`	需登入	Prepare cancelling a registration made in the last few days (the registry's add grace period, about 5 days). Once approved the domain is deleted and the payment refunded.
`list_domain_services`	需登入	Read DNSSEC DS records, URL forwarding, email forwarding or branded (vanity) nameservers for a domain, live from the registrar.
`change_domain_service`	需登入	Prepare a DNSSEC, URL forwarding, email forwarding or vanity nameserver change. Needs approval. data: dnssec {key_tag, algorithm, digest_type, digest} (delete: digest); url_forwarding {host, forwards_to, type: masked/redirect/302, title?, meta?} (delete: host); email_forwarding {email_box, email_to} (delete: email_box); vanity_nameservers {hostname, ips} (delete: hostname).
`list_transfers`	需登入	Transfers into Nymwell for this organization and where each one is.
`cancel_transfer`	需登入	Prepare cancelling a transfer: direction "in" stops one coming to Nymwell (the payment is refunded), "out" stops a domain leaving for another registrar. Needs approval.
`list_unverified_contacts`	需登入	Registrant emails still waiting for ICANN verification on this organization's domains, with the deadline. A domain whose registrant misses it stops resolving.
`get_registrant`	需登入	Whether this organization has its registrant on file. The customer is the legal holder of every domain; a signed-in person enters the registrant and accepts the terms in the console before the first registration or transfer.
`list_approvals`	需登入	Changes waiting for a person to approve, and the ones already decided, each with workflow.state (action_required, in_progress, succeeded, failed). Approving is done by a person in the console, never through MCP.
`resend_contact_verification`	需登入	Send the ICANN verification email again for one verification_id from list_unverified_contacts.

結構定義：https://nymwell.com/mcp-tools.json · Server card：https://nymwell.com/.well-known/mcp/server-card.json · 官方 MCP Registry：com.nymwell/mcp