thatmgmt-mcp is a read-only/planning MCP server for domain availability, pricing, portfolio inspection, and safety-checked registration/order plans—it never executes purchases, renewals, transfers, or DNS changes.
Check API liveness and discover the public no-auth surface without an API key.
Check domain availability and get locked price quotes with wholesale, itemized platform cut, and total.
With TMGMT_API_KEY: suggest domain names, list portfolio domains, inspect DNS, view portfolio health/renewal risk/exceptions, and see reseller offerings.
Prepare a domain registration plan and dry-run register/renew/transfer orders with itemized pricing, readiness checks, and next steps—without moving money.
Follow the two-step flow: quote first, show the human, then prepare the plan; execute tools are not available in the current release.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@thatmgmt-mcp Is example.com available? If not, suggest alternatives."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
An MCP (Model Context Protocol) server that wraps the ThatMgmt domain API. Check availability, get locked price quotes, and prepare registrations from any MCP client — with zero signup for the public tools. Tenant tools (portfolio, suggestions, dry-run planning) unlock with an API key. Nothing executes blindly: the API exposes no execute endpoints, so this server plans and prices, never purchases.
Base API: https://api.thatmgmt.com
Spec: openapi.json
Machine docs: llms-full.txt
Every claim below is backed by a test in test/ — fully mocked, no network, no key, no charges. Run them yourself: npm test (47/47 pass).
Claim | Backing data |
13 MCP tools, exactly 4 of them public |
|
Tenant tools fail closed without an API key |
|
Public tools send no Authorization header |
|
The API key never leaks into error messages |
|
Exactly one retry on retryable GET / 429 / 5xx; none on 400 or non-retryable 503 |
|
The approval gate refuses without a quote id, without |
|
Invalid domains are rejected before any network call |
|
A quote for an unavailable domain says so plainly instead of returning bare |
|
Transfer dry-runs pass |
|
Related MCP server: Domain Checker MCP Server
git clone https://github.com/thingscorp/thatmgmt-mcp.git && cd thatmgmt-mcp
npm install
node demo-agent-run.mjs # real server over stdio, stub API, zero signupThe demo drives the real server through tmgmt_health → availability → locked quote → prepare-registration, with no network and no key. Live mode (public tools only, read-only): node demo-agent-run.mjs --live.
From npm (no clone needed):
npx -y @thatmgmt/mcpFrom source (Node 18+):
git clone https://github.com/thingscorp/thatmgmt-mcp.git thatmgmt-mcp
cd thatmgmt-mcp
npm install
npm testAdd to your MCP client (Claude Code .mcp.json, Cursor, Replit):
{
"mcpServers": {
"thatmgmt": {
"command": "npx",
"args": ["-y", "@thatmgmt/mcp"],
"env": { "TMGMT_API_KEY": "your-thatmgmt-api-key" }
}
}
}The key is only needed for tenant tools; the public reads work without it.
Releases are automated: pushing a version tag (e.g. v0.2.2) runs the Publish to npm workflow (npm publish via the NPM_TOKEN secret) and the Publish to MCP Registry workflow (validates server.json, publishes io.github.thingscorp/thatmgmt-mcp via GitHub OIDC). The tag must match version in package.json and server.json.
The two-step purchase flow is written into every tool description so agents show the human the price first:
Quote. Call domains_get_quote. It returns the locked price: wholesaleCents, the itemized 1% cut (platformCutCents, platformCutBasisPoints), and totalCents. No key needed. Show this to the human.
Plan. Call domains_prepare_registration (needs TMGMT_API_KEY). It returns the safety-checked plan. It never executes anything.
A quote carries wholesale, the flat 1% platform cut, and the total — no subscription, no tiers. The shape, from the mocked test fixture: wholesaleCents: 1299, platformCutCents: 13, platformCutBasisPoints: 100, totalCents: 1312.
The ThatMgmt API exposes no execute endpoints. Purchase, renewal, transfer, and DNS changes are never executed by the API; the API returns validated plans and preflights instead. This server therefore cannot register, renew, or transfer a domain, and it will never claim it did. src/approval.js holds the approval gate that future execute tools will use (quote id passed back plus an explicit approved: true flag, or the call is refused) — implemented and tested now so the safety design is ready the day execute routes exist.
Current release: 0.2.2 (read-only public tools plus validated plans). Execute tools are planned for the 0.3.0 release.
Env vars only — no flags, no config file:
Variable | Required | Default | What it does |
| Only for tenant tools | — | Tenant API key, sent as a Bearer token. Never logged; redacted from errors. |
| No |
| API base URL override. |
| No |
| Per-request timeout in milliseconds. |
Transient failures (network errors, timeouts, 429s, retryable 5xx) are retried once on side-effect-free calls; the server never retries anything that could move money.
The 13 tools the server exposes over MCP stdio, exactly as defined in src/tools.js. Each maps to a real route in the live OpenAPI spec; no invented endpoints.
Tool | What it does | API route | Key needed |
| Liveness check |
| No |
| Discover the public no-auth surface |
| No |
| Check if a domain is available |
| No |
| Locked price quote: wholesale + itemized 1% cut + total (step 1) |
| No |
| Suggest alternative names |
| Yes |
| Safety-checked plan, never executes (step 2) |
| Yes |
| List portfolio domains |
| Yes |
| Inspect DNS records for a domain |
| Yes |
| Portfolio health summary |
| Yes |
| Renewal-risk view |
| Yes |
| Prioritized exception queue |
| Yes |
| Full order plan with itemized pricing, never moves money |
| Yes |
| Offering coverage matrix |
| Yes |
Public tools never send an Authorization header and never ask for a key. Tenant tools return a 401-style refusal without a key; the server tells you to set TMGMT_API_KEY.
skills/thatmgmt/SKILL.md is the agent skill for this server: when to use it, the tool list, and the two-step purchase flow. Point your agent at it for the fastest start.
See CONTRIBUTING.md.
MIT. See LICENSE.
Check whether a domain name is available to register. Read-only, no API key needed: this uses the public endpoint, so any agent can try it with zero signup. Pass the fully qualified domain name, e.g. "example.com".
Inputs: domain (required).
Inspect DNS records for a domain resource. Read-only; use the resource id from domains_list. Optionally filter by record type (A, CNAME, ...) or name.
Inputs: resourceId (required), name, type.
Get the locked price quote for registering a domain: wholesale plus the itemized 1% platform cut, printed plainly as wholesaleCents, platformCutCents, platformCutBasisPoints, and totalCents. Read-only, no API key needed: this uses the public endpoint, so any agent can try it with zero signup. Nothing is purchased.
Inputs: domain (required), period.
List domain resources in the tenant portfolio (paginated). Read-only.
Inputs: pageSize, pageToken.
Prepare (never execute) a domain registration: returns the safety-checked plan only. Step 2 of the two-step purchase flow. Show the plan, with the locked total and fee, to the human first. Note: the ThatMgmt API does not expose an execute endpoint for this action (purchase, renewal, transfer, and DNS changes are never executed by the API). This tool returns the validated plan only. Show the locked price to the human first.
Inputs: domain (required), period.
Suggest alternative domain names for a search query. Read-only. Optionally filter by comma-separated TLDs, e.g. "com,io".
Inputs: query (required), tlds, pageSize.
Reseller offering coverage matrix: every supplier family, its exposed routes, entitlement state, and write-gating. Read-only. Useful to see what this tenant is entitled to.
Inputs: no named parameters.
Plan a domain order in one call: register, renew, or transfer. Returns the full plan with itemized pricing (wholesale plus the platform fee as separate lines), the readiness checklist with machine-readable reason codes, what is still gated, and the next steps. The total shown is the locked total your approval binds to. Never moves money and never touches the supplier. For transfers, pass authCodePresent: true to show you hold the authorization code; the API never accepts the raw code. Note: the ThatMgmt API does not expose an execute endpoint for this action (purchase, renewal, transfer, and DNS changes are never executed by the API). This tool returns the validated plan only. Show the locked price to the human first.
Inputs: fqdn (required), action (required), periodYears, authCodePresent.
Prioritized operator exception queue derived from portfolio health (expiring certificates, commerce issues). Read-only, GET-only.
Inputs: no named parameters.
Domain portfolio health summary for the tenant. Read-only.
Inputs: no named parameters.
Renewal-risk view over the domain portfolio: which domains need attention before they expire. Read-only.
Inputs: no named parameters.
Discover what you can do without signing up: the machine-readable list of every public no-auth route with its parameters. No API key needed. Start here if you are unsure.
Inputs: no named parameters.
Check that the ThatMgmt API is reachable. No API key needed. Use it to verify setup.
Inputs: no named parameters.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 13 tools
Most tools are distinct, but orders_dry_run, domains_prepare_registration, and domains_get_quote all produce pricing/validated plans for registration, so an agent could easily pick the wrong one. The portfolio_health/renewal_risk/exceptions trio also shades into overlapping 'portfolio view' territory, though their names help differentiate them.
Strong predictable prefix_noun snake_case pattern (portfolio_*, domains_*, orders_*, tmgmt_*), with only minor deviations like the bare 'offerings' and the tmgmt_ vs thatmgmt- prefix mismatch at the server level.
13 tools sits comfortably in the ideal 3-15 range and each tool maps to a distinct capability (discovery, health, availability, DNS, quoting, planning, portfolio views) without obvious padding.
The read-only/planning surface is well covered (list, DNS inspect, availability, suggestions, quoting, portfolio health/risk/exceptions, capability and health checks), but there is no single-resource 'get domain' tool and no certificate lifecycle tooling, leaving minor gaps.
Register, transfer and manage domain names and DNS from your AI agent.
Find, register, and manage domains from any AI chat or agent
Domain search, registration, DNS, marketplace, and checkout with your AI agent.
Buy & manage domains from any AI chat: availability, register, DNS, email forwarding, AI bot stats.