WHMCS MCP Server
by yashodhank
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| MCP_ENV | No | Env profile: local, staging, production. Layers .env.<MCP_ENV> over base .env. | production |
| MCP_MODE | No | Operation mode: read_only, simulate, full | read_only |
| MCP_DEBUG | No | Enable verbose logging | false |
| WHMCS_SECRET | Yes | API secret from WHMCS API Credentials | |
| WHMCS_API_URL | Yes | Your WHMCS base URL (e.g., https://billing.example.com) | |
| MCP_AUTH_TOKEN | No | Optional shared secret required on tool calls (auth_token param). Not used for resource reads. | |
| MCP_RATE_LIMIT | No | Max WHMCS API calls per second | 10 |
| MCP_ACCESS_MODE | No | Access mode: admin (full) or client (scoped) | admin |
| WHMCS_ACCESS_KEY | No | Optional WHMCS API access key (for IP restricted setups) | |
| WHMCS_ALLOW_HTTP | No | Allow an http:// WHMCS_API_URL (not recommended; credentials sent in clear). Otherwise https is required. | false |
| WHMCS_IDENTIFIER | Yes | API identifier from WHMCS API Credentials | |
| MCP_MAX_PAGE_SIZE | No | Maximum pagination size | 100 |
| MCP_ALLOW_ANON_LLM | No | Allow anonymous llm_safe_summary fallback when governance is on | false |
| MCP_TOOL_ALLOWLIST | No | Comma-separated list of allowed tools | |
| MCP_WRITE_AUDIT_PATH | No | Durable audit log path (required when prod writes are allowlisted) | |
| MCP_CONSUMER_REGISTRY | No | JSON consumer registry (token_sha256 only) | |
| MCP_WRITE_KILL_SWITCH | No | Emergency block on controlled writes | false |
| MCP_ALLOWED_CLIENT_IDS | No | Comma-separated client IDs allowed in client mode | |
| MCP_GOVERNANCE_ENABLED | No | Opt-in consumer-aware projection for reads (see Phase B docs) | false |
| MCP_PROD_WRITE_AUTHORIZED | No | Comma-separated WHMCS actions allowed for production write execution | |
| MCP_LARGE_REFUND_THRESHOLD | No | Refunds above this amount require confirm_large_refund: true | 1000 |
| MCP_WRITE_IDEMPOTENCY_PATH | No | Durable idempotency store path | |
| MCP_PROD_HIGH_RISK_DAILY_CAP | No | Daily aggregate cap for high-risk writes | 0 |
| MCP_CLIENT_CUSTOM_FIELD_LABELS | No | Comma-separated fieldId:label overrides for client custom fields | |
| MCP_WRITE_EXECUTION_AUTHORIZED | No | Non-prod runtime write allowlist | |
| MCP_PROD_HIGH_RISK_PER_ACTION_CAP | No | Per-action cap for high-risk write scopes | 0 |
Capabilities
Server capabilities have not been inspected yet.
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
No tools | |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
Latest Blog Posts
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/yashodhank/whmcs-mcp-server'
If you have feedback or need assistance with the MCP directory API, please join our Discord server