thatmgmt-mcp
An MCP (Model Context Protocol) server that wraps the ThatMgmt domain API. Check availability, get locked price quotes, and prepare registrations from any MCP client — with zero signup for the public tools. Tenant tools (portfolio, suggestions, dry-run planning) unlock with an API key. Nothing executes blindly: the API exposes no execute endpoints, so this server plans and prices, never purchases.
Base API: https://api.thatmgmt.com
Spec: openapi.json
Machine docs: llms-full.txt
Verified claims
Every claim below is backed by a test in test/ — fully mocked, no network, no key, no charges. Run them yourself: npm test (47/47 pass).
| Claim | Backing data |
|---|---|
| 13 MCP tools, exactly 4 of them public | test/tools.test.js "exposes the expected tool set" asserts all 13 names; "exactly the zero-signup tools are marked public" pins tmgmt_health, tmgmt_capabilities, domains_check_availability, domains_get_quote |
| Tenant tools fail closed without an API key | test/server.test.js "refuses tenant tools without an API key": isError true, message names TMGMT_API_KEY |
| Public tools send no Authorization header | test/server.test.js "public reads work with no API key and send no Authorization header" asserts the header is absent on all 4 public routes |
| The API key never leaks into error messages | test/thatmgmt.test.js "never leaks the API key in error messages": key replaced with [REDACTED] |
| Exactly one retry on retryable GET / 429 / 5xx; none on 400 or non-retryable 503 | test/thatmgmt.test.js: 2 fetch calls after a 429; 1 call for a 400 and for a 503 marked non-retryable |
The approval gate refuses without a quote id, without approved: true, and on a mismatched id | test/tools.test.js approval-gate cases |
| Invalid domains are rejected before any network call | test/tools.test.js "callTool rejects an invalid domain before any network call": 0 fetch calls |
A quote for an unavailable domain says so plainly instead of returning bare {available:false} | test/tools.test.js quote-shaping cases |
Transfer dry-runs pass authCodePresent, never the raw auth code | test/tools.test.js "passes authCodePresent (never the raw code)" |
Quickstart
git clone https://github.com/thingscorp/thatmgmt-mcp.git && cd thatmgmt-mcp
npm install
node demo-agent-run.mjs # real server over stdio, stub API, zero signup
The demo drives the real server through tmgmt_health → availability → locked quote → prepare-registration, with no network and no key. Live mode (public tools only, read-only): node demo-agent-run.mjs --live.
Install
From npm (no clone needed):
npx -y @thatmgmt/mcp
From source (Node 18+):
git clone https://github.com/thingscorp/thatmgmt-mcp.git thatmgmt-mcp
cd thatmgmt-mcp
npm install
npm test
Add to your MCP client (Claude Code .mcp.json, Cursor, Replit):
{
"mcpServers": {
"thatmgmt": {
"command": "npx",
"args": ["-y", "@thatmgmt/mcp"],
"env": { "TMGMT_API_KEY": "your-thatmgmt-api-key" }
}
}
}
The key is only needed for tenant tools; the public reads work without it.
Releases are automated: pushing a version tag (e.g. v0.2.2) runs the Publish to npm workflow (npm publish via the NPM_TOKEN secret) and the Publish to MCP Registry workflow (validates server.json, publishes io.github.thingscorp/thatmgmt-mcp via GitHub OIDC). The tag must match version in package.json and server.json.
Usage
The two-step purchase flow is written into every tool description so agents show the human the price first:
- Quote. Call
domains_get_quote. It returns the locked price:wholesaleCents, the itemized 1% cut (platformCutCents,platformCutBasisPoints), andtotalCents. No key needed. Show this to the human. - Plan. Call
domains_prepare_registration(needsTMGMT_API_KEY). It returns the safety-checked plan. It never executes anything.
A quote carries wholesale, the flat 1% platform cut, and the total — no subscription, no tiers. The shape, from the mocked test fixture: wholesaleCents: 1299, platformCutCents: 13, platformCutBasisPoints: 100, totalCents: 1312.
What this server cannot do
The ThatMgmt API exposes no execute endpoints. Purchase, renewal, transfer, and DNS changes are never executed by the API; the API returns validated plans and preflights instead. This server therefore cannot register, renew, or transfer a domain, and it will never claim it did. src/approval.js holds the approval gate that future execute tools will use (quote id passed back plus an explicit approved: true flag, or the call is refused) — implemented and tested now so the safety design is ready the day execute routes exist.
Current release: 0.2.2 (read-only public tools plus validated plans). Execute tools are planned for the 0.3.0 release.
Configuration
Env vars only — no flags, no config file:
| Variable | Required | Default | What it does |
|---|---|---|---|
TMGMT_API_KEY | Only for tenant tools | — | Tenant API key, sent as a Bearer token. Never logged; redacted from errors. |
TMGMT_BASE_URL | No | https://api.thatmgmt.com | API base URL override. |
TMGMT_TIMEOUT_MS | No | 30000 | Per-request timeout in milliseconds. |
Transient failures (network errors, timeouts, 429s, retryable 5xx) are retried once on side-effect-free calls; the server never retries anything that could move money.
API reference
The 13 tools the server exposes over MCP stdio, exactly as defined in src/tools.js. Each maps to a real route in the live OpenAPI spec; no invented endpoints.
| Tool | What it does | API route | Key needed |
|---|---|---|---|
tmgmt_health | Liveness check | GET /health/live | No |
tmgmt_capabilities | Discover the public no-auth surface | GET /v1/public/capabilities | No |
domains_check_availability | Check if a domain is available | GET /v1/public/availability | No |
domains_get_quote | Locked price quote: wholesale + itemized 1% cut + total (step 1) | GET /v1/public/quote | No |
domains_suggest | Suggest alternative names | GET /v1/domains/suggestions | Yes |
domains_prepare_registration | Safety-checked plan, never executes (step 2) | GET /v1/domains/prepare-registration | Yes |
domains_list | List portfolio domains | GET /v1/domains | Yes |
domains_dns | Inspect DNS records for a domain | GET /v1/domains/{resourceId}/dns | Yes |
portfolio_health | Portfolio health summary | GET /v1/portfolio/health | Yes |
portfolio_renewal_risk | Renewal-risk view | GET /v1/portfolio/renewal-risk | Yes |
portfolio_exceptions | Prioritized exception queue | GET /v1/portfolio/exceptions | Yes |
orders_dry_run | Full order plan with itemized pricing, never moves money | POST /v1/orders/dry-run | Yes |
offerings | Offering coverage matrix | GET /v1/offerings | Yes |
Public tools never send an Authorization header and never ask for a key. Tenant tools return a 401-style refusal without a key; the server tells you to set TMGMT_API_KEY.
For agents
skills/thatmgmt/SKILL.md is the agent skill for this server: when to use it, the tool list, and the two-step purchase flow. Point your agent at it for the fastest start.
Contributing
See CONTRIBUTING.md.
License
MIT. See LICENSE.