Thatmgmt Mcp

io.github.ThingscorpPublished by GitHub account Thingscorpv0.2.2Updated Nov 10, 2026

MCP server for ThatMgmt: domain availability, quotes, registration prep. Crypto checkout.

VerifiedSTDIODesktop onlyDeveloper ToolsBusiness & Commerce

Overview

AI-generated overview

MCP server wrapping the ThatMgmt domain API: check domain availability, get locked price quotes, and prepare registration plans.

What you can do
  • Check service health and discover the public no-auth API surface
  • Check domain availability and get locked price quotes with itemized platform cut and total
  • Suggest alternative domain names and prepare a safety-checked registration plan
  • List portfolio domains and inspect their DNS records
  • Review portfolio health, renewal risk and prioritized exceptions
  • Run full order dry-runs with itemized pricing and view the offering coverage matrix
When to use it
Use it when an assistant needs to research domain names, show a human a firm price before any purchase decision, or review an existing domain portfolio. Public availability and quote checks need no account, so it is easy to try.
Requirements
Runs locally over stdio via npx (Node 18+). Public tools need no key or account. Tenant tools (suggestions, prepare-registration, portfolio, DNS, dry-run, offerings) require TMGMT_API_KEY sent as a Bearer token. Optional TMGMT_BASE_URL and TMGMT_TIMEOUT_MS settings; network access to the ThatMgmt API.
Before you install
Tenant tools send TMGMT_API_KEY as a Bearer token to the ThatMgmt API; the server redacts it from errors. The API has no execute endpoints, so the server cannot register, renew, transfer or change DNS and only returns plans and preflights. Transfer dry-runs pass only an auth-code-present flag, not the raw code. Domain queries go to a third-party service.

Installation

In SourceWeft

  1. Open Thatmgmt Mcp in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

thatmgmt-mcp

[license] [npm]

An MCP (Model Context Protocol) server that wraps the ThatMgmt domain API. Check availability, get locked price quotes, and prepare registrations from any MCP client — with zero signup for the public tools. Tenant tools (portfolio, suggestions, dry-run planning) unlock with an API key. Nothing executes blindly: the API exposes no execute endpoints, so this server plans and prices, never purchases.

Base API: https://api.thatmgmt.com Spec: openapi.json Machine docs: llms-full.txt

Verified claims

Every claim below is backed by a test in test/ — fully mocked, no network, no key, no charges. Run them yourself: npm test (47/47 pass).

ClaimBacking data
13 MCP tools, exactly 4 of them publictest/tools.test.js "exposes the expected tool set" asserts all 13 names; "exactly the zero-signup tools are marked public" pins tmgmt_health, tmgmt_capabilities, domains_check_availability, domains_get_quote
Tenant tools fail closed without an API keytest/server.test.js "refuses tenant tools without an API key": isError true, message names TMGMT_API_KEY
Public tools send no Authorization headertest/server.test.js "public reads work with no API key and send no Authorization header" asserts the header is absent on all 4 public routes
The API key never leaks into error messagestest/thatmgmt.test.js "never leaks the API key in error messages": key replaced with [REDACTED]
Exactly one retry on retryable GET / 429 / 5xx; none on 400 or non-retryable 503test/thatmgmt.test.js: 2 fetch calls after a 429; 1 call for a 400 and for a 503 marked non-retryable
The approval gate refuses without a quote id, without approved: true, and on a mismatched idtest/tools.test.js approval-gate cases
Invalid domains are rejected before any network calltest/tools.test.js "callTool rejects an invalid domain before any network call": 0 fetch calls
A quote for an unavailable domain says so plainly instead of returning bare {available:false}test/tools.test.js quote-shaping cases
Transfer dry-runs pass authCodePresent, never the raw auth codetest/tools.test.js "passes authCodePresent (never the raw code)"

Quickstart

bash
git clone https://github.com/thingscorp/thatmgmt-mcp.git && cd thatmgmt-mcpnpm installnode demo-agent-run.mjs   # real server over stdio, stub API, zero signup

The demo drives the real server through tmgmt_health → availability → locked quote → prepare-registration, with no network and no key. Live mode (public tools only, read-only): node demo-agent-run.mjs --live.

Install

From npm (no clone needed):

bash
npx -y @thatmgmt/mcp

From source (Node 18+):

bash
git clone https://github.com/thingscorp/thatmgmt-mcp.git thatmgmt-mcpcd thatmgmt-mcpnpm installnpm test

Add to your MCP client (Claude Code .mcp.json, Cursor, Replit):

json
{  "mcpServers": {    "thatmgmt": {      "command": "npx",      "args": ["-y", "@thatmgmt/mcp"],      "env": { "TMGMT_API_KEY": "your-thatmgmt-api-key" }    }  }}

The key is only needed for tenant tools; the public reads work without it.

Releases are automated: pushing a version tag (e.g. v0.2.2) runs the Publish to npm workflow (npm publish via the NPM_TOKEN secret) and the Publish to MCP Registry workflow (validates server.json, publishes io.github.thingscorp/thatmgmt-mcp via GitHub OIDC). The tag must match version in package.json and server.json.

Usage

The two-step purchase flow is written into every tool description so agents show the human the price first:

  1. Quote. Call domains_get_quote. It returns the locked price: wholesaleCents, the itemized 1% cut (platformCutCents, platformCutBasisPoints), and totalCents. No key needed. Show this to the human.
  2. Plan. Call domains_prepare_registration (needs TMGMT_API_KEY). It returns the safety-checked plan. It never executes anything.

A quote carries wholesale, the flat 1% platform cut, and the total — no subscription, no tiers. The shape, from the mocked test fixture: wholesaleCents: 1299, platformCutCents: 13, platformCutBasisPoints: 100, totalCents: 1312.

What this server cannot do

The ThatMgmt API exposes no execute endpoints. Purchase, renewal, transfer, and DNS changes are never executed by the API; the API returns validated plans and preflights instead. This server therefore cannot register, renew, or transfer a domain, and it will never claim it did. src/approval.js holds the approval gate that future execute tools will use (quote id passed back plus an explicit approved: true flag, or the call is refused) — implemented and tested now so the safety design is ready the day execute routes exist.

Current release: 0.2.2 (read-only public tools plus validated plans). Execute tools are planned for the 0.3.0 release.

Configuration

Env vars only — no flags, no config file:

VariableRequiredDefaultWhat it does
TMGMT_API_KEYOnly for tenant tools—Tenant API key, sent as a Bearer token. Never logged; redacted from errors.
TMGMT_BASE_URLNohttps://api.thatmgmt.comAPI base URL override.
TMGMT_TIMEOUT_MSNo30000Per-request timeout in milliseconds.

Transient failures (network errors, timeouts, 429s, retryable 5xx) are retried once on side-effect-free calls; the server never retries anything that could move money.

API reference

The 13 tools the server exposes over MCP stdio, exactly as defined in src/tools.js. Each maps to a real route in the live OpenAPI spec; no invented endpoints.

ToolWhat it doesAPI routeKey needed
tmgmt_healthLiveness checkGET /health/liveNo
tmgmt_capabilitiesDiscover the public no-auth surfaceGET /v1/public/capabilitiesNo
domains_check_availabilityCheck if a domain is availableGET /v1/public/availabilityNo
domains_get_quoteLocked price quote: wholesale + itemized 1% cut + total (step 1)GET /v1/public/quoteNo
domains_suggestSuggest alternative namesGET /v1/domains/suggestionsYes
domains_prepare_registrationSafety-checked plan, never executes (step 2)GET /v1/domains/prepare-registrationYes
domains_listList portfolio domainsGET /v1/domainsYes
domains_dnsInspect DNS records for a domainGET /v1/domains/{resourceId}/dnsYes
portfolio_healthPortfolio health summaryGET /v1/portfolio/healthYes
portfolio_renewal_riskRenewal-risk viewGET /v1/portfolio/renewal-riskYes
portfolio_exceptionsPrioritized exception queueGET /v1/portfolio/exceptionsYes
orders_dry_runFull order plan with itemized pricing, never moves moneyPOST /v1/orders/dry-runYes
offeringsOffering coverage matrixGET /v1/offeringsYes

Public tools never send an Authorization header and never ask for a key. Tenant tools return a 401-style refusal without a key; the server tells you to set TMGMT_API_KEY.

For agents

skills/thatmgmt/SKILL.md is the agent skill for this server: when to use it, the tool list, and the two-step purchase flow. Point your agent at it for the fastest start.

Contributing

See CONTRIBUTING.md.

License

MIT. See LICENSE.

Source: README.md at commit 0e5f194

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

2
  1. v0.2.2LatestSep 29, 2026
  2. v0.2.1Sep 27, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts