Skip to content
anlyon.devby Anlyon

Nymwell

com.nymwell/mcpnymwell.comstreamable-httpv1.0.0Scanned

Search and buy domain names: live prices, buy links, renewals, transfers and approved DNS changes.

31 tools: 2 can delete or cancel things, 3 do something that can't be undone, 11 change things and 15 only read.

Tools: 2 delete, 3 irreversible, 11 write, 15 read.
  • Reads private data · 6
  • Reads text others write · 3
  • Can send data out · 1
  • No findings

Anlyon alternative

16 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

31 tools

Deletes or cancels 2Claude Code: deny
  • cancel_registrationPrepare cancelling a registration made in the last few days (the registry's add grace period, about 5 days).No findings

    Why it is in this group

    • The name "cancel_registration" says "cancel": a word for removing or ending something.
    Description, as the server wrote it
    Prepare cancelling a registration made in the last few days (the registry's add grace period, about 5 days). Once approved the domain is deleted and the payment refunded.
  • cancel_transferPrepare cancelling a transfer: direction "in" stops one coming to Nymwell (the payment is refunded), "out" stops a domain leaving for another registrar.No findings

    Why it is in this group

    • The name "cancel_transfer" says "cancel": a word for removing or ending something.
    Description, as the server wrote it
    Prepare cancelling a transfer: direction "in" stops one coming to Nymwell (the payment is refunded), "out" stops a domain leaving for another registrar. Needs approval.
Can't be undone 3Claude Code: ask
  • list_transfersTransfers into Nymwell for this organization and where each one is.No findings

    Why it is in this group

    • The name "list_transfers" says "list": a word for reading.
    • The description's first verb is "transfer": a word for a change that another call does not undo.
    Description, as the server wrote it
    Transfers into Nymwell for this organization and where each one is.
  • purchase_domainStart paying for a quote (registration, renewal or transfer).No findings

    Why it is in this group

    • The name "purchase_domain" says "purchase": a word that usually means money moves, which cannot be taken back.
    Description, as the server wrote it
    Start paying for a quote (registration, renewal or transfer). Returns a checkout_url: give it to the person, who pays once; paying is their approval. The registrar call (and, for a registration, the DNS records you pass) then runs on its own. Poll get_order for the result. An agent never pays by itself.
  • resend_contact_verificationSend the ICANN verification email again for one verification_id from list_unverified_contacts.Can send data outNo findings

    Why it is in this group

    • The name "resend_contact_verification" says "resend": a word for sending, and what is sent cannot be taken back.

    What it can reach

    • outboundThe name "resend_contact_verification" says "resend": it sends or publishes something to other people.
    Description, as the server wrote it
    Send the ICANN verification email again for one verification_id from list_unverified_contacts.
Changes things 11Claude Code: ask
  • apply_dns_presetPrepare DNS records for a domain this organization already manages.No findings

    Why it is in this group

    • The name "apply_dns_preset" says "apply": a word for a change.
    Description, as the server wrote it
    Prepare DNS records for a domain this organization already manages. It creates a change set a person approves in the console; nothing is written before that.
  • change_domain_servicePrepare a DNSSEC, URL forwarding, email forwarding or vanity nameserver change.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Prepare a DNSSEC, URL forwarding, email forwarding or vanity nameserver change. Needs approval. data: dnssec {key_tag, algorithm, digest_type, digest} (delete: digest); url_forwarding {host, forwards_to, type: masked|redirect|302, title?, meta?} (delete: host); email_forwarding {email_box, email_to} (delete: email_box); vanity_nameservers {hostname, ips} (delete: hostname).
  • get_quoteLock the exact price for one domain: action "register" (default) for an available name, "renew" for a domain this organization holds, or "transfer" to bring one from another regist…No findings

    Why it is in this group

    • The name "get_quote" says "get": a word for reading.
    • The description's first verb is "lock": a word for a change.
    Description, as the server wrote it
    Lock the exact price for one domain: action "register" (default) for an available name, "renew" for a domain this organization holds, or "transfer" to bring one from another registrar (adds one year; the owner then submits the auth code in the console). Valid for 40 minutes; purchase_domain charges exactly this.
  • request_auth_codePrepare unlocking a domain and revealing its transfer auth code, to move it to another registrar.No findings

    Why it is in this group

    • The name "request_auth_code" says "request": a word for a change.
    Description, as the server wrote it
    Prepare unlocking a domain and revealing its transfer auth code, to move it to another registrar. After approval the code is shown once to the approving person; an agent never sees it. Not possible within 60 days of a registration or transfer.
  • screen_domainsFast first pass over many names: is there a registration record, since when, with which registrar, is it parked for sale.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Fast first pass over many names: is there a registration record, since when, with which registrar, is it parked for sale. Uses public RDAP and DNS, so it works before any registrar is configured. It is NOT availability: no_record still has to be confirmed with search_domains or get_quote after nymwell_status reports a live registrar. No sign-in needed.
  • set_auto_renewTurn Nymwell's auto-renew on or off for a domain.No findings

    Why it is in this group

    • The name "set_auto_renew" says "set": a word for a change.
    Description, as the server wrote it
    Turn Nymwell's auto-renew on or off for a domain. When it is on and the workspace has a saved card, Nymwell charges that card for a one-year renewal from 14 days before expiry (retrying 7, 3 and 1 day before); without a card it sends reminders instead. The answer says which applies. The registrar's own auto-renew always stays off.
  • set_contactsPrepare a contact change.No findings

    Why it is in this group

    • The name "set_contacts" says "set": a word for a change.
    Description, as the server wrote it
    Prepare a contact change. registrant is required (it is the legal holder); admin, tech and billing are optional. A new registrant must confirm by email within 15 days or the domain stops resolving. Needs approval.
  • set_nameserversPrepare a nameserver change: 2 to 13 hostnames, or "default" to return to Nymwell DNS.No findings

    Why it is in this group

    • The name "set_nameservers" says "set": a word for a change.
    Description, as the server wrote it
    Prepare a nameserver change: 2 to 13 hostnames, or "default" to return to Nymwell DNS. Pointing elsewhere means the records in Nymwell stop applying. Needs approval.
  • stage_dns_changePrepare DNS changes (create, update, delete) for review.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Prepare DNS changes (create, update, delete) for review. Nothing is written until an owner or admin approves; then Nymwell applies them at the registrar in order. For update and delete, pass record_id from list_dns_records when a name has more than one record of that type.
  • suggest_domainsNames a live registrar can sell now that fit a keyword, with prices (registration inventory only).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Names a live registrar can sell now that fit a keyword, with prices (registration inventory only). Sandbox suggestions are refused; use screen_domains until nymwell_status reports a live registrar. No sign-in needed.
  • update_domain_settingsPrepare a WHOIS privacy or transfer lock change.No findings

    Why it is in this group

    • The name "update_domain_settings" says "update": a word for a change.
    Description, as the server wrote it
    Prepare a WHOIS privacy or transfer lock change. An owner or admin approves it in the console before the registrar is touched.
Only reads 15Show 15 read-only tools
  • get_domainLive state of a domain this organization holds through Nymwell: expiry, renewal price, transfer lock, WHOIS privacy, registry locks, nameservers, contact verification and any trans…Reads private dataNo findings

    Why it is in this group

    • The name "get_domain" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "contact": it reads contacts.
    Description, as the server wrote it
    Live state of a domain this organization holds through Nymwell: expiry, renewal price, transfer lock, WHOIS privacy, registry locks, nameservers, contact verification and any transfer in progress.
  • get_orderRead where a purchase is: awaiting_payment, registering, registered, needs_attention or failed_refunded, with the DNS records that were created.No findings

    Why it is in this group

    • The name "get_order" says "get": a word for reading.
    Description, as the server wrote it
    Read where a purchase is: awaiting_payment, registering, registered, needs_attention or failed_refunded, with the DNS records that were created. workflow.state says what to do: in_progress or blocked = check again later; action_required = give workflow.action.url to the person; succeeded or failed = stop (failed carries workflow.error).
  • get_registrantWhether this organization has its registrant on file.Reads private dataNo findings

    Why it is in this group

    • The name "get_registrant" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "file": it reads files.
    Description, as the server wrote it
    Whether this organization has its registrant on file. The customer is the legal holder of every domain; a signed-in person enters the registrant and accepts the terms in the console before the first registration or transfer.
  • get_tld_infoWhat an ending costs (registration, renewal, transfer) and its rules: allowed terms, days left to renew after expiry, WHOIS privacy, DNSSEC, HSTS preload.No findings

    Why it is in this group

    • The name "get_tld_info" says "get": a word for reading.
    Description, as the server wrote it
    What an ending costs (registration, renewal, transfer) and its rules: allowed terms, days left to renew after expiry, WHOIS privacy, DNSSEC, HSTS preload. No sign-in needed.
  • list_approvalsChanges waiting for a person to approve, and the ones already decided, each with workflow.state (action_required, in_progress, succeeded, failed).No findings

    Why it is in this group

    • The name "list_approvals" says "list": a word for reading.
    Description, as the server wrote it
    Changes waiting for a person to approve, and the ones already decided, each with workflow.state (action_required, in_progress, succeeded, failed). Approving is done by a person in the console, never through MCP.
  • list_audit_eventsRead recent immutable audit evidence for the signed-in Nymwell organization.No findings

    Why it is in this group

    • The name "list_audit_events" says "list": a word for reading.
    Description, as the server wrote it
    Read recent immutable audit evidence for the signed-in Nymwell organization.
  • list_dns_presetsList the DNS presets purchase_domain and apply_dns_preset accept (Vercel, Netlify, GitHub Pages, Cloudflare Pages, Agent Lab Deploy, Google Workspace email).Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "list_dns_presets" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "list" and "email": it reads mail.
    • untrusted-inputThe description's first sentence says "list" and "email": it reads inbound email, which other people can write.
    Description, as the server wrote it
    List the DNS presets purchase_domain and apply_dns_preset accept (Vercel, Netlify, GitHub Pages, Cloudflare Pages, Agent Lab Deploy, Google Workspace email). No sign-in needed.
  • list_dns_recordsList DNS records for a managed domain.No findings

    Why it is in this group

    • The name "list_dns_records" says "list": a word for reading.
    Description, as the server wrote it
    List DNS records for a managed domain. refresh: true first pulls the records from the registrar (including ones changed outside Nymwell).
  • list_domain_servicesRead DNSSEC DS records, URL forwarding, email forwarding or branded (vanity) nameservers for a domain, live from the registrar.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "list_domain_services" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "read" and "email": it reads mail.
    • untrusted-inputThe description's first sentence says "read" and "url": it reads web pages, which anyone can write.
    Description, as the server wrote it
    Read DNSSEC DS records, URL forwarding, email forwarding or branded (vanity) nameservers for a domain, live from the registrar.
  • list_domainsList domains visible to the signed-in Nymwell organization.No findings

    Why it is in this group

    • The name "list_domains" says "list": a word for reading.
    Description, as the server wrote it
    List domains visible to the signed-in Nymwell organization.
  • list_invoicesList invoice metadata for the signed-in Nymwell organization.No findings

    Why it is in this group

    • The name "list_invoices" says "list": a word for reading.
    Description, as the server wrote it
    List invoice metadata for the signed-in Nymwell organization.
  • list_membersList members and roles for the signed-in Nymwell organization.No findings

    Why it is in this group

    • The name "list_members" says "list": a word for reading.
    Description, as the server wrote it
    List members and roles for the signed-in Nymwell organization.
  • list_unverified_contactsRegistrant emails still waiting for ICANN verification on this organization's domains, with the deadline.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "list_unverified_contacts" says "list": a word for reading.

    What it can reach

    • private-dataThe name "list_unverified_contacts" says "list" and "contact": it reads contacts.
    • private-dataThe description's first sentence says "email": it reads mail.
    • untrusted-inputThe description's first sentence says "email": it reads inbound email, which other people can write.
    Description, as the server wrote it
    Registrant emails still waiting for ICANN verification on this organization's domains, with the deadline. A domain whose registrant misses it stops resolving.
  • nymwell_statusRead Nymwell backend, database and provider-adapter readiness.Reads private dataNo findings

    Why it is in this group

    • The name "nymwell_status" says "status": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "read" and "database": it reads databases.
    Description, as the server wrote it
    Read Nymwell backend, database and provider-adapter readiness.
  • search_domainsCheck which domain names can be registered and what they cost from a live registrar (not DNS or RDAP).No findings

    Why it is in this group

    • The name "search_domains" says "search": a word for reading.
    Description, as the server wrote it
    Check which domain names can be registered and what they cost from a live registrar (not DNS or RDAP). Pass exact domains, or a name plus endings. If Nymwell is not connected to a live registrar, this tool refuses sandbox data; use screen_domains for a public-record first pass. Prices are USD for the minimum term; get_quote gives the exact price for a chosen term. Each name has tier (standard or premium) when it can be registered, or reason (domain_unavailable, extension_not_supported, extension_disallows_registration) when it cannot. No sign-in needed.

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

18 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 outbound tool breaks every one.

Reads private data6
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write3
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out1
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__nymwell__resend_contact_verification"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

No check matched anything in these tool definitions. That is not a safety guarantee.

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http nymwell https://nymwell.com/mcp
claude mcp add --transport http nymwell https://nymwell.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__nymwell__nymwell_status",
      "mcp__nymwell__list_domains",
      "mcp__nymwell__list_dns_records",
      "mcp__nymwell__list_invoices",
      "mcp__nymwell__list_members",
      "mcp__nymwell__list_audit_events",
      "mcp__nymwell__search_domains",
      "mcp__nymwell__get_order",
      "mcp__nymwell__list_dns_presets",
      "mcp__nymwell__get_tld_info",
      "mcp__nymwell__get_domain",
      "mcp__nymwell__list_domain_services",
      "mcp__nymwell__list_unverified_contacts",
      "mcp__nymwell__get_registrant",
      "mcp__nymwell__list_approvals"
    ],
    "ask": [
      "mcp__nymwell__stage_dns_change",
      "mcp__nymwell__screen_domains",
      "mcp__nymwell__get_quote",
      "mcp__nymwell__purchase_domain",
      "mcp__nymwell__apply_dns_preset",
      "mcp__nymwell__suggest_domains",
      "mcp__nymwell__set_auto_renew",
      "mcp__nymwell__update_domain_settings",
      "mcp__nymwell__set_nameservers",
      "mcp__nymwell__set_contacts",
      "mcp__nymwell__request_auth_code",
      "mcp__nymwell__change_domain_service",
      "mcp__nymwell__list_transfers",
      "mcp__nymwell__resend_contact_verification"
    ],
    "deny": [
      "mcp__nymwell__cancel_registration",
      "mcp__nymwell__cancel_transfer"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as nymwell. Review it before you use it.

Capability tags behind 7 rules
  • mcp__nymwell__nymwell_status private-data
  • mcp__nymwell__list_dns_presets private-data, untrusted-input
  • mcp__nymwell__get_domain private-data
  • mcp__nymwell__list_domain_services private-data, untrusted-input
  • mcp__nymwell__list_unverified_contacts private-data, untrusted-input
  • mcp__nymwell__get_registrant private-data
  • mcp__nymwell__resend_contact_verification outbound

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/com.nymwell/mcp/verify?hash=80b8c9c0d0288e80d05429711a4a16e743008bc8a0ed305dfadbf9e2d881b6d7" | jq -e '.changed == false'

Pinned hash 80b8c9c0d028, from Oct 26, 2026, 14:17 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/com.nymwell/mcp/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for com.nymwell/mcp
[![anlyon.dev](https://anlyon.dev/badge/com.nymwell/mcp.svg)](https://anlyon.dev/servers/com.nymwell/mcp)

Source: MCP Registry. Synced Oct 26, 2026, 14:17 UTC.