OSIR Domain Registrar
by osir.com · remote · no sign-in to list tools · v2.4.2 · published by com.osir
Register, renew, transfer, and manage domains, DNS, VPS, and email with 106 tools. By OSIR.
Deletes · 11Final · 7Changes · 40
106 tools: 11 can delete or cancel things, 7 do something that can't be undone, 40 change things and 48 only read.
Scanned Oct 21, 2026
- Deletes or cancels11Claude Code: deny: see these tools
- Can't be undone7Claude Code: ask: see these tools
- Changes things40Claude Code: ask: see these tools
- Only reads48Claude Code: allow: see these tools
5 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http domain-registrar https://be.osir.com/mcp/httpFindings
Matches of fixed checks, with the text they matched.
The server marks "addPrefixToDomain" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "addPrefixToDomain" says "add": a word for a change.
The server marks "addSuffixToDomain" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "addSuffixToDomain" says "add": a word for a change.
The server marks "checkDeviceLoginStatus" as not read-only (readOnlyHint: false), and its words say it reads.
What this check looks forMatched text
annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "checkDeviceLoginStatus" says "status": a word for reading.
The server marks "generateDomainSuggestions" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "generateDomainSuggestions" says "generate": a word for a change.
- InfologinWithDevice
The description mentions "credentials".
What this check looks forMatched text
description: "...er the code, and sign in with your OSIR credentials. Then call checkDeviceLoginStatus with..."
Tools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
106 tools
Deletes or cancels 11Claude Code: deny
buildVpsInstancebuildVpsInstance: Stage an operating system install (or reinstall) on a VPS instance.No findings
Why it is in this group
- The description says "cannot be undone".
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it buildVpsInstance: Stage an operating system install (or reinstall) on a VPS instance. DESTRUCTIVE: ERASES ALL DATA on the server, including any deployed application, and cannot be undone. The install is asynchronous; afterwards poll getVpsInstanceDetails until buildState is COMPLETE. If an Osir app was deployed onto this instance, a rebuild erases it; re-attach it afterwards with osirAppDeployToVps. Never rebuild a box just to install an app runtime by hand. Requires authentication. Returns an actionId: present the summary to the user, then call executeConfirmedAction with the actionId if they approve.
Annotations the server declares
- title: Install OS on VPS
- destructiveHint: true
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
cancelTransfercancelTransfer: Stage cancellation of a pending domain transfer.No findings
Why it is in this group
- The name "cancelTransfer" says "cancel": a word for removing or ending something.
- The description says "irreversible".
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it cancelTransfer: Stage cancellation of a pending domain transfer. DESTRUCTIVE and irreversible once executed. Requires authentication. Returns an actionId; present the summary to the user, then call executeConfirmedAction with the actionId if they approve.
Annotations the server declares
- title: Cancel domain transfer
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: false
deleteContactdeleteContact: Stage deletion of a contact.No findings
Why it is in this group
- The name "deleteContact" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it deleteContact: Stage deletion of a contact. DESTRUCTIVE; fails if the contact is assigned to active domains. Requires authentication. Returns an actionId; present the summary to the user, then call executeConfirmedAction with the actionId if they approve.
Annotations the server declares
- title: Delete contact
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: false
deleteDnsRecorddeleteDnsRecord: Stage deletion of a DNS record.No findings
Why it is in this group
- The name "deleteDnsRecord" says "delete": a word for removing or ending something.
- The description says "irreversible".
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it deleteDnsRecord: Stage deletion of a DNS record. DESTRUCTIVE and irreversible once executed. Requires authentication. Returns an actionId; present the summary to the user, then call executeConfirmedAction with the actionId if they approve.
Annotations the server declares
- title: Delete DNS record
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: false
deleteHostdeleteHost: Stage deletion of a host/glue record.No findings
Why it is in this group
- The name "deleteHost" says "delete": a word for removing or ending something.
- The description says "irreversible".
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it deleteHost: Stage deletion of a host/glue record. DESTRUCTIVE and irreversible once executed. Requires authentication. Returns an actionId; present the summary to the user, then call executeConfirmedAction with the actionId if they approve.
Annotations the server declares
- title: Delete host record
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: false
deleteMailboxdeleteMailbox: Stage deletion of a mailbox.No findings
Why it is in this group
- The name "deleteMailbox" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it deleteMailbox: Stage deletion of a mailbox. The mailbox stops working immediately and its data is destroyed after a 14-day grace period. Requires authentication. Returns an actionId: present the summary to the user, then call executeConfirmedAction with the actionId if they approve.
Annotations the server declares
- title: Delete mailbox
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: false
deleteSshKeydeleteSshKey: Stage removal of an SSH key from your account.No findings
Why it is in this group
- The name "deleteSshKey" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it deleteSshKey: Stage removal of an SSH key from your account. This does not affect servers already built with it, and the key can simply be added again. Requires authentication. Returns an actionId; present the summary to the user, then call executeConfirmedAction with the actionId if they approve.
Annotations the server declares
- title: Delete SSH key
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: false
deleteVpsInstancedeleteVpsInstance: Stage deletion/cancellation of a VPS instance.No findings
Why it is in this group
- The name "deleteVpsInstance" says "delete": a word for removing or ending something.
- The description says "irreversible".
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it deleteVpsInstance: Stage deletion/cancellation of a VPS instance. DESTRUCTIVE and irreversible. Requires authentication. Returns an actionId: present the summary to the user, then call executeConfirmedAction with the actionId if they approve.
Annotations the server declares
- title: Delete VPS instance
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: false
executeConfirmedActionexecuteConfirmedAction: Execute a previously staged destructive or financial action after user approval.No findings
Why it is in this group
- The name "executeConfirmedAction" says "execute": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it executeConfirmedAction: Execute a previously staged destructive or financial action after user approval. The action expires after 5 minutes and can only be executed once.
Annotations the server declares
- title: Execute confirmed action
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: false
osirAppDeleteosirAppDelete: Stage deletion of an Osir app.No findings
Why it is in this group
- The name "osirAppDelete" says "delete": a word for removing or ending something.
- The description says "irreversible".
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it osirAppDelete: Stage deletion of an Osir app. DESTRUCTIVE and irreversible: removes its microVM, image, route, and data. Returns an actionId; present the summary to the user, then call executeConfirmedAction with the actionId if they approve. Requires authentication.
Annotations the server declares
- title: Delete an app
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: false
unlockDomainunlockDomain: Stage removal of registrar lock from a domain to allow transfers.No findings
Why it is in this group
- The name "unlockDomain" says "unlock": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it unlockDomain: Stage removal of registrar lock from a domain to allow transfers. DESTRUCTIVE: reduces domain security. Returns an actionId: present the summary to the user, then call executeConfirmedAction with the actionId if they approve.
Annotations the server declares
- title: Unlock a domain
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: false
Can't be undone 7Claude Code: ask
changeVpsPaymentTermchangeVpsPaymentTerm: Stage a change of the payment term (billing cycle) for a VPS instance.No findings
Why it is in this group
- The name "changeVpsPaymentTerm" says "payment": a word that usually means money moves, which cannot be taken back.
Description, as the server wrote it changeVpsPaymentTerm: Stage a change of the payment term (billing cycle) for a VPS instance. Affects what you are billed. Requires authentication. Returns an actionId; present the summary to the user, then call executeConfirmedAction with the actionId if they approve.
Annotations the server declares
- title: Change VPS payment term
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
createPaymentSessioncreatePaymentSession: Stage a Stripe checkout session to add funds to the account balance.No findings
Why it is in this group
- The name "createPaymentSession" says "create": a word for a change.
- The name "createPaymentSession" also says "payment": a word that usually means money moves, which cannot be taken back.
- The input carries an amount (input.amount) and a currency, so it moves money.
Description, as the server wrote it createPaymentSession: Stage a Stripe checkout session to add funds to the account balance. Requires authentication. Returns an actionId; present the summary to the user, then call executeConfirmedAction with the actionId if they approve. The executed result includes checkoutUrl (hand it to the human to pay) and expiresAt; then poll getPaymentTransactions until the balance credit appears.
Annotations the server declares
- title: Create payment session
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
initiateTransferinitiateTransfer: Starts a transfer for a domain already prepared at the losing registrar (unlocked, auth code in hand).No findings
Why it is in this group
- The name "initiateTransfer" says "transfer": a word for a change that another call does not undo.
Description, as the server wrote it initiateTransfer: Starts a transfer for a domain already prepared at the losing registrar (unlocked, auth code in hand). transferDomain (domain tools) stages transfer + registrant assignment in one step; use that when the user gives you contact details. Deducts from account balance. Requires authentication. Returns an actionId; present the summary to the user, then call executeConfirmedAction with the actionId if they approve.
Annotations the server declares
- title: Initiate domain transfer
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
osirSitePublishosirSitePublish: Publish a single-page website to a live HTTPS URL on Osir (free tier).No findings
Why it is in this group
- The name "osirSitePublish" says "publish": a word for a change that another call does not undo.
Description, as the server wrote it osirSitePublish: Publish a single-page website to a live HTTPS URL on Osir (free tier). ANY complete HTML document works: the user's own site, a page designed in this chat, or one from the osirSiteDesignBrief flow. Calling again with the same name redeploys the new version. For MULTI-FILE sites (separate CSS/JS/images) use osirAppCreateUpload + osirAppDeploy with a zip instead. Then poll osirAppStatus until READY. If the app was moved to the user's own VPS, redeploying under the same name updates it there and keeps its domain. Requires authentication.
Annotations the server declares
- title: Publish a website
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
payInvoicepayInvoice: Stage payment of an outstanding invoice from account balance.No findings
Why it is in this group
- The name "payInvoice" says "pay": a word that usually means money moves, which cannot be taken back.
Description, as the server wrote it payInvoice: Stage payment of an outstanding invoice from account balance. Requires authentication. Returns an actionId; present the summary to the user, then call executeConfirmedAction with the actionId if they approve.
Annotations the server declares
- title: Pay invoice
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
transferDomaintransferDomain: Stage transfer of a domain from another registrar to OSIR.No findings
Why it is in this group
- The name "transferDomain" says "transfer": a word for a change that another call does not undo.
Description, as the server wrote it transferDomain: Stage transfer of a domain from another registrar to OSIR. Deducts from account balance. Returns an actionId: present the summary to the user, then call executeConfirmedAction with the actionId if they approve.
Annotations the server declares
- title: Transfer a domain
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
Changes things 40Claude Code: ask
addPrefixToDomainaddPrefixToDomain: Generate domain suggestions by adding prefixes to a base name.1 finding
Why it is in this group
- The name "addPrefixToDomain" says "add": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "addPrefixToDomain" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "addPrefixToDomain" says "add": a word for a change.
Description, as the server wrote it addPrefixToDomain: Generate domain suggestions by adding prefixes to a base name.
Annotations the server declares
- title: Add domain prefixes
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
addSshKeyaddSshKey: Store an SSH public key on your account so it can be injected into VPS installs.No findings
Why it is in this group
- The name "addSshKey" says "add": a word for a change.
Description, as the server wrote it addSshKey: Store an SSH public key on your account so it can be injected into VPS installs. Idempotent: storing a key you already have returns the existing one instead of creating a duplicate, so it is safe to call before every order. Returns the key id to pass to orderVps or buildVpsInstance. Requires authentication.
Annotations the server declares
- title: Add SSH key
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: false
addSuffixToDomainaddSuffixToDomain: Generate domain suggestions by adding suffixes to a base name.1 finding
Why it is in this group
- The name "addSuffixToDomain" says "add": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "addSuffixToDomain" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "addSuffixToDomain" says "add": a word for a change.
Description, as the server wrote it addSuffixToDomain: Generate domain suggestions by adding suffixes to a base name.
Annotations the server declares
- title: Add domain suffixes
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
bulkDomainSuggestionsbulkDomainSuggestions: Generate domain suggestions for 1-10 keywords across 1-6 TLDs (hard cap), grouped by originating keyword.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it bulkDomainSuggestions: Generate domain suggestions for 1-10 keywords across 1-6 TLDs (hard cap), grouped by originating keyword. Typical flow: call listCategorizedTlds first to pick 3-6 TLDs, then this tool. Per-suggestion availability may be "available", "taken", or "unknown"; confirm "unknown" or premium-TLD names with checkDomainAvailability before recommending.
Annotations the server declares
- title: Bulk domain suggestions
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
checkDeviceLoginStatuscheckDeviceLoginStatus: Poll for device login completion.1 finding
Why it is in this group
- The name "checkDeviceLoginStatus" says "status": a word for reading.
- The server marks it as not read-only (readOnlyHint: false).
Findings
- Warn
The server marks "checkDeviceLoginStatus" as not read-only (readOnlyHint: false), and its words say it reads.
What this check looks forMatched text
annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "checkDeviceLoginStatus" says "status": a word for reading.
Description, as the server wrote it checkDeviceLoginStatus: Poll for device login completion. Call this after loginWithDevice() once you have opened the verification URL and signed in. Required: deviceCode (the device_code returned by loginWithDevice). On success returns a sessionKey; pass it as the sessionKey argument on every subsequent authenticated tool call.
Annotations the server declares
- title: Check device login status
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
checkDomainAvailabilitycheckDomainAvailability: Check if a domain name is available for registration, with price.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it checkDomainAvailability: Check if a domain name is available for registration, with price. No authentication required; anonymous callers get list pricing, authenticated callers get their account pricing. Required: domain (e.g., 'example.com')
Annotations the server declares
- title: Check domain availability
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
checkHostAvailabilitycheckHostAvailability: Check if a host/glue record name is available for creation.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it checkHostAvailability: Check if a host/glue record name is available for creation. Requires authentication. Returns whether the hostname is free; call before createHost.
Annotations the server declares
- title: Check host availability
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
checkKeywordAvailabilitycheckKeywordAvailability: Check keyword availability across all supported TLDs and registries with detailed per-domain results.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it checkKeywordAvailability: Check keyword availability across all supported TLDs and registries with detailed per-domain results. Use checkKeywordAvailabilitySummary instead when you only need counts; it is faster.
Annotations the server declares
- title: Check keyword availability
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
checkKeywordAvailabilitySummarycheckKeywordAvailabilitySummary: Check keyword availability across TLDs and registries.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it checkKeywordAvailabilitySummary: Check keyword availability across TLDs and registries. Summary statistics only (no per-domain results), faster than checkKeywordAvailability.
Annotations the server declares
- title: Keyword availability summary
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
createAccountcreateAccount: Create a new OSIR customer account; step 1 of onboarding, no authentication required.No findings
Why it is in this group
- The name "createAccount" says "create": a word for a change.
Description, as the server wrote it createAccount: Create a new OSIR customer account; step 1 of onboarding, no authentication required. The contact must be the PRINCIPAL's real ICANN registrant contact (the human or business the account is for), never the AI agent itself. Sends a verification email; complete via verifyAccount with the emailed code. While PENDING_VERIFICATION the account can search, quote and fund; billable actions need ACTIVE. Calling again for a PENDING account re-sends the verification email.
Annotations the server declares
- title: Create account
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: false
createContactcreateContact: Create a new contact for use with domain registrations.No findings
Why it is in this group
- The name "createContact" says "create": a word for a change.
Description, as the server wrote it createContact: Create a new contact for use with domain registrations. Requires authentication. Returns the created contact including its id for assignment to domains.
Annotations the server declares
- title: Create contact
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
createDnsRecordcreateDnsRecord: Create a new DNS record for a domain.No findings
Why it is in this group
- The name "createDnsRecord" says "create": a word for a change.
Description, as the server wrote it createDnsRecord: Create a new DNS record for a domain. Requires authentication. For newly registered domains the zone is initialized automatically if missing. Returns the created record including its id for later updates or deletion.
Annotations the server declares
- title: Create DNS record
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
createHostcreateHost: Create a new host/glue record, e.g.No findings
Why it is in this group
- The name "createHost" says "create": a word for a change.
Description, as the server wrote it createHost: Create a new host/glue record, e.g. for custom nameservers like 'ns1.example.com'. Requires authentication. Check the name first with checkHostAvailability. Returns the created host record.
Annotations the server declares
- title: Create host record
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
createMailboxcreateMailbox: Stage creation of a paid mailbox on a mail-enabled domain.No findings
Why it is in this group
- The name "createMailbox" says "create": a word for a change.
Description, as the server wrote it createMailbox: Stage creation of a paid mailbox on a mail-enabled domain. BILLABLE: deducts from account balance; get a quote with getMailboxQuote and confirm the price with the user first. Requires authentication. Returns an actionId: present the summary to the user, then call executeConfirmedAction with the actionId if they approve. The result of the confirmed action contains the generated password EXACTLY ONCE; it can never be retrieved again, so show it to the user immediately (they can change it later with setMailboxPassword). Also share the client settings from the result (IMAP/SMTP/webmail).
Annotations the server declares
- title: Create mailbox
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
enableMailDomainenableMailDomain: Enable email hosting on a domain you own.No findings
Why it is in this group
- The name "enableMailDomain" says "enable": a word for a change.
Description, as the server wrote it enableMailDomain: Enable email hosting on a domain you own. Free; mailboxes are what cost money. If the call fails with a DNS conflict (an existing SPF or MX record), ask the user for explicit consent, then re-call with spfMergeConfirmed=true and/or takeoverConfirmed=true. Requires authentication.
Annotations the server declares
- title: Enable mail domain
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: false
generateDomainSuggestionsgenerateDomainSuggestions: Generate domain name suggestions based on keywords.1 finding
Why it is in this group
- The name "generateDomainSuggestions" says "generate": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "generateDomainSuggestions" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "generateDomainSuggestions" says "generate": a word for a change.
Description, as the server wrote it generateDomainSuggestions: Generate domain name suggestions based on keywords. This is the preferred suggestion tool for a single keyword; use it over suggestAlternatives. Returns suggested names with availability.
Annotations the server declares
- title: Generate domain suggestions
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
initializeDnsZoneinitializeDnsZone: Initialize (create) the DNS zone for a domain.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it initializeDnsZone: Initialize (create) the DNS zone for a domain. NOT needed after registerDomain, which initializes the zone automatically. Use only for pre-existing domains without a zone (e.g. after a transfer, or if registration opted out with initializeDnsZone:false). Safe on existing zones, it will not overwrite records. Requires authentication.
Annotations the server declares
- title: Initialize DNS zone
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: false
lockDomainlockDomain: Enable registrar lock on a domain to prevent unauthorized transfers.No findings
Why it is in this group
- The name "lockDomain" says "lock": a word for a change.
Description, as the server wrote it lockDomain: Enable registrar lock on a domain to prevent unauthorized transfers.
Annotations the server declares
- title: Lock a domain
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: false
loginToVpsPanelloginToVpsPanel: Generate a one-time login URL to the VPS control panel (VirtFusion) for managing the server.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it loginToVpsPanel: Generate a one-time login URL to the VPS control panel (VirtFusion) for managing the server. Requires authentication.
Annotations the server declares
- title: Log in to VPS panel
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
loginWithDeviceloginWithDevice: Start a device authorization login (RFC 8628).1 finding
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Findings
- Info
The description mentions "credentials".
What this check looks forMatched text
description: "...er the code, and sign in with your OSIR credentials. Then call checkDeviceLoginStatus with..."
Description, as the server wrote it loginWithDevice: Start a device authorization login (RFC 8628). Returns a verificationUri and userCode. Open the URI in your browser, enter the code, and sign in with your OSIR credentials. Then call checkDeviceLoginStatus with the returned deviceCode to complete login. No parameters required.
Annotations the server declares
- title: Start device login
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
logoutlogout: Log out: revokes the session's tokens at the identity provider immediately.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it logout: Log out: revokes the session's tokens at the identity provider immediately. Optional: sessionKey (from checkDeviceLoginStatus); pass it to end that conversation session.
Annotations the server declares
- title: Log out
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: false
orderVpsorderVps: Stage an order for a new VPS instance; deducts from account balance.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it orderVps: Stage an order for a new VPS instance; deducts from account balance. If this server is being ordered to host an Osir app, do NOT configure it by hand afterwards: deploy the app with osirAppDeploy, then put it on the box with osirAppDeployToVps. Requires authentication. Returns an actionId: present the summary to the user, then call executeConfirmedAction with the actionId if they approve.
Annotations the server declares
- title: Order a VPS
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
osirAppCreateUploadosirAppCreateUpload: Create an upload ticket for deploying app source code to Osir.No findings
Why it is in this group
- The name "osirAppCreateUpload" says "create": a word for a change.
Description, as the server wrote it osirAppCreateUpload: Create an upload ticket for deploying app source code to Osir. Returns an uploadTicket, a putUrl, and instructions to zip the project and upload it. After uploading, call osirAppDeploy with the uploadTicket. Requires authentication.
Annotations the server declares
- title: Create app upload ticket
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
osirAppDeployosirAppDeploy: Deploy an app to Osir (free tier) and get a live HTTPS URL; the app runs isolated in a microVM.No findings
Why it is in this group
- The name "osirAppDeploy" says "deploy": a word for a change.
Description, as the server wrote it osirAppDeploy: Deploy an app to Osir (free tier) and get a live HTTPS URL; the app runs isolated in a microVM. Deploying an existing app name redeploys it (new version) and applies any secrets set via osirAppSetSecret. A plain static website (HTML/CSS/JS with no framework or build step) is also supported: it is auto-detected and served directly; pass language 'node' for it. To put the app on the user's OWN VPS, server or production box instead, deploy it here first and then call osirAppDeployToVps - never SSH into the box or write an install script. Once an app is on the user's own VPS, redeploying HERE under the same name is how you update it: the platform re-ships it to the box and keeps its domain. Requires authentication.
Annotations the server declares
- title: Deploy an app
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
osirAppDeployToVpsosirAppDeployToVps: Deploy a live Osir app onto the user's own VPS / server / production box, moving it off the shared free tier.No findings
Why it is in this group
- The name "osirAppDeployToVps" says "deploy": a word for a change.
Description, as the server wrote it osirAppDeployToVps: Deploy a live Osir app onto the user's own VPS / server / production box, moving it off the shared free tier. Use this INSTEAD of SSH, a provisioning or install script, nginx/systemd/TLS configuration, or any manual server setup - the platform ships the app to the box itself over its own deploy key, so the assistant needs no shell access and no outbound SSH. This is the ONLY supported way to put an app on a user's own server or a custom domain. TWO WAYS IN. (1) The user already owns a VPS: pass instanceId (from listMyVpsInstances) and NO packageId - this ATTACHES the app to that server, SPENDS NOTHING and needs no confirmation. (2) No server yet: pass packageId (from listVpsPackages) and the call stages a VPS order (COSTS MONEY): returns an actionId; present the price/summary to the user and call executeConfirmedAction only if they approve. Before staging any order this tool checks whether the user ALREADY has a box for this app (its C2 binding, then their own VPS list) and attaches that instead - a retry after a failed move never buys a second server. After the move starts the platform ships the app onto the box server-side, which takes about two minutes; watch it with osirAppStatus ('ownedMove'). Calling this tool again while a move is still running just reports its progress, and calling it after one FAILED retries the ship - unless osirAppStatus says the VPS refused the Osir deploy key or its web ports are taken: then retry only after the user has made the changes that message lists. If the result status is BUILDING or BUILD_FAILED, follow its nextStep. Requires authentication.
Annotations the server declares
- title: Deploy app to the user's own VPS
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
osirAppProvisionDatabaseosirAppProvisionDatabase: Provision a managed Postgres database for an Osir app.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it osirAppProvisionDatabase: Provision a managed Postgres database for an Osir app. The connection string is stored as the app's DATABASE_URL secret (encrypted, injected on the next osirAppDeploy) and is NEVER returned. Requires authentication.
Annotations the server declares
- title: Provision app database
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
osirAppSetSecretosirAppSetSecret: Set an environment secret for an Osir app (e.g.No findings
Why it is in this group
- The name "osirAppSetSecret" says "set": a word for a change.
Description, as the server wrote it osirAppSetSecret: Set an environment secret for an Osir app (e.g. DATABASE_URL, API_KEY). The value is stored encrypted and injected as an env var on the next osirAppDeploy of the app; it is NEVER returned or logged. Requires authentication.
Annotations the server declares
- title: Set app secret
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
osirSiteDesignBriefosirSiteDesignBrief: Step 1 of designing a NEW website with OSIR.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it osirSiteDesignBrief: Step 1 of designing a NEW website with OSIR. Validates the brief and returns 'systemPrompt', the structured design brief and constraints YOU must then follow to write one complete self-contained HTML page, plus 'editRules' for later revisions. Call it before osirSitePublish for a new site, then publish the finished page with osirSitePublish. No authentication needed.
Annotations the server declares
- title: Create site design brief
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
registerDomainregisterDomain: Stage registration of a new domain name.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it registerDomain: Stage registration of a new domain name. Deducts from account balance. The DNS zone is initialised automatically after registration (asynchronously; if createDnsRecord right after registration reports a missing zone, retry after a few seconds). Pass initializeDnsZone:false to opt out. Returns an actionId: present the summary to the user, then call executeConfirmedAction with the actionId if they approve.
Annotations the server declares
- title: Register a domain
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
renewDomainrenewDomain: Stage renewal of a domain for a specified number of years.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it renewDomain: Stage renewal of a domain for a specified number of years. Deducts from account balance. Returns an actionId: present the summary to the user, then call executeConfirmedAction with the actionId if they approve.
Annotations the server declares
- title: Renew a domain
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
setMailboxPasswordsetMailboxPassword: Set a new password on a mailbox.No findings
Why it is in this group
- The name "setMailboxPassword" says "set": a word for a change.
Description, as the server wrote it setMailboxPassword: Set a new password on a mailbox. Never log or store the password. Requires authentication.
Annotations the server declares
- title: Set mailbox password
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: false
spinDomainWordsspinDomainWords: Generate domain suggestions by spinning/replacing words with similar alternatives.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it spinDomainWords: Generate domain suggestions by spinning/replacing words with similar alternatives.
Annotations the server declares
- title: Spin domain words
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
suggestAlternativessuggestAlternatives: Suggest alternative domain names if the requested one is unavailable.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it suggestAlternatives: Suggest alternative domain names if the requested one is unavailable. Legacy; prefer generateDomainSuggestions.
Annotations the server declares
- title: Suggest alternative domains
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
updateContactupdateContact: Update an existing contact's information.No findings
Why it is in this group
- The name "updateContact" says "update": a word for a change.
Description, as the server wrote it updateContact: Update an existing contact's information. Requires authentication. Only the fields you provide are changed; omitted fields keep their current values. Get the contactId from listContacts. Returns the updated contact.
Annotations the server declares
- title: Update contact
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: false
updateDnsRecordupdateDnsRecord: Update an existing DNS record.No findings
Why it is in this group
- The name "updateDnsRecord" says "update": a word for a change.
Description, as the server wrote it updateDnsRecord: Update an existing DNS record. Requires authentication. Only the fields you provide are changed; omitted fields keep their current values. Get the recordId from listDnsRecords. Returns the updated record.
Annotations the server declares
- title: Update DNS record
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: false
updateDomainAutoRenewupdateDomainAutoRenew: Enable or disable auto-renewal for a domain.No findings
Why it is in this group
- The name "updateDomainAutoRenew" says "update": a word for a change.
Description, as the server wrote it updateDomainAutoRenew: Enable or disable auto-renewal for a domain.
Annotations the server declares
- title: Set domain auto-renew
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
updateDomainPrivacyupdateDomainPrivacy: Enable or disable WHOIS privacy protection for a domain.No findings
Why it is in this group
- The name "updateDomainPrivacy" says "update": a word for a change.
Description, as the server wrote it updateDomainPrivacy: Enable or disable WHOIS privacy protection for a domain.
Annotations the server declares
- title: Set WHOIS privacy
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
updateNameserversupdateNameservers: Update nameservers for a domain.No findings
Why it is in this group
- The name "updateNameservers" says "update": a word for a change.
Description, as the server wrote it updateNameservers: Update nameservers for a domain. Replaces the current nameserver set with the given list.
Annotations the server declares
- title: Update nameservers
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
verifyAccountverifyAccount: Verify a newly created OSIR account with the code from the verification email; step 2 of onboarding, no authentication required.No findings
Why it is in this group
- The input takes a statement or command to run (input.code), which can change anything it can reach.
Description, as the server wrote it verifyAccount: Verify a newly created OSIR account with the code from the verification email; step 2 of onboarding, no authentication required. The code is the same token as the email link, so the principal can relay it to their agent. On success the account becomes ACTIVE and billable actions are unlocked. If the code expired, call createAccount again with the same email to get a fresh one.
Annotations the server declares
- title: Verify account
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: false
verifyMailDnsverifyMailDns: Check that a mail domain's DNS records resolve; activates the domain for email when all records are found.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it verifyMailDns: Check that a mail domain's DNS records resolve; activates the domain for email when all records are found. Returns any still-missing records. Requires authentication.
Annotations the server declares
- title: Verify mail DNS
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
Only reads 48Claude Code: allow
countMyVpsInstancescountMyVpsInstances: Get the total count of VPS instances owned by the authenticated user.No findings
Why it is in this group
- The name "countMyVpsInstances" says "count": a word for reading.
Description, as the server wrote it countMyVpsInstances: Get the total count of VPS instances owned by the authenticated user. Requires authentication.
Annotations the server declares
- title: Count my VPS instances
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
getAccountBalancegetAccountBalance: Get the current account balance for the authenticated user.No findings
Why it is in this group
- The name "getAccountBalance" says "get": a word for reading.
Description, as the server wrote it getAccountBalance: Get the current account balance for the authenticated user. Requires authentication.
Annotations the server declares
- title: Get account balance
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
getAccountSummarygetAccountSummary: Get a comprehensive summary of the user's account: profile, balance, domain count, VPS count, and pending transfers.No findings
Why it is in this group
- The name "getAccountSummary" says "get": a word for reading.
Description, as the server wrote it getAccountSummary: Get a comprehensive summary of the user's account: profile, balance, domain count, VPS count, and pending transfers. Requires authentication.
Annotations the server declares
- title: Get account summary
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
getAuthStatusgetAuthStatus: Check whether the current session is authenticated.No findings
Why it is in this group
- The name "getAuthStatus" says "get": a word for reading.
Description, as the server wrote it getAuthStatus: Check whether the current session is authenticated. Returns authenticated status and token expiry. Optional: sessionKey (from checkDeviceLoginStatus).
Annotations the server declares
- title: Get authentication status
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
getContactgetContact: Get detailed information about a specific contact.No findings
Why it is in this group
- The name "getContact" says "get": a word for reading.
Description, as the server wrote it getContact: Get detailed information about a specific contact. Requires authentication. Get the contactId from listContacts. Returns name, email, phone, organization, and address.
Annotations the server declares
- title: Get contact
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
getContactsForDomaingetContactsForDomain: Get all contacts (registrant, admin, tech, billing) assigned to a domain.No findings
Why it is in this group
- The name "getContactsForDomain" says "get": a word for reading.
Description, as the server wrote it getContactsForDomain: Get all contacts (registrant, admin, tech, billing) assigned to a domain. Requires authentication. Returns the contact assigned to each role.
Annotations the server declares
- title: Get domain contacts
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
getDedicatedServerCataloggetDedicatedServerCatalog: Get all available dedicated server configurations with pricing and specifications.No findings
Why it is in this group
- The name "getDedicatedServerCatalog" says "get": a word for reading.
Description, as the server wrote it getDedicatedServerCatalog: Get all available dedicated server configurations with pricing and specifications. No authentication required.
Annotations the server declares
- title: Get dedicated server catalog
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
getDnsRecordgetDnsRecord: Get details of a specific DNS record by id.No findings
Why it is in this group
- The name "getDnsRecord" says "get": a word for reading.
Description, as the server wrote it getDnsRecord: Get details of a specific DNS record by id. Requires authentication. Get the recordId from listDnsRecords. Returns the record's name, type, content, TTL, and priority.
Annotations the server declares
- title: Get DNS record
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
getDomainAuditTrailgetDomainAuditTrail: Get the audit trail (history of all changes) for a specific domain.No findings
Why it is in this group
- The name "getDomainAuditTrail" says "get": a word for reading.
Description, as the server wrote it getDomainAuditTrail: Get the audit trail (history of all changes) for a specific domain. Requires authentication.
Annotations the server declares
- title: Get domain audit trail
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
getDomainExtensionsgetDomainExtensions: Get all available domain extensions (TLDs) with pricing information.No findings
Why it is in this group
- The name "getDomainExtensions" says "get": a word for reading.
Description, as the server wrote it getDomainExtensions: Get all available domain extensions (TLDs) with pricing information. No authentication required.
Annotations the server declares
- title: Get domain extensions
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
getDomainInfogetDomainInfo: Get registry (EPP) state plus account settings for one domain: status, nameservers, lock state, auto-renew, privacy, creation/expiry dates, premium/expired/redemptio…No findings
Why it is in this group
- The name "getDomainInfo" says "get": a word for reading.
Description, as the server wrote it getDomainInfo: Get registry (EPP) state plus account settings for one domain: status, nameservers, lock state, auto-renew, privacy, creation/expiry dates, premium/expired/redemption info. Dates are null while a registration is still pending at the registry; autoRenew is omitted for transferredOut domains.
Annotations the server declares
- title: Get domain details
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
getDomainPricinggetDomainPricing: Get pricing for domain extensions from the product catalog.No findings
Why it is in this group
- The name "getDomainPricing" says "get": a word for reading.
Description, as the server wrote it getDomainPricing: Get pricing for domain extensions from the product catalog. Requires authentication.
Annotations the server declares
- title: Get domain pricing
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
getHostingBundlegetHostingBundle: Get the hosting options and exact prices for a specific domain: recommended VPS packages (cheapest first), email plans, web forwarding, and app/site deployment.No findings
Why it is in this group
- The name "getHostingBundle" says "get": a word for reading.
Description, as the server wrote it getHostingBundle: Get the hosting options and exact prices for a specific domain: recommended VPS packages (cheapest first), email plans, web forwarding, and app/site deployment. No authentication required. Call this ONCE after a successful availability check or registration to make a concise hosting offer; do not repeat the offer in the same conversation. Prices are display prices; the authoritative amount is computed at purchase.
Annotations the server declares
- title: Get hosting bundle
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
getHostsForDomaingetHostsForDomain: List all host/glue records associated with a domain.No findings
Why it is in this group
- The name "getHostsForDomain" says "get": a word for reading.
Description, as the server wrote it getHostsForDomain: List all host/glue records associated with a domain. Requires authentication. Returns each host name and its IP addresses.
Annotations the server declares
- title: List host records
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
getInvoiceDetailsgetInvoiceDetails: Get detailed information about a specific invoice including line items.No findings
Why it is in this group
- The name "getInvoiceDetails" says "get": a word for reading.
Description, as the server wrote it getInvoiceDetails: Get detailed information about a specific invoice including line items. Requires authentication.
Annotations the server declares
- title: Get invoice details
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
getInvoiceStatisticsgetInvoiceStatistics: Get summary statistics of invoices: total paid, pending, overdue amounts.No findings
Why it is in this group
- The name "getInvoiceStatistics" says "get": a word for reading.
Description, as the server wrote it getInvoiceStatistics: Get summary statistics of invoices: total paid, pending, overdue amounts. Requires authentication.
Annotations the server declares
- title: Get invoice statistics
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
getMailboxQuotegetMailboxQuote: Get a display-only price quote for a mailbox plan.No findings
Why it is in this group
- The name "getMailboxQuote" says "get": a word for reading.
Description, as the server wrote it getMailboxQuote: Get a display-only price quote for a mailbox plan. The backend re-derives the authoritative price at purchase. Requires authentication.
Annotations the server declares
- title: Get mailbox quote
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
getMailboxUsagegetMailboxUsage: Get disk usage per mailbox in bytes, for quota display alongside the plan's quotaBytes.No findings
Why it is in this group
- The name "getMailboxUsage" says "get": a word for reading.
Description, as the server wrote it getMailboxUsage: Get disk usage per mailbox in bytes, for quota display alongside the plan's quotaBytes. Requires authentication.
Annotations the server declares
- title: Get mailbox usage
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
getMailDnsRecordsgetMailDnsRecords: Get the DNS records a mail domain needs (MX, SPF, DKIM, ...), for customers managing DNS externally.No findings
Why it is in this group
- The name "getMailDnsRecords" says "get": a word for reading.
Description, as the server wrote it getMailDnsRecords: Get the DNS records a mail domain needs (MX, SPF, DKIM, ...), for customers managing DNS externally. Requires authentication.
Annotations the server declares
- title: Get mail DNS records
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
getMyAuditLogsgetMyAuditLogs: Get recent audit logs for the authenticated user across all services.No findings
Why it is in this group
- The name "getMyAuditLogs" says "get": a word for reading.
Description, as the server wrote it getMyAuditLogs: Get recent audit logs for the authenticated user across all services. Requires authentication.
Annotations the server declares
- title: Get my audit logs
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
getMyProfilegetMyProfile: Get the authenticated user's profile and account information including name, email, organization, balance, and domain/VPS counts.No findings
Why it is in this group
- The name "getMyProfile" says "get": a word for reading.
Description, as the server wrote it getMyProfile: Get the authenticated user's profile and account information including name, email, organization, balance, and domain/VPS counts. Requires authentication.
Annotations the server declares
- title: Get my profile
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
getPaymentTransactionsgetPaymentTransactions: Get payment transaction history for the authenticated user.No findings
Why it is in this group
- The name "getPaymentTransactions" says "get": a word for reading.
Description, as the server wrote it getPaymentTransactions: Get payment transaction history for the authenticated user. Requires authentication.
Annotations the server declares
- title: Get payment transactions
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
getProductCataloggetProductCatalog: Get the complete product catalog including domain extensions, VPS packages, and dedicated servers.No findings
Why it is in this group
- The name "getProductCatalog" says "get": a word for reading.
Description, as the server wrote it getProductCatalog: Get the complete product catalog including domain extensions, VPS packages, and dedicated servers. No authentication required.
Annotations the server declares
- title: Get product catalog
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
getRecentActivitygetRecentActivity: Get the most recent activity across all domains and services for the user.No findings
Why it is in this group
- The name "getRecentActivity" says "get": a word for reading.
Description, as the server wrote it getRecentActivity: Get the most recent activity across all domains and services for the user. Requires authentication.
Annotations the server declares
- title: Get recent activity
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
getTransferQuotegetTransferQuote: Get a transfer price quote for a domain.No findings
Why it is in this group
- The name "getTransferQuote" says "get": a word for reading.
Description, as the server wrote it getTransferQuote: Get a transfer price quote for a domain. Requires authentication. Returns transfer price, currency, extension years, and new expiration date. Call before initiateTransfer to show the user the cost.
Annotations the server declares
- title: Get transfer quote
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
getTransferStatusgetTransferStatus: Check the current status of a domain transfer.No findings
Why it is in this group
- The name "getTransferStatus" says "get": a word for reading.
Description, as the server wrote it getTransferStatus: Check the current status of a domain transfer. Requires authentication. Returns status, request date, current registrar, and expected completion.
Annotations the server declares
- title: Get transfer status
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
getVpsInstanceDetailsgetVpsInstanceDetails: Get detailed information about a specific VPS instance including resource usage.No findings
Why it is in this group
- The name "getVpsInstanceDetails" says "get": a word for reading.
Description, as the server wrote it getVpsInstanceDetails: Get detailed information about a specific VPS instance including resource usage. Requires authentication.
Annotations the server declares
- title: Get VPS instance details
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
getVpsPackageDetailsgetVpsPackageDetails: Get detailed information about a specific VPS package including all pricing tiers.No findings
Why it is in this group
- The name "getVpsPackageDetails" says "get": a word for reading.
Description, as the server wrote it getVpsPackageDetails: Get detailed information about a specific VPS package including all pricing tiers. Requires authentication. For anonymous browsing use listVpsPackages, which already includes per-term pricing.
Annotations the server declares
- title: Get VPS package details
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
listCategorizedTldslistCategorizedTlds: List TLDs from the OSIR catalog that have category and audience metadata, with registration and renewal prices as decimal strings (e.g.No findings
Why it is in this group
- The name "listCategorizedTlds" says "list": a word for reading.
Description, as the server wrote it listCategorizedTlds: List TLDs from the OSIR catalog that have category and audience metadata, with registration and renewal prices as decimal strings (e.g. '10.39'). Use it to pick 3-6 relevant TLDs before calling bulkDomainSuggestions. Filters: price cap, exclude ccTLDs/restricted/premium, registry. Returns unranked candidates with categories, audience, prices, and flags. No auth required.
Annotations the server declares
- title: List categorized TLDs
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
listContactslistContacts: List all contacts for the authenticated user, optionally filtered by a search term.No findings
Why it is in this group
- The name "listContacts" says "list": a word for reading.
Description, as the server wrote it listContacts: List all contacts for the authenticated user, optionally filtered by a search term. Requires authentication. Returns each contact with its id for use in getContact, updateContact, deleteContact, or domain registration.
Annotations the server declares
- title: List contacts
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
listDnsRecordslistDnsRecords: List all DNS records for a domain.No findings
Why it is in this group
- The name "listDnsRecords" says "list": a word for reading.
Description, as the server wrote it listDnsRecords: List all DNS records for a domain. Requires authentication. Returns each record with its id, name, type, content, TTL, and priority; use the record id with getDnsRecord, updateDnsRecord, or deleteDnsRecord.
Annotations the server declares
- title: List DNS records
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
listInvoiceslistInvoices: List invoices for the authenticated user with optional status filtering and pagination.No findings
Why it is in this group
- The name "listInvoices" says "list": a word for reading.
Description, as the server wrote it listInvoices: List invoices for the authenticated user with optional status filtering and pagination. Requires authentication.
Annotations the server declares
- title: List invoices
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
listMailboxeslistMailboxes: List your mailboxes with plan, payment term, status, and next renewal date.No findings
Why it is in this group
- The name "listMailboxes" says "list": a word for reading.
Description, as the server wrote it listMailboxes: List your mailboxes with plan, payment term, status, and next renewal date. Requires authentication.
Annotations the server declares
- title: List mailboxes
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
listMailDomainslistMailDomains: List your domains that are enabled for email hosting, with status (PENDING_DNS or ACTIVE) and DNS mode.No findings
Why it is in this group
- The name "listMailDomains" says "list": a word for reading.
Description, as the server wrote it listMailDomains: List your domains that are enabled for email hosting, with status (PENDING_DNS or ACTIVE) and DNS mode. Requires authentication.
Annotations the server declares
- title: List mail domains
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
listMailPlanslistMailPlans: List available email mailbox plans with quotas and prices (monthly and annual, in cents).No findings
Why it is in this group
- The name "listMailPlans" says "list": a word for reading.
Description, as the server wrote it listMailPlans: List available email mailbox plans with quotas and prices (monthly and annual, in cents). Requires authentication. Always quote prices from here, never from memory.
Annotations the server declares
- title: List mail plans
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
listMySshKeyslistMySshKeys: List the SSH keys stored on your account, with their ids and SHA256 fingerprints.No findings
Why it is in this group
- The name "listMySshKeys" says "list": a word for reading.
Description, as the server wrote it listMySshKeys: List the SSH keys stored on your account, with their ids and SHA256 fingerprints. Use this to check whether a key is already stored and to get the ids to pass to orderVps or buildVpsInstance. Requires authentication.
Annotations the server declares
- title: List SSH keys
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
listMyVpsInstanceslistMyVpsInstances: List all VPS instances owned by the authenticated user.No findings
Why it is in this group
- The name "listMyVpsInstances" says "list": a word for reading.
Description, as the server wrote it listMyVpsInstances: List all VPS instances owned by the authenticated user. An instanceId from this list is what osirAppDeployToVps takes to put an app on a server the user already owns, at no cost. Requires authentication.
Annotations the server declares
- title: List my VPS instances
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
listPendingTransferslistPendingTransfers: List all pending incoming (gaining) domain transfers.No findings
Why it is in this group
- The name "listPendingTransfers" says "list": a word for reading.
Description, as the server wrote it listPendingTransfers: List all pending incoming (gaining) domain transfers. Requires authentication. Returns each transfer with its status, request date, current registrar, and expected completion.
Annotations the server declares
- title: List pending transfers
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
listUserDomainslistUserDomains: List all domains owned by the authenticated user.No findings
Why it is in this group
- The name "listUserDomains" says "list": a word for reading.
Description, as the server wrote it listUserDomains: List all domains owned by the authenticated user. No parameters required. Must be authenticated first.
Annotations the server declares
- title: List my domains
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
listVpsLocationslistVpsLocations: List available VPS hosting locations (cities/countries) with available packages.No findings
Why it is in this group
- The name "listVpsLocations" says "list": a word for reading.
Description, as the server wrote it listVpsLocations: List available VPS hosting locations (cities/countries) with available packages. No authentication required.
Annotations the server declares
- title: List VPS locations
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
listVpsOsTemplateslistVpsOsTemplates: List operating system templates available to install.No findings
Why it is in this group
- The name "listVpsOsTemplates" says "list": a word for reading.
Description, as the server wrote it listVpsOsTemplates: List operating system templates available to install. Requires authentication. Pass EXACTLY ONE of packageId (to pick an operatingSystemId for orderVps, so the server arrives with an OS on it) or instanceId (to pick a template for reinstalling via buildVpsInstance). The two are not interchangeable: the available set depends on the package. Template ids change over time, so always resolve an id here rather than reusing a remembered or hardcoded one.
Annotations the server declares
- title: List VPS OS templates
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
listVpsPackageslistVpsPackages: List available VPS hosting packages with pricing, specs, and locations.No findings
Why it is in this group
- The name "listVpsPackages" says "list": a word for reading.
Description, as the server wrote it listVpsPackages: List available VPS hosting packages with pricing, specs, and locations. No authentication required.
Annotations the server declares
- title: List VPS packages
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
osirAppGetSourceosirAppGetSource: Get a short-lived signed download URL for an Osir app's current source zip.No findings
Why it is in this group
- The name "osirAppGetSource" says "get": a word for reading.
Description, as the server wrote it osirAppGetSource: Get a short-lived signed download URL for an Osir app's current source zip. Use this to make edits to a deployed app without the user re-attaching the project: download, patch the files, then osirAppCreateUpload (PUT the new zip) and osirAppDeploy under the SAME name; the platform rebuilds and, for owned-tier apps, auto-ships the new version to the user's box. Requires authentication.
Annotations the server declares
- title: Get app source
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
osirAppListosirAppList: List the authenticated user's deployed Osir apps with their live URLs and status.No findings
Why it is in this group
- The name "osirAppList" says "list": a word for reading.
Description, as the server wrote it osirAppList: List the authenticated user's deployed Osir apps with their live URLs and status. Requires authentication.
Annotations the server declares
- title: List deployed apps
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
osirAppLogsosirAppLogs: Get recent logs from an Osir app's microVM ('why is my app broken?').No findings
Why it is in this group
- The name "osirAppLogs" says "log": a word for reading.
Description, as the server wrote it osirAppLogs: Get recent logs from an Osir app's microVM ('why is my app broken?'). Requires authentication.
Annotations the server declares
- title: Get app logs
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
osirAppStatusosirAppStatus: Get an Osir app's current status, live URL, and health ('is my app working?').No findings
Why it is in this group
- The name "osirAppStatus" says "status": a word for reading.
Description, as the server wrote it osirAppStatus: Get an Osir app's current status, live URL, and health ('is my app working?'). If the status is BUILD_FAILED, 'recentErrors' explains why so you can fix the source and redeploy. 'qa' is an independent black-box check of the LIVE app after deploy: qa.status PASSED means it loaded and worked; FAILED means it deployed but didn't actually work, and qa.findings lists the problems so you can fix and redeploy. 'ownedMove' tracks a move onto the user's own VPS, which leaves tier and status unchanged while it runs: state MOVING (in progress, stage says where, ~2 minutes in total), MOVED (done - tier reads 'owned'), FAILED or REFUSED (follow this result's message: usually call osirAppDeployToVps again to retry, which never orders a second server; but when the VPS refused the Osir deploy key or its web ports are taken, the user must fix the VPS first, and the message says how). Requires authentication.
Annotations the server declares
- title: Get app status
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
previewPaymentFeespreviewPaymentFees: Preview the fees that would be charged for a given payment amount.No findings
Why it is in this group
- The name "previewPaymentFees" says "preview": a word for reading.
Description, as the server wrote it previewPaymentFees: Preview the fees that would be charged for a given payment amount. Requires authentication.
Annotations the server declares
- title: Preview payment fees
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
validateDomainNamevalidateDomainName: Validate if a domain name format is correct.No findings
Why it is in this group
- The name "validateDomainName" says "validate": a word for reading.
Description, as the server wrote it validateDomainName: Validate if a domain name format is correct. No authentication required.
Annotations the server declares
- title: Validate domain name
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Install
Pinned to version 2.4.2. Values in angle brackets are yours to fill in.
claude mcp add --transport http domain-registrar https://be.osir.com/mcp/httpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__domain-registrar__countMyVpsInstances",
"mcp__domain-registrar__getAccountBalance",
"mcp__domain-registrar__getAccountSummary",
"mcp__domain-registrar__getAuthStatus",
"mcp__domain-registrar__getContact",
"mcp__domain-registrar__getContactsForDomain",
"mcp__domain-registrar__getDedicatedServerCatalog",
"mcp__domain-registrar__getDnsRecord",
"mcp__domain-registrar__getDomainAuditTrail",
"mcp__domain-registrar__getDomainExtensions",
"mcp__domain-registrar__getDomainInfo",
"mcp__domain-registrar__getDomainPricing",
"mcp__domain-registrar__getHostingBundle",
"mcp__domain-registrar__getHostsForDomain",
"mcp__domain-registrar__getInvoiceDetails",
"mcp__domain-registrar__getInvoiceStatistics",
"mcp__domain-registrar__getMailDnsRecords",
"mcp__domain-registrar__getMailboxQuote",
"mcp__domain-registrar__getMailboxUsage",
"mcp__domain-registrar__getMyAuditLogs",
"mcp__domain-registrar__getMyProfile",
"mcp__domain-registrar__getPaymentTransactions",
"mcp__domain-registrar__getProductCatalog",
"mcp__domain-registrar__getRecentActivity",
"mcp__domain-registrar__getTransferQuote",
"mcp__domain-registrar__getTransferStatus",
"mcp__domain-registrar__getVpsInstanceDetails",
"mcp__domain-registrar__getVpsPackageDetails",
"mcp__domain-registrar__listCategorizedTlds",
"mcp__domain-registrar__listContacts",
"mcp__domain-registrar__listDnsRecords",
"mcp__domain-registrar__listInvoices",
"mcp__domain-registrar__listMailDomains",
"mcp__domain-registrar__listMailPlans",
"mcp__domain-registrar__listMailboxes",
"mcp__domain-registrar__listMySshKeys",
"mcp__domain-registrar__listMyVpsInstances",
"mcp__domain-registrar__listPendingTransfers",
"mcp__domain-registrar__listUserDomains",
"mcp__domain-registrar__listVpsLocations",
"mcp__domain-registrar__listVpsOsTemplates",
"mcp__domain-registrar__listVpsPackages",
"mcp__domain-registrar__osirAppGetSource",
"mcp__domain-registrar__osirAppList",
"mcp__domain-registrar__osirAppLogs",
"mcp__domain-registrar__osirAppStatus",
"mcp__domain-registrar__previewPaymentFees",
"mcp__domain-registrar__validateDomainName"
],
"ask": [
"mcp__domain-registrar__addPrefixToDomain",
"mcp__domain-registrar__addSshKey",
"mcp__domain-registrar__addSuffixToDomain",
"mcp__domain-registrar__bulkDomainSuggestions",
"mcp__domain-registrar__changeVpsPaymentTerm",
"mcp__domain-registrar__checkDeviceLoginStatus",
"mcp__domain-registrar__checkDomainAvailability",
"mcp__domain-registrar__checkHostAvailability",
"mcp__domain-registrar__checkKeywordAvailability",
"mcp__domain-registrar__checkKeywordAvailabilitySummary",
"mcp__domain-registrar__createAccount",
"mcp__domain-registrar__createContact",
"mcp__domain-registrar__createDnsRecord",
"mcp__domain-registrar__createHost",
"mcp__domain-registrar__createMailbox",
"mcp__domain-registrar__createPaymentSession",
"mcp__domain-registrar__enableMailDomain",
"mcp__domain-registrar__fundBalanceWithSharedPaymentToken",
"mcp__domain-registrar__generateDomainSuggestions",
"mcp__domain-registrar__initializeDnsZone",
"mcp__domain-registrar__initiateTransfer",
"mcp__domain-registrar__lockDomain",
"mcp__domain-registrar__loginToVpsPanel",
"mcp__domain-registrar__loginWithDevice",
"mcp__domain-registrar__logout",
"mcp__domain-registrar__orderVps",
"mcp__domain-registrar__osirAppCreateUpload",
"mcp__domain-registrar__osirAppDeploy",
"mcp__domain-registrar__osirAppDeployToVps",
"mcp__domain-registrar__osirAppProvisionDatabase",
"mcp__domain-registrar__osirAppSetSecret",
"mcp__domain-registrar__osirSiteDesignBrief",
"mcp__domain-registrar__osirSitePublish",
"mcp__domain-registrar__payInvoice",
"mcp__domain-registrar__registerDomain",
"mcp__domain-registrar__renewDomain",
"mcp__domain-registrar__setMailboxPassword",
"mcp__domain-registrar__spinDomainWords",
"mcp__domain-registrar__suggestAlternatives",
"mcp__domain-registrar__transferDomain",
"mcp__domain-registrar__updateContact",
"mcp__domain-registrar__updateDnsRecord",
"mcp__domain-registrar__updateDomainAutoRenew",
"mcp__domain-registrar__updateDomainPrivacy",
"mcp__domain-registrar__updateNameservers",
"mcp__domain-registrar__verifyAccount",
"mcp__domain-registrar__verifyMailDns"
],
"deny": [
"mcp__domain-registrar__buildVpsInstance",
"mcp__domain-registrar__cancelTransfer",
"mcp__domain-registrar__deleteContact",
"mcp__domain-registrar__deleteDnsRecord",
"mcp__domain-registrar__deleteHost",
"mcp__domain-registrar__deleteMailbox",
"mcp__domain-registrar__deleteSshKey",
"mcp__domain-registrar__deleteVpsInstance",
"mcp__domain-registrar__executeConfirmedAction",
"mcp__domain-registrar__osirAppDelete",
"mcp__domain-registrar__unlockDomain"
]
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as domain-registrar. Review it before you use it.