io.github.Thingscorp/thatmgmt-mcp

thatmgmt-mcp

An MCP (Model Context Protocol) server that wraps the ThatMgmt domain API. Check availability, get locked price quotes, and prepare registrations from any MCP client — with zero signup for the public tools. Tenant tools (portfolio, suggestions, dry-run planning) unlock with an API key. Nothing executes blindly: the API exposes no execute endpoints, so this server plans and prices, never purchases.

Base API: https://api.thatmgmt.com Spec: openapi.json Machine docs: llms-full.txt

Verified claims

Every claim below is backed by a test in test/ — fully mocked, no network, no key, no charges. Run them yourself: npm test (47/47 pass).

Quickstart

git clone https://github.com/thingscorp/thatmgmt-mcp.git && cd thatmgmt-mcp
npm install
node demo-agent-run.mjs   # real server over stdio, stub API, zero signup

The demo drives the real server through tmgmt_health → availability → locked quote → prepare-registration, with no network and no key. Live mode (public tools only, read-only): node demo-agent-run.mjs --live.

Install

From npm (no clone needed):

npx -y @thatmgmt/mcp

From source (Node 18+):

git clone https://github.com/thingscorp/thatmgmt-mcp.git thatmgmt-mcp
cd thatmgmt-mcp
npm install
npm test

Add to your MCP client (Claude Code .mcp.json, Cursor, Replit):

{
  "mcpServers": {
    "thatmgmt": {
      "command": "npx",
      "args": ["-y", "@thatmgmt/mcp"],
      "env": { "TMGMT_API_KEY": "your-thatmgmt-api-key" }
    }
  }
}

The key is only needed for tenant tools; the public reads work without it.

Releases are automated: pushing a version tag (e.g. v0.2.2) runs the Publish to npm workflow (npm publish via the NPM_TOKEN secret) and the Publish to MCP Registry workflow (validates server.json, publishes io.github.thingscorp/thatmgmt-mcp via GitHub OIDC). The tag must match version in package.json and server.json.

Usage

The two-step purchase flow is written into every tool description so agents show the human the price first:

1. Quote. Call domains_get_quote. It returns the locked price: wholesaleCents, the itemized 1% cut (platformCutCents, platformCutBasisPoints), and totalCents. No key needed. Show this to the human.
2. Plan. Call domains_prepare_registration (needs TMGMT_API_KEY). It returns the safety-checked plan. It never executes anything.

A quote carries wholesale, the flat 1% platform cut, and the total — no subscription, no tiers. The shape, from the mocked test fixture: wholesaleCents: 1299, platformCutCents: 13, platformCutBasisPoints: 100, totalCents: 1312.

What this server cannot do

The ThatMgmt API exposes no execute endpoints. Purchase, renewal, transfer, and DNS changes are never executed by the API; the API returns validated plans and preflights instead. This server therefore cannot register, renew, or transfer a domain, and it will never claim it did. src/approval.js holds the approval gate that future execute tools will use (quote id passed back plus an explicit approved: true flag, or the call is refused) — implemented and tested now so the safety design is ready the day execute routes exist.

Current release: 0.2.2 (read-only public tools plus validated plans). Execute tools are planned for the 0.3.0 release.

Configuration

Env vars only — no flags, no config file:

Transient failures (network errors, timeouts, 429s, retryable 5xx) are retried once on side-effect-free calls; the server never retries anything that could move money.

API reference

The 13 tools the server exposes over MCP stdio, exactly as defined in src/tools.js. Each maps to a real route in the live OpenAPI spec; no invented endpoints.

Public tools never send an Authorization header and never ask for a key. Tenant tools return a 401-style refusal without a key; the server tells you to set TMGMT_API_KEY.

For agents

skills/thatmgmt/SKILL.md is the agent skill for this server: when to use it, the tool list, and the two-step purchase flow. Point your agent at it for the fastest start.

Contributing

See CONTRIBUTING.md.

License

MIT. See LICENSE.