thatmgmt-mcp
An MCP (Model Context Protocol) server that wraps the ThatMgmt domain API. Check availability, get locked price quotes, and prepare registrations from any MCP client — with zero signup for the public tools. Tenant tools (portfolio, suggestions, dry-run planning) unlock with an API key. Nothing executes blindly: the API exposes no execute endpoints, so this server plans and prices, never purchases.
Base API: https://api.thatmgmt.com
Spec: openapi.json
Machine docs: llms-full.txt
Verified claims
Every claim below is backed by a test in test/ — fully mocked, no network, no key, no charges. Run them yourself: npm test (47/47 pass).
Quickstart
git clone https://github.com/thingscorp/thatmgmt-mcp.git && cd thatmgmt-mcp
npm install
node demo-agent-run.mjs # real server over stdio, stub API, zero signup
The demo drives the real server through tmgmt_health → availability → locked quote → prepare-registration, with no network and no key. Live mode (public tools only, read-only): node demo-agent-run.mjs --live.
Install
From npm (no clone needed):
npx -y @thatmgmt/mcp
From source (Node 18+):
git clone https://github.com/thingscorp/thatmgmt-mcp.git thatmgmt-mcp
cd thatmgmt-mcp
npm install
npm test
Add to your MCP client (Claude Code .mcp.json, Cursor, Replit):
{
"mcpServers": {
"thatmgmt": {
"command": "npx",
"args": ["-y", "@thatmgmt/mcp"],
"env": { "TMGMT_API_KEY": "your-thatmgmt-api-key" }
}
}
}
The key is only needed for tenant tools; the public reads work without it.
Releases are automated: pushing a version tag (e.g. v0.2.2) runs the Publish to npm workflow (npm publish via the NPM_TOKEN secret) and the Publish to MCP Registry workflow (validates server.json, publishes io.github.thingscorp/thatmgmt-mcp via GitHub OIDC). The tag must match version in package.json and server.json.
Usage
The two-step purchase flow is written into every tool description so agents show the human the price first:
- Quote. Call
domains_get_quote. It returns the locked price:wholesaleCents, the itemized 1% cut (platformCutCents,platformCutBasisPoints), andtotalCents. No key needed. Show this to the human. - Plan. Call
domains_prepare_registration(needsTMGMT_API_KEY). It returns the safety-checked plan. It never executes anything.
A quote carries wholesale, the flat 1% platform cut, and the total — no subscription, no tiers. The shape, from the mocked test fixture: wholesaleCents: 1299, platformCutCents: 13, platformCutBasisPoints: 100, totalCents: 1312.
What this server cannot do
The ThatMgmt API exposes no execute endpoints. Purchase, renewal, transfer, and DNS changes are never executed by the API; the API returns validated plans and preflights instead. This server therefore cannot register, renew, or transfer a domain, and it will never claim it did. src/approval.js holds the approval gate that future execute tools will use (quote id passed back plus an explicit approved: true flag, or the call is refused) — implemented and tested now so the safety design is ready the day execute routes exist.
Current release: 0.2.2 (read-only public tools plus validated plans). Execute tools are planned for the 0.3.0 release.
Configuration
Env vars only — no flags, no config file:
Transient failures (network errors, timeouts, 429s, retryable 5xx) are retried once on side-effect-free calls; the server never retries anything that could move money.
API reference
The 13 tools the server exposes over MCP stdio, exactly as defined in src/tools.js. Each maps to a real route in the live OpenAPI spec; no invented endpoints.
Public tools never send an Authorization header and never ask for a key. Tenant tools return a 401-style refusal without a key; the server tells you to set TMGMT_API_KEY.
For agents
skills/thatmgmt/SKILL.md is the agent skill for this server: when to use it, the tool list, and the two-step purchase flow. Point your agent at it for the fastest start.
Contributing
See CONTRIBUTING.md.
License
MIT. See LICENSE.