Brave Search MCP Server: web results, images, videos, rich results, AI summaries, and more.
Nothing to run from here
Nymwell is installed from its publisher's own source and answers where it runs, so this marketplace is not in the path of a single call. There is no address here to send one to, and a panel that pretended otherwise would be showing you an answer we made up. Install it and call it from your own client — the Installation tab has the entry for each one.
93/100
tool-list score
54
tools declared
remote
at its publisher
—
calls last 7d
What it does
Look up and buy domain names: live prices, any domain's public records, renewals, transfers and DNS.
Quickstart
# 1 — add it to Claude Code
claude mcp add --scope user --transport http nymwell-mcp https://nymwell.com/mcp
# 2 — ask your agent for something these tools do
# nymwell_status, list_domains, list_dns_records and 51 more
Nymwell costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.
Publishernot claimed
NYAll 2 servers
nymwell2 servers
1 category
Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.
Installation
Where are you running it?
Every route below installs the same thing and ends at the same approval screen. Nothing here runs on your machine and nothing runs on ours: this server answers at its publisher’s own address, and what you install is the connection straight to it.
Claude Codedeclared by this listing
This is a public server: it answers at its publisher’s own address and this marketplace is not in the path. Claude Code registers it in one command; --scope user makes it available in every project. The transport below is http, as the publisher's own manifest declares it.
claude mcp add --scope user --transport http nymwell-mcp https://nymwell.com/mcpReconnect, or start a new session, and the tools appear in the model’s tool list.
Free on mcprush, and it answers at its publisher’s own address: this marketplace is not in the path, so there is no key of ours to hold and no card to add.
What it writes
One config entry pointing straight at the publisher’s own address — this marketplace is not in the path, and nothing from this listing executes on your machine.
What you approve
54 tools, with what each one reads, writes and reaches shown before you agree — the same list on every route above. Read the tool surface.
Tool surface
What the model actually sees. Descriptions are diffed on every release — see version history.
Read Nymwell backend, database and provider-adapter readiness.
No parameter schema on file.
List domains visible to the signed-in Nymwell organization.
No parameter schema on file.
List DNS records for a managed domain. refresh: true first pulls the records from the registrar (including ones changed outside Nymwell).
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domain | string | yes | — |
| refresh | boolean | no | — |
List invoice metadata for the signed-in Nymwell organization.
No parameter schema on file.
List members and roles for the signed-in Nymwell organization.
No parameter schema on file.
Read recent immutable audit evidence for the signed-in Nymwell organization: who (person, API key, OAuth app, schedule, registrar), how (console, API, MCP) and the outcome, with a summary. Reads are left out unless include_reads is true.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| limit | integer | no | — |
| domain | string | no | — |
| include_reads | boolean | no | — |
| actor | string | no | — |
| category | string | no | — |
| outcome | string | no | — |
| days | integer | no | — |
Before a sensitive action, ask whether it can happen now. For transfer_out, renew and cancel it returns state (eligible, action_required, blocked, in_progress), reasons with a code, the source (registry, namecom, nymwell), an until date when the block ends, the next action, and what the action requires (roles, Google confirmation, approval, payment). Staging checks the same rules again.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domain | string | yes | — |
| action | string | no | — |
Change DNS records (create, update, delete), applied at the registrar in order. Applies at once when you act for an owner or admin and the workspace lets agents apply changes (the default); otherwise it waits in list_approvals. workflow.state says which. Values are checked first (invalid_record names the change and field). For update and delete, pass record_id from list_dns_records when a name has
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domain | string | yes | — |
| changes | array | yes | — |
The authoritative check: which domain names can be registered and what they cost, from the live registrar (not DNS or RDAP). Call it on the few names you will offer, right before get_quote; for many names, run screen_domains first (it is free and wide). Up to 20 names: exact domains, or a name plus endings. If Nymwell is not connected to a live registrar, this tool refuses sandbox data; use screen
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domains | array | no | — |
| name | string | no | A name without an ending, e.g. orbitnotes |
| tlds | array | no | Endings to try with name, e.g. ["com","ai","dev"] |
The fast lookup, for many names at once (up to 500, or one name across every ending with tlds ["all"]): taken or not from DNS and public registry records (RDAP), with registrar and expiry, parked-for-sale, and for names with no record the ending's list price and a buy_url. Costs no registrar call, so use it first and widely; it is NOT availability, so confirm the names you will offer with search_d
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domains | array | no | — |
| name | string | no | A name without an ending, e.g. noren |
| tlds | array | no | Endings to try with name; ["all"] for every ending Nymwell sells; defaults to com, ai, dev, app, io, co, tw |
| details | boolean | no | Fetch the registry record for taken names too (registrar, dates). Default: on for up to 20 names. |
Everything public about one domain, wherever it is registered: registry record (registrar, created, expires, statuses, transfer lock, DNSSEC), DNS (nameservers and where it is hosted, A/AAAA, MX, SPF, DMARC, parked for sale), whether HTTPS answers, and the next step: a buy_url for a name with no record, or a transfer_url (and when a transfer becomes possible) for a registered one. No sign-in neede
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domain | string | yes | — |
Lock the exact price for one domain: action "register" (default) for an available name, "renew" for a domain this organization holds, or "transfer" to bring one from another registrar (adds one year; the owner then submits the auth code in the console). Valid for 40 minutes; purchase_domain charges exactly this.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domain | string | yes | — |
| years | integer | no | — |
| action | no | — |
Buy what a quote priced (registration, renewal or transfer). You act for the person who connected you: when the workspace has a saved card and the amount is inside the agent spending limits (get_agent_policy), the card is charged at once and the order runs; the person is told. Otherwise (no card, over a limit, or pay_with "checkout") it returns a checkout_url and checkout_reason: give the link to
| Parameter | Type | Required | Notes |
|---|---|---|---|
| quote_id | string | yes | — |
| dns | object | no | Records to create right after registration: a preset from list_dns_presets, optional records, or both. |
| idempotency_key | string | no | — |
| accept_trademark_notice | boolean | no | true only after the person has read the trademark notice get_quote returned |
| tld_requirements | object | no | Extra registry fields some country endings need (see get_tld_info) |
| locale | no | Language of the page the person returns to after paying | |
| pay_with | no | saved_card (default) charges the saved card within the agent limits; checkout always returns a link for the person |
Read where a purchase is: awaiting_payment, registering, registered, needs_attention or failed_refunded, with the DNS records that were created. workflow.state says what to do: in_progress or blocked = check again later; action_required = give workflow.action.url to the person; succeeded or failed = stop (failed carries workflow.error).
| Parameter | Type | Required | Notes |
|---|---|---|---|
| order_id | string | yes | — |
List the DNS presets purchase_domain and apply_dns_preset accept (Vercel, Netlify, GitHub Pages, Cloudflare Pages, Agent Lab Deploy, Google Workspace email). No sign-in needed.
No parameter schema on file.
Add a preset's DNS records to one domain this organization manages (records that already exist are skipped). Applies at once when you act for an owner or admin and the workspace lets agents apply changes (the default); otherwise it waits in list_approvals. workflow.state says which. undo_dns_apply takes it back.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domain | string | yes | — |
| preset | string | yes | — |
| target | string | no | — |
Names a live registrar can sell now that fit a keyword, with prices (registration inventory only). Sandbox suggestions are refused; use screen_domains until nymwell_status reports a live registrar. No sign-in needed.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| keyword | string | yes | — |
| tlds | array | no | — |
What an ending costs (registration, renewal, transfer) and its rules: allowed terms, days left to renew after expiry, WHOIS privacy, DNSSEC, HSTS preload. Pass up to 10 tlds for live answers, or none for every ending Nymwell sells (the same list as https://nymwell.com/tlds.json). No sign-in needed.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| tlds | array | no | — |
Live state of a domain this organization holds through Nymwell: expiry, renewal price, transfer lock, WHOIS privacy, registry locks, nameservers, contact verification and any transfer in progress.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domain | string | yes | — |
Turn Nymwell's auto-renew on or off for a domain. When it is on and the workspace has a saved card, Nymwell charges that card for a one-year renewal from 14 days before expiry (retrying 7, 3 and 1 day before); without a card it sends reminders instead. The answer says which applies. The registrar's own auto-renew always stays off.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domain | string | yes | — |
| enabled | boolean | yes | — |
Change WHOIS privacy or the transfer lock. Applies at once when you act for an owner or admin and the workspace lets agents apply changes (the default); otherwise it waits in list_approvals. workflow.state says which.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domain | string | yes | — |
| privacy_enabled | boolean | no | — |
| transfer_lock | boolean | no | — |
Change nameservers: 2 to 13 hostnames, or "default" to return to Nymwell DNS. Pointing elsewhere means the records in Nymwell stop applying. Applies at once when you act for an owner or admin and the workspace lets agents apply changes (the default); otherwise it waits in list_approvals. workflow.state says which.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domain | string | yes | — |
| nameservers | yes | — |
Change contacts. registrant is required (it is the legal holder); admin, tech and billing are optional. A new registrant must confirm by email within 15 days or the domain stops resolving. Applies at once when you act for an owner or admin and the workspace lets agents apply changes (the default); otherwise it waits in list_approvals. workflow.state says which.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domain | string | yes | — |
| contacts | object | yes | — |
Unlock a domain and get its transfer auth code, to move it to another registrar. When applied, the code is in the result (shown once; owners get a notice). Not possible within 60 days of a registration or transfer. Applies at once when you act for an owner or admin and the workspace lets agents apply changes (the default); otherwise it waits in list_approvals. workflow.state says which.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domain | string | yes | — |
Cancel a registration made in the last few days (the registry's add grace period, about 5 days): the domain is deleted and the payment refunded. Applies at once when you act for an owner or admin and the workspace lets agents apply changes (the default); otherwise it waits in list_approvals. workflow.state says which.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domain | string | yes | — |
Read DNSSEC DS records, URL forwarding, email forwarding or branded (vanity) nameservers for a domain, live from the registrar.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domain | string | yes | — |
| service | yes | — |
Change DNSSEC, URL forwarding, email forwarding or a vanity nameserver. Applies at once when you act for an owner or admin and the workspace lets agents apply changes (the default); otherwise it waits in list_approvals. workflow.state says which. data: dnssec {key_tag, algorithm, digest_type, digest} (delete: digest); url_forwarding {host, forwards_to, type: masked|redirect|302, title?, meta?} (de
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domain | string | yes | — |
| service | yes | — | |
| operation | yes | — | |
| data | object | yes | — |
Transfers into Nymwell for this organization and where each one is.
No parameter schema on file.
Cancel a transfer: direction "in" stops one coming to Nymwell (the payment is refunded), "out" stops a domain leaving for another registrar. Applies at once when you act for an owner or admin and the workspace lets agents apply changes (the default); otherwise it waits in list_approvals. workflow.state says which.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domain | string | yes | — |
| direction | yes | — |
Registrant emails still waiting for ICANN verification on this organization's domains, with the deadline. A domain whose registrant misses it stops resolving.
No parameter schema on file.
Whether this organization has its registrant on file, and its details. The customer is the legal holder of every domain; save_registrant sets it and accepts the registration terms for the person you act for, before the first registration or transfer.
No parameter schema on file.
Changes waiting for approval, and the ones already decided, each with workflow.state (action_required, in_progress, succeeded, failed). decide_approval approves or rejects one when you act for an owner or admin.
No parameter schema on file.
Send the ICANN verification email again for one verification_id from list_unverified_contacts.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| verification_id | string | yes | — |
One look at the workspace: domain counts, what needs attention, recent notices, whether a card is saved, and the agent policy (do your changes apply at once, and how much you may charge to the saved card per order and per 30 days).
No parameter schema on file.
Recent orders (registrations, renewals, transfers) with status, amount, how they were paid and by whom.
No parameter schema on file.
Start a transfer in: give the auth code from the current registrar. Nymwell seals the code at rest, checks the name is held elsewhere, and returns a transfer quote; then call purchase_domain with its quote_id. A name nobody holds returns domain_not_exists (register it instead).
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domain | string | yes | — |
| auth_code | string | yes | — |
Checks, read-only. kind "dns": website, www, email (MX/SPF/DKIM/DMARC) and DNSSEC findings with one-step fixes. kind "ssl": does HTTPS work, which certificate authorities issued certificates (certificate transparency logs), CAA suggestions. kind "transfer": can these names (domains, up to 20) move to Nymwell now, grouped ready / needs action / not possible, with reasons.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| kind | yes | — | |
| domain | string | no | — |
| domains | array | no | — |
Track a domain registered elsewhere (expiry, registrar, DNS) without moving it. Nymwell reads public registry data daily and reminds you before it expires.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domain | string | yes | — |
Apply a DNS preset (list_dns_presets) or a saved template (tpl_…) to up to 100 domains at once; existing records are skipped. dry_run: true shows what each domain would get. Applies at once when you act for an owner or admin and the workspace lets agents apply changes.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domains | array | yes | — |
| preset | string | yes | — |
| target | string | no | — |
| dry_run | boolean | no | — |
Take back the records the last preset or template added to a domain (only those still there).
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domain | string | yes | — |
Saved DNS templates. action "list"; "save" with name and records (or from_domain to copy a domain's records); "delete" with id.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| action | yes | — | |
| id | string | no | — |
| name | string | no | — |
| from_domain | string | no | — |
| records | array | no | — |
action "export": the domain's records as a BIND zone file. action "import": a zone file becomes one change set of creates and deletes (dry_run: true only shows the plan).
| Parameter | Type | Required | Notes |
|---|---|---|---|
| action | yes | — | |
| domain | string | yes | — |
| zone | string | no | — |
| dry_run | boolean | no | — |
Write a note on one DNS record (what it is for), shown next to it in the console. Empty note clears it.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domain | string | yes | — |
| type | string | yes | — |
| name | string | yes | — |
| value | string | yes | — |
| note | string | no | — |
Add or remove tags on up to 500 domains at once (tags filter the domain list).
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domains | array | yes | — |
| add | array | no | — |
| remove | array | no | — |
The domain's own page: "for_sale" (price, minimum offer, offers reach the owner) or "parked". action "get" shows it and the offers; "save" turns it on or off (enabled) and changes mode, price_minor, min_offer_minor, headline or message; fields left out keep what is saved.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| action | yes | — | |
| domain | string | yes | — |
| enabled | boolean | no | — |
| mode | no | — | |
| price_minor | integer | no | — |
| min_offer_minor | integer | no | — |
| headline | string | no | — |
| message | string | no | — |
The optional Managed Domain plan (managed DNS, SSL for secure redirects, renewal management; yearly on the saved card). action "get" shows price, status and the consent text; "enable" charges the first year (send accept_charge: true after the person agreed to the consent text; within the agent spending limits); "disable" stops renewal (no refund).
| Parameter | Type | Required | Notes |
|---|---|---|---|
| action | yes | — | |
| domain | string | yes | — |
| accept_charge | boolean | no | — |
What every new domain starts with: auto_renew, transfer_lock, privacy, dns_preset {preset, target}, forward_to, tags. action "get"; "save" (fields left out keep what is saved); "apply" puts them on the given domains now.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| action | yes | — | |
| auto_renew | boolean | no | — |
| transfer_lock | boolean | no | — |
| privacy | boolean | no | — |
| dns_preset | object/null | no | — |
| forward_to | string/null | no | — |
| tags | array | no | — |
| domains | array | no | — |
Move a domain to another Nymwell workspace (it stays at the registrar). action "list" (incoming and outgoing); "request" with domain and to_email (an owner or admin there accepts within 5 days; possible 10 days after registration); "accept" or "decline" an incoming move (id) sent to the person you act for; "cancel" an outgoing one (id).
| Parameter | Type | Required | Notes |
|---|---|---|---|
| action | yes | — | |
| domain | string | no | — |
| to_email | string | no | — |
| id | string | no | — |
Approve or reject a change waiting in list_approvals (one prepared by a teammate or another agent). Needs the account:manage scope and an owner or admin behind you. An approved change is applied at once and recorded in the person's name, with you named.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| approval_request_id | string | yes | — |
| decision | yes | — | |
| comment | string | no | — |
Set who every new domain is registered to (the legal holder) and accept the registration terms for the person you act for. Read links from get_registrant first and tell the person. contact: firstName, lastName, companyName?, address1, address2?, city, state?, zip?, country (2 letters), email, phone (+886.912345678). Needs account:manage.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| contact | object | yes | — |
| accept_agreement | boolean | yes | — |
action "list" members and pending invitations; "invite" email with role (admin, billing_admin, domain_manager, dns_operator, viewer). Inviting needs account:manage.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| action | yes | — | |
| string | no | — | |
| role | no | — |
API keys of this workspace. action "list" (metadata only, never secrets); "create" with name, scopes (no wider than yours), expires_in_days (1-90), optional domain_allowlist and ip_allowlist; the secret is returned once. "revoke" with id. create and revoke need account:manage.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| action | yes | — | |
| id | string | no | — |
| name | string | no | — |
| scopes | array | no | — |
| expires_in_days | integer | no | — |
| domain_allowlist | array | no | — |
| ip_allowlist | array | no | — |
| environment | no | — |
AI apps connected over OAuth. action "list"; "revoke" with id disconnects one (needs account:manage).
| Parameter | Type | Required | Notes |
|---|---|---|---|
| action | yes | — | |
| id | string | no | — |
Send Nymwell support a message (category: domain, dns, billing, transfer, account, other; optional domain). The team is alerted at once and replies to the email of the person you act for. action "notices" lists what Nymwell told the workspace (security changes, renewals, price changes).
| Parameter | Type | Required | Notes |
|---|---|---|---|
| action | yes | — | |
| category | no | — | |
| domain | string | no | — |
| message | string | no | — |
Free
$0 forever
- Every tool — any call limit is its publisher’s, not ours
- No card, and mcprush charges nothing for it
- Runs at its publisher’s own address — this marketplace is not in the path
- Nothing to cap, because mcprush bills nothing
What counts against your monthly calls
| Tool | Unit | Calls used | Out of the allowance |
|---|
Nothing here is billable: mcprush charges nothing to install Nymwell or to call it, at any volume.
Call allowance · this installenforced at the gateway
Monthly allowance, in calls
—
—
Alert at 80% · then the tool returns a normal MCP error
Used this month: —
ATool-list grade · score 93 / 100
Release 1.0.1 · scanned 28 Oct 2026
Graded from the tools this server lists, not from its source code.
Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.
Threat score100
Client score93
Findings0 threat · 1 capability
Capabilitymoderate
Coveragemanifest
Verificationnot in this report
Surface digest0d0b2b5989e9ded8a1b31dc9fb9938cb52f2e127950f46abe41f6adcfa63e9b9
Score vectorthreat 100 → client 93
| Term | Level | What it prices | Points |
|---|---|---|---|
| capability-exposure | moderate | capability blast radius (moderate) — client exposure if the model is manipulated | −3 |
| coverage-honesty | manifest | inspection depth (manifest) — how much of the target the scan could see | −4 |
score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.
What the scan could actually read
A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.
The scan read each tool’s name, description, input schema and annotations exactly as the server listed them the last time it answered us; no code was reviewed. We ask the server again about once a month, and a list that changed is graded again.
Tool surfaceread
Implementation sourcenot available
Package metadatanot available
Live transportnot available
The implementation source was not read — this reflects the declared tool metadata only.
Capability — what it could do if the model were manipulated
Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. moderate is the level these add up to.
| Tool | Capability tags | Why the tag was assigned |
|---|---|---|
| nymwell_status | no tags | |
| list_domains | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| list_dns_records | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| list_invoices | no tags | |
| list_members | no tags | |
| list_audit_events | no tags | |
| check_domain_eligibility | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| stage_dns_change | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
| search_domains | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| screen_domains | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| domain_info | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
| get_quote | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| purchase_domain | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
| get_order | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| list_dns_presets | no tags | |
| apply_dns_preset | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
| suggest_domains | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| get_tld_info | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| get_domain | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| set_auto_renew | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
| update_domain_settings | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
| set_nameservers | external-sink | external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true |
| set_contacts | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
| request_auth_code | external-sink | external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true |
| cancel_registration | external-sink | external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true |
| list_domain_services | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| change_domain_service | external-sink | external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true |
| list_transfers | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| cancel_transfer | external-sink | external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true |
| list_unverified_contacts | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| get_registrant | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| list_approvals | no tags | |
| resend_contact_verification | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
| get_dashboard | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| list_orders | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| submit_transfer | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
| check_domain | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| track_domain | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
| apply_dns_to_domains | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
| undo_dns_apply | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
| dns_templates | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
| dns_zone_file | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
| set_record_note | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
| set_domain_tags | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
| domain_page | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
| managed_domain_plan | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
| workspace_defaults | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
| domain_moves | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
| decide_approval | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
| save_registrant | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
| manage_members | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
| manage_api_keys | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
| connected_apps | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
| contact_support | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
Toxic-flow graph
The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.
flow-1
Untrusted input can drive an external action even though no sensitive source is exposed.
Supply chain and provenance
Integrityfirst-seen
Surface digest0d0b2b5989e9ded8
Scanned2026-10-28
This is the first scan of this surface here, so there is nothing yet to compare it against.
Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.
Release history
This is an address its publisher runs: which release it serves is theirs to choose, so there is nothing here to pin. The history below is for reading; the current release on file is 1.0.1.
1.0.1
undated
latestNo release note was published with this version.
—
no reviews yet
Who can review
One review per account, from a signed-in account that does not publish this listing. Nothing else is asked — you can say what you think before you install it. Publishers can reply once per review, and a review can be edited or deleted by whoever wrote it.
Sign in to write one
Any signed-in account that does not publish Nymwell can review it, once — before installing it or after. A review from an account that has installed it is marked as one.
No reviews yet
Nobody has reviewed this listing. The rating on the card is the mean of the reviews written here and nothing else, so there is no rating until somebody writes the first — which takes a signed-in account that does not publish it, and nothing else.