URL: /mcp/tools/domains

---
title: Domain tools
description: List, inspect, and update settings on domains the org owns.
---

Read-only tools require `domains:read`. `update_domain_settings` requires `domains:write`. The EPP `auth_code` only ships in responses to keys with `domains:write`.

## `list_org_domains`

Cursor-paginated listing of an org's domains.

Required scope: `domains:read`.

<ParamField path="org_oid" type="string" required />
<ParamField path="state" type="string">Filter by state: `registered`, `expired`, `redemption`, `external`, `deleted`, `failed`, `pending`.</ParamField>
<ParamField path="cursor" type="string">Domain name from a previous page's `next_cursor`.</ParamField>
<ParamField path="limit" type="integer" default="50">Max 100.</ParamField>

<ResponseField name="domains" type="object[]">Domain summaries (see `get_domain` for shape).</ResponseField>
<ResponseField name="next_cursor" type="string | null" />
<ResponseField name="total_count" type="integer">Total matching, ignoring cursor.</ResponseField>

## `get_domain`

Full record for one domain, including subscription and (for `domains:write` keys) the EPP `auth_code`.

Required scope: `domains:read`.

<ParamField path="domain" type="string" required />
<ParamField path="org_oid" type="string" required />

<ResponseField name="name" type="string" />
<ResponseField name="tld" type="string" />
<ResponseField name="state" type="string">`registered`, `expired`, `redemption`, etc.</ResponseField>
<ResponseField name="registration_status" type="string" />
<ResponseField name="dns_management" type="string">`domaingenius` or `external`.</ResponseField>
<ResponseField name="ns_management" type="string" />
<ResponseField name="for_sale" type="boolean" />
<ResponseField name="sale_min_offer_aud" type="number" />
<ResponseField name="redirect_url" type="string" />
<ResponseField name="auto_renew" type="boolean" />
<ResponseField name="privacy" type="boolean" />
<ResponseField name="expiry" type="string">ISO 8601 timestamp.</ResponseField>
<ResponseField name="cloudflare_zone_id" type="string" />
<ResponseField name="contacts_synced_at" type="string" />
<ResponseField name="dns_setup" type="boolean" />
<ResponseField name="worker_setup" type="boolean" />
<ResponseField name="nameserver_setup" type="boolean" />
<ResponseField name="nameserver_one" type="string" />
<ResponseField name="nameserver_two" type="string" />
<ResponseField name="auth_code" type="string">EPP transfer code. Returned only with `domains:write` scope.</ResponseField>
<ResponseField name="subscription" type="object">Period, price, auto-renew status.</ResponseField>

## `update_domain_settings`

Update the safe per-domain knobs.

Required scope: `domains:write`.

<ParamField path="domain" type="string" required />
<ParamField path="org_oid" type="string" required />
<ParamField path="auto_renew" type="boolean" />
<ParamField path="privacy" type="boolean">Toggle WHOIS privacy. Some TLDs (e.g. `.com.au`) ignore privacy at the registry.</ParamField>
<ParamField path="for_sale" type="boolean">List or unlist on the marketplace.</ParamField>
<ParamField path="sale_min_offer" type="integer">Minimum offer in cents.</ParamField>
<ParamField path="redirect_url" type="string">Absolute http(s) URL. Empty string clears the redirect.</ParamField>

DNS, nameserver, and contact-role changes are out of scope here — see the DNS, contact, and (API-only) registrar-sync tools.