Next free-source huntWe check for new free data every weekday.
OSINTMCP serverFirst audited Nov 13, 2026

StableDomains

USDC/USDT domain registrar on 7 chains, card checkout for people, expiring drops, WHOIS/DNS tools.The vendor's description, from its MCP Registry listing.

Passed public checksAudited Nov 13, 2026

Every public check ran and passed. Public audit: we connect as an AI client would, list the tools and check what they say. We do not run them. How we audit

Does it work?
YesConnected in 635 ms.
Sign-up?
None neededIt answered without any account or key.
Can it change things?
YesSome tools say they can change things. Your AI client should ask you first.
Endpointhttps://stabledomains.net/api/mcp

Website Streamable HTTP · protocol 2025-11-25 · server version 2.5.0

What we checked, the evidence, and the tools it offers.

What we checked

Security

  • Passed: Connections are encrypted (HTTPS).

  • Passed: No hidden instructions found in tool text.

Safety labels

  • Note: 17 tools are labelled as able to change things.

    Expected for tools that send, write or buy. Your AI client should ask before calling them.

    • agent_signup
    • create_order
    • buy_with_balance
    • pay_order
    • topup_balance
    • radar_alert
    • watch_domain
    • set_url_forward
    • and 9 more
  • Passed: Every tool says whether it only reads or can change things.

Tools

  • Passed: 38 tools listed.

  • Passed: Every tool describes its inputs with a valid schema.

Protocol

  • Passed: The MCP handshake works (Streamable HTTP).

  • Passed: Protocol version 2025-11-25 (latest).

  • Passed: Unknown requests are refused.

Connection

  • Passed: The server responds.

Tools (38)

As the server describes them. The labels are the server's own: it says whether each tool only reads or can change things.

  • search_domainsCheck availability and USD price for a name across TLDs. Each result has premium (boolean; registry premium name) and renewal_price (USD/yr). If the name is taken, suggestions[] lists close AVAILABLE…Read-only
  • agent_signupInstant signup: returns an API key immediately (no form, no email). Guest tier (30 req/min) until claimed by email or wallet. Rate limited per IP (3/hour). Store the key; it is shown once. Pass it on…Can change things
  • quote_domainLive price quote for one domain. Returns premium (boolean) and renewal_price (USD/yr). Premium orders are refused if they exceed what we can currently fund.Read-only
  • create_orderCreate a registration order (a price-locked quote). A 402 is the payment challenge, not an error: pay the existing invoice and poll poll_url / check_order — do not create_order again for the same dom…Can change things
  • buy_with_balanceRegister a domain and pay from prepaid balance in one call.Can change things
  • check_orderGet order status and next actions.Read-only
  • pay_orderSubmit payment: tx_hash (EVM hash or Solana signature) of your transfer, or x_payment (base64 x402 EIP-3009 payload, gasless).Can change things
  • get_balanceGet your prepaid USD balance and its ledger of top-ups and spends.Read-only
  • topup_balanceCreate a top-up order (USD 1–5000); pay it like any order.Can change things
  • find_dropping_domainsFind expiring, pending-delete and just-dropped domains ranked by a verified quality score (0-100) built from sampled Wayback snapshots (real site vs parked/for-sale), Common Crawl presence, dictionar…Read-only
  • drop_radarDomain Drop Radar: expiring, pending-delete and just-dropped domains filtered by TLD(s), length, keywords, value, quality and drop date, with presets (short-brandable, ai-names, dictionary-com, real-…Read-only
  • radar_alertSave a Drop Radar search and get a signed webhook (event radar.match, header X-StableDomains-Signature = sha256 HMAC of the body with the returned secret) and/or email (double opt-in) when new names…Can change things
  • suggest_domainsFree. Pass domain (e.g. a taken name like agent.com) to get close AVAILABLE alternatives (other extensions, get/try/hq/app variants), live-checked and ranked by price. Or pass idea to generate branda…Read-only
  • estimate_domain_valueHeuristic USD value estimate for any domain (length, TLD, dictionary words, brandability, Wayback age, backlinks) with factor breakdown and availability.Read-only
  • whois_lookupRDAP (modern WHOIS) lookup for any domain: registrar, created/expires dates, status codes, nameservers, DNSSEC.Read-only
  • dns_email_checkDNS + email security audit via DNS-over-HTTPS: A/AAAA/MX/NS/CAA, SPF, DKIM (common or given selectors), DMARC policy, grade A-F and concrete fixes.Read-only
  • is_domain_droppingIs an expired domain about to become available? Returns lifecycle (grace, redemption, pending delete, available, registered), estimated drop date and backlink data if in our drop feed.Read-only
  • domain_historyInternet Archive history for a domain or page URL: first and latest snapshots (with view links), snapshot/month counts, unique pages, years active, status-code mix, yearly timeline, a short former-us…Read-only
  • watch_domainGet notified when an expiring domain changes status or drops (becomes registrable). Pass webhook_url (active immediately, POSTs JSON events domain.status_changed / domain.available with a ready order…Can change things
  • set_url_forwardFREE 301 URL forwarding for a domain you registered with us: forward the whole domain (subdomain '@', also covers www) or a subdomain to any https URL. Points DNS at our redirect service. preserve_pa…Can change things
  • list_url_forwardsURL forwards configured on a domain you own.Read-only
  • apply_dns_templateFREE one-call DNS setup for a domain you own. template: vercel | netlify (params.site) | github-pages (params.user) | google-workspace | microsoft-365 | zoho-mail (params.region: com|eu|in|com.au). R…Can change things
  • get_dnsNameservers and DNS records (A/AAAA/CNAME/MX/TXT) of a domain you own.Read-only
  • set_dnsSet DNS records and/or nameservers of a domain you own. records: [{type: A|AAAA|CNAME|MX|TXT|NS (SRV/CAA/ALIAS not supported on hosted DNS: use custom nameservers), name: '@'|sub, value, ttl?, priori…Can change things
  • renew_domainRenew a domain you own. Returns USDC payment requirements (402), or pay_with=balance to renew instantly from prepaid balance. dry_run=true previews quote, new expiry and blockers without charging.Can change things
  • set_notification_webhookSigned account webhook (returns secret). Events: domain.registered, domain.registration_pending, domain.registration_completed, domain.transfer_started, domain.transfer_completed, domain.renewed, dom…Can change things
  • transfer_domainTransfer a domain in from another registrar using its auth/EPP code; paid in USDC (adds 1 year). Unlock it at the current registrar first. Completes in ~5-7 days.Can change things
  • create_cartRegister up to 20 available domains with ONE payment (exact total in the 402). Returns a price-locked quote, checkout_url for a human to pay, and is idempotent via idempotency_key. After payment each…Can change things
  • get_referral_linkReferral link for a code (?ref=<code>, 30-day first-referrer attribution). This tool is read-only. Pass code for a known public referral code — no auth needed; the link is deterministic. Omit code an…Read-only
  • get_referral_statsReferral stats (read-only). Pass code for public aggregate-safe counts on a known code (clicks, sales, referred users; no payout address or earnings ledger) — no auth needed. Omit code and sign in (o…Read-only
  • set_payout_addressSet the Base USDC address that receives your weekly referral payouts (null to clear). Optional to activate — get_referral_link works first; earnings accrue until an address is set. Crypto-only progra…Can change things
  • set_auto_renewTurn auto-renew on/off for a domain you own and/or fund its renewal balance (vault). deposit_usd moves USDC from your prepaid balance (topup_balance) into the domain's vault; withdraw_usd moves it ba…Can change things
  • get_renewal_balanceAuto-renew vault for a domain: renewal balance, 1-year renewal price, whether it is covered, shortfall, days to expiry and ledger. Omit domain to list all your domains' renewal balances.Read-only
  • search_agentsSearch the StableDomains.net agent directory (approved AI agents and MCP servers) by keyword or capability. Returns name, description, url, endpoint_url, mcp_url, capabilities, payment_methods and pr…Read-only
  • get_agentGet one agent directory profile by slug.Read-only
  • list_my_agentAgent profiles you submitted (any status: pending, approved, rejected) with review notes. Submit a new one with POST /api/v1/agents (auth required, moderated).Read-only
  • list_domainsList the domains owned by the caller, with expiry dates and status.Read-only
  • contact_supportOpen a support ticket with a person at StableDomains (order, payment, DNS, transfer, account or abuse issues). Pass the order_id or its SD- ref if there is one. A person replies by email to the given…Can change things

Audit history

  1. Nov 13Passed

What we sent

Every request in this audit, with the answer and how long it took. We never send credentials and never call a tool.

RequestAnswerTime
initializeHTTP 200635 ms
initializedHTTP 202145 ms
tools/listHTTP 200243 ms
unknown-methodHTTP 200157 ms

Run this server, or disagree with the result?

Fix the issue and it shows in the next weekly audit, or email us to ask for a re-audit or to dispute a finding. Read how we audit for what each check means.