Changelog

Added

• 30 new tools — domain management (register_domain, transfer_domain, renew_domain, get_domain_whois, get_domain_nameservers, update_domain_nameservers, get_domain_lock_status, update_domain_lock_status, get_tld_pricing), admin (get_admin_users, get_staff_online, get_whmcs_details, log_activity), affiliates (get_affiliates, activate_affiliate), promotions (get_promotions), servers (get_servers, module_change_password), system info, support, orders, and invoices. Total tool count is now 86.
• 24 MCP resources for real-time, read-only access to system data via whmcs:// URIs with a 60-second TTL cache.
• 18 MCP workflow prompts for guided AI interactions — client onboarding, fraud investigation, revenue reports, churn risk, domain audits, and more.
• overideautosuspend flag on update_service to exempt a service from automatic suspension.

Changed

• Unified auth stack — MCP_AUTH_MODE removed. The simple / oauth mode split is gone. The server now always runs the full OAuth 2.0 stack. Bearer tokens work in all configurations. /authorize is available only when MCP_OAUTH_ADMIN_PASSWORD is set.
• MCP_REQUIRE_AUTH removed. Authentication is always enforced in HTTP mode.
• /health response updated. auth.mode and auth.required replaced by auth.oauthEnabled.

Fixed

• dryRun response prefix normalized to [dryRun] across all mutating tools.
• XSS sanitization applied to user input echoed in dryRun responses.
• get_product_groups reimplemented to derive groups from GetProducts.
• Startup warnings emitted when deprecated MCP_AUTH_MODE or MCP_REQUIRE_AUTH env vars are detected.

Fixed

• create_invoice sent wrong client field — WHMCS CreateInvoice requires userid; the client was forwarding clientid.
• get_cancelled_packages client filter — clientId argument was forwarded but the WHMCS API does not support it for this action. Tool description updated.

Fixed

• list_invoices / get_overdue_invoices client filter ignored — WHMCS GetInvoices accepts userid, not clientid. Both tools now send the correct field.

Fixed

• OAuth state parameter missing from callback redirect — fixed two-part bug: state was coerced to "" in the consent URL, then dropped by the if (state) guard on POST. Both paths are now fixed; state is echoed verbatim per the OAuth 2.0 spec. Required for Claude.ai Custom Connector OAuth.

Fixed

• OAuth /token returned HTTP 500 for normal grant failures — OAuthProvider now throws proper InvalidGrantError for invalid/expired codes and tokens; clients receive 400 with invalid_grant.

Fixed

• OAuth consent session cookie for cross-site POST (Claude.ai) — connect.sid now uses SameSite=None; Secure on HTTPS so the browser sends it on cross-site POST to /oauth/consent.

Fixed

• CSRF tokens now persisted via express-session — previous in-memory Map was wiped on container restart. Sessions now backed by session-file-store on disk.

New optional env vars: MCP_OAUTH_SESSION_SECRET, MCP_OAUTH_SESSIONS_DIR.

Major production release + OAuth stabilisation

• Bearer token auth with scope-based access control (mcp:read, mcp:write, mcp:admin)
• Prometheus metrics, structured JSON logging, audit trail, Grafana dashboard
• Per-IP and per-token rate limiting
• Docker, Kubernetes, and standalone binary deployment
• auth-cli for token management
• OAuth discovery document and CIMD support for Claude.ai and ChatGPT
• Multiple OAuth routing and PKCE fixes (v2.0.1–v2.0.4)

Full v2.0.0 release notes on GitHub →

Initial MCP server with core WHMCS tools, stdio and HTTP transport, dryRun mode, and basic Docker support.

View on GitHub →