Changelog

Added

• create_product tool. Creates a new product/package in the WHMCS product catalog via AddProduct. Accepts name and gid (required) plus optional type, paytype, description, hidden, showdomainoptions, welcomeemail, stockcontrol, qty, module, and a pricing array of { currencyId, billingCycle, price } entries. Supports dryRun=true to preview without creating. Total tool count is now 98.

Added

• update_domain_donotrenew tool. Sets or clears the do-not-renew flag on a WHMCS domain via UpdateClientDomain. Accepts domainid or domain name; the ID is resolved automatically when only the name is supplied. Supports dryRun=true. Total tool count is now 97.

Fixed / Extended

• v2.3.4 — update_client now accepts companyname, notes, and customfields (same encoding as add_client). register_domain now accepts an existing domainid for retrying WHMCS DomainRegister after CIRA additional fields are saved.
• v2.3.3 — add_client accepts customfields, companyname, and notes, resolving WHMCS rejections when required custom fields (e.g. B2B/B2C) are missing. add_order accepts domainFields for per-domain TLD extras needed for .ca registrations at Enom.
• v2.3.2 — domain action names corrected. register_domain, transfer_domain, and renew_domain were calling non-existent WHMCS actions (RegisterDomain, TransferDomain, RenewDomain). All three now send the correct DomainRegister, DomainTransfer, and DomainRenew forms. Action required: update your WHMCS API role to grant the corrected permission names.

Fixed

• start_task_timer parameter name corrected — WHMCS 9.x expects taskid; the tool was sending timerid, causing "Task ID Not Set" errors. The client now sends both for cross-version compatibility. Tool input renamed timerId → taskId.
• end_task_timer docs clarified — timerId is the timelog entry ID created by start_task_timer, not the task ID.

Added

• 10 Project Management tools — full coverage of the WHMCS Project Management addon API (addon must be active): list_projects, get_project, create_project, update_project, add_project_task, update_project_task, delete_project_task, add_project_message, start_task_timer, end_task_timer. Total tool count is now 96.

Added

• adminUsername on open_ticket — optional field that attributes the ticket to a staff member rather than the client.
• Multi-line invoice support on create_invoice — new optional items[] array (up to 50 entries, each with description, amount, optional taxed) maps to WHMCS numbered line-item fields. The legacy single-item fields remain fully backward-compatible.

Fixed

• phpSerialize byte-length fix — the s: length field now uses the byte length of the original string, not the escaped copy. Strings with \, ", or null bytes previously produced incorrect lengths and failed to deserialize in WHMCS.
• Input validation added to create_invoice, update_client, get_ticket, and add_ticket_note — each now returns a validation error when no usable identifier is provided.

Security

• Pushgateway credentials externalized — configure via PUSHGATEWAY_URL, PUSHGATEWAY_USER, and PUSHGATEWAY_PASSWORD env vars.
• CIMD SSRF protection — the auto-fetch now blocks RFC1918, loopback, link-local, and IPv6 internal addresses.
• OAuth consent page XSS fix — scope tokens are HTML-escaped before rendering.
• IP rate limiter extended to /token, /authorize, and /register OAuth endpoints.
• MCP_TRUST_PROXY default changed to false — set to true explicitly when behind a TLS-terminating proxy. Official Docker Compose stack is unaffected.

Added

• 30 new tools — domain management (register_domain, transfer_domain, renew_domain, get_domain_whois, get_domain_nameservers, update_domain_nameservers, get_domain_lock_status, update_domain_lock_status, get_tld_pricing), admin (get_admin_users, get_staff_online, get_whmcs_details, log_activity), affiliates (get_affiliates, activate_affiliate), promotions (get_promotions), servers (get_servers, module_change_password), system info, support, orders, and invoices. Total tool count is now 86.
• 24 MCP resources for real-time, read-only access to system data via whmcs:// URIs with a 60-second TTL cache.
• 18 MCP workflow prompts for guided AI interactions — client onboarding, fraud investigation, revenue reports, churn risk, domain audits, and more.
• overideautosuspend flag on update_service to exempt a service from automatic suspension.

Changed

• Unified auth stack — MCP_AUTH_MODE removed. The simple / oauth mode split is gone. The server now always runs the full OAuth 2.0 stack. Bearer tokens work in all configurations. /authorize is available only when MCP_OAUTH_ADMIN_PASSWORD is set.
• MCP_REQUIRE_AUTH removed. Authentication is always enforced in HTTP mode.
• /health response updated. auth.mode and auth.required replaced by auth.oauthEnabled.

Fixed

• dryRun response prefix normalized to [dryRun] across all mutating tools.
• XSS sanitization applied to user input echoed in dryRun responses.
• get_product_groups reimplemented to derive groups from GetProducts.
• Startup warnings emitted when deprecated MCP_AUTH_MODE or MCP_REQUIRE_AUTH env vars are detected.

Fixed

• create_invoice sent wrong client field — WHMCS CreateInvoice requires userid; the client was forwarding clientid.
• get_cancelled_packages client filter — clientId argument was forwarded but the WHMCS API does not support it for this action. Tool description updated.

Fixed

• list_invoices / get_overdue_invoices client filter ignored — WHMCS GetInvoices accepts userid, not clientid. Both tools now send the correct field.

Fixed

• OAuth state parameter missing from callback redirect — fixed two-part bug: state was coerced to "" in the consent URL, then dropped by the if (state) guard on POST. Both paths are now fixed; state is echoed verbatim per the OAuth 2.0 spec. Required for Claude.ai Custom Connector OAuth.

Fixed

• OAuth /token returned HTTP 500 for normal grant failures — OAuthProvider now throws proper InvalidGrantError for invalid/expired codes and tokens; clients receive 400 with invalid_grant.

Fixed

• OAuth consent session cookie for cross-site POST (Claude.ai) — connect.sid now uses SameSite=None; Secure on HTTPS so the browser sends it on cross-site POST to /oauth/consent.

Fixed

• CSRF tokens now persisted via express-session — previous in-memory Map was wiped on container restart. Sessions now backed by session-file-store on disk.

New optional env vars: MCP_OAUTH_SESSION_SECRET, MCP_OAUTH_SESSIONS_DIR.

Major production release + OAuth stabilisation

• Bearer token auth with scope-based access control (mcp:read, mcp:write, mcp:admin)
• Prometheus metrics, structured JSON logging, audit trail, Grafana dashboard
• Per-IP and per-token rate limiting
• Docker, Kubernetes, and standalone binary deployment
• auth-cli for token management
• OAuth discovery document and CIMD support for Claude.ai and ChatGPT
• Multiple OAuth routing and PKCE fixes (v2.0.1–v2.0.4)

Full v2.0.0 release notes on GitHub →

Initial MCP server with core WHMCS tools, stdio and HTTP transport, dryRun mode, and basic Docker support.

View on GitHub →