Porkbun MCP Server (official)BLOCK
mcp/oborseth/porkbun-mcp
Official Porkbun MCP server — exposes the Porkbun v3 API as native tools for Claude Desktop, Cursor, and other AI agents. Idempotency-safe writes, full domain lifecycle.
Verdict
BLOCK
Grade
D
Trust score
69 /100
Exposed tools
109 56r · 41w · 12d
Transport
stdio · streamable-http
License
MIT
Stars
32
01
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://www.npmjs.com/package/@porkbunllc/mcp-server) [](https://www.npmjs.com/package/@porkbunllc/mcp-server) [](https://opensource.org/licenses/MIT)
The official MCP server from Porkbun, built and maintained by Porkbun (by Owen Borseth, Porkbun's CTO). It is published on npm as `@porkbunllc/mcp-server` and hosted by Porkbun at https://mcp.porkbun.com/mcp. Other "Porkbun MCP" projects on GitHub and in MCP directories are community wrappers around the public API; they are not made or supported by Porkbun. In the official MCP Registry it is listed as `com.porkbun/mcp`, a name the registry grants only to whoever proves control of porkbun.com; community projects appear under io.github.* names.
A Model Context Protocol server that exposes the Porkbun v3 API as native tools for AI agents — Claude Desktop, Cursor, Cline, and any other MCP-compatible client.
Setup guide, client configs and the full tool list: [porkbun.com/mcp](https://porkbun.com/mcp)
No install: use the hosted connector. Porkbun runs this server at https://mcp.porkbun.com/mcp. Add that URL as a custom connector in ChatGPT or Claude (or claude mcp add --transport http porkbun https://mcp.porkbun.com/mcp in Claude Code), sign in to Porkbun and approve. No API key to copy. Steps per client: Connect ChatGPT or Claude. How it is deployed: deploy/README.md. The ChatGPT and Claude directory listings use a narrower variant, `/
Read from source at commit
31eb99033edfOBSERVED · 2026-10-1102
Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude-code (npm)
claude mcp add mcp-server --env PORKBUN_SECRET_API_KEY=${PORKBUN_SECRET_API_KEY} -- npx -y @porkbunllc/[email protected]03
Exposed tools (109)
56 read · 41 write · 12 destructive. Blast radius: 12 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
buy_closeout | read | **Spends account credit |
check_domain | read | Check whether a single domain is available for registration and what it costs. Returns availability ( |
check_domains | read | Check up to 25 domains for availability and price in ONE call. Prefer this over calling |
configure_auto_topup | write | Set the top-up amount, and/or turn auto top-up on or off.\n\n |
confirm_email_verification | read | Verify the account |
confirm_phone_verification | read | Verify the account |
connect_domains_to_cloudflare | write | Queue domains to move into the customer |
create_cloudflare_record | write | Create a DNS record in a domain |
create_dns_record | write | Create a DNS record on a domain in the authenticated account. Returns the new record |
create_email_forward | write | Forward an address at the domain (e.g. |
create_glue_record | write | Create a glue record for a host on a domain. Used when running your own nameservers on the same domain they serve (e.g. |
create_hosting | write | Provision hosting for a domain in the account — Secure Static Hosting OR Cloud for WordPress (a managed WordPress site), chosen by |
create_mailbox | write | **Spends account credit |
create_sandbox_key | write | Instantly create a free SANDBOX API key — NO credentials or approval needed (works before you have any keys). Returns a |
create_url_forward | write | Add a URL forwarding rule for a domain. Forwards a subdomain (or apex if |
create_webhook | write | Register a webhook endpoint. Porkbun will POST a signed JSON payload to |
create_wp_credentials | write | CLOUD FOR WORDPRESS ONLY. Mint a WordPress Application Password for a domain |
delete_cloudflare_record | destructive | Delete a DNS record from a domain |
delete_dns_record | destructive | Delete a single DNS record by its numeric |
delete_dnssec_record | destructive | Remove a DNSSEC DS record from the registry for a domain, identified by key tag. Use when retiring a key. Idempotent: deleting a non-existent key tag returns success. |
delete_email_forward | destructive | Delete one email forward, named by its |
delete_glue_record | destructive | Delete a glue record by host on a domain. Idempotent: deleting a non-existent glue record returns success. |
delete_hosting | destructive | Deprovision (cancel) Secure Static Hosting for a domain; teardown is scheduled by Porkbun. Note: the domain has already used its one free trial, so provisioning it again later will be charged (no second free trial). |
delete_hosting_file | destructive | Delete a file or directory at |
delete_url_forward | destructive | Delete a URL forwarding rule by its |
delete_webhook | destructive | Delete a webhook endpoint by id. Deliveries stop immediately. Idempotent in effect: deleting a non-existent endpoint returns an error you can safely ignore. |
delete_wp_credentials | destructive | CLOUD FOR WORDPRESS ONLY. Revoke a WordPress application password by |
deploy_site | write | Upload static files to a domain |
diff_dns_restore_point | read | Compare a DNS restore point with the live zone before changing anything. Always do this before |
disconnect_cloudflare | destructive | Remove this account |
edit_cloudflare_record | write | Update a DNS record in a domain |
get_api_settings | read | Get the account |
get_auto_topup | read | Read the account |
get_balance | read | Get the available account credit balance for the authenticated Porkbun account. Returns the balance in cents (integer) and a human-readable display string (e.g. |
get_closeout | read | Get one closeout plus |
get_cloudflare_connection | read | Check whether this Porkbun account is connected to a Cloudflare account, and which one. THIS IS THE POLL TARGET for the connect flow. Connecting is a HUMAN action: Cloudflare |
get_cloudflare_domain_status | write | Get the Cloudflare move status for ONE domain, including the Cloudflare zone id once created and the nameservers Porkbun replaced (kept so the move can be undone). Returns NOT_QUEUED if the domain has never been queued. |
get_cloudflare_queue | write | List every Cloudflare move this account has requested, with per-domain status and message. Use this to poll progress after connect_domains_to_cloudflare. Queue rows are never deleted, so this is also the audit trail of past moves. |
get_cloudflare_records | read | List a domain |
get_cloudflare_zone | read | Get what CLOUDFLARE currently says about a domain |
get_cloudflare_zone_settings | write | Read the Cloudflare zone settings that matter after a move: ssl mode, always_use_https, automatic_https_rewrites, min_tls_version, development_mode, cache_level. Warns when SSL mode is |
get_contacts | read | Get the four contacts (registrant, admin, tech, billing) for a domain in the authenticated account, with their current field values (name, organization, address, phone, email). Read-only. |
get_domain | read | Get the metadata for a single domain in the authenticated account: status, TLD, create date, expire date, security lock, WHOIS privacy, auto-renew, API access opt-in, and (optionally) labels. Returns an error with code |
get_hosting | read | Get Secure Static Hosting status for a domain (plan, server, trial, expiry, auto-renew), or null if the domain has no hosting. When ACTIVE, deploy_site publishes site files to it. |
get_invoice | read | Get one invoice as data: who it is billed to, how it was paid (card brand and last four only), each line with its product, term, resulting domain expiry and status, and the gross, refunded and net totals in cents. The same figures as the PDF. |
get_invoice_pdf | read | Get an invoice PDF: the same document as Download PDF on porkbun.com. The file comes back as an embedded PDF resource (for clients that can show or save files), alongside |
get_nameservers | read | Get the current nameservers configured for a domain in the authenticated account. Returns an array of nameserver hostnames, read live from the registry. Read-only complement to |
get_pricing | write | Get current Porkbun pricing: registration, renewal and transfer prices per TLD in USD. No authentication required. **Pass |
get_registration_requirements | read | Get a TLD |
get_ssl_bundle | read | Retrieve the free Porkbun-issued SSL certificate bundle for a domain. Returns the certificate chain, private key, and public key (PEM-encoded strings). Porkbun automatically provisions Let |
get_transfer_setup | write | Report where a held inbound transfer is and what it is waiting on: whether it is held at PENDINGDNS, whether its DNS zone exists, how many records it holds, what the domain currently delegates to, and the next step. Use this to resume a no-downtime transfer instead of tracking that state yourself. |
get_transfer_status | write | Get the status of a specific inbound transfer for a domain. Useful for polling after |
get_usdc_topup_status | read | Check a USDC top-up from |
get_webhook | read | Fetch a single webhook endpoint by its numeric id, including its signing secret and delivery health (consecutive failures, last success/failure). |
get_webhook_delivery | read | Fetch a single webhook delivery by id, including the full JSON payload that was (or will be) sent and its delivery status. Get delivery ids from list_webhook_deliveries. |
get_webhook_event_types | read | List the event types you can subscribe a webhook endpoint to. Returns event-type strings like |
import_dns_records | write | Create many DNS records on a Porkbun domain in one call \u2014 the companion to scan_dns_records for keeping a transferred domain working. |
list_cloudflare_inventory | read | List every domain in the account with its Cloudflare eligibility: |
list_dns_records | read | List all DNS records for a domain in the authenticated account. Returns each record |
list_dns_restore_points | read | List the saved versions of a domain |
list_dnssec_records | read | List the DNSSEC DS records currently submitted to the registry for a domain. Returns key tag, algorithm, digest type, and digest. Use this to verify DNSSEC chain-of-trust setup. Empty array = DNSSEC not configured. |
list_domains | read | List domains in the authenticated Porkbun account. Returns one page (up to 1000) with metadata: expire date, auto-renew, security lock, WHOIS privacy, API access opt-in, and notLocal flag.\n\nFilters (all optional):\n- |
list_email_forwards | read | List the email forwards on a domain: each |
list_glue_records | read | List glue records for a domain. Glue records associate a host (e.g. |
list_hosting_files | read | List file/directory names under an optional |
list_hosting_plans | read | List the hosting plans provisionable via the API, with price (cents — pass as |
list_invoices | read | List the account |
list_mailboxes | read | List a domain |
list_marketplace | read | Browse domains for sale on Porkbun Marketplace: names other Porkbun customers listed themselves, not new registrations. This is ONE aftermarket source; to find whether a taken name is for sale anywhere (Afternic, Sedo, Atom, NameBright, DAX and Porkbun Marketplace together), use |
list_transfers | read | List all in-progress and recent inbound domain transfers for the authenticated account. Returns each transfer |
list_url_forwards | read | List all URL forwarding rules configured for a domain. Each entry includes its |
list_wp_credentials | read | CLOUD FOR WORDPRESS ONLY. List the WordPress application passwords on a domain |
make_hosting_dir | write | Create a directory (and any missing parent directories) at |
mock_call | read | Get a schema-accurate EXAMPLE response for any API endpoint with NO credentials — nothing to set up. Mirrors the real path under /mock (e.g. path |
ping | read | Verify the Porkbun API connection and credentials. Returns the caller |
read_doc | read | Read a Porkbun documentation page as Markdown. Pass a |
register_domain | read | **Spends account credit |
renew_domain | read | **Spends account credit |
renew_mailbox | read | **Spends account credit |
request_api_key | write | Start creating a new LIVE Porkbun API key that the account holder approves in their browser (no credentials needed to call this). Returns |
restore_dns_zone | write | Put a domain |
retrieve_api_key | read | Collect the API key the user approved after |
retry_cloudflare_domain | write | Re-queue a domain whose Cloudflare move failed or was skipped. Fails if it is already connected, already in progress, or no longer in the account — the message says which. Fix the underlying reason first (e.g. disable DNSSEC) or the retry will be skipped again. |
rollback_cloudflare_domain | write | UNDO a completed Cloudflare move: point the domain |
rotate_webhook_secret | read | Generate a new signing secret for a webhook endpoint and return the endpoint with the new secret. Deliveries are signed with the new secret immediately, so update your verifier as part of the same operation. |
sandbox_reset | destructive | SANDBOX ONLY. Wipe the sandbox account |
sandbox_topup | read | SANDBOX ONLY. Grant fake account credit to the sandbox account so paid operations (register/renew/transfer) can keep being exercised after funds run out. Requires a sandbox API key ( |
sandbox_trigger_webhook | write | SANDBOX ONLY. Fire a sample signed webhook event to your registered endpoints so you can test your handler and HMAC signature verification for ANY event type on demand — including cron-driven events like |
scan_dns_records | read | Discover the DNS records a domain currently publishes by querying its live authoritative nameservers. Writes nothing. |
search_aftermarket | read | Find registered domains that are FOR SALE on the aftermarket: Afternic, Sedo, Atom, NameBright and DAX listings and auctions, plus Porkbun Marketplace, merged to the lowest price per name. Use it when check_domain says a name is taken ( |
search_closeouts | read | Search expired-domain closeouts: names that did not sell at auction and are now offered at a fixed price that descends on a schedule. No bidding \u2014 the first buyer at the current price takes the name. |
search_docs | read | Keyword-search the full Porkbun API reference and return the most relevant sections (endpoints/topics) as Markdown. Use for |
send_email_verification_code | write | Email a verification code to the email address on the user |
send_phone_verification_code | write | Text a verification code to the phone number on the user |
set_cloudflare_proxy | write | Turn the Cloudflare proxy (orange cloud) on or off for a domain |
set_cloudflare_zone_settings | write | Change Cloudflare zone settings for a moved domain. Only an allowlist is editable (ssl, always_use_https, automatic_https_rewrites, min_tls_version, development_mode, cache_level) — WAF/firewall/security controls are deliberately not exposed. Prefer ssl |
set_email_password | write | Change the password of an email hosting mailbox (an active one, from |
setup_mailbox | read | Give a waiting mailbox (already paid for, or the free trial that comes with a domain registration) its address and password. Free. If none is waiting the result is |
test_webhook | write | Send a |
top_up_account_credit | read | **Charges the user |
top_up_with_card_mpp | read | Get a payment link that adds account credit when paid with the user |
top_up_with_usdc | write | Add account credit by paying USDC on Base, through a Coinbase checkout. Use it to add credit when a purchase failed with INSUFFICIENT_FUNDS and there is no saved card (or the user would rather pay in crypto); to pay for just that one purchase, retry it with |
transfer_domain | write | **Spends account credit |
update_auto_renew | write | Turn auto-renewal on or off for a domain in the authenticated account. When auto-renew is on, Porkbun automatically charges your account credit at expiration. When off, you must manually renew or the domain expires. Idempotent. |
update_contacts | write | Edit a domain |
update_dns_record | write | Update an existing DNS record by its numeric |
update_glue_record | write | Update the IP addresses associated with an existing glue record. Replaces the full IP list — pass all IPs you want set, not just additions. Idempotent. |
update_nameservers | write | Replace the nameservers for a domain in the authenticated account. **This is a full replacement, not an append** — the supplied list becomes the complete set of nameservers. Most TLDs require 2-13 entries. Setting custom nameservers disables Porkbun |
update_webhook | write | Update a webhook endpoint. Only the supplied fields change. Set |
04
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (3 observation(s))
- Network
- declared (13 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (16)
HIGHPrompt injection · prompt.credential_read · CWE-94, CWE-1427
<tool:retrieve_api_key>:1
Collect the API key the user approved after
Why it matters. asks the agent to read credentials
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
deploy/deploy.sh:35
curl -fsS "http://127.0.0.1:$PORT/health" >/dev/null 2>&1 && return 0
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
deploy/setup.sh:68
if curl -fsS "http://127.0.0.1:$PORT/health" >/dev/null 2>&1; then
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
deploy/setup.sh:77
curl -fsS "http://127.0.0.1:$PORT/.well-known/oauth-protected-resource"; echo
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
deploy/setup.sh:80
curl -s -o /dev/null -D - -X POST "http://127.0.0.1:$PORT/mcp" -H 'Content-Type: application/json' -d '{}' \MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59
delete_cloudflare_record, delete_dns_record, delete_dnssec_record, delete_email_forward, delete_glue_record, delete_hosting, delete_hosting_file, delete_url_forward, delete_webhook, delete_wp_credenti
Why it matters. 12 tool(s) can delete or overwrite
Fix. prefer a read-only mode or scoped tokens; the page states the blast radius
LOWInventory / provenance · inv.hidden_file · CWE-1104
.mcpbignore
.mcpbignore
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
@modelcontextprotocol/sdk, @x402/core, @x402/evm, viem, zod, @types/node, typescript
Why it matters. 7 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWPrompt injection · prompt.authority_framing · CWE-94, CWE-1427
README.md:272
- **Permissions** — Full access, **Read-only**, **Manage, but no purchases**, or custom scopes (`read`, `dns`, `domains`, `email`, `hosting`, `purchase`, `funding`, `account`). A tool call outside the
LOWPrompt injection · prompt.authority_framing · CWE-94, CWE-1427
deploy/README.md:152
API enforces. Connections made before then keep full access until they reconnect.
LOWPrompt injection · prompt.credential_read · CWE-94, CWE-1427
README.md:340
- **Storage.** The server keeps your credentials in memory for the lifetime of the process (read from environment variables); it does not write them to disk, log them, or cache your data.
Why it matters. asks the agent to read credentials
LOWPrompt injection · prompt.credential_read · CWE-94, CWE-1427
kb/KB-DRAFTS.md:66
You can connect ChatGPT to your Porkbun account and manage your domains in the conversation. You sign in to Porkbun and approve access; ChatGPT never sees your password or an API key.
Why it matters. asks the agent to read credentials
LOWPrompt injection · prompt.credential_read · CWE-94, CWE-1427
kb/KB-DRAFTS.md:183
- **Keywords:** connected app, disconnect claude, disconnect chatgpt, revoke access, api access, allowed domains, api key, remove connector, oauth, security
Why it matters. asks the agent to read credentials
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
README.md:161
Use a **sandbox API key** (public key prefixed `pk1_sb_`, secret `sk1_sb_`) and *every* tool above runs against an isolated test environment — same server, you just swap the key. Registrations, renewa
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
deploy/README.md:158
| `/mcp/no-purchases` | 81 | + `register_domain`, `renew_domain`, `transfer_domain`, `buy_closeout`, `create_hosting`, `create_mailbox`, `renew_mailbox`; the secret-returning `get_ssl_bundle`, `create
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
kb/KB-DRAFTS.md:258
3. **Make a call.** Send both keys as `X-API-Key` / `X-Secret-API-Key` headers (or in the JSON body) to `https://api.porkbun.com/api/json/v3/`. Start with `/ping` to check your keys.
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
Gates applied: no_behavioural_pass.
Audited 2026-10-11 · audit v0.4.1 · source sha
31eb99033edffull audit observations/trust-audit/mcp-server/oborseth__porkbun-mcp.json · Report an issue / request a re-scan05
Audit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 31eb99033edf | BLOCK | D | 69 | first audit |
06
Questions
What is the @porkbunllc/mcp-server MCP server?
Official Porkbun MCP server — exposes the Porkbun v3 API as native tools for Claude Desktop, Cursor, and other AI agents. Idempotency-safe writes, full domain lifecycle.
What tools does @porkbunllc/mcp-server expose?
109 in total: 56 read-only, 41 that write, and 12 that can delete or overwrite (delete_cloudflare_record, delete_dns_record, delete_dnssec_record, delete_email_forward, delete_glue_record). Every one is listed on this page with its risk.
Is @porkbunllc/mcp-server safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 12 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does @porkbunllc/mcp-server need?
It reads OAUTH_ISSUER, PORKBUN_API_KEY, PORKBUN_SECRET_API_KEY and PORKBUN_X402_PRIVATE_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does @porkbunllc/mcp-server run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @porkbunllc/mcp-server at 0.50.0.
How current is this page?
The grade is for one exact copy of the source (31eb99033edf), read on 2026-10-11. The repository is watched and re-audited when it changes.