Let an AI agent search and quote domains, then approve the purchase yourself

You want an agent to look up a domain and tell you the Cloudflare price. You don’t want it to register the name because a sentence in the chat sounded like a yes.

Registration is billable, and Cloudflare doesn’t refund it. Cloudflare Domains Toolkit is a local MCP server with four tools. The agent can search, check one name, and create a quote. The purchase tool stops and shows a form. You tick a box. If the client can’t show that form, the purchase doesn’t run.

The app page is the story of how that boundary is built. This is the run: install the server, connect a client, and buy one name you already chose. If you’ve never pointed a client at a local server, start with how to build an MCP server. The form is an MCP elicitation, the same kind of confirmation covered in MCP Tasks and Elicitations in Claude Code.

What you need

Node.js 20 or later. A Cloudflare account with Registrar setup finished: a default payment method, a default registrant contact, and the Domain Registration Agreement accepted. An MCP client that speaks stdio and can show an elicitation form. The repo includes Cursor and Codex configuration examples.

After purchasing, download the source zip from your Polar receipt and unzip it. It has an mcp directory and a cli directory, each with its own dependencies.

Use separate Cloudflare tokens with separate permissions. Give the Registrar server Registrar write access, and give the DNS CLI Zone Read and DNS Edit. The limits come from the scopes you assign to each token, so don’t reuse one broad token in both places.

The toolkit doesn’t include a domain. The registration charge is billed by Cloudflare, separate from the software.

Build the Registrar server

From the mcp directory:

npm install
npm run build
npm run smoke

The smoke test checks that a client can start the server and discover its tools, without buying anything.

Create a Cloudflare user API token with Registrar write permission, on the account you mean to use. On macOS, store it with the prompt in the repo:

npm run keychain:store

The default Keychain service is cloudflare.domain-registrar-mcp. The account is your macOS username. Keep the token out of the source folder.

Find the paths the client config needs:

which node
pwd

Add a stdio server. The command is that Node executable. The argument is the absolute path to mcp/dist/server.js. Set these on that server entry:

The examples are in mcp/examples/. Merge the server entry into the client config you already have, replace the paths and the account ID, and restart the client.

On a machine without that Keychain helper, set CLOUDFLARE_API_TOKEN through the client’s secret store. Don’t write the token into a file you commit.

Ask for names, then check one

The tools don’t do the same job.

Search can be loose. Quote and purchase take one exact registrable domain, in plain ASCII, like hostingpicker.dev. The server rejects URLs, paths, ports, wildcards, Unicode input, empty labels and bad hyphen placement.

Ask for a check before any quote, and tell the agent not to buy:

Check whether hostingpicker.dev is available. Do not buy it.

Read the availability and the price. Then ask for a quote of that one name, and say you haven’t approved a purchase.

Read the quote before you approve

quote_domain_purchase asks Cloudflare for availability, price and the minimum registration term. It stores a quote in memory. The quote has an ID, the exact domain, the registration and renewal prices, the currency, the years required, the complete initial charge in cents, the auto-renewal state, and an expiry time.

Quotes expire after five minutes. Each one is single-use, and they disappear when the MCP process stops. Cloudflare doesn’t hold the name for you while a quote is open.

Some extensions require more than one year. For those, the first charge is the registration price plus the renewal price times the remaining required years. The server compares that complete first charge with a hard limit of $20. A name advertised under $20 can still be rejected when the minimum term pushes the first bill over the limit. Premium domains are rejected. Prices outside USD are rejected.

When purchase_domain runs, the caller repeats the quote ID, the domain, the currency and the total cents. The server asks Cloudflare again. If availability, price or minimum term changed, the purchase stops and you create a new quote. The form appears only after that live recheck. You approve the latest charge.

The form repeats the domain, the exact USD total, the registration term, a non-refundable warning, and that auto-renewal is disabled. The checkbox starts unchecked. The purchase continues only when the client returns an accepted form with the value set to true.

If the client doesn’t support elicitation, the server blocks the purchase. There’s no terminal fallback and no environment flag that skips the form.

The registration request disables auto-renewal. After it succeeds, review the renewal settings in the Cloudflare account.

A real quote: hostingpicker.dev

I bought hostingpicker.dev with the toolkit. The quote was $12.20 for a one-year term, so the initial charge was the registration price alone, totalCents was 1220, and it passed the $20 limit.

Here’s how to ask for a quote and nothing more. Swap in the name you want:

Check hostingpicker.dev and request a quote if it is available.
Show me the exact domain, minimum term, initial USD charge and renewal
price. Stop after the quote. I have not approved registration.

Compare the quote with what you meant to buy. Read the full name, including the extension, and look at the renewal price as well as the first bill.

When you go ahead, the purchase can stop for several reasons, each with a different next step:

If something looks wrong

If the server exits as soon as the client starts it, check the absolute paths and run the build again.

The server never retries a registration on its own. If the request reached Cloudflare and the connection died before the answer came back, the server can’t tell whether the name was bought. The quote stays used. Look in the Cloudflare account before you try anything else.

A missing zone is a different login. The companion cf-domains command, from the cli directory after npm install and npm link, edits records in zones you already have. Its token needs Zone Read and DNS Edit. Save it with cf-domains auth login. The default Keychain service for that token is cloudflare.domains-cli. cf-domains --help lists the record commands. Deleting a record asks for confirmation.

Get Cloudflare Domains Toolkit

Search, quote and register Cloudflare domains through an MCP server with human approval. Includes a DNS CLI and full MIT source.

See Cloudflare Domains Toolkit → · Read the docs · $20 including tax, with full source code.

More tutorials for my apps →

Want me to talk about your product? You can sponsor this site.