# XRPName

> XRPL domains for AI agents — availability, pricing, profiles, portfolio, and register links.

- name: io.github.XRPDomains/xrpname-mcp-server
- version: 0.1.1
- connection class: R0 (autonomous)
- trust: 89/100
- quality: 71/100 (needs work)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/io.github.XRPDomains%2Fxrpname-mcp-server
- tools: https://api.protogrid.dev/v1/servers/io.github.XRPDomains%2Fxrpname-mcp-server/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "xrpname-mcp-server": {
      "type": "http",
      "url": "https://xrpdomains.xyz/mcp"
    }
  }
}
```


## Trust

- hygiene: 100
- liveness: 98
- freshness: 65
- provenance: 90
- drivers: +repository +namespace-matches-repo +website +reachable +uptime-94% ~updated-99d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 71/100 (needs work)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 86 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 10 of 10 tools declare readOnlyHint or destructiveHint
- fail `tools.directory_hints`: no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: recommend_domain (destructiveHint); resolve_address (destructiveHint); set_primary_domain (destructiveHint); …
- pass `tools.token_cost`: about 2,086 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 75 (weight 15)

- warn `stability.changes`: 10 tool changes in 30 days
- pass `stability.rug_pull`: no tool changed its meaning under the same name

### dependencies: 33 (weight 15)

- fail `deps.known_vulns`: 6 advisories to act on (malicious, or rated high or critical with a fix available): GHSA-667r-xxjv-c9mm in fastify@4.29.1 (direct, fixed in 5.12.2), GHSA-9q9j-q6p8-xq58 in fastify@4.29.1 (direct, fixed in 5.12.2), GHSA-hwr6-493r-vm6h in fastify@4.29.1 (direct, fixed in 5.12.2), ...; 5 more of lower severity or without a fix
- fail `deps.mcp_sdk_version`: @modelcontextprotocol/sdk 1.30.1 has 3 known advisories (GHSA-22jm-h49p-29qw, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h); update @modelcontextprotocol/sdk to 1.32.0 or later
- pass `deps.resolvable`: @xrpname/xrpname-mcp@0.1.1 resolved: 169 packages

- tools: 10, about 2,086 tokens to load them all
- tool set hash: b324fbef52603adf6653793d82d8e9a4
- tools last changed: 2026-10-16T09:36:47.438Z
- badge: [![protogrid quality](https://protogrid.dev/badge/io.github.XRPDomains/xrpname-mcp-server.svg)](https://protogrid.dev/servers/io.github.XRPDomains/xrpname-mcp-server)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-10-16 `set_primary_domain` changed (annotations)
- 2026-10-16 `register_domain` changed (annotations)
- 2026-10-16 `resolve_address` changed (annotations)
- 2026-10-16 `get_portfolio` changed (annotations)
- 2026-10-16 `get_pending_offers` changed (annotations)
- 2026-10-16 `check_order_status` changed (annotations)
- 2026-10-16 `check_tx_status` changed (annotations)
- 2026-10-16 `get_domain_profile` changed (annotations)
- 2026-10-16 `recommend_domain` changed (annotations)
- 2026-10-16 `check_domains` changed (annotations)

Full history: https://api.protogrid.dev/v1/servers/io.github.XRPDomains%2Fxrpname-mcp-server/changes

## Dependencies

- npm @xrpname/xrpname-mcp@0.1.1: resolved, 168 dependencies, MCP SDK @modelcontextprotocol/sdk 1.30.1
  - GHSA-22jm-h49p-29qw (high) in `` @modelcontextprotocol/sdk@1.30.1 ``, direct, fixed in `` 1.32.0 ``, advisory summary: "MCP TypeScript SDK: Experimental tasks were not tied to the session that created them" https://osv.dev/vulnerability/GHSA-22jm-h49p-29qw
  - GHSA-6qxp-vccf-f47h (high) in `` @modelcontextprotocol/sdk@1.30.1 ``, direct, fixed in `` 1.31.0 ``, advisory summary: "MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server" https://osv.dev/vulnerability/GHSA-6qxp-vccf-f47h
  - GHSA-667r-xxjv-c9mm (high) in `` fastify@4.29.1 ``, direct, fixed in `` 5.12.2 ``, advisory summary: "fastify vulnerable to request body replacement via an async validation result collision" https://osv.dev/vulnerability/GHSA-667r-xxjv-c9mm
  - GHSA-9q9j-q6p8-xq58 (high) in `` fastify@4.29.1 ``, direct, fixed in `` 5.12.2 ``, advisory summary: "fastify vulnerable to header validation bypass via incomplete schema case normalization" https://osv.dev/vulnerability/GHSA-9q9j-q6p8-xq58
  - GHSA-hwr6-493r-vm6h (high) in `` fastify@4.29.1 ``, direct, fixed in `` 5.12.2 ``, advisory summary: "fastify vulnerable to request validation bypass via skipped boolean false schemas" https://osv.dev/vulnerability/GHSA-hwr6-493r-vm6h
  - GHSA-jx2c-rxcm-jvmq (high) in `` fastify@4.29.1 ``, direct, fixed in `` 5.7.2 ``, advisory summary: "Fastify's Content-Type header tab character allows body validation bypass" https://osv.dev/vulnerability/GHSA-jx2c-rxcm-jvmq
  - GHSA-p68q-wchp-6fh7 (high) in `` fastify@4.29.1 ``, direct, fixed in `` 5.12.2 ``, advisory summary: "fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers" https://osv.dev/vulnerability/GHSA-p68q-wchp-6fh7
  - GHSA-c96f-x56v-gq3h (high) in `` find-my-way@8.2.2 ``, indirect, fixed in `` 9.7.0 ``, advisory summary: "find-my-way: DDoS with HTTP2" https://osv.dev/vulnerability/GHSA-c96f-x56v-gq3h
  - GHSA-6prh-2h8m-c8cw (moderate) in `` @modelcontextprotocol/sdk@1.30.1 ``, direct, fixed in `` 1.32.0 ``, advisory summary: "MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies" https://osv.dev/vulnerability/GHSA-6prh-2h8m-c8cw
  - GHSA-444r-cwp2-x5xf (moderate) in `` fastify@4.29.1 ``, direct, fixed in `` 5.8.3 ``, advisory summary: "fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections" https://osv.dev/vulnerability/GHSA-444r-cwp2-x5xf
  - GHSA-4mh8-r7rc-xpvc (moderate) in `` fastify@4.29.1 ``, direct, fixed in `` 5.12.5 ``, advisory summary: "fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses" https://osv.dev/vulnerability/GHSA-4mh8-r7rc-xpvc
  - GHSA-w2qp-rph6-63g4 (moderate) in `` fastify@4.29.1 ``, direct, fixed in `` 5.12.1 ``, advisory summary: "fastify vulnerable to schema validation bypass via root primitive coercion mismatch" https://osv.dev/vulnerability/GHSA-w2qp-rph6-63g4
  - GHSA-5r4p-p66f-jhc7 (moderate) in `` hono@4.13.9 ``, indirect, fixed in `` 4.13.11 ``, advisory summary: "Hono: \`serveStatic\` decodes the request path a second time, leading to bypass of middleware on static paths" https://osv.dev/vulnerability/GHSA-5r4p-p66f-jhc7
  - GHSA-mrq3-vjjr-p77c (low) in `` fastify@4.29.1 ``, direct, fixed in `` 5.7.3 ``, advisory summary: "Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream" https://osv.dev/vulnerability/GHSA-mrq3-vjjr-p77c

Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0.

## Remotes

- https://xrpdomains.xyz/mcp (streamable-http, auth none, reachable true, uptime30d 0.9380531)

## Packages

- npm @xrpname/xrpname-mcp@0.1.1

## Tools (10)

- `check_domains`: Check 1 to 25 XRPL domains for registration status and cost. Use for questions like "is <name>.xrp taken?", "how much does <name>.xrp cost?", "who owns <name>.xrp?", or to verify availability before registering. Accepts .xrp, .xrpl, .xrpfi, .rlusd TLDs (defaults to .xrp when omitted). Returns availability, price in XRP and RLUSD, owner address, profile metadata if registered, and a web URL for the user to register if available. Also returns invalid_domains for inputs that fail validation.
- `check_order_status`: Check the backend order status for a domain you tried to register on xrpdomains.xyz. Returns whether payment landed, the offer was created, the mint completed, or it failed at a step. Use when a user asks "did my X.xrp registration go through?" or "what's the status of my order?". This is deeper than check_domains (which only shows availability).
- `check_tx_status`: Check the validation status of an XRPL transaction by hash. Use after send_signed_tx to confirm whether the transaction was validated on-ledger. Returns status (pending, validated, failed, not_found) and engine result code.
- `get_domain_profile`: Get the full public profile of a single XRPL domain — owner, NFT token ID, metadata, avatar, fullname, description, social handles, linked chain addresses, and optionally the on-chain ownership history (pass include_history=true). Use when the user asks "show me X.xrp", "what does X.xrp link to?", "who owns X.xrp?", or "show me the history of X.xrp". Returns null fields gracefully if no profile is set.
- `get_pending_offers`: Get all pending XRPL domain operations for a wallet — incoming offers (someone offered the wallet a domain), outgoing offers (the wallet listed a domain), and paid-but-not-yet-minted orders the user can still complete. Use when the user asks "do I have any pending transfers?", "what offers are waiting on me?", or before suggesting an accept/cancel/continue-mint action. Requires an XRPL r... address.
- `get_portfolio`: List all XRPL domains owned by a wallet address. Use when the user asks "what domains do I own?", "show me my domains", or wants to see another wallet's holdings. Returns each domain with its TLD, length, primary flag, subname flag, and quick-action URLs. (nftoken_id, image, and mint time are not included here — use get_domain_profile for one domain.) Requires an XRPL r... address.
- `recommend_domain`: Get AI-recommended domain suggestions for a keyword or theme (e.g. "tom", "crypto", "defi"). Returns creative name + TLD combos with a category, each cross-checked for availability, priced, and given a register link. Use when a user asks "suggest names", "find me a domain about X", or "give me some .xrp ideas".
- `register_domain`: Get the link to register a .xrp / .xrpl / .xrpfi / .rlusd domain on xrpdomains.xyz. Registration is completed in the browser — the website handles the order and the user signs in their wallet there (the MCP does NOT build or broadcast the payment). Use when the user says "register X.xrpfi" or "buy X.xrp". Pass refcode if a referral applies.
- `resolve_address`: Reverse resolution: given an XRPL address, return its primary XRPName (if set) and the full list of names owned by the wallet. Use when the user says "who owns [address]?", "look up this wallet", or "what names does [address] have?", or when chained with get_domain_profile to explore a wallet. Returns found:false if the address owns no XRPName.
- `set_primary_domain`: Get the link to set a domain as your wallet's primary (the name shown by default for your address). Setting primary is completed in the browser — the website handles it and your wallet signs there (the MCP does NOT build or broadcast the transaction). Use when the user says "make X.xrp my primary" or "set X.xrpfi as my main domain". The wallet must already own the domain.