POST /mcp — the MCP server
No API key, no account, no signup. Responses are JSON, CORS is open, and every endpoint is read-only — nothing here can register, buy or change anything.
The endpoint
https://dotsweep.com/mcp — one URL, nothing to install and nothing running
on your machine. Model Context Protocol over JSON-RPC, streamable HTTP.
curl -X POST https://dotsweep.com/mcp -H 'Content-Type: application/json' \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'Tools
check_domains— availability, price and policy for a list of names. POST /check underneath.whois— the registry record for one name. GET /whois/{domain} underneath.list_tlds— every checkable extension. GET /tlds underneath.
All three are read-only. Nothing here registers, buys or transfers anything, and the server holds no account of yours to change — which is why there is no dry-run flag and no idempotency key in this API.
A GET here answers 405, and that is correct
Every message is a POST. There is no server-initiated stream, so a GET on this
URL returns 405 with Allow: POST rather than a page or a
stream. A client reporting that as an error is describing the endpoint working.
It adds no capability
This is a transport over the endpoints documented here, and it holds no logic of its own. It exists so the service can be added to a client and listed in MCP registries. If you are writing code rather than configuring an assistant, call the HTTP endpoints directly.
Adding it to a client
Setup instructions per client — Claude, Claude Code, Cursor, VS Code and Codex, each with the exact menu path. There is no transport to choose in any of them, and no key to paste.
Errors
{ "error": { "code": "invalid_domain", "message": "...", "hint": "..." } }Codes: invalid_domain, bad_body,
batch_too_large, rate_limited,
unknown_endpoint, method_not_allowed,
internal_error. The hint says what to do differently.
For anything other than rate_limited and internal_error,
repeating the same call fails the same way.
Rate limit
120 requests a minute per client, counted as requests rather than domains. Edge cache hits never reach the Worker and are not counted at all.
That rate is the whole quota. There is no daily or monthly ceiling, no credit balance and no trial that expires, so a job that stays under the rate can run as long as it needs to. Said plainly because an unstated limit gets read as a hidden one, and a caller who plans around a monthly cap is planning around nothing.
The other endpoints
GET /check/{domain}— one domain, edge-cached, unmetered on a hitPOST /check— up to 10 domains per request, for volumeGET /whois/{domain}— registrar, dates, nameservers, and the for-sale signalGET /tlds— the full list, with price, term and eligibility