Deleting a client, terminating a service and marking an order fraudulent are each one call, so the permissions on the API credential are the real boundary. WHMCS lets you enable only the API functions you need and restrict access by IP — set both before you point an assistant at a production install.
A TypeScript server over the WHMCS API that covers the whole admin surface: clients, products, billing, support tickets, domains, orders, service provisioning and system data.
- Client records end to end — `whmcs_get_clients`, `whmcs_get_client_details`, `whmcs_add_client`, `whmcs_update_client`, `whmcs_delete_client`
- Billing — `whmcs_get_invoices`, `whmcs_create_invoice`, `whmcs_add_payment`, `whmcs_apply_credit`, `whmcs_get_transactions`
- The support desk — `whmcs_get_tickets`, `whmcs_open_ticket`, `whmcs_add_ticket_reply`, `whmcs_update_ticket`
- Domains — `whmcs_register_domain`, `whmcs_transfer_domain`, `whmcs_renew_domain`, `whmcs_update_domain_nameservers`, `whmcs_get_tld_pricing`
- Service lifecycle on the server modules — `whmcs_module_create`, `whmcs_module_suspend`, `whmcs_module_terminate`, `whmcs_module_change_password`
- Read-only live resources such as `whmcs://stats`, `whmcs://products` and `whmcs://tld-pricing`, plus prompt templates for client onboarding, revenue reporting and fraud investigation
Three environment variables — `WHMCS_API_URL`, `WHMCS_API_IDENTIFIER` and `WHMCS_API_SECRET` — from credentials created under Setup → Staff Management → API Credentials. `WHMCS_ACCESS_KEY` is optional and adds a second factor. Run the `ghcr.io/scarecr0w12/whmcs-mcp-tool:latest` image, or build from source with npm.
One command plus a key — docker run -it --rm -e WHMCS_API_URL="https://billing.example.com/" -e WHMCS_API_IDENTIFIER="your-identifier" -e WHMCS_API_SECRET="your-secret" ghcr.io/scarecr0w12/whmcs-mcp-tool:latest, then supply credentials