// SCAN REPORT

Gandi

187 tools. 101 can modify or destroy data without limits.

27 destructive tools with no built-in limits. Policy required.

Last updated:

101 can modify or destroy data
86 read-only
187 tools total

Community server · catalogue entry verified 03/07/2026

How to control Gandi ↓

TOOL MAP

What Gandi exposes to your agents

Read (86) Write / Execute (74) Destructive / Financial (27)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS
Critical Risk

The most dangerous Gandi tools

Financial · Critical gandi_domain_transfer_in Domain transfers at registrars like Gandi involve paying transfer/registration fees and committing to domain ownership obligations. Financial · High gandi_email_refund_slot This tool processes refunds, which constitutes a financial obligation and reversal of charges. Financial · Critical gandi_domain_register Registering a domain is a paid action that commits a financial obligation (typically annual fees). Financial · High gandi_domain_renew Domain renewal on Gandi is a paid transaction that charges the account for extending domain registration.

101 of Gandi's 187 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Gandi

PolicyLayer is an MCP gateway — it sits between your AI agents and Gandi, and nothing reaches the server without passing your rules. These are the rules we recommend:

Block financial tools by default
{
  "gandi_domain_register": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Requires human approval."
      }
    ]
  }
}

Financial tools should be explicitly enabled per use case, not open by default.

Deny destructive operations
{
  "gandi_cert_revoke": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations
{
  "gandi_cert_add_tag": {
    "limits": [
      {
        "counter": "gandi_cert_add_tag_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations
{
  "gandi_billing_get_info": {
    "limits": [
      {
        "counter": "gandi_billing_get_info_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

  1. Create a free account and register Gandi — nothing to install.
  2. Add these rules — paste them, or build them visually. Tune the limits to your setup.
  3. Point your MCP client (Claude, Cursor, anything) at your gateway URL.
ENFORCE POLICY ON GANDI →

Instant setup, no code required.

FULL CATALOGUE

All 187 Gandi tools

FINANCIAL 6 tools
Financial gandi_domain_register gandi_domain_register Financial gandi_domain_renew gandi_domain_renew Financial gandi_domain_transfer_in gandi_domain_transfer_in Financial gandi_email_refund_slot Refund/delete an unused slot (within the refund window). Financial gandi_mailbox_buy_product gandi_mailbox_buy_product Financial gandi_mailbox_renew_mailbox gandi_mailbox_renew_mailbox
DESTRUCTIVE 21 tools
Destructive gandi_cert_revoke Revoke an issued certificate. Destructive gandi_comment_delete Delete the comment on a Gandi object. Destructive gandi_domain_delete Delete a domain (restricted — typically only works on test TLDs). Destructive gandi_domain_delete_dnssec_key Remove a DS record from the registry. Destructive gandi_domain_delete_glue_record Delete a glue record. Destructive gandi_domain_delete_tags Remove all operator-defined tags from a domain. Destructive gandi_domain_delete_web_redirection Delete a web redirection by host. Destructive gandi_email_delete_forward Delete a forwarding address. Destructive gandi_email_delete_mailbox Delete a mailbox (frees the slot — mail is destroyed). Destructive gandi_email_purge_mailbox Purge the contents of a mailbox (destroys all mail, keeps the mailbox). Destructive gandi_linkedzone_delete_zone Delete a linked zone. Destructive gandi_livedns_delete_all_records Delete ALL records in a zone (highly destructive — snapshot first). Destructive gandi_livedns_delete_dnssec_key Delete a LiveDNS DNSSEC key. Destructive gandi_livedns_delete_named_records Delete ALL records under a name (every type). Destructive gandi_livedns_delete_record Delete a specific (name, type) record set. Destructive gandi_livedns_delete_snapshot Delete a zone snapshot. Destructive gandi_mailbox_delete_forward Delete a mailbox forward by source address (current mailbox product). Destructive gandi_mailbox_delete_mailbox Delete a mailbox (current mailbox product, not legacy email). Destructive gandi_simplehosting_delete_instance Delete a Simple Hosting instance. Destructive gandi_simplehosting_delete_vhost Delete a vhost from a Simple Hosting instance. Destructive gandi_simplehosting_purge_vhost_cache Purge the cache of a vhost on a Simple Hosting instance.
EXECUTE 5 tools
Execute gandi_cert_resend_dcv Resend the domain-control-validation request for a pending certificate. Execute gandi_domain_relaunch_reachability Relaunch the registrant reachability (contact-validation) check. Execute gandi_domain_relaunch_transferin Relaunch a stalled transfer-in operation (no new charge). Execute gandi_domain_resend_transferin_foa gandi_domain_resend_transferin_foa Execute gandi_simplehosting_perform_instance_action gandi_simplehosting_perform_instance_action
WRITE 69 tools
Write gandi_cert_add_tag Add a single operator-defined tag to a certificate. Write gandi_cert_delete_tags Remove all operator-defined tags from a certificate. Write gandi_cert_issue gandi_cert_issue Write gandi_cert_replace_tags Replace the full set of tags on a certificate. Write gandi_cert_update Update an issued certificate's metadata. Write gandi_cert_update_dcv_method gandi_cert_update_dcv_method Write gandi_cert_update_tags Add tags to a certificate without removing existing ones. Write gandi_comment_set gandi_comment_set Write gandi_domain_accept_claim Accept the TMCH trademark claim for a candidate domain. Write gandi_domain_activate_livedns_dnssec Activate LiveDNS-managed DNSSEC for a domain. Write gandi_domain_create_dnssec_key gandi_domain_create_dnssec_key Write gandi_domain_create_glue_record gandi_domain_create_glue_record Write gandi_domain_create_tag Add a single operator-defined tag to a domain. Write gandi_domain_create_web_redirection gandi_domain_create_web_redirection Write gandi_domain_disable_livedns_dnssec Disable LiveDNS-managed DNSSEC for a domain. Write gandi_domain_enable_livedns Switch a domain's nameservers to LiveDNS (registry-side enablement). Write gandi_domain_initiate_ownership_change gandi_domain_initiate_ownership_change Write gandi_domain_replace_dnssec_keys gandi_domain_replace_dnssec_keys Write gandi_domain_replace_tags gandi_domain_replace_tags Write gandi_domain_reset_authinfo Regenerate the transfer authorization code. Write gandi_domain_restore gandi_domain_restore Write gandi_domain_set_autorenew gandi_domain_set_autorenew Write gandi_domain_set_nameservers gandi_domain_set_nameservers Write gandi_domain_update_contacts gandi_domain_update_contacts Write gandi_domain_update_glue_record gandi_domain_update_glue_record Write gandi_domain_update_owner_contact gandi_domain_update_owner_contact Write gandi_domain_update_tags Add tags to a domain without removing existing ones. Write gandi_domain_update_transferin_authinfo gandi_domain_update_transferin_authinfo Write gandi_domain_update_web_redirection gandi_domain_update_web_redirection Write gandi_email_create_forward gandi_email_create_forward Write gandi_email_create_mailbox gandi_email_create_mailbox Write gandi_email_create_slot gandi_email_create_slot Write gandi_email_update_forward gandi_email_update_forward Write gandi_email_update_mailbox gandi_email_update_mailbox Write gandi_email_update_offer gandi_email_update_offer Write gandi_linkedzone_attach_domain Attach a domain to a linked zone. Write gandi_linkedzone_create_zone Create a linked zone. Write gandi_linkedzone_link_domains Link one or more domains to a linked zone. Write gandi_linkedzone_unlink_domains Unlink one or more domains from their linked zone. Write gandi_linkedzone_update_zone Update a linked zone. Write gandi_livedns_add_domain Add a domain to LiveDNS (enables zone management). Write gandi_livedns_create_dnssec_key Create a LiveDNS DNSSEC key. Write gandi_livedns_create_named_record gandi_livedns_create_named_record Write gandi_livedns_create_record gandi_livedns_create_record Write gandi_livedns_create_snapshot gandi_livedns_create_snapshot Write gandi_livedns_create_tsig_key Create a new AXFR TSIG key for the account. Write gandi_livedns_create_typed_record gandi_livedns_create_typed_record Write gandi_livedns_replace_named_records gandi_livedns_replace_named_records Write gandi_livedns_replace_record gandi_livedns_replace_record Write gandi_livedns_replace_zone gandi_livedns_replace_zone Write gandi_livedns_restore_dnssec_key Restore (undelete) a previously deleted LiveDNS DNSSEC key. Write gandi_livedns_update_domain Update LiveDNS zone settings. Write gandi_livedns_update_record gandi_livedns_update_record Write gandi_livedns_update_snapshot gandi_livedns_update_snapshot Write gandi_mailbox_create_forward Create a mailbox forward (current mailbox product). Write gandi_mailbox_create_mailbox gandi_mailbox_create_mailbox Write gandi_mailbox_update_forward gandi_mailbox_update_forward Write gandi_mailbox_update_mailbox Update a mailbox (current mailbox product, not legacy email). Write gandi_org_create_customer Create a customer under a reseller organization. Write gandi_org_renew_access_token Renew an organization access token. Write gandi_org_update_customer gandi_org_update_customer Write gandi_org_update_organization Update an organization's profile. Write gandi_simplehosting_create_instance gandi_simplehosting_create_instance Write gandi_simplehosting_create_vhost Create a vhost on a Simple Hosting instance. Write gandi_simplehosting_update_instance gandi_simplehosting_update_instance Write gandi_simplehosting_update_vhost gandi_simplehosting_update_vhost Write gandi_template_apply_template gandi_template_apply_template Write gandi_template_create_template Create a domain-configuration template. Write gandi_template_update_template Update a domain-configuration template.
READ 86 tools
Read gandi_billing_get_info Billing summary for the token owner (prepaid balance, annual spend, tier). Read gandi_billing_get_info_for_org Billing summary for a specific organization. Read gandi_billing_get_price_catalog gandi_billing_get_price_catalog Read gandi_cert_get Retrieve details for a specific certificate. Read gandi_cert_get_cert_dcv_params gandi_cert_get_cert_dcv_params Read gandi_cert_get_crt Fetch the raw issued certificate (PEM document) for a certificate. Read gandi_cert_get_dcv_params gandi_cert_get_dcv_params Read gandi_cert_get_package Get a single certificate package by name. Read gandi_cert_list gandi_cert_list Read gandi_cert_list_packages List available certificate packages (product offerings). Read gandi_cert_list_tags List the operator-defined tags on a certificate. Read gandi_cert_renew gandi_cert_renew Read gandi_comment_get Get the comment attached to a Gandi object. Read gandi_domain_check_availability gandi_domain_check_availability Read gandi_domain_check_transferin_available Check whether a domain is eligible for transfer-in (no charge). Read gandi_domain_get_claims Trademark claims (TMCH) for a candidate registration. Read gandi_domain_get_contacts Current contact block (admin/tech/bill/owner) for a domain. Read gandi_domain_get_create_status Status of a pending domain creation. Read gandi_domain_get_domain Retrieve full details for a domain (contacts, nameservers, status, dates). Read gandi_domain_get_glue_record Get a specific glue record by hostname label. Read gandi_domain_get_livedns LiveDNS enablement state for a domain (registry-side view). Read gandi_domain_get_livedns_dnssec LiveDNS-managed DNSSEC state for a domain. Read gandi_domain_get_nameservers Configured nameservers for a domain. Read gandi_domain_get_ownership_change_status Status of a pending ownership change. Read gandi_domain_get_renew_info Price and eligibility preview for a domain renewal (no charge). Read gandi_domain_get_restore_info Restore eligibility and price preview for a deleted domain (no charge). Read gandi_domain_get_status gandi_domain_get_status Read gandi_domain_get_tld Get details and policy for a single TLD. Read gandi_domain_get_transferin_info Check transfer-in availability and price preview (no charge). Read gandi_domain_get_web_redirection Get a single web redirection by host. Read gandi_domain_list_dnssec_keys List DS records registered at the registry for DNSSEC. Read gandi_domain_list_domains gandi_domain_list_domains Read gandi_domain_list_glue_records List glue records (in-bailiwick host records) for a domain. Read gandi_domain_list_tags List the operator-defined tags on a domain. Read gandi_domain_list_tlds List the TLDs Gandi supports. Read gandi_domain_list_web_redirections List web redirections configured for a domain. Read gandi_domain_resend_foa Resend the Form-of-Authorization email for a pending ownership change. Read gandi_email_get_mailbox Retrieve details for a mailbox. Read gandi_email_get_offer Get the email offer (plan and quotas) for a domain. Read gandi_email_get_slot Retrieve details for a slot. Read gandi_email_list_forwards gandi_email_list_forwards Read gandi_email_list_mailboxes gandi_email_list_mailboxes Read gandi_email_list_slots List mailbox slots (purchased capacity) for a domain. Read gandi_email_renew_all_mailboxes gandi_email_renew_all_mailboxes Read gandi_email_renew_mailbox gandi_email_renew_mailbox Read gandi_linkedzone_get_domain Get linked-zone info for a single domain. Read gandi_linkedzone_get_task Get a single linked-zone task by id. Read gandi_linkedzone_get_zone Get a single linked zone by id. Read gandi_linkedzone_list_domains List domains that can use linked zones. Read gandi_linkedzone_list_tasks List linked-zone background tasks. Read gandi_linkedzone_list_zones List linked zones. Read gandi_livedns_get_dnssec_key Get a single LiveDNS DNSSEC key by id. Read gandi_livedns_get_domain Get LiveDNS zone metadata for a domain. Read gandi_livedns_get_generic_nameservers Recommended generic LiveDNS nameservers for a domain. Read gandi_livedns_get_snapshot Get a single zone snapshot by id. Read gandi_livedns_get_tsig_key Get a single AXFR TSIG key by id. Read gandi_livedns_list_dnssec_keys List DNSSEC keys generated by LiveDNS for a domain. Read gandi_livedns_list_domains List all domains managed by LiveDNS. Read gandi_livedns_list_nameservers Get the LiveDNS nameservers assigned to a domain. Read gandi_livedns_list_records gandi_livedns_list_records Read gandi_livedns_list_rrtypes List DNS record types accepted by LiveDNS (A, AAAA, CNAME, MX, etc.). Read gandi_livedns_list_snapshots List zone snapshots for a domain. Read gandi_livedns_list_tsig_keys List AXFR TSIG keys for the account. Read gandi_mailbox_get_domain Get mailbox-product configuration for a domain (not legacy email). Read gandi_mailbox_get_mailbox Get a single mailbox by address (current mailbox product). Read gandi_mailbox_get_quotas Get mailbox quota usage for the account (current mailbox product). Read gandi_mailbox_get_slot Get a single mailbox slot by id. Read gandi_mailbox_list_domains List domains enabled for the current mailbox product (not legacy email). Read gandi_mailbox_list_forwards gandi_mailbox_list_forwards Read gandi_mailbox_list_mailboxes gandi_mailbox_list_mailboxes Read gandi_mailbox_list_products List mailbox products available for purchase (current mailbox product). Read gandi_mailbox_list_slots List mailbox slots (purchased capacity for the mailbox product). Read gandi_mailbox_validate_domain gandi_mailbox_validate_domain Read gandi_org_get_customer Retrieve a specific customer of a reseller org. Read gandi_org_get_organization Retrieve one organization by UUID. Read gandi_org_get_user_info Profile info for the token owner (name, email, lang, scope). Read gandi_org_list_customers gandi_org_list_customers Read gandi_org_list_organizations gandi_org_list_organizations Read gandi_simplehosting_get_instance Get a single Simple Hosting instance by id. Read gandi_simplehosting_get_instance_usage Get resource-usage metrics for a Simple Hosting instance. Read gandi_simplehosting_get_vhost Get a single vhost on a Simple Hosting instance. Read gandi_simplehosting_list_instances List Simple Hosting instances. Read gandi_simplehosting_list_vhosts List vhosts on a Simple Hosting instance. Read gandi_template_get_dispatch Get the status of a template dispatch (application) operation. Read gandi_template_get_template Get a single domain-configuration template by id. Read gandi_template_list_templates List domain-configuration templates.
EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

Yaver 1060 tools
paymentsadmin
Binance MCP Server 734 tools
paymentsadmin
GoHighLevel MCP Server 566 tools
paymentsadmin
GoCreative Agent API 546 tools
paymentsadmin
Claude Flow 454 tools
paymentsadmin
ServiceTitan MCP Server 454 tools
paymentsadmin
CloudStack MCP Server 442 tools
paymentsadmin
Integrations MCP 420 tools
paymentsadmin
FAQ

Questions about Gandi

Can an AI agent move money through the Gandi MCP server? +

Yes. The Gandi server exposes 6 financial tools including gandi_domain_register, gandi_domain_renew, gandi_domain_transfer_in. Without a policy, an autonomous agent can call these with no spend caps, no rate limits, and no approval flow. PolicyLayer lets you block financial tools by default, require human approval, or set per-tool rate limits — enforced on every call.

Can an AI agent delete data through the Gandi MCP server? +

Yes. The Gandi server exposes 21 destructive tools including gandi_cert_revoke, gandi_comment_delete, gandi_domain_delete. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through Gandi? +

The Gandi server has 69 write tools including gandi_cert_add_tag, gandi_cert_delete_tags, gandi_cert_issue. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach Gandi.

How many tools does the Gandi MCP server expose? +

187 tools across 4 categories: Destructive, Financial, Read, Write. 86 are read-only. 101 can modify, create, or delete data.

How do I enforce a policy on Gandi? +

Register the Gandi MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Gandi tool call.

Deterministic rules across all 187 Gandi tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON GANDI →

Instant setup, no code required.

187 Gandi tools catalogued and risk-classified — across an index of 43,000+ MCP servers.

// GET IN TOUCH

Have a question or want to learn more? Send us a message.

Message sent.

We'll get back to you soon.