// SCAN REPORT

Whmcs

62 tools. 33 can modify or destroy data without limits.

12 destructive tools with no built-in limits. Policy required.

Last updated: 12 Jun 2026

33 can modify or destroy data

29 read-only

62 tools total

Community server · catalogue entry verified 12/06/2026

How to control Whmcs ↓

TOOL MAP

What Whmcs exposes to your agents

Read (29) Write / Execute (21) Destructive / Financial (12)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous Whmcs tools

Financial · High whmcs_add_payment This tool records a payment against an invoice, which is a financial operation that commits financial records. Financial · High whmcs_register_domain Registering a domain with a registrar commits a financial obligation — domain registration fees are charged to the account. Financial · High whmcs_renew_domain Renewing a domain with a registrar commits a financial obligation (domain registration fees) and triggers an external billing/payment action. Financial · High whmcs_accept_quote Accepting a quote and converting it to an invoice commits a financial obligation — it formalises a pending quote into a billable invoice, which is a financial action that can trigger payment demands.

33 of Whmcs's 62 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Whmcs

PolicyLayer is an MCP gateway — it sits between your AI agents and Whmcs, and nothing reaches the server without passing your rules. These are the rules we recommend:

Block financial tools by default

{
  "whmcs_accept_quote": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Requires human approval."
      }
    ]
  }
}

Financial tools should be explicitly enabled per use case, not open by default.

Deny destructive operations

{
  "whmcs_cancel_order": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "whmcs_activate_affiliate": {
    "limits": [
      {
        "counter": "whmcs_activate_affiliate_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "whmcs_get_activity_log": {
    "limits": [
      {
        "counter": "whmcs_get_activity_log_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register Whmcs — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON WHMCS →

Free to start. No card required.

FULL CATALOGUE

All 62 Whmcs tools

FINANCIAL 4 tools

Financial whmcs_accept_quote Accept a quote and convert to invoice Financial whmcs_add_payment Record a payment on an invoice Financial whmcs_register_domain Send domain registration command to registrar Financial whmcs_renew_domain Send domain renewal command to registrar

DESTRUCTIVE 8 tools

Destructive whmcs_cancel_order Cancel an order Destructive whmcs_delete_client Delete a client from WHMCS (use with caution) Destructive whmcs_delete_order Delete an order (use with caution) Destructive whmcs_delete_quote Delete a quote Destructive whmcs_delete_ticket Delete a support ticket (use with caution) Destructive whmcs_fraud_order Mark an order as fraudulent Destructive whmcs_module_suspend Suspend a service account Destructive whmcs_module_terminate Terminate a service account

EXECUTE 5 tools

Execute whmcs_transfer_domain Send domain transfer command to registrar Execute whmcs_accept_order Accept and process a pending order Execute whmcs_module_change_password Change password for a service account Execute whmcs_module_unsuspend Unsuspend a service account Execute whmcs_module_create Create/provision a service account

WRITE 16 tools

Write whmcs_activate_affiliate Activate a client as an affiliate Write whmcs_add_client Create a new client in WHMCS Write whmcs_add_ticket_note Add an admin-only internal note to a ticket. Notes are not visible to the client and do not trigger email noti Write whmcs_add_ticket_reply Reply to an existing support ticket Write whmcs_apply_credit Apply credit to an invoice Write whmcs_create_invoice Create a new invoice for a client Write whmcs_create_quote Create a new quote Write whmcs_log_activity Add an entry to the activity log Write whmcs_open_ticket Create a new support ticket Write whmcs_pending_order Set an order status to pending Write whmcs_send_email Send an email to a client Write whmcs_update_client Update an existing client in WHMCS Write whmcs_update_domain_lock_status Lock or unlock a domain Write whmcs_update_domain_nameservers Update nameservers for a domain Write whmcs_update_invoice Update an existing invoice Write whmcs_update_ticket Update ticket properties

READ 29 tools

Read whmcs_get_activity_log Get system activity log Read whmcs_get_admin_users Get list of admin users Read whmcs_get_affiliates Get list of affiliates Read whmcs_get_client_details Get detailed information about a specific client Read whmcs_get_client_domains Get domains owned by a client Read whmcs_get_client_products Get products/services owned by a client Read whmcs_get_clients Get a list of clients from WHMCS with optional filtering and pagination Read whmcs_get_currencies Get configured currencies Read whmcs_get_domain_lock_status Get lock/unlock status for a domain Read whmcs_get_domain_nameservers Get nameservers for a domain Read whmcs_get_domain_whois Get WHOIS information for a domain Read whmcs_get_email_templates Get list of email templates Read whmcs_get_invoice Get detailed information about a specific invoice Read whmcs_get_invoices Get invoices with optional filtering Read whmcs_get_orders Get orders with optional filtering Read whmcs_get_payment_methods Get available payment methods Read whmcs_get_product_groups Get all product groups from WHMCS Read whmcs_get_products Get available products/services from WHMCS Read whmcs_get_promotions Get list of promotions/coupons Read whmcs_get_quotes Get list of quotes Read whmcs_get_servers Get list of configured servers Read whmcs_get_stats Get WHMCS system statistics including income and order counts Read whmcs_get_support_departments Get list of support departments Read whmcs_get_support_statuses Get ticket statuses with counts Read whmcs_get_ticket Get detailed information about a specific ticket including replies Read whmcs_get_tickets Get support tickets with optional filtering Read whmcs_get_tld_pricing Get domain TLD pricing information Read whmcs_get_todo_items Get admin to-do items Read whmcs_get_transactions Get payment transactions

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about Whmcs

Can an AI agent move money through the Whmcs MCP server? +

Yes. The Whmcs server exposes 4 financial tools including whmcs_accept_quote, whmcs_add_payment, whmcs_register_domain. Without a policy, an autonomous agent can call these with no spend caps, no rate limits, and no approval flow. PolicyLayer lets you block financial tools by default, require human approval, or set per-tool rate limits — enforced on every call.

Can an AI agent delete data through the Whmcs MCP server? +

Yes. The Whmcs server exposes 8 destructive tools including whmcs_cancel_order, whmcs_delete_client, whmcs_delete_order. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through Whmcs? +

The Whmcs server has 16 write tools including whmcs_activate_affiliate, whmcs_add_client, whmcs_add_ticket_note. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach Whmcs.

How many tools does the Whmcs MCP server expose? +

62 tools across 4 categories: Destructive, Financial, Read, Write. 29 are read-only. 33 can modify, create, or delete data.

How do I enforce a policy on Whmcs? +

Register the Whmcs MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Whmcs tool call.

Deterministic rules across all 62 Whmcs tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON WHMCS →

Free to start. No card required.

62 Whmcs tools catalogued and risk-classified — across an index of 43,000+ MCP servers.