Search domains entering the deletion cycle — expired, in redemption, or pending delete. Unlike 'deleted' domains (which are free to register), these require backorder or have time-sensitive acquisition windows. Lifecycle stages: - expired: Domain has lapsed but has not entered redemption. Typical...
Risk signalsHigh parameter count (14 properties)
Part of the DomainKits server.
Free to start. No card required.
AI agents may call expired to permanently remove or destroy resources in DomainKits. Without a policy, an autonomous agent could delete critical data in a loop with no way to undo the damage. PolicyLayer blocks destructive tools by default and requires explicit human approval before enabling them.
Without a policy, an AI agent could call expired in a loop, permanently destroying resources in DomainKits. There is no undo for destructive operations. PolicyLayer blocks this tool by default and only allows it when a human explicitly approves the action.
Destructive tools permanently remove data. Block by default. Only enable with explicit approval workflows.
{
"version": "1",
"default": "deny",
"hide": [
"expired"
]
}See the full DomainKits policy for all 38 tools.
These attack patterns abuse exactly the kind of access expired gives an agent. Each links to the full case and the policy that stops it:
Other destructive tools across the catalogue. The same approach applies to each: deny by default, or require human approval.
Search domains entering the deletion cycle — expired, in redemption, or pending delete. Unlike 'deleted' domains (which are free to register), these require backorder or have time-sensitive acquisition windows. Lifecycle stages: - expired: Domain has lapsed but has not entered redemption. Typically enters expired auction at the registrar — acquisition requires bidding, not standard registration. - redemption: Owner can still reclaim by paying a redemption fee (~$80+). For premium names in this stage, consider using set_monitor to track status changes, or whois to find the registrar and suggest the user contact the owner directly with an offer. - pending_delete: Final stage, drops in 1-5 days. Highest urgency. Good names at this stage rarely survive manual registration — backorder via the register_url (Gname) is recommended. Best practices: - Always use no_hyphen=true and no_number=true unless the user specifically wants them. - keyword defaults to 'contain' matching, which searches all domains containing the keyword anywhere in the name. Use position=start, position=end, or position=middle to control where the keyword appears. - sort=age_desc prioritizes domains with the longest history, but age alone does not guarantee value — a domain with long history could have been used for spam. For high-value candidates, verify clean history with safety checks. - status=pending_delete is the most actionable filter — these domains drop soonest. - auction_date='today' or 'tomorrow' narrows to imminent drops. - register_url links to Gname (affiliate). Disclose when presenting to users.. It is categorised as a Destructive tool in the DomainKits MCP Server, which means it can permanently delete or destroy data. Block by default and require explicit approval.
Register the DomainKits MCP server in PolicyLayer and add a rule for expired: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches DomainKits. Nothing to install.
expired is a Destructive tool with critical risk. Critical-risk tools should be blocked by default and only enabled with explicit human approval.
Yes. Add a rate_limit block to the expired rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for expired. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
expired is provided by the DomainKits MCP server (https://api.domainkits.com/v1/mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.
Deterministic rules across all 38 DomainKits tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.
Free to start. No card required.
4,600+ MCP servers and 31,000+ tools scanned and risk-classified.