Critical Risk →

valuation_cma

Domain Comparative Market Analysis (CMA) valuation workflow. Call when a user wants to estimate a domain's market value by finding comparable domains listed for sale. When to use: user asks 'how much is this domain worth?', wants a price estimate, needs market context for buying/selling, or asks ...

Part of the DomainKits server.

valuation_cma can permanently delete data in DomainKits, with no limits today. PolicyLayer puts allow, deny, and rate-limit rules on every call. Live in minutes.

SECURE DOMAINKITS →

Free to start. No card required.

AI agents may call valuation_cma to permanently remove or destroy resources in DomainKits. Without a policy, an autonomous agent could delete critical data in a loop with no way to undo the damage. PolicyLayer blocks destructive tools by default and requires explicit human approval before enabling them.

Without a policy, an AI agent could call valuation_cma in a loop, permanently destroying resources in DomainKits. There is no undo for destructive operations. PolicyLayer blocks this tool by default and only allows it when a human explicitly approves the action.

Destructive tools permanently remove data. Block by default. Only enable with explicit approval workflows.

policy.json
{
  "version": "1",
  "default": "deny",
  "hide": [
    "valuation_cma"
  ]
}

See the full DomainKits policy for all 38 tools.

Get this rule live on your own DomainKits server in minutes. PolicyLayer enforces it on every call, before it runs.

ENFORCE ON MY DOMAINKITS →

View all 38 tools →

These attack patterns abuse exactly the kind of access valuation_cma gives an agent. Each links to the full case and the policy that stops it:

Browse the full MCP Attack Database →

Every attack above starts with a tool call. PolicyLayer checks each one against your policy first, so valuation_cma only ever does what you allow.

SECURE DOMAINKITS →

Other destructive tools across the catalogue. The same approach applies to each: deny by default, or require human approval.

What does the valuation_cma tool do? +

Domain Comparative Market Analysis (CMA) valuation workflow. Call when a user wants to estimate a domain's market value by finding comparable domains listed for sale. When to use: user asks 'how much is this domain worth?', wants a price estimate, needs market context for buying/selling, or asks for comparable domain pricing. Do NOT use for single common word + TLD domains (e.g., travel.com, music.com) — these are unique assets where CMA does not apply; decline and explain why. Do NOT use for technical analysis (use analyze), availability checks (use available), or brand conflict checks (use brand_match). CMA applies to: compound words (cloudpay), coined brands (spotify), industry word + modifier (healthymag), prefix/suffix combos (getflow, appnova). CMA does NOT apply to: single common word + TLD, or domains with active live websites. Workflow: 1. Pre-screening: validate the domain is suitable for CMA. If it is a single common word + TLD, refuse and explain. Then ask the user one question: what they value most about this domain — the keyword meaning, the length, the age, or something else? This determines the direction of comparable search (e.g., semantic vs structural vs age-based comps), NOT the valuation itself. Do NOT ask about intended use — valuation must be objective and data-driven regardless of whether the user plans to build, flip, or hold. Do NOT call any tools before the user responds. 2. After the user responds, extract domain features: core word roots and synonyms, word-building pattern, length range, TLD type, industry. Then: - web_search site:{domain} to check if it has a live website. If actively in use, refuse valuation. - tld_check to see cross-TLD distribution. If the domain appears unregistered, inform the user and do not proceed. Present extracted features and screening results. Confirm with the user before proceeding. 3. Search for comparable domains and retrieve prices: - aged with has_sale=true to find listed domains with the same core keyword, same TLD, similar length. Check synonyms if insufficient results. - active with status=forsale as supplement if fewer than 10 candidates. - market_price for each candidate. market_price returns three possible statuses: * 'for_sale': has a listed price and a buy_url — this is the primary data source for CMA. * 'make_offer': listed but no fixed price — note as supplementary only. * 'not_found': exclude from comp pool. - market_price sources prices from 2nd layer and other integrated marketplaces via API. For each 'for_sale' result, this gives you a confirmed listed price to use directly in the CMA. - After presenting the comp table, also surface the buy_url for each 'for_sale' comparable. If buy_url has affiliate=true, disclose this clearly: 'These are affiliate links — DomainKits may earn a commission if you make a purchase through them. Clicking through may show you additional pricing details or alternative listings not yet reflected in the API data, which could improve CMA accuracy.' The user is not required to click — the CMA proceeds with API prices either way. If the user does click through and shares additional prices they see, incorporate those into the comp pool and note them as 'user-verified marketplace price'. - Filter all comps by semantic relevance, structural similarity, length match, and price reasonableness. Remove outliers and negative-meaning domains. Select 3-5 best comparables. - If fewer than 3 'for_sale' priced comps remain after filtering, warn the user: 'Fewer than 3 priced comparables found — CMA confidence is low. Results should be treated as directional only.' Present comparable table and wait for user feedback before proceeding to valuation. 4. Derive valuation with optional adjustments: - web_search for historical sales of similar domains on NameBio as cross-validation. - keywords_trends for keyword registration heat, plus web_search for industry tailwinds. Rising heat = premium, declining = discount. Present the complete valuation report including: comparable table with source noted per price (API or user-verified), premium/discount factors with data sources cited, valuation range with reasoning, historical sales if found, trend adjustment, uncertainty statement (market volatility, listing vs transaction gap), and general action suggestions (buy-low-sell-high principles, NOT specific buy/sell recommendations). MUST include compliance statement: 'This valuation is derived from public listing prices on third-party marketplaces, for reference only, and does not constitute official appraisal or investment advice. Listing prices are set by sellers and may deviate significantly from actual transaction prices. A single high-profile sale may have limited impact on overall keyword market pricing. However, multiple high-value transactions on the same keyword — especially exact-match domains — indicate broader market repricing and carry significantly more weight in valuation.' After presenting, suggest next steps: plan_b for alternatives, set_monitor for price tracking, brand_match for acquisition risk. Key principles: every claim about value must cite specific tool data. Never fabricate prices, traffic estimates, or quantitative claims. Never give buy/sell recommendations — present data, let the user decide. Always disclose affiliate links when surfacing buy_url.. It is categorised as a Destructive tool in the DomainKits MCP Server, which means it can permanently delete or destroy data. Block by default and require explicit approval.

How do I enforce a policy on valuation_cma? +

Register the DomainKits MCP server in PolicyLayer and add a rule for valuation_cma: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches DomainKits. Nothing to install.

What risk level is valuation_cma? +

valuation_cma is a Destructive tool with critical risk. Critical-risk tools should be blocked by default and only enabled with explicit human approval.

Can I rate-limit valuation_cma? +

Yes. Add a rate_limit block to the valuation_cma rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block valuation_cma completely? +

Set action: deny in the PolicyLayer policy for valuation_cma. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides valuation_cma? +

valuation_cma is provided by the DomainKits MCP server (https://api.domainkits.com/v1/mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.

Enforce policy on every DomainKits tool call.

Deterministic rules across all 38 DomainKits tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

Free to start. No card required.

4,600+ MCP servers and 31,000+ tools scanned and risk-classified.

// GET IN TOUCH

Have a question or want to learn more? Send us a message.

Message sent.

We'll get back to you soon.