PBuilt with MG Page BuilderThis entire website — header, pages and footer — is designed with our own WHMCS page builder.See how it works

MODULESGUARD

WHMCS MCP

Connect Claude, Codex or Cursor to your WHMCS — with guardrails.

A Model Context Protocol server that runs inside WHMCS. 170 tools, per-token permissions, risk-based approvals and a full audit log, so AI agents can work on clients, billing, services and tickets without getting the keys to everything.

Beta v0.9.14 Streamable HTTP OAuth
yourdomain.com/admin/addonmodules.php?module=mcp
WHMCS MCP0.9.14-beta Endpoint enabled / full
Module administration
Overview
DashboardTokensPermissionsSecurityAudit logApprovalsDiagnosticsOAuth diagnosticsToolsAbout
Registered tools170Access depends on token permissions.
Active sessions3Unexpired sessions
Global modefullModule execution limit
HTTPSOKDetected for this request
Environment
EndpointEnabled MCP URLhttps://yourdomain.com/mcp TransportStreamable HTTP Available tools170
170 tools88 read · 82 write
28 permissionsGrant exactly what each agent needs
Risk-based approvalsHigh-impact actions wait for a human
Full audit logEvery call, token and result recorded
Ask in plain language

Your AI agent, working directly in WHMCS

Point any MCP client at your WHMCS endpoint. The agent picks the right tools, reads live data and prepares changes — while the module decides what it is allowed to do.

  • ✓ Client 360° view in one call: services, invoices, tickets, domains
  • ✓ Billing, orders, provisioning, domains and support
  • ✓ Works with Claude, Codex, Cursor and other MCP clients
  • ✓ Dry-run previews before anything is changed
AI assistant · connected to WHMCS MCP
Which clients have unpaid invoices over $100 this month?
Search invoicesBilling · read✓ 38 ms
Client overviewClients · read✓ 3 clients

Three clients have unpaid invoices above $100 in September:

ClientInvoiceDueAmount Northwind Hosting#1052Sep 18$240.00 Blue Fjord SARL#1047Sep 21$129.00 Kite Labs Ltd#1039Sep 24$315.50
Suspend Kite Labs’ VPS until they pay.
Suspend serviceServices · write⏳ approval required

This is a high-risk action, so I created draft #218 instead of running it. An administrator can approve it from the Approvals tab.

yourdomain.com/admin/addonmodules.php?module=mcp&tab=tokens
Create token
Name
Claude Desktop — support team
Mode
Read only ▾
Permissions
AdminClients readClients writeBilling readBilling writeTickets read Tickets writeOrders readOrders writeDomains readDomains writeServices read Services writeProducts readProducts writeServers readServers writeConfig read Config writeGateways readGateways writeRegistrars readRegistrars writeSystem read System writeModules readModules writeModules execute
Allowed IP/CIDR
203.0.113.0/24
Expiration (UTC)
31/12/2026
Create token
Cursor — billing bot — full — Active
Billing (read, write), Clients (read) · IP: 198.51.100.7 · Expires: 2026-11-30
Revoke
Tokens & permissions

One token per agent, with exactly the access it needs

Each token has its own mode, permissions, IP allowlist and expiry. The global mode can never expand a token beyond what you granted.

  • ✓ Read-only or full mode per token
  • ✓ 28 granular permissions, area by area
  • ✓ IP/CIDR allowlist and UTC expiration
  • ✓ OAuth sign-in for supported clients, revocable at any time
Human in the loop

Risky changes become drafts you approve

Choose how mutations are handled. Every change can go through a draft that is validated, approved and only then executed.

  • ✓ Always approve — every change waits for an administrator
  • ✓ Risk-based — only high-impact changes need approval
  • ✓ Direct — for fully trusted tokens
  • ✓ Previews and a simulation mode that never writes
yourdomain.com/admin/addonmodules.php?module=mcp&tab=approvals
Approvals
AlwaysRisk-basedDirect
DraftActionTargetRiskStatus #218Suspend serviceService #4412highApproveCancel #217Update pricingProduct #12highApproveCancel #216Apply creditClient #88 · $20mediumExecuted #215Reply to ticketTicket #5531lowExecuted #214Close clientClient #61criticalCancelled
yourdomain.com/admin/addonmodules.php?module=mcp&tab=audit
Audit log
Time (UTC)TokenActionIPResult 22:41:07Claude DesktopClient overview203.0.113.24ok 22:40:52Claude DesktopSearch invoices203.0.113.24ok 22:38:15Cursor botSuspend service198.51.100.7draft 22:31:40Cursor botUpdate client198.51.100.7denied: permission 22:29:03unknownList clients192.0.2.99denied: IP 22:12:44Claude DesktopReply to ticket203.0.113.24ok
Requests / minute / token60
Trusted proxiesnone
HTTPS originsexact match
Security & audit

Know exactly what every agent did

Every action is logged with its token, IP and outcome — including the ones that were refused.

  • ✓ Per-token rate limiting (requests per minute)
  • ✓ Exact HTTPS browser origins and trusted proxy list
  • ✓ Diagnostics and OAuth diagnostics tabs
  • ✓ Clean uninstall: data kept by default, optional guarded wipe of the module’s own tables only
Coverage

170 tools across 13 areas of WHMCS

From read-only reporting to day-to-day operations. Each area has its own read and write permissions, so every agent only reaches what you allow.

👥ClientsSearch, view and manage client accounts.11
💳Billing & invoicesInvoices, payments, credits and refunds.12
🛒OrdersReview, accept or cancel orders.7
⚙ServicesProvision, suspend and upgrade services.10
🌐DomainsRegistrations, renewals, transfers and DNS.15
💬Support ticketsRead, open and reply to tickets.14
📦Products & pricingProducts, add-ons, options and pricing.31
🖥ServersServers and server groups.10
💰Payment gatewaysGateway activation and settings.5
🔖RegistrarsRegistrar activation and settings.5
🔧ConfigurationGeneral settings, currencies, taxes and emails.17
🧩Module bridgeWork safely with your other WHMCS addons.22
🛡Approvals & systemApproval workflow, health checks and roles.11

Simple annual license

WHMCS MCP
$XX.XX / year
Annual license · Renews every year
All 170 tools included
Buy Now

Requirements

  • WHMCS 8.x or later
  • PHP 8.1 or later
  • HTTPS on your WHMCS domain
  • An MCP client supporting Streamable HTTP

Works with

ClaudeCodexCursorAny MCP client

FAQ

Can the AI change my data without my approval?
Only if you allow it. In Always approve mode every change waits for an administrator. In Risk-based mode, only high-impact changes need approval.
How do I limit what an agent can see?
Create one token per agent with read-only or full mode, pick its permissions, restrict it to an IP range and set an expiry. The global mode can never grant more than the token allows.
Is every action logged?
Yes. The audit log records each action with the token, IP address and result, including refused calls.
Can it work with my other WHMCS addons?
Yes. The module bridge lets agents work with your other installed addons, under dedicated permissions.
What happens if I deactivate the module?
The endpoint closes and all module data is kept. An optional, guarded option permanently deletes the module’s own tables; WHMCS and other addon tables are never touched.
How much does the license cost?
The license is $XX.XX per year and renews annually.

Give your AI agents WHMCS access — on your terms.

170 tools, scoped tokens, approvals and a full audit trail.

Buy Now

Powered by WHMCompleteSolution