API and MCP
MCP tool reference
The 196 tools by family, the scope each needs, and the most useful tools in each with what they return. 104 read, 82 write, 10 destructive.
Updated · 5 min read
Tools are grouped by scope. R reads stored data (Pro and up). W changes state, runs a live lookup, or spends (Enterprise, with write). WD is destructive and the assistant is told to confirm first. list_domains is the entry point: its numeric ids are what almost every other tool takes.
Domains, DNS and deliverability (domains)
| Tool | Access | Returns |
|---|---|---|
list_domains |
R | Every domain with health score, last scan, SSL expiry. Start here |
get_domain_history |
R | Results over time for one domain |
get_domain_events, get_domain_hijack_events, get_domain_event, act_on_domain_event |
R / W | Change events with lifecycle; authorize or deny one |
get_uptime_snapshots, get_downtime_events |
R | Probe observations and outage windows |
get_dmarc_summary, get_dmarc_diagnostics, get_dmarc_setup_status, get_dmarc_senders, list_dmarc_reports, get_dmarc_inbox |
R | The report stream: 30-day volume and alignment, ranked deliverability findings, the five-step checklist, sender attribution, the rua= address |
add_domain, add_domains_bulk, update_domain, delete_domain |
W / WD | Inventory writes; bulk takes up to 100 |
get_domain_email_security, discover_domain_subdomains |
W | Live DNS reads of SPF/DKIM/DMARC/MX/MTA-STS/TLS-RPT; passive subdomain discovery |
plan_domain_onboarding, onboard_domain, get_domain_setup_guide, skip_domain_setup_step |
R / W | The interview, the one write that applies it, and the computed checklist |
list_alerts, get_alert_activity, mark_alerts_read |
R / W | The alert inbox and the History ledger |
get_account_settings, update_account_settings |
R / W | Every notification and scan setting |
list_domain_groups, create_domain_group, assign_domains_to_group, delete_domain_group, list_scan_clients, create_scan_client, delete_scan_client |
R / W / WD | Labels and clients |
list_support_conversations, get_support_conversation, reply_to_support_conversation, update_support_conversation |
R / W | Support threads with NHM |
rotate_dmarc_inbox, get_managed_email_auth, enable_managed_email_auth, check_managed_email_auth, set_managed_dmarc_policy, disable_managed_email_auth |
W | The report address and delegated records |
Scans, checkups and dark web (scans)
get_checkup_history (R, the richest single answer to "what is wrong with this site"), run_domain_scan (W, health plus checkup plus single-page SEO), run_domain_checkup (W), get_dark_web_status (R, cache only), run_dark_web_scan (W), get_dark_web_breach (R), add_dark_web_email, remove_dark_web_email, list_dark_web_domain_monitors, add_dark_web_domain_monitor, run_dark_web_domain_scan, remove_dark_web_domain_monitor, get_dark_web_alert_delivery, update_dark_web_alert_delivery, report_scanner_issue, submit_scanner_review.
SEO and Local SEO (seo)
get_seo_results, get_seo_history, run_seo_scan, start_site_audit, get_site_audit_status, get_site_audit_results, get_seo_intent_conflicts (R, free); get_seo_policy, fetch_sitemap, start_deep_seo_job, list_deep_seo_jobs, get_deep_seo_job, cancel_deep_seo_job, get_deep_seo_scans, get_deep_seo_scan_pages, list_manual_url_scans; check_page_seo, assess_website, score_page_accessibility, score_page_performance (W, any public URL); email_seo_report, get_report_branding, save_report_branding. Local: get_local_seo_profile, save_local_seo_profile, get_local_keyword_targets, add_local_keyword_target, delete_local_keyword_target, get_local_rank_history, check_local_ranks, get_geogrid_scans, run_geogrid_scan, get_local_seo_catalog (R, call before running an action), run_local_seo_action, get_local_seo_operation (recover a paid action after a timeout), get_local_seo_credits, get_local_seo_quickstart, run_local_seo_quickstart, plus the discovery, quote and location tools.
Accessibility (accessibility)
quote_accessibility_audit, list_accessibility_audits, get_accessibility_audit (R); start_accessibility_audit (W, spends 5 credits, takes a request_key).
Vulnerability and exposure (vulnscan)
get_vuln_scan_latest, get_vuln_scan_results, get_vuln_scan_history, get_vulnerability_assets, get_open_ports, get_observed_components, list_software_vendors, get_software_vendor, list_software_alerts (with exposure verdicts), get_software_alert_summary, get_vulnerability_feed, get_software_advisory_history, list_vuln_dismissals (R); start_vuln_scan, get_scan_ownership_verification, verify_scan_ownership, verify_scan_ownership_bulk, request_ownership_email_link, get_scan_clearance_status, request_scan_authorization, get_scan_authorization, list_scan_authorizations, dismiss_vuln_finding, restore_vuln_dismissal, update_software_alert, list_tracked_software, search_software_catalog, track_software, update_tracked_software, untrack_software (WD); lookalikes: list_lookalikes, get_lookalike_events, run_lookalike_scan, set_lookalike_verdict, set_lookalike_watch, get_lookalike_evidence, act_on_lookalike_event, get_lookalike_alert_settings, update_lookalike_alert_settings; network: list_ip_targets, add_ip_target, update_ip_target, delete_ip_target, list_ip_target_scans, scan_ip_target.
Compliance (compliance)
get_compliance_records (R), update_compliance_item (W: unanswered, met, partial, not met, n/a; uses the record id), create_incident_record (W: an incident with its playbook steps and WISP text), and the incident list.
Status (status)
list_status_checks, get_status_services (R); create_status_check, run_status_check (W); delete_status_check (WD).
Operator reads (admin)
list_error_events, get_self_check_status, list_scan_failures, list_scanner_reports. Only from an administrator's own session; a customer key cannot carry the scope.
Three habits the server asks of an assistant
- Read stored results before running a scan; scans take minutes and count against the plan.
- Quote before any paid step and wait for a yes.
- Verify a finding it can check itself (resolve the record, fetch the page) before presenting it as fact, and report a disagreement with
report_scanner_issue.
Keep reading
Related articles
- API and MCP: 401, 402, 403, 429, or a missing toolWhat each response means when a key or an MCP client is refused, and the one fix that usually applies: mint a key with the right scope on the right plan.Troubleshooting ·Updated
- Check any domain for freeThe Check tab, the signed-out welcome check, the App Clip, and the public tools on nhmohio.com. What each runs and what needs an account.Getting started ·Updated
- API keysCreate scoped nhm_ keys under Settings: resource scopes, the Enterprise-only write scope, optional expiry, the hourly rate limit, ten active keys, and usage.API and MCP ·Updated
