WHMCS MCP Server: Connect Claude or ChatGPT to WHMCS Safely

A WHMCS MCP server lets Claude, ChatGPT or Cursor read and act on WHMCS through the Model Context Protocol. Ready-made Marketplace modules, free open-source packages and a hosted service already exist. Connect one safely by starting read-only, giving it its own WHMCS API role and allowed IP address, and making a person approve anything that changes money, services or domains.

A WHMCS MCP server is a program that turns WHMCS actions into tools an AI client can call through the Model Context Protocol (MCP). It sits between the AI and WHMCS, holds the credentials and decides which actions exist at all. The model never logs in to WHMCS.

I have built 200+ custom WHMCS modules and build with Claude Code, but I have not published a WHMCS MCP server of my own. Product facts come from each product's own page, read on 21 October 2026, untested by me. Client-facing chat is covered in my WHMCS AI guide and on my WHMCS AI chatbot page.

What is MCP, and where does a WHMCS MCP server sit?

The official introduction calls MCP "an open-source standard for connecting AI applications to external systems." The specification, version 2026-07-28 and marked latest, uses JSON-RPC 2.0 messages between hosts (AI applications), clients (connectors inside them) and servers, which offer resources, prompts and tools: "Functions for the AI model to execute".

For WHMCS the chain is AI client, MCP server, then WHMCS, through the External API or, for an addon module, from inside WHMCS. The spec admits "MCP itself cannot enforce these security principles at the protocol level," and its tools page says servers MUST "Implement proper access controls" and "Rate limit tool invocations". So the limits live in the server and in WHMCS.

Which AI clients can connect to a WHMCS MCP server?

Claude, ChatGPT and Cursor all accept MCP servers but reach them differently, which decides where your server runs. Per their docs on 21 October 2026:

A stdio server stays on one admin's computer; a remote server for Claude or ChatGPT must accept connections from their clouds, or from OpenAI's tunnel, which is more to defend. MagizAI, the AI chat product I founded, has a WHMCS addon module and connects to MCP servers too; as its founder and CEO, I am not neutral here.

Which WHMCS API should an MCP server use?

Use the External API with its own credential for any server outside WHMCS, so WHMCS enforces the limits. The WHMCS API documentation has two forms: the External API, an HTTPS POST to includes/api.php with an identifier and secret, and the Internal API, localAPI(), for calls "from within the WHMCS system". It takes no credential, so an addon module is limited by its own checks, not an API role.

1. API roles. At Configuration > System Settings > Manage API Credentials. The API Credentials page says a request passes "if any role provides permission to the requested action", so roles add up.
2. IP restriction. The access control page says "Access to the API by default is restricted by IP." Add addresses under API IP Access Restriction on the Security tab of General Settings. Skip the optional $api_access_key, which lets "IP restrictions to be bypassed".
3. A dedicated admin. Disabling or deleting an admin invalidates its credentials, so one admin per integration is also an off switch.
4. Logging. Log API Authentication, on the Security tab, records successful API logins in the Admin Log; it is off by default.

Never give an MCP server an admin password. The authentication page says the pre-7.2 login method still works "for backwards compatibility". Setup steps are in my WHMCS API guide.

What WHMCS MCP server options exist today?

I found three Marketplace modules, several open-source servers and a hosted service, none from WHMCS itself. Each is described from its own page on 21 October 2026; tool counts are theirs.

The Marketplace modules run inside WHMCS with their own keys, so their settings (plus, for MCP Hub, the bound admin's role) are the limit. The open-source packages call the External API, so a narrow API role holds whatever the package does.

How do you connect Claude to WHMCS safely?

Assume the model can be talked into anything; make WHMCS and the server refuse. OWASP's LLM06:2025 Excessive Agency says: "Implement authorization in downstream systems rather than relying on an LLM to decide if an action is allowed or not." My rules:

• Read-only first. Only "Get" actions, for weeks, before any write.
• Least privilege. One role, credential and admin per agent; OWASP warns of "an extension intended to read data" whose identity can also delete.
• No passwords, no access key. API credentials only, from an allowed IP.
• Approval for money and services. The spec says "there SHOULD always be a human in the loop with the ability to deny tool invocations." Enforce it in the server; client dialogs can be set to auto-run.
• An audit log you own, refusals included.
• Rate limits and less data. Cap calls per minute and strip card details, notes and passwords from results (OWASP LLM02 Sensitive Information Disclosure).

Ticket text is the main way in. OWASP's LLM01:2025 Prompt Injection covers inputs "from external sources, such as websites or files", and anyone can open a ticket asking the AI to credit an account. The toc-whmcs-mcp README designs for that: "a customer can put text in a support ticket and that text reaches the agent choosing the next tool call." So the session that reads tickets gets no billing or service tools, and you "Separate and clearly denote untrusted content", as OWASP advises.

Which WHMCS API actions should an AI agent get first?

Reads first; each action that changes money, services or domains is its own decision for a WHMCS AI agent. Names are from the API index.

The API index lists no action named Refund; if a module offers refunds, ask its vendor how before enabling that tool.

Do you need a WHMCS MCP server at all?

Often not. A task that runs the same way every time is cheaper as a script or hook; MCP pays off when staff ask varied questions (see my chatbot vs agent guide).

1. Is the goal answering clients in a chat widget? Yes: use a chat module, not MCP.
2. Do staff need ad-hoc questions across WHMCS data? No: script it with the API or a hook.
3. Is read-only access enough for the job? Yes: a read-only MCP server on its own API role.
4. Will a person approve every write before it runs? Yes: MCP with an approval step. No: keep write actions manual.

Should you buy a module, use an open-source package or build your own?

Buy when a module's tool list fits, use open source to read every line, and build when your products, approval rules or data limits are unusual.

How would you build a custom read-only WHMCS MCP server?

Small: a few read tools, one API role, a log.

1. Map each question staff really ask to one API action.
2. Set up the admin, Get-only role, credential, IP and logging described above.
3. Write one tool per question with a tight input schema, returning only needed fields.
4. Mark read tools with readOnlyHint, but rely on the role: the SDK docs say annotations "never change how the SDK runs the tool".
5. Use stdio for one admin's machine, or Streamable HTTP with OAuth or a token for remote clients.
6. Add writes later, on a separate credential, as pending requests a person approves.

With version 2 of the official TypeScript SDK (v2.3.1, 5 October 2026), one read tool looks like this; whmcs() is your own POST to includes/api.php:

import { McpServer } from '@modelcontextprotocol/server';
import { StdioServerTransport } from '@modelcontextprotocol/server/stdio';
import * as z from 'zod/v4';

const server = new McpServer({ name: 'whmcs-readonly', version: '0.1.0' });

server.registerTool(
    'get_invoice',
    {
        description: 'Read one WHMCS invoice by its ID',
        inputSchema: z.object({ invoiceid: z.number().int().positive() }),
        annotations: { readOnlyHint: true }
    },
    async ({ invoiceid }) => ({
        content: [{ type: 'text', text: JSON.stringify(await whmcs('GetInvoice', { invoiceid })) }]
    })
);

async function main() {
    await server.connect(new StdioServerTransport());
}

main();

How do you test a WHMCS MCP server before production?

On a staging copy with test clients:

• Credential and IP. WhmcsDetails works from the server's address and fails from any other.
• Tool list. The MCP Inspector (npx @modelcontextprotocol/inspector@latest), recommended in OpenAI's guide, shows only intended tools.
• Role. AddCredit sent with the same credential outside the server is refused by WHMCS.
• Injection. A test ticket asking for a credit, summarized by the AI, changes nothing.
• Approval. Every write waits for a person; a denied request writes nothing.
• Logs and limits. Calls and refusals are logged; bursts hit the rate limit.
• Off switch. Deleting the credential stops the server at once.
• Repeat after every WHMCS, server or module update.

What else do people ask about WHMCS MCP servers?

Is MCP safe to use?

It depends on the server and its permissions. The specification says tools "represent arbitrary code execution and must be treated with appropriate caution." Use servers you can inspect, start read-only and enforce limits in WHMCS.

What is the difference between an MCP server and an API?

The WHMCS API is the set of actions WHMCS accepts. An MCP server wraps chosen actions as described tools an AI client can discover and call. The API does the work; the MCP server decides what an AI may reach.

Can ChatGPT use MCP servers?

Yes. OpenAI's developer docs describe adding a custom MCP server in ChatGPT, subject to workspace policies, over public HTTPS with streamable HTTP or through OpenAI's Secure MCP Tunnel.

Does Claude Desktop support remote MCP servers?

Yes, as custom connectors on Free, Pro, Max, Team and Enterprise plans; Free users get one. Connections come from Anthropic's cloud, so the server must be reachable from the internet.

If no package fits your products, roles or approval rules, that is custom WHMCS module development: a free scoping call of about 30 minutes, then a written quote within one business day.

Last reviewed 21 October 2026. Disclosure: I sell WHMCS development, so I am not neutral. I am CTO at ElySpace and founder of WHMCSPilot and MagizAI. I am not affiliated with WHMCS, Anthropic or OpenAI, or any vendor named here, and no link is an affiliate link.