Pipeworx domains

Search registered domain names by keyword and TLD — find what's taken via Domainsdb.info

Security Scan

The skill mostly does what it says (search domains) but the documentation claims 'via Domainsdb.info' while its runtime examples call an external Pipeworx gateway and even recommend running npx mcp-remote@latest — this mismatch and the suggestion to fetch/run remote npm code create supply‑chain and privacy concerns.

Purpose & Capability

The name/description claim searching domains 'via Domainsdb.info', but the SKILL.md shows all runtime calls going to https://gateway.pipeworx.io/domains/mcp. That is an inconsistency: either the skill proxies Domainsdb.info or it uses Pipeworx; the manifest should be explicit. Requiring only curl is proportionate for a simple search helper.

Instruction Scope

Instructions are narrow and only demonstrate POSTing JSON-RPC queries (query, zone, limit) to the Pipeworx gateway; they do not ask to read local files or environment variables. However, the SKILL.md suggests using npx mcp-remote to connect to the gateway — which implies executing remote code and sending user queries off‑host (possible logging/exfiltration of brand/domain research).

Install Mechanism

No formal install spec in the registry (instruction-only), but the README recommends running 'npx -y mcp-remote@latest'. That pulls and executes code from npm dynamically (latest tag) and creates a supply‑chain risk. The curl-only example is low-risk, but the npx recommendation raises installation/execution concerns.

Credentials

The skill declares no required environment variables, credentials, or config paths — that is appropriate for a read-only domain search. There are no hidden env requirements in the SKILL.md.

Persistence & Privilege

The skill does not request always:true or other elevated persistence. The MCP config snippet suggests adding an mcpServers entry to local config, but that's optional and not enforced by the registry metadata.

What to consider before installing

This skill will send your domain queries to https://gateway.pipeworx.io; if you expect it to query Domainsdb.info directly, that claim is inaccurate. Avoid running 'npx mcp-remote@latest' from an untrusted source — fetching the latest npm package executes remote code. If you care about confidentiality of brand/domain ideas, either (a) use the curl JSON-RPC example and review the gateway URL before sending sensitive queries, (b) contact the skill author for clarification and a pinned package/hash for mcp-remote, or (c) prefer a direct, documented API (e.g., Domainsdb.info) whose privacy policy you trust. If you choose to install/run the npx approach, inspect the package source or pin a specific vetted version to reduce supply‑chain risk.

Domain Search

Search for registered domain names matching a keyword. Filter by TLD zone (.com, .net, .io, etc.) to see what's already taken. Useful for brand research, competitive analysis, and domain name brainstorming.

Tools

• search_domains — Search registered domains by keyword, optionally filtered by TLD. Returns domain names, creation dates, and update timestamps.

When to use

• Checking if variations of a brand name are registered
• Competitive research — see who owns domains around a keyword
• Domain squatting analysis for a particular term
• Brainstorming domain names by seeing what patterns are taken

Example: search for "weather" domains in .io

curl -s -X POST https://gateway.pipeworx.io/domains/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"search_domains","arguments":{"query":"weather","zone":"io","limit":5}}}'

MCP config

{
  "mcpServers": {
    "pipeworx-domains": {
      "command": "npx",
      "args": ["-y", "mcp-remote@latest", "https://gateway.pipeworx.io/domains/mcp"]
    }
  }
}