WHMCS MCP Server

WHMCS MCP Server

Production-grade AI integration for WHMCS. Connect ChatGPT, Claude, and Cursor directly to your WHMCS installation — manage clients, invoices, tickets, and services through natural language.

You: "Send a payment reminder to all clients with overdue invoices over $50"
AI:  Fetching overdue invoices... Found 12. Sending reminder emails... Done.

Prerequisites — WHMCS API Setup

Before running the installer you need a WHMCS API credential with the right permissions.

1. Create an API Role

In WHMCS Admin: Setup → Staff Management → API Roles → Add Role

Choose a permission preset based on how much you trust the AI:

Minimum permissions (read-only — AI can look but not touch): GetClients GetClientsDetails GetClientsProducts GetClientsDomains GetClientsAddons GetClientGroups GetContacts GetEmails GetInvoice GetInvoices GetOrders GetOrderStatuses GetProducts GetTicket GetTickets GetSupportDepartments GetQuotes GetCredits GetTransactions GetStats GetActivityLog GetCancelledPackages GetEmailTemplates GetCurrencies GetPaymentMethods GetHealthStatus GetProductGroups GetRegistrars GetServers GetAffiliates GetAnnouncements GetSupportStatuses GetTicketCounts GetTicketPredefinedCats GetAdminUsers GetToDoItems GetToDoItemStatuses GetStaffOnline DomainWhois DomainGetNameservers DomainGetLockingStatus GetTLDPricing GetPromotions GetProjects GetProject

Maximum permissions (full access — AI can take any action): Everything above, plus: AddClient UpdateClient AddClientNote AddContact UpdateContact CreateInvoice AddInvoicePayment AddOrder AcceptOrder CancelOrder OpenTicket AddTicketReply UpdateTicket CreateQuote UpdateQuote SendQuote AcceptQuote DeleteQuote AddCredit ApplyCredit AddBillableItem SendEmail UpdateClientProduct ModuleSuspend ModuleUnsuspend ModuleTerminate ModuleCreate UpgradeProduct DomainRegister DomainTransfer DomainRenew DomainUpdateNameservers DomainUpdateLockingStatus DomainToggleIdProtect FraudOrder PendingOrder UpdateInvoice ModuleChangePw LogActivity AddTicketNote AffiliateActivate CreateProject UpdateProject AddProjectTask UpdateProjectTask DeleteProjectTask AddProjectMessage StartTaskTimer EndTaskTimer

Project Management tools: listprojects through endtasktimer additionally require the WHMCS Project Management addon** to be active (Setup → Addon Modules), regardless of API role permissions.

Domain write permissions: registerdomain, transferdomain, and renew_domain require

DomainRegister, DomainTransfer, and DomainRenew respectively. Note the Domain prefix

comes first — RegisterDomain / TransferDomain / RenewDomain are not valid WHMCS permission

keys and are silently ignored if granted. If a domain tool returns HTTP 403, the matching

permission is missing from your role. Upgrading from 2.3.1 or earlier? See the

2.3.2 changelog entry — you need to re-grant these three under their correct

names.

Tip: Start with minimum permissions and add write permissions only as needed. This limits blast radius if an AI client goes rogue or gets a bad prompt.

2. Set an API Access Key (recommended)

An Access Key bypasses IP restrictions entirely — the recommended approach since the MCP server's outbound IP can change (Docker restarts, server moves, etc.).

Add this line to your configuration.php in the WHMCS root:

$api_access_key = 'your-secret-passphrase';

Shortened. The full README is on GitHub.