VacatoVacato

developers

REST API & MCP

Authenticated API for your Vacato watchlist: list / add / remove domains and run a live RDAP check. Same surface over MCP for Cursor and Claude Desktop. Pro plan or higher — Free gets the product (10 domains) but not API keys.

  • Watchlist: GET/POST /domains, DELETE /domains/{name}
  • Live check: GET /check/{domain} (RDAP + DNS)
  • Auth: x-api-key header · rate limits by plan
  • No public unauthenticated API — no OpenAPI marketplace listing without a Pro key

Base URL

https://wwbodpkkqiagumervyjt.supabase.co/functions/v1/api-v1

Authentication

Send your API key in the x-api-key header on every request. Generate a key in Settings → Developer API after upgrading to Pro.

curl -H "x-api-key: vac_YOUR_KEY_HERE" \
  https://wwbodpkkqiagumervyjt.supabase.co/functions/v1/api-v1/domains

401
Invalid or missing API key

403
Free plan — upgrade to Pro for API access

429
Rate limit exceeded (includes reset_at)

Rate limits

PlanRequests/day
Pro1,000
Business5,000
EnterpriseUnlimited

REST endpoints

GET
/domains

List watchlist domains. Query: limit (max 200), offset, or cursor (last domain_name). Response includes next_cursor and has_more.

POST
/domains

Bulk add domains. Body: `{ "domains": ["a.com", "b.io"] }` (max 500 per request).

DELETE
/domains/{name}

Remove a domain from your watchlist (soft delete).

GET
/check/{domain}

Live RDAP availability check for a single domain.

POST /domains response: { added, skipped_duplicates, rejected_over_limit, remaining_quota }

MCP server

Vacato exposes an MCP (Model Context Protocol) server over Streamable HTTP. Connect from Cursor or Claude Desktop to manage your watchlist in plain language.

Available tools

check_domain
list_watchlist
add_domains
remove_domain

Cursor / Claude Desktop config

{
  "mcpServers": {
    "vacato": {
      "type": "http",
      "url": "https://wwbodpkkqiagumervyjt.supabase.co/functions/v1/api-v1/mcp",
      "headers": {
        "x-api-key": "vac_YOUR_KEY_HERE"
      }
    }
  }
}

Replace vac_YOUR_KEY_HERE with your API key. Endpoint: POST https://wwbodpkkqiagumervyjt.supabase.co/functions/v1/api-v1/mcp

MCP directory submission pack

Copy-paste listing for cursor.directory, Smithery, Glama, or similar registries. Requires Pro API key to test tools during review. Full checklist also in docs/mcp-listing.md.

NameVacato
TitleVacato — domain watchlist MCP
CategoryDeveloper tools / Productivity
Homepagehttps://vacato.io
Documentationhttps://vacato.io/docs/api
PricingPro plan ($7/mo) required for API key

Short description (≤280 chars)

Manage a domain availability watchlist from Cursor or Claude Desktop. Tools: check_domain, list_watchlist, add_domains, remove_domain. Vacato alerts when names become available — it does not register or catch domains. Requires Vacato Pro API key.

Long description

Vacato is a domain monitoring SaaS. The MCP server exposes your watchlist to AI assistants over Streamable HTTP (JSON-RPC 2.0).

Tools: check_domain (live RDAP), list_watchlist, add_domains (bulk up to 500), remove_domain.

Authentication: x-api-key header with a Pro+ API key from Settings → Developer API.

Honest positioning: Vacato is an alert layer. It does not drop-catch, backorder, or register domains at the registry.

Tags

domains
monitoring
rdap
whois
watchlist
developer-tools
cursor
claude

Cursor / Claude Desktop config

{
  "mcpServers": {
    "vacato": {
      "type": "http",
      "url": "https://wwbodpkkqiagumervyjt.supabase.co/functions/v1/api-v1/mcp",
      "headers": {
        "x-api-key": "vac_YOUR_KEY_HERE"
      }
    }
  }
}

Submission checklist

  • Generate API key on Pro (needed to test tools in directory review)
  • Submit to cursor.directory/mcp/new — use config + short description above
  • Submit to Smithery / Glama if accepted (same JSON config)
  • Reply to reviewers: Vacato is watchlist alerts, not a registrar
  • After publish, add directory URL back to this page

Account session endpoints

These are signed-in browser calls (session JWT), not the public x-api-key REST API. Unauthenticated requests return 401. Both are rate-limited.

POST
/functions/v1/export-account

Full-account JSON: profile, watchlist, notification preferences, organization memberships, invitations you sent. Omits API keys, webhook URLs/secrets, Telegram chat IDs, and invite tokens. Cap 3 requests / 10 minutes. Settings → Download account export.

POST
/functions/v1/send-org-invite

Body: { invitationId }. Emails an existing org invite through the account mailer. Cap 5 / 10 minutes. Returns { sent: true } only after Auth accepts the invite send. Existing accounts and send failures stay copy-link (UI claims emailed only when sent: true).

Webhook signatures

Custom alert webhooks (Pro+) POST JSON. When you save a secret, Vacato sends X-Vacato-Signature as sha256=<hex> — HMAC-SHA256 of the raw body. Verify that header. Vacato does not send the raw secret as X-Webhook-Secret.

Ready to integrate?

Start free (10 domains in the app), upgrade to Pro for an API key, or grab the press kit for launch write-ups. No-account RDAP tools stay free at /tools.