[{"slug":"ZV-2026-0196","server_name":"mcp.atom.com","severity":"breaking","title":"mcp.atom.com: Tool update_registrant_contact was renamed to create_registrant_contact.","summary":"[breaking] Tool update_registrant_contact was renamed to create_registrant_contact. [risky] Description of buy_ai_tokens changed (27% word delta). [risky] Description of check_domain_availability changed (46% word delta). [risky] Description of get_ai_tokens_pay_link changed (31% word delta). [risky] Description of get_checkout_link changed (30% word delta). [risky] Description of get_domain_purchase_pay_link changed (29% word delta). [risky] Description of get_domain_register_pay_link changed (26% word delta). [safe] Description of register_domain changed (25% word delta). [risky] Description of register_domain_spt changed (25% word delta). [risky] Description of update_registrant_contact changed (41% word delta).","changes":[{"kind":"tool_renamed","tool":"update_registrant_contact","after":"create_registrant_contact","before":"update_registrant_contact","detail":"Tool `update_registrant_contact` was renamed to `create_registrant_contact`.","severity":"breaking"},{"kind":"description_changed","tool":"buy_ai_tokens","after":"Purchase AI Tokens ($0.10 per token) by charging a Stripe Shared Payment Token (SPT) — for users with no Atom balance. This SPENDS REAL MONEY and requires the 'domains:register' scope.\n\nMANDATORY three-step flow — never skip a step:\n1) Call with confirm=false to get a QUOTE: price is entirely server-authoritative ($0.10 x token_count) — never assume or pass a price.\n2) Call again with confirm=true, the SAME idempotency_key, and NO payment_token: returns a structured payment_required challenge (amount, currency).\n3) Once a Shared Payment Token is obtained for that exact amount, call a third time with confirm=true, the SAME idempotency_key, and payment_token set. Payment is captured FIRST; tokens are only credited after that succeeds.\n\nPAYMENT PRIORITY for AI Tokens: this tool is priority 1 — try it first, using whatever payment method your own platform can already supply for the payment_token. Only if you have no way to obtain a payment_token here, fall back to priority 2: get_ai_tokens_pay_link, paid via link-cli's tools (e.g. mpp_pay), if those are present in this session. There is no checkout-link fallback for AI Tokens.\n\nRules: never assume or pass a price. Reuse one idempotency_key across all calls for the same intent. If crediting fails AFTER payment succeeds, no refund is issued automatically — the result says so explicitly; do not tell the user a refund is coming.","before":"Purchase AI Tokens ($0.10 per token) by charging a Stripe Shared Payment Token (SPT) — for users with no Atom balance. This SPENDS REAL MONEY and requires the 'domains:register' scope.\n\nMANDATORY three-step flow — never skip a step:\n1) Call with confirm=false to get a QUOTE: price is entirely server-authoritative ($0.10 x token_count) — never assume or pass a price.\n2) Call again with confirm=true, the SAME idempotency_key, and NO payment_token: returns a structured payment_required challenge (amount, currency).\n3) Once a Shared Payment Token is obtained for that exact amount, call a third time with confirm=true, the SAME idempotency_key, and payment_token set. Payment is captured FIRST; tokens are only credited after that succeeds.\n\nRules: never assume or pass a price. Reuse one idempotency_key across all calls for the same intent. If crediting fails AFTER payment succeeds, no refund is issued automatically — the result says so explicitly; do not tell the user a refund is coming.","detail":"Description of `buy_ai_tokens` changed (27% word delta).","severity":"risky","descriptionDelta":0.26618705035971224},{"kind":"description_changed","tool":"check_domain_availability","after":"Check whether ONE specific, fully-spelled domain is available, taken, or a premium listing. Use whenever a user names a specific domain (e.g. \"is acme.com available?\", \"who owns x.io?\", \"can I get nova.ai?\"). For open-ended \"suggest names for my idea\" requests use search_brandable_domains instead. If the user wants to PURCHASE a domain they already know is an Atom marketplace listing, use get_domain_details or get_domain_purchase_pay_link instead — this tool checks fresh-registration availability, which will misleadingly report an already-listed/owned domain as \"taken.\"\n\nReturns: status (\"available\" = registrable now | \"taken\" = registered/unavailable | \"premium\" = for sale on Atom), registrable (bool), price + currency when applicable, estimated_value (rough appraisal, optional), and alternatives[] — when the domain is taken or premium, the closest available premium names from Atom (each with domain, price, url) so the user always has a buyable path. Also returns a top-level url (an Atom /name/ page).\n\nIMPORTANT — the top-level url is only meaningful when status is \"taken\" or \"premium\": that page exists to view/buy an existing Atom marketplace listing. When status is \"available\" (a fresh, unregistered domain), there is nothing to show on that page — do NOT mention or show this url to the user at all in that case. Just state that the domain is available and registrable, with nothing else. Separately, and regardless of the url: when status is \"available\" and the user wants it, do NOT tell them to register it on the website themselves. Continue the purchase yourself, in this same conversation, via register_domain (the user's Atom balance) or register_domain_spt (Stripe card) — both quote a real price and confirm with the user before charging anything. If either reports error registrant_contact_required, that's expected and not a dead end: ask the user for their name, phone, address, city, and country, call create_registrant_contact with those, then retry the registration call — do not send them to the dashboard link unless they explicitly prefer to enter it there themselves.","before":"Check whether ONE specific, fully-spelled domain is available, taken, or a premium listing. Use whenever a user names a specific domain (e.g. \"is acme.com available?\", \"who owns x.io?\", \"can I get nova.ai?\"). For open-ended \"suggest names for my idea\" requests use search_brandable_domains instead. If the user wants to PURCHASE a domain they already know is an Atom marketplace listing, use get_domain_details or get_domain_purchase_pay_link instead — this tool checks fresh-registration availability, which will misleadingly report an already-listed/owned domain as \"taken.\"\n\nReturns: status (\"available\" = registrable now | \"taken\" = registered/unavailable | \"premium\" = for sale on Atom), registrable (bool), price + currency when applicable, estimated_value (rough appraisal, optional), and alternatives[] — when the domain is taken or premium, the closest available premium names from Atom (each with domain, price, url) so the user always has a buyable path. Ends with an Atom url.","detail":"Description of `check_domain_availability` changed (46% word delta).","severity":"risky","descriptionDelta":0.4571428571428572},{"kind":"description_changed","tool":"get_ai_tokens_pay_link","after":"Get a real, payable Machine Payment Protocol (MPP) URL to top up AI Tokens ($0.10/token) — for use with an MPP-native payment agent (e.g. Stripe's link-cli), NOT with buy_ai_tokens's own payment flow (that tool's challenge cannot be paid by an external MPP agent). Use this ONLY when an MPP-native agent's tools (e.g. link-cli's mpp_pay) are available in this session.\n\nPAYMENT PRIORITY: this is priority 2 for AI Tokens — reach for it only after buy_ai_tokens's own in-band payment flow (priority 1) isn't viable (no payment_token available from your own platform), and only when link-cli is present. Always hand over the exact server-computed pay_url/price returned here — never estimate or recompute the amount yourself. There is no checkout-link fallback for AI Tokens.\n\nReturns a pay_url that a real HTTP 402 challenge is served from — hand it directly to the MPP agent's pay tool (e.g. mpp_pay) rather than fetching or decoding it yourself.","before":"Get a real, payable Machine Payment Protocol (MPP) URL to top up AI Tokens ($0.10/token) — for use with an MPP-native payment agent (e.g. Stripe's link-cli), NOT with buy_ai_tokens's own payment flow (that tool's challenge cannot be paid by an external MPP agent). Use this ONLY when an MPP-native agent's tools (e.g. link-cli's mpp_pay) are available in this session.\n\nReturns a pay_url that a real HTTP 402 challenge is served from — hand it directly to the MPP agent's pay tool (e.g. mpp_pay) rather than fetching or decoding it yourself.","detail":"Description of `get_ai_tokens_pay_link` changed (31% word delta).","severity":"risky","descriptionDelta":0.30612244897959184},{"kind":"description_changed","tool":"get_checkout_link","after":"Generate a pre-filled, authenticated Atom checkout URL for a chosen domain so the user can pay on Atom. Use when a user wants to BUY a domain but is not using balance registration, lacks sufficient balance, or prefers to pay per purchase (card/PayPal). This is the no-debit alternative to register_domain.\n\nPAYMENT PRIORITY: this is priority 3, the LAST RESORT — only for buying a premium/marketplace domain, only after BOTH register_domain (Atom balance, priority 1) is insufficient AND get_domain_purchase_pay_link + link-cli (priority 2) isn't available. There is no equivalent of this tool for a fresh domain registration or an AI Tokens purchase — neither has a checkout-link fallback.\n\nIMPORTANT: this tool only returns a link — it does NOT charge anything or complete a purchase. Returns: domain, price + currency, checkout_url (give this to the user to finish payment), and expires_at. Present the price and the checkout link; tell the user payment completes on Atom.","before":"Generate a pre-filled, authenticated Atom checkout URL for a chosen domain so the user can pay on Atom. Use when a user wants to BUY a domain but is not using balance registration, lacks sufficient balance, or prefers to pay per purchase (card/PayPal). This is the no-debit alternative to register_domain.\n\nIMPORTANT: this tool only returns a link — it does NOT charge anything or complete a purchase. Returns: domain, price + currency, checkout_url (give this to the user to finish payment), and expires_at. Present the price and the checkout link; tell the user payment completes on Atom.","detail":"Description of `get_checkout_link` changed (30% word delta).","severity":"risky","descriptionDelta":0.3033707865168539},{"kind":"description_changed","tool":"get_domain_purchase_pay_link","after":"Get a real, payable Machine Payment Protocol (MPP) URL to purchase an ALREADY-LISTED Atom marketplace domain via Stripe SPT (the SPT-paid sibling of register_domain, which pays from an Atom balance instead) — for use with an MPP-native payment agent (e.g. Stripe's link-cli). Use this ONLY when an MPP-native agent's tools (e.g. link-cli's mpp_pay) are available in this session, and only for domains that are curated Atom listings — for a fresh, unlisted domain, use get_domain_register_pay_link instead.\n\nPAYMENT PRIORITY: this is priority 2 for buying a premium/marketplace domain — reach for it only after register_domain (Atom balance, priority 1) reports insufficient funds, and only when link-cli is present. Always hand over the exact server-computed pay_url/price returned here — never estimate or recompute the amount yourself. If link-cli is not available either, use get_checkout_link (priority 3, last resort) instead.\n\nReturns a pay_url that a real HTTP 402 challenge is served from — hand it directly to the MPP agent's pay tool (e.g. mpp_pay) rather than fetching or decoding it yourself.","before":"Get a real, payable Machine Payment Protocol (MPP) URL to purchase an ALREADY-LISTED Atom marketplace domain via Stripe SPT (the SPT-paid sibling of register_domain, which pays from an Atom balance instead) — for use with an MPP-native payment agent (e.g. Stripe's link-cli). Use this ONLY when an MPP-native agent's tools (e.g. link-cli's mpp_pay) are available in this session, and only for domains that are curated Atom listings — for a fresh, unlisted domain, use get_domain_register_pay_link instead.\n\nReturns a pay_url that a real HTTP 402 challenge is served from — hand it directly to the MPP agent's pay tool (e.g. mpp_pay) rather than fetching or decoding it yourself.","detail":"Description of `get_domain_purchase_pay_link` changed (29% word delta).","severity":"risky","descriptionDelta":0.2857142857142857},{"kind":"description_changed","tool":"get_domain_register_pay_link","after":"Get a real, payable Machine Payment Protocol (MPP) URL to register a FRESH domain (an available domain that is NOT a curated Atom marketplace listing — for that, use get_domain_purchase_pay_link instead) via Stripe SPT — for use with an MPP-native payment agent (e.g. Stripe's link-cli), NOT with register_domain_spt's own payment flow (that tool's challenge cannot be paid by an external MPP agent). Use this ONLY when an MPP-native agent's tools (e.g. link-cli's mpp_pay) are available in this session.\n\nPAYMENT PRIORITY: this is priority 2 for a fresh registration — reach for it only after register_domain_spt's own in-band payment flow (priority 1) isn't viable (no payment_token available from your own platform), and only when link-cli is present. Always hand over the exact server-computed pay_url/price returned here — never estimate or recompute the amount yourself. There is no checkout-link fallback for a fresh registration.\n\nReturns a pay_url that a real HTTP 402 challenge is served from — hand it directly to the MPP agent's pay tool (e.g. mpp_pay) rather than fetching or decoding it yourself. term_years is never a caller input — always derived server-side from the TLD.","before":"Get a real, payable Machine Payment Protocol (MPP) URL to register a FRESH domain (an available domain that is NOT a curated Atom marketplace listing — for that, use get_domain_purchase_pay_link instead) via Stripe SPT — for use with an MPP-native payment agent (e.g. Stripe's link-cli), NOT with register_domain_spt's own payment flow (that tool's challenge cannot be paid by an external MPP agent). Use this ONLY when an MPP-native agent's tools (e.g. link-cli's mpp_pay) are available in this session.\n\nReturns a pay_url that a real HTTP 402 challenge is served from — hand it directly to the MPP agent's pay tool (e.g. mpp_pay) rather than fetching or decoding it yourself. term_years is never a caller input — always derived server-side from the TLD.","detail":"Description of `get_domain_register_pay_link` changed (26% word delta).","severity":"risky","descriptionDelta":0.25688073394495414},{"kind":"description_changed","tool":"register_domain","after":"Purchase/register a domain by DEBITING the authenticated user's Atom account balance. This SPENDS REAL MONEY and requires the 'domains:register' scope. Use only when the user clearly wants to buy now from their Atom balance; otherwise use get_checkout_link (pay per purchase).\n\nMANDATORY two-step flow — never skip the quote:\n1) Call with confirm=false (default) to get a QUOTE: returns stage='quote', the authoritative price, currency, balance_after, sufficient_funds, and expires_at. Show this to the user and get explicit confirmation.\n2) Call again with confirm=true and the SAME idempotency_key to commit: returns stage='committed', amount_debited, balance_remaining, and order_id.\n\nPAYMENT PRIORITY for buying a premium/marketplace domain: this tool (Atom account balance) is priority 1 — try it first. If funds are insufficient, priority 2 is get_domain_purchase_pay_link, paid via link-cli's tools (e.g. mpp_pay), if those are present in this session. Only if link-cli isn't available either does it fall to priority 3 (last resort): get_checkout_link.\n\nRules: never assume or pass a price — the server is authoritative. Reuse one client-generated idempotency_key across both calls (and any retry) to prevent double-charging. If funds are insufficient the tool returns error 'insufficient_funds' with required/available/top_up_url — in that case follow the priority above (link-cli, then get_checkout_link). Always confirm with the user before the confirm=true call.","before":"Purchase/register a domain by DEBITING the authenticated user's Atom account balance. This SPENDS REAL MONEY and requires the 'domains:register' scope. Use only when the user clearly wants to buy now from their Atom balance; otherwise use get_checkout_link (pay per purchase).\n\nMANDATORY two-step flow — never skip the quote:\n1) Call with confirm=false (default) to get a QUOTE: returns stage='quote', the authoritative price, currency, balance_after, sufficient_funds, and expires_at. Show this to the user and get explicit confirmation.\n2) Call again with confirm=true and the SAME idempotency_key to commit: returns stage='committed', amount_debited, balance_remaining, and order_id.\n\nRules: never assume or pass a price — the server is authoritative. Reuse one client-generated idempotency_key across both calls (and any retry) to prevent double-charging. If funds are insufficient the tool returns error 'insufficient_funds' with required/available/top_up_url — in that case suggest get_checkout_link instead. Always confirm with the user before the confirm=true call.","detail":"Description of `register_domain` changed (25% word delta).","severity":"safe","descriptionDelta":0.24817518248175185},{"kind":"description_changed","tool":"register_domain_spt","after":"Register a FRESH domain (an available domain that is NOT a curated Atom marketplace listing) by charging a Stripe Shared Payment Token (SPT) — for users with no Atom balance. This SPENDS REAL MONEY and requires the 'domains:register' scope. For already-listed marketplace domains paid from an Atom balance, use register_domain instead.\n\nMANDATORY three-step flow — never skip a step:\n1) Call with confirm=false to get a QUOTE: price and term_years, both entirely server-authoritative (term_years is derived from the TLD; there is no such input — never invent one).\n2) Call again with confirm=true, the SAME idempotency_key, and NO payment_token: returns a structured payment_required challenge (amount, currency).\n3) Once a Shared Payment Token is obtained for that exact amount, call a third time with confirm=true, the SAME idempotency_key, and payment_token set. Payment is captured FIRST; registration only starts after that succeeds.\n\nPAYMENT PRIORITY for a fresh registration: this tool is priority 1 — try it first, using whatever payment method your own platform can already supply for the payment_token (no external tool needed). Only if you have no way to obtain a payment_token here, fall back to priority 2: get_domain_register_pay_link, paid via link-cli's tools (e.g. mpp_pay), if those are present in this session. There is no checkout-link fallback for a fresh registration — get_checkout_link only works for an already-listed marketplace domain.\n\nRules: never assume or pass a price or term_years. Reuse one idempotency_key across all calls for the same intent. If registration fails AFTER payment succeeds, the registrar submission itself attempts a real refund of the charge — the result reports whether that happened.","before":"Register a FRESH domain (an available domain that is NOT a curated Atom marketplace listing) by charging a Stripe Shared Payment Token (SPT) — for users with no Atom balance. This SPENDS REAL MONEY and requires the 'domains:register' scope. For already-listed marketplace domains paid from an Atom balance, use register_domain instead.\n\nMANDATORY three-step flow — never skip a step:\n1) Call with confirm=false to get a QUOTE: price and term_years, both entirely server-authoritative (term_years is derived from the TLD; there is no such input — never invent one).\n2) Call again with confirm=true, the SAME idempotency_key, and NO payment_token: returns a structured payment_required challenge (amount, currency).\n3) Once a Shared Payment Token is obtained for that exact amount, call a third time with confirm=true, the SAME idempotency_key, and payment_token set. Payment is captured FIRST; registration only starts after that succeeds.\n\nRules: never assume or pass a price or term_years. Reuse one idempotency_key across all calls for the same intent. If registration fails AFTER payment succeeds, the registrar submission itself attempts a real refund of the charge — the result reports whether that happened.","detail":"Description of `register_domain_spt` changed (25% word delta).","severity":"risky","descriptionDelta":0.2532467532467533},{"kind":"description_changed","tool":"update_registrant_contact","after":"Create the authenticated user's registrant (WHOIS) contact — the name/address/phone/email a domain registry requires to complete registration. Call this ONLY when register_domain, register_domain_spt, or get_domain_register_pay_link report error 'registrant_contact_required' (meaning the account has none yet). All fields are required except organization. This does NOT charge anything, and it never edits an existing contact — if one already exists it safely does nothing and reports has_contact=true.","before":"Create or update the authenticated user's registrant (WHOIS) contact — the name/address/phone/email a domain registry requires to complete registration. Call this when register_domain, register_domain_spt, or get_domain_register_pay_link report error 'registrant_contact_required', or whenever the user wants to set up or change this info directly. All fields are required except organization. This does NOT charge anything — it only updates contact records.","detail":"Description of `update_registrant_contact` changed (41% word delta).","severity":"risky","descriptionDelta":0.41428571428571426}],"published_at":"2026-08-19T13:59:39.456Z"}]