The MCP server itself
The tool surface below is specified and is not serving traffic in this preview. Nothing on this page lets you call a tool today.
Model Context Protocol
Hostingsurge MCP: a scoped door, not a keyring.
Your own AI client should be able to work on your projects without ever holding provider credentials. Hostingsurge builds its own MCP layer for exactly that. The server is in development — the credential and approval foundation it stands on is not.
Where this stands
Two parts of this area already exist in the platform, and one does not. They are kept apart here on purpose.
Scoped API and MCP credentials
Credentials are issued from the account key page with explicit organization, brand and project binding, explicit scopes and a chosen expiry. Secrets are hashed at rest and shown once.
Short-lived operation approvals
A sensitive action needs an approval bound to the user, organization, project, exact action, target and canonical input digest. It is consumed once, and a failed callback rolls the whole admission back.
Audit and revocation
Credential use and mutation intents are recorded. Role, membership or project-grant changes permanently revoke pending approvals and invalidate the authority a credential was relying on.
The planned tool surface
Safely scoped operations from the specification. Each tool maps to an operation the platform already models internally.
| Tool | What it would do | Approval |
|---|---|---|
| list_projects | List the projects your token is scoped to. | Standard |
| get_project | Read one project and its current state. | Standard |
| get_deployment | Read the state of a deployment attempt. | Standard |
| get_logs | Read bounded logs for a project or deployment. | Standard |
| create_preview | Build a preview from a saved version. | Standard |
| deploy_preview | Make a preview reachable at its preview address. | Standard |
| request_production_deploy | Request a production deployment. This is a request, not a publish. | Standard |
| list_domains | List domains attached to the project. | Standard |
| check_domain | Check DNS and certificate readiness for a domain. | Standard |
| get_dns | Read current DNS records. | Standard |
| create_dns_record | Add a DNS record to a project domain. | Standard |
| get_backend_schema | Read the Hostingsurge Backend schema. | Standard |
| get_storage | Read storage usage and object listing. | Standard |
| get_wordpress_status | Read the state of a managed WordPress site. | Standard |
| analyze_wordpress | Analyse a connected WordPress site and report findings. | Standard |
| create_migration | Start an import or migration assessment. | Standard |
| get_migration_status | Read migration progress and the compatibility report. | Standard |
| get_usage | Read usage and credit balance for the scoped organization. | Standard |
| register_domain | Register a domain — a billable action. | Approval required |
| delete_project | Delete a project and its resources. | Approval required |
| delete_database | Delete a managed database. | Approval required |
| publish_production | Switch production to a specific version. | Approval required |
| purchase_resource | Buy additional capacity or add-ons. | Approval required |
Specified scope of the Hostingsurge MCP server. None of these tools can be called in this development preview.
Why this is built this way
An AI client with write access is a power tool. The rules below come from the specification and are already enforced where the platform implements the underlying operation.
No provider credentials, ever
Customer AI never receives direct provider admin credentials. The MCP layer talks to Hostingsurge, and the platform talks to providers through adapters with scoped credentials.
Tokens map to a scope
Every call runs with an organization and project scope, intersected with the current membership, role and project grants of the person the token belongs to.
Destructive means explicit
Production deploys are separated from generic write access, and destructive or billable operations require an explicit, short-lived approval that names the exact target and input.
Every call audited
Tool use is audited. A refused or revoked call is recorded as refused — never reported as success.
MCP questions
Can I connect an MCP client today?
No. The MCP server is not running in this preview, and no MCP endpoint is published. The credential and approval machinery it depends on is implemented; the server itself is in development.
How will a client authenticate?
With a scoped MCP token issued from the account key page: bound to one organization, brand and project, with explicit scopes and an expiry you choose.
Can an agent publish to production on its own?
No. publish_production, register_domain, delete_project, delete_database and purchase_resource sit behind explicit approval, and production access is a separate scope from generic write.
Do agent runtimes get network access?
Agent runtimes are in development. The specification requires isolation rules — no privileged mode, no Docker socket, no host mounts — plus an emergency control to disable agent networking.
Is this the same as giving an AI my hosting panel login?
No, and that is the point. A panel login is all-or-nothing and cannot be audited per action. A scoped token can be limited to a project, to read-only work, or to a single approved operation — and revoked without touching anything else.
The foundation is already in place.
Create an account and issue a scoped credential today. When the MCP server ships, the same scopes and approvals apply to it.
The MCP server is in development and is not running in this preview. The tool list above is the specification’s planned surface, not a live capability.