| docs

Appearance

MCP Server ​

AdminBolt ships a remote MCP server (Model Context Protocol), so any MCP-capable AI client (Claude, Cursor, VS Code and others) can drive your hosting panel in plain language: provision accounts, manage mailboxes and databases, suspend a late payer, or check whether the server can take fifty more sites this week.

The server is exposed at a single endpoint:

https://ai-hub.adminbolt.com/mcp

Authorization runs through your browser over OAuth. When your AI client connects, a browser window opens the Authorize MCP Connection form. Fill in:

  • Panel URL: the public address of your panel with its port, starting with https://, for example https://server.example.com:8443. Use the base address only, without /admin, /reseller, or /client.
  • API Key and API Secret: a key you created in the panel. Copy the full secret when you create the key.

The OAuth Client ID / Client Secret fields in your AI client's settings stay empty. Access expires after a while. When it does, reconnect and complete the authorization form again.

Role scoping ​

The same endpoint behaves differently depending on which API key authorizes it. It is the same permission model that runs the rest of the panel:

RoleWhere the key comes fromScope
AdminAPI Keys in the admin panelFull: hosting accounts, domains & subdomains, email, databases & DB users, FTP, SSL, hosting plans, resellers, server health & metrics
ResellerAPI Keys in the reseller panelOwn portfolio only: hosting accounts and plans. New accounts attach to your reseller automatically; there is no reseller_id to pass
Hosting accountAPI Keys in the client panelOne hosting account: its domains, email, databases, files, WordPress sites, applications, and other areas of the client API. See Connecting as a hosting account

Account-level resources (mail, databases, FTP, domains, SSL) belong to the account owner's panel, so a reseller key stays within its own lane. The tools follow the panel's REST API (see API Reference), so the exact set depends on the panel version and on the version of the MCP server.

The role sets which tools the assistant sees, not what the key may do. Every call still goes through the key's own settings in the panel, so a tool for an endpoint the key is not allowed to call is refused. Calls also depend on the requested feature being available on the account and the server.

When connecting, the MCP server checks the key against one endpoint per role. A key limited to selected endpoints (Allow all endpoints off) must include the one for its role, or the authorization form refuses it:

RoleEndpoint the key must allow
Admin/api/admin/statistics (GET)
Reseller/api/reseller/hosting-plans (GET)
Hosting account/api/client/account (GET)

Connecting as a hosting account ​

A hosting account owner can connect an AI client to their own account, with the same endpoint and the same clients as below.

  1. In the client panel, open Security > API Keys. The page is there only when the hosting plan includes API keys; if you do not see it, ask your hosting provider.
  2. Click New API Key, enter a Key Name, and review the settings:
    • Enable API Key is on by default.
    • IP Restriction is off by default. The requests reach your panel from the MCP server, not from your computer, so listing your own address does not help. If you turn it on, the list must include the address the MCP server connects from; ask your hosting provider for it.
    • Allow all endpoints is on by default. If you turn it off and pick endpoints, include /api/client/account (GET) (see Role scoping).
    • Allow WP-CLI execution is off by default. Turn it on only if the assistant should run WP-CLI on your WordPress sites, for example to change which page is the front page. Without it, a WP-CLI request that the key may otherwise make is refused with "This API key is not permitted to run WP-CLI."
  3. Click Create and copy the key and the secret from the notification. The secret is not shown again.
  4. Add the MCP server to your AI client (see the client sections below) and connect. In the Authorize MCP Connection form, enter the panel address, for example https://server.example.com:8443 (without /client), the API key, and the secret.

The session works only on that hosting account. It cannot see other accounts, hosting plans, resellers, or server settings.

If the form answers "Invalid credentials. Please check your Panel URL, API Key, and API Secret.", check that the panel URL has no /client at the end, that the key is enabled, that IP Restriction is off or lets the MCP server through, and, for a key limited to selected endpoints, that it includes /api/client/account (GET). A panel URL that does not start with https:// is refused with its own message.

Running Node.js, Python, or Ruby applications through the assistant also needs the server side ready, which is the administrator's part: the runtime installed on Application Runtimes, plus what the web server needs to serve applications, described in The web server matters (for example Phusion Passenger on Apache). Until then, the panel reports that runtime as not available.

Connecting Claude Desktop ​

Custom connectors require a paid Claude plan (Pro, Max, Team or Enterprise).

  1. Open Claude → Settings (Cmd , / Ctrl ,) → Connectors.
  2. In Custom Connectors click Add custom connector.
  3. Fill in: Name adminbolt, Remote MCP server URLhttps://ai-hub.adminbolt.com/mcp. Leave the Advanced OAuth fields empty. Click Add.
  4. Click the new connector → Connect. A browser window opens the Authorize MCP Connection form: enter the panel URL, API key, and API secret, then authorize. The status changes to Connected.
  5. In a conversation, open Search and tools and make sure adminbolt is enabled.
  6. Test it: "list my hosting accounts" with an administrator or reseller key, or "list my domains" with a hosting account key.

Connecting Cursor ​

Cursor only needs the URL; OAuth runs in the browser. Add to ~/.cursor/mcp.json (global) or .cursor/mcp.json (per project):

json
{
  "mcpServers": {
    "adminbolt": {
      "url": "https://ai-hub.adminbolt.com/mcp"
    }
  }
}

Via UI: Cursor → Settings → Tools & MCP → New MCP Server. After saving, Cursor shows an OAuth login button that opens the same authorize form; a green status means you are connected.

Connecting VS Code (Copilot Agent mode) ​

Requires VS Code with MCP support enabled. Note the different schema: the key is servers (not mcpServers) and a type field is required. Add to .vscode/mcp.json (project) or via command palette → MCP: Open User Configuration (global):

json
{
  "servers": {
    "adminbolt": {
      "type": "http",
      "url": "https://ai-hub.adminbolt.com/mcp"
    }
  }
}

Via UI: command palette → MCP: Add Server → HTTP → paste the URL → name it adminbolt. Check status with MCP: List Servers.

What the tools cover ​

Tool names follow the REST API one-to-one (get_hosting-accounts, post_hosting-account_email-accounts, post_reseller_hosting-accounts_suspend, ...). The full parameter reference is the API Reference. The role in italics is the key whose session shows the tool; a hosting account key has its own set, in the last item. Whether a call succeeds still depends on the key's settings (see Role scoping).

  • Accounts (admin and reseller): list, inspect, create, update holder details, change password, suspend / unsuspend, export, delete; per-account usage details (disk, bandwidth).
  • Domains & subdomains (admin): add domain / subdomain / parked domain, set PHP version and PHP-FPM per domain, change document root, delete.
  • Email, databases, DB users, FTP (admin): create and delete mailboxes, databases, database users with privilege assignment, FTP accounts.
  • SSL (admin): toggle automatic Let's Encrypt SSL per account.
  • Plans: list, create, rename, delete (admin and reseller).
  • Resellers (admin): create, update, delete.
  • Health & metrics (admin): health check, service status, admin statistics, live CPU/RAM/disk, historical metrics, system info.
  • Hosting account (hosting account key): tool names contain client (get_client_domains, post_client_applications, ...). They cover the account, domains, cron jobs, email accounts and forwarders, databases and database users, FTP, DNS records, SSL certificates, IP blocking, error logs, files, WordPress (including WP-CLI when the key allows it), and Node.js, Python, and Ruby applications.

Example workflows ​

Admin ​

PromptWhat runs underneath
"Set up hosting for acme.com on the Business plan, add an admin@ mailbox and a database with a user."get_hosting-plans → post_hosting-accounts → post_hosting-account_email-accounts → post_hosting-account_databases → post_hosting-account_database-users → ..._assign
"Create a database, a DB user with full privileges and an FTP account for a WordPress install on example.com."databases → database-users (ALL privileges) → ftp-accounts
"Add blog.example.com as a subdomain on PHP 8.4 with PHP-FPM."post_hosting-account_domains (domain_type=subdomain) → put_hosting-account_domains
"Suspend latepayer.com until they pay."post_hosting-accounts_suspend / later ..._unsuspend
"Can the server handle 50 new accounts this week?"read-only: get_health, get_services, get_metrics_stats, get_metrics_history, get_admin_statistics
"Which accounts are close to their disk or bandwidth limits?"get_hosting-accounts → get_hosting-accounts_usage-details per account
"oldclient.com cancelled. Take a backup, then delete the account."post_hosting-accounts_export (non-destructive) → delete_hosting-accounts

Reseller ​

PromptWhat runs underneath
"Show me all my hosting accounts."get_reseller_hosting-accounts (auto-scoped)
"Create hosting for clientx.com on my Pro plan."get_reseller_hosting-plans → post_reseller_hosting-accounts
"Suspend clientx.com until they pay."post_reseller_hosting-accounts_suspend / ..._unsuspend
"Add a Business 2026 plan and retire the legacy one."post_reseller_hosting-plans, delete_reseller_hosting-plans
"Reset the password for clientx.com and update their contact details."post_reseller_hosting-accounts_change-password, put_reseller_hosting-accounts

Deleting plans

Deleting a plan that still has accounts on it orphans them. Move those accounts to another plan first.

Security guardrails ​

  • Approve destructive actions explicitly. Treat delete_*, suspend and password resets as high-impact: have the assistant state the exact target and wait for your confirmation before running.
  • Resolve IDs first. Once the assistant holds a resource ID, deletes and updates act on it directly. Always resolve via a get_*/list call and have the assistant echo back what it is about to touch.
  • Secrets travel in cleartext. Passwords and FTP credentials are plain strings in tool calls. Avoid logging conversations that contain them; rotate anything that leaks.
  • Start read-only. Every get_* tool is non-destructive and the right place for staff to learn the assistant's behavior before getting write access.
  • Throttle bulk loops. Audits across every server (e.g. usage per account) should be paced; do not assume unlimited throughput.