Provider-neutral MCP server for AgentDispatch.
Hostinger Api is installed from its publisher's own source and answers where it runs, so this marketplace is not in the path of a single call. There is no address here to send one to, and a panel that pretended otherwise would be showing you an answer we made up. Install it and call it from your own client — the Installation tab has the entry for each one.
Open InstallationWhat it does
MCP server for Hostinger API
Quickstart
# 1 — run it from where its publisher ships it
npx -y hostinger-api-mcp
# 2 — the plan is chosen at checkout, in the browser
# 3 — ask your agent something
> MCP server for Hostinger API
Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.
Where are you running it?
Every route below installs the same thing and ends at the same approval screen. This one runs on your machine: your client starts Hostinger Api as a process under your own user, with your files and your network, so the tool surface below is what it can do to your computer rather than to a server somewhere else. It is scanned, signed and pinned to the version you choose — read the surface before you approve it.
This is a public server: you run it yourself and this marketplace is not in the path. Claude Code registers it in one command.
claude mcp add hostinger-api-mcp -- npx -y hostinger-api-mcpReconnect, or start a new session, and the tools appear in the model’s tool list.
Nothing is required, but it can take HOSTINGER_API_TOKEN if you want to set them.
One config entry your client uses to start the process locally. A local server runs with your file system and your network, which is why it is priced without metering.
200 tools, with what each one reads, writes and reaches shown before you agree — the same list on every route above. Read the tool surface.
Tool surface
What the model actually sees. Descriptions are diffed on every release — see version history.
Deploy a WordPress plugin from a directory to a hosting server. This tool uploads all plugin files and triggers plugin deployment. Upload credentials are generated and used internally — do not call a separate upload-url endpoint or upload the files yourself, this tool does it end-to-end.
Takes no parameters.
List javascript application deployments for checking their status. Use this tool when customer asks for the status of the deployment. This tool retrieves a paginated list of Node.js application deployments for a domain with optional filtering by deployment states.
Takes no parameters.
Retrieve logs for a specified JavaScript application deployment for debugging purposes in case of failure.
Takes no parameters.
Returns the list of cron jobs configured for the specified account, including their schedule and command.
Takes no parameters.
Creates a cron job for the specified account from a schedule expression and a command.\n\nReturns the created cron job, including its uid, which is required to delete the cron job or fetch its output.
Takes no parameters.
Permanently deletes the cron job identified by its uid.\n\nThe uid is returned by the list cron jobs endpoint.
Takes no parameters.
Returns the output captured from the last execution of the cron job identified by its uid.\n\nThe uid is returned by the list cron jobs endpoint.
Takes no parameters.
Changes the password for the specified database user.\n\nThe database name must be the full name returned by the list databases endpoint.\nThe password must also be updated in any website configuration that uses this database.
Takes no parameters.
Returns a paginated list of databases for the specified account.\n\nUse the domain and is_assigned filters to find databases assigned to a specific domain.
Takes no parameters.
Creates a database with a database user and password for the specified account.\n\nThe database name and user are automatically prefixed with the account username when needed.
Takes no parameters.
Permanently deletes a database and its remote connections.\n\nThe database name must be the full name returned by the list databases endpoint.
Takes no parameters.
Allows a remote host to connect to the specified database.\n\nProvide an IPv4/IPv6 address, or \
Takes no parameters.
Permanently removes a remote-access rule, revoking the given host
Takes no parameters.
Returns the remote-access rules for the specified account: the remote hosts\n(IPv4/IPv6 addresses, or \
Takes no parameters.
Repairs corrupted database tables asynchronously.\n\nUse when database errors, crashes, or corruption are reported.\nThe database name must be the full name returned by the list databases endpoint.
Takes no parameters.
Returns a direct sign-on link to phpMyAdmin for the specified database.\n\nUse this when a visual database interface is needed for SQL queries, imports, exports, or table management.\nThe database name must be the full name returned by the list databases endpoint.
Takes no parameters.
Retrieve a list of datacenters available for setting up hosting plans\nbased on available datacenter capacity and hosting plan of your order.\nThe first item in the list is the best match for your specific order\nrequirements.
Takes no parameters.
Generate a unique free subdomain that can be used for hosting services without purchasing custom domains.\nFree subdomains allow you to start using hosting services immediately\nand you can always connect a custom domain to your site later.
Takes no parameters.
Retrieve all parked or alias domains created under the selected website.\n\nUse this endpoint to inspect parked domain configuration for a specific website,\nincluding the parent domain and root directory assigned to each parked domain.
Takes no parameters.
Create a parked or alias domain for the selected website.\n\nProvide a domain name or IP address to park on the website so it serves the same content\nas the parent domain.
Takes no parameters.
Delete an existing parked or alias domain from the selected website.\n\nUse this endpoint to remove parked domains that are no longer needed.
Takes no parameters.
Retrieve all subdomains created under the selected website.\n\nUse this endpoint to inspect subdomain configuration for a specific website,\nincluding the parent domain and root directory assigned to each subdomain.
Takes no parameters.
Create a new subdomain for the selected website.\n\nProvide a subdomain prefix and, optionally, a custom directory or the\nwebsite public directory to use as the subdomain root.
Takes no parameters.
Delete an existing subdomain from the selected website.\n\nUse this endpoint to remove subdomains that are no longer needed.
Takes no parameters.
Verify ownership of a single domain and return the verification status.\n\nUse this endpoint to check if a domain is accessible for you before using it for new websites.\nIf the domain is accessible, the response will have `is_accessible: true`.\nIf not, add the given TXT record to your domain
Takes no parameters.
Generate a file browser upload URL with authentication credentials\nfor uploading files directly to a website
Takes no parameters.
List files and directories under a website
Takes no parameters.
Get a single file
Takes no parameters.
Start a Node.js build process using files already present on the website
Takes no parameters.
Resets all PHP extensions of the website to their default state.\n\nUse it to recover from extension conflicts or restore the original configuration.
Takes no parameters.
Returns the full phpinfo page (HTML) for the website.\n\nUse it to debug PHP issues or inspect the complete PHP environment of the website.
Takes no parameters.
Enables or disables PHP extensions (modules) for the website.\n\nUse the Get PHP details endpoint to check the current extension states before changing them.
Takes no parameters.
Changes the PHP version of the website.\n\nUse the Get PHP details endpoint to see the versions available for the website.
Takes no parameters.
Returns a paginated list of redirects configured for the selected website.
Takes no parameters.
Creates a redirect from a URL on the selected website to another URL or IP address.
Takes no parameters.
Permanently deletes the redirect identified by its source URL.\n\nPass the `from` value exactly as returned by the list redirects endpoint.
Takes no parameters.
Deploy a static application from an archive file.\n\nWARNING: this overwrites the website
Takes no parameters.
Get a single automation with the counts of contacts that entered it, are moving through it,\nfinished it or failed on the way.\n\nThis describes the automation itself. To see the workflow it runs, use the steps endpoint.
Takes no parameters.
Get the workflow of an automation as a flat list of steps.\n\nThe steps form a tree rather than a straight line: follow `parent_uuid` to reconstruct the\nbranches, and use `step_order` to order the steps that share a parent. An automation with no\nsteps yet returns an empty list.
Takes no parameters.
Get a single campaign with its sender, subject, template reference, targeting and delivery\nprogress.\n\nThis describes how the campaign was set up and how far it has got. For opens, clicks and\nunsubscribes use the campaign statistics endpoint.
Takes no parameters.
Get the performance of a campaign: delivery, opens, clicks and unsubscribes, with the\nmatching rates.\n\nEvery count is unique contacts rather than raw events, so a contact who opens the same email\nfive times is counted once.
Takes no parameters.
Delete a contact with the specified UUID.\n\nThis endpoint permanently removes a contact from the email marketing system.\n\n**Deprecated.** This endpoint cannot target a profile, so it always falls back to the\nclient
Takes no parameters.
Delete a custom contact field.\n\nEvery value contacts hold for the field is deleted with it, and for the choice types so\nare its options. The contacts themselves are not affected.
Takes no parameters.
Get the custom contact fields defined in a profile.\n\nCustom fields let you store your own attributes on contacts. The returned uuids are what\nyou pass to the contact update endpoint to set values, and choice fields also list the\noptions available to pick from.
Takes no parameters.
Define a new custom contact field in a profile.\n\nThe `slug` is derived from the label and, like the field type, cannot be changed later.\nUse the returned uuid to set values on contacts.
Takes no parameters.
Get a list of all contact groups.\n\nThis endpoint returns a list of contact groups that can be used to organize contacts.
Takes no parameters.
Create a new contact in the email marketing system.\n\nThis endpoint allows you to create a new contact with basic information like name, email, and surname.\n\nIf double opt-in is enabled,\nthe contact will be created with a pending status and a confirmation email will be sent.
Takes no parameters.
Get the full details of a single contact.\n\nAlongside the contact
Takes no parameters.
Permanently delete a contact from a profile.\n\nThe contact is removed together with its custom field values and tag assignments.
Takes no parameters.
Update a contact
Takes no parameters.
Get a paginated list of contacts belonging to a profile.\n\nContacts can be filtered by subscription status, by tag, and by an email search term.\nThe `meta.total` field of the response is the number of contacts matching the filters,\nso calling this endpoint without filters gives the profile
Takes no parameters.
Create a new contact in the email marketing system.\n\nThis endpoint allows you to create a new contact with basic information like name, email, and surname.\n\nIf double opt-in is enabled, the contact will be created with a pending status\nand a confirmation email will be sent.
Takes no parameters.
Get a list of all contact segments.\n\nThis endpoint returns a list of contact segments that can be used to organize contacts.\n\n**Deprecated.** This endpoint cannot target a profile, so it always falls back to\nthe client
Takes no parameters.
Count the contacts currently matching a segment without listing them.\n\nCheaper than paging through the segment contacts endpoint when only the size is needed.
Takes no parameters.
Retrieve contacts associated with a specific segment for a given profile.\n\nThis endpoint allows you to fetch and filter contacts that belong to a particular segment,\nidentified by its UUID, scoped to a specific profile.
Takes no parameters.
Get a single segment of a profile, including the conditions that define it.\n\nTo retrieve the contacts currently matching those conditions, use the segment contacts\nendpoint instead.
Takes no parameters.
Delete a segment.\n\nOnly the segment definition is removed. The contacts that matched it are left untouched.
Takes no parameters.
List every attribute a segment condition can filter on, with the operators each attribute\naccepts, the value format they expect and, where the value is constrained, the allowed\nvalues.\n\nThe list is profile specific: it includes the profile
Takes no parameters.
Get a paginated list of the segments defined in a profile.\n\nEach entry carries the number of contacts currently matching it, which is recalculated on\nread rather than stored. Use `count_type` to count either every matching contact or only\nthe subscribed ones.
Takes no parameters.
Create a segment in a profile.\n\nA segment is a saved set of conditions rather than a fixed list, so its membership changes\nas contacts change. Creating one does not modify any contact.
Takes no parameters.
Retrieve contacts associated with a specific segment.\n\nThis endpoint allows you to fetch and filter contacts that belong to a particular segment,\nidentified by its UUID.\n\n**Deprecated.** This endpoint cannot target a profile, so it always falls back to\nthe client
Takes no parameters.
Get details of a specific segment.\n\nThis endpoint retrieves information about a single segment identified by UUID.\nSegments are used to organize and group contacts based on specific criteria.\n\n**Deprecated.** This endpoint cannot target a profile, so it always falls back to\nthe client
Takes no parameters.
Assign a tag to a single contact.\n\nUnlike the bulk endpoint this is applied immediately rather than queued. Assigning a tag\nthe contact already carries succeeds without duplicating it.
Takes no parameters.
Remove a tag from a single contact.\n\nUnlike the bulk endpoint this is applied immediately rather than queued. Neither the tag\nnor the contact is deleted.
Takes no parameters.
Assign a tag to many contacts at once.\n\nPass `contact_uuids` to target specific contacts, or `all_contacts` to target every contact\nin the profile. The work is queued, so a success response means it was accepted rather than\nfinished. Contacts that already carry the tag are left alone.
Takes no parameters.
Remove a tag from many contacts at once.\n\nPass `contact_uuids` to target specific contacts, or `all_contacts` to target every contact\nin the profile. The work is queued, so a success response means it was accepted rather than\nfinished. The tag itself and the contacts are not deleted.
Takes no parameters.
Delete a tag and remove it from every contact carrying it.\n\nThe contacts themselves are not deleted. This is idempotent: deleting a tag that does not\nexist in the profile still succeeds.
Takes no parameters.
Rename a tag.\n\nThe contacts assigned to the tag are unaffected. Names are unique within a profile, so\nrenaming a tag to a name that is already taken is rejected.
Takes no parameters.
Get all tags defined in a profile.\n\nTags are the way contacts are grouped in Reach, and can be used to filter the contact\nlist or to build segments.
Takes no parameters.
Create tags in a profile.\n\nNames that already exist in the profile are not duplicated: the existing tag is returned\ninstead, so the call is safe to repeat. Every tag in the request is returned, whether it\nwas created now or already existed.
Takes no parameters.
Get a single form with the URL of its hosted template and the tags it applies to the contacts\nit captures.\n\nThere is no ready-made embed snippet in the response - either serve the template HTML yourself\nor build your own embed around the form uuid.
Takes no parameters.
Permanently delete a form together with its template.\n\nA form that has already captured submissions cannot be deleted, so that the contacts it collected\nare never silently discarded - pause the form instead to stop it collecting new ones. Views alone\ndo not block deletion.
Takes no parameters.
Get a paginated list of the signup forms in a profile.\n\nEach form carries a reference to the template that renders it. Get the form details for a\ndirectly usable template URL and for the tags the form puts on the contacts it captures.
Takes no parameters.
Retrieve the DNS configuration status for a profile
Takes no parameters.
This endpoint returns all profiles available to the client, including their basic information.
Takes no parameters.
Retrieve all available data centers.\n\nUse this endpoint to view location options before deploying VPS instances.
Takes no parameters.
Starts all services in a Docker Compose project that are currently stopped. \n\nThis operation brings up containers in the correct dependency order as defined in the compose file. \n\nUse this to resume a project that was previously stopped or to start services after a system reboot.
Takes no parameters.
Stops all running services in a Docker Compose project while preserving\ncontainer configurations and data volumes.\n\nThis operation gracefully shuts down containers in reverse dependency order. \n\nUse this to temporarily halt a project without removing data or configurations.
Takes no parameters.
Activate a firewall for a specified virtual machine.\n\nOnly one firewall can be active for a virtual machine at a time.\n\nUse this endpoint to apply firewall rules to VPS instances.
Takes no parameters.
Deactivate a firewall for a specified virtual machine.\n\nUse this endpoint to remove firewall protection from VPS instances.
Takes no parameters.
Retrieve firewall by its ID and rules associated with it.\n\nUse this endpoint to view specific firewall configuration and rules.
Takes no parameters.
Delete a specified firewall.\n\nAny virtual machine that has this firewall activated will automatically have it deactivated.\n\nUse this endpoint to remove unused firewall configurations.
Takes no parameters.
Retrieve all available firewalls.\n\nUse this endpoint to view existing firewall configurations.
Takes no parameters.
Create a new firewall.\n\nUse this endpoint to set up new firewall configurations for VPS security.
Takes no parameters.
Update a specific firewall rule from a specified firewall.\n\nAny virtual machine that has this firewall activated will lose sync with the firewall\nand will have to be synced again manually.\n\nUse this endpoint to modify existing firewall rules.
Takes no parameters.
Delete a specific firewall rule from a specified firewall.\n\nAny virtual machine that has this firewall activated will lose sync with the firewall\nand will have to be synced again manually.\n\nUse this endpoint to remove specific firewall rules.
Takes no parameters.
Sync a firewall for a specified virtual machine.\n\nFirewall can lose sync with virtual machine if the firewall has new rules added, removed or updated.\n\nUse this endpoint to apply updated firewall rules to VPS instances.
Takes no parameters.
Retrieve post-install script by its ID.\n\nUse this endpoint to view specific automation script details.
Takes no parameters.
Update a specific post-install script.\n\nUse this endpoint to modify existing automation scripts.
Takes no parameters.
Delete a post-install script from your account.\n \nUse this endpoint to remove unused automation scripts.
Takes no parameters.
Retrieve post-install scripts associated with your account.\n\nUse this endpoint to view available automation scripts for VPS deployment.
Takes no parameters.
Attach existing public keys from your account to a specified virtual machine.\n\nMultiple keys can be attached to a single virtual machine.\n\nUse this endpoint to enable SSH key authentication for VPS instances.
Takes no parameters.
Delete a public key from your account. \n\n**Deleting public key from account does not remove it from virtual machine** \n \nUse this endpoint to remove unused SSH keys from account.
Takes no parameters.
Retrieve public keys associated with your account.\n\nUse this endpoint to view available SSH keys for VPS authentication.
Takes no parameters.
Add a new public key to your account.\n\nUse this endpoint to register SSH keys for VPS authentication.
Takes no parameters.
Retrieve detailed information about a specific OS template for virtual machines.\n\nUse this endpoint to view specific template specifications before deployment.
Takes no parameters.
Retrieve available OS templates for virtual machines.\n\nUse this endpoint to view operating system options before creating or recreating VPS instances.
Takes no parameters.
Retrieve detailed information about a specific action performed on a specified virtual machine.\n\nUse this endpoint to monitor specific VPS operation status and details.
Takes no parameters.
Retrieve public keys attached to a specified virtual machine.\n\nUse this endpoint to view SSH keys configured for specific VPS instances.
Takes no parameters.
Retrieve backups for a specified virtual machine.\n\nUse this endpoint to view available backup points for VPS data recovery.
Takes no parameters.
Reset hostname and PTR record of a specified virtual machine to default value.\n\nUse this endpoint to restore default hostname configuration for VPS instances.
Takes no parameters.
Retrieve detailed information about a specified virtual machine.\n\nUse this endpoint to view comprehensive VPS configuration and status.
Takes no parameters.
Retrieve all available virtual machines.\n\nUse this endpoint to view available VPS instances.
Takes no parameters.
Uninstall the Monarx malware scanner on a specified virtual machine.\n\nIf Monarx is not installed, the request will still be processed without any effect.\n\nUse this endpoint to remove malware scanner from VPS instances.
Takes no parameters.
Retrieve historical metrics for a specified virtual machine.\n\nIt includes the following metrics: \n- CPU usage\n- Memory usage\n- Disk usage\n- Network usage\n- Uptime\n\nUse this endpoint to monitor VPS performance and resource utilization over time.
Takes no parameters.
Set nameservers for a specified virtual machine.\n\nBe aware, that improper nameserver configuration can lead to the virtual\nmachine being unable to resolve domain names.\n\nUse this endpoint to configure custom DNS resolvers for VPS instances.
Takes no parameters.
Create or update a PTR (Pointer) record for a specified virtual machine.\n\nUse this endpoint to configure reverse DNS lookup for VPS IP addresses.
Takes no parameters.
Delete a PTR (Pointer) record for a specified virtual machine.\n\nOnce deleted, reverse DNS lookups to the virtual machine
Takes no parameters.
Stop recovery mode for a specified virtual machine.\n\nIf virtual machine is not in recovery mode, this operation will fail.\n\nUse this endpoint to exit system rescue mode and return VPS to normal operation.
Takes no parameters.
Restart a specified virtual machine by fully stopping and starting it.\n\nIf the virtual machine was stopped, it will be started.\n\nUse this endpoint to reboot VPS instances.
Takes no parameters.
Set root password for a specified virtual machine.\n\nRequirements for password are same as in the [recreate virtual machine\nendpoint](/#tag/vps-virtual-machine/POST/api/vps/v1/virtual-machines/{virtualMachineId}/recreate).\n\nUse this endpoint to update administrator credentials for VPS instances.
Takes no parameters.
Setup newly purchased virtual machine with `initial` state.\n\nUse this endpoint to configure and initialize purchased VPS instances.
Takes no parameters.
Retrieve snapshot for a specified virtual machine.\n\nUse this endpoint to view current VPS snapshot information.
Takes no parameters.
Delete a snapshot of a specified virtual machine.\n\nUse this endpoint to remove VPS snapshots.
Takes no parameters.
Restore a specified virtual machine to a previous state using a snapshot.\n\nRestoring from a snapshot allows users to revert the virtual machine to that state,\nwhich is useful for system recovery, undoing changes, or testing.\n\nUse this endpoint to revert VPS instances to previous saved states.
Takes no parameters.
Start a specified virtual machine.\n\nIf the virtual machine is already running, the request will still be processed without any effect.\n\nUse this endpoint to power on stopped VPS instances.
Takes no parameters.
Enable or disable an AI option for the Hostinger Tools plugin on the specified\nWordPress installation.\n\nProvide the WordPress installation (software) identifier in the path. It can\nbe obtained from GET /api/hosting/v1/wordpress/installations (the `id` field).
Takes no parameters.
Trigger a background scan to detect WordPress installations for the account.\n\nThis operation is asynchronous: a successful response only means the scan has\nbeen queued. Poll GET /api/hosting/v1/wordpress/installations to fetch the\ndetected installations once the scan completes.
Takes no parameters.
Import WordPress website to the specified domain.\n\nWARNING: this overwrites the website
Takes no parameters.
List available WordPress core updates for the specified installation.\n\nProvide the WordPress installation (software) identifier in the path. It can\nbe obtained from GET /api/hosting/v1/wordpress/installations (the `id` field).
Takes no parameters.
Show the WordPress core version for the specified installation, along with\nknown vulnerabilities affecting it.\n\nProvide the WordPress installation (software) identifier in the path. It can\nbe obtained from GET /api/hosting/v1/wordpress/installations (the `id` field).
Takes no parameters.
Purge the LiteSpeed Cache for the specified WordPress installation.\n\nProvide the WordPress installation (software) identifier in the path. It can\nbe obtained from GET /api/hosting/v1/wordpress/installations (the `id` field).
Takes no parameters.
Show the LiteSpeed Cache status for the specified WordPress installation.\n\nProvide the WordPress installation (software) identifier in the path. It can\nbe obtained from GET /api/hosting/v1/wordpress/installations (the `id` field).
Takes no parameters.
Create temporary auto-login links for the specified WordPress installation.\n\nProvide the WordPress installation (software) identifier in the path. It can\nbe obtained from GET /api/hosting/v1/wordpress/installations (the `id` field).
Takes no parameters.
Show the maintenance mode status for the specified WordPress installation.\n\nProvide the WordPress installation (software) identifier in the path. It can\nbe obtained from GET /api/hosting/v1/wordpress/installations (the `id` field).
Takes no parameters.
Enable or disable maintenance mode for the specified WordPress installation,\nbased on the `enabled` flag.\n\nProvide the WordPress installation (software) identifier in the path. It can\nbe obtained from GET /api/hosting/v1/wordpress/installations (the `id` field).
Takes no parameters.
Show the Memcached object cache status for the specified WordPress\ninstallation.\n\nProvide the WordPress installation (software) identifier in the path. It can\nbe obtained from GET /api/hosting/v1/wordpress/installations (the `id` field).
Takes no parameters.
Activate or deactivate the Memcached object cache for the specified WordPress\ninstallation, based on the `enabled` flag.\n\nProvide the WordPress installation (software) identifier in the path. It can\nbe obtained from GET /api/hosting/v1/wordpress/installations (the `id` field).
Takes no parameters.
Deploy a WordPress plugin from an already uploaded directory.\n\nThis endpoint allows you to deploy a WordPress plugin that has been uploaded to the website
Takes no parameters.
List plugins recommended for installation on a WordPress installation that are\nnot yet installed.\n\nProvide the WordPress installation (software) identifier in the path. It can\nbe obtained from GET /api/hosting/v1/wordpress/installations (the `id` field).
Takes no parameters.
List plugins installed on a WordPress installation, including their status,\navailable updates and known vulnerabilities.\n\nProvide the WordPress installation (software) identifier in the path. It can\nbe obtained from GET /api/hosting/v1/wordpress/installations (the `id` field).
Takes no parameters.
Search the WordPress.org plugin directory for plugins available to install.\n\nUse the returned `slug` values with\nPOST /api/hosting/v1/accounts/{username}/wordpress/{software}/plugins/install.
Takes no parameters.
List curated plugin suggestions grouped by website type.\n\nUse the returned `slug` values with\nPOST /api/hosting/v1/accounts/{username}/wordpress/{software}/plugins/install.
Takes no parameters.
Check whether WooCommerce is installed on any WordPress installation of a\ndomain. Optionally filter by domain to scope the check.
Takes no parameters.
Deploy a WordPress theme from an already uploaded directory.\n\nThis endpoint allows you to deploy a WordPress theme that has been uploaded to the website
Takes no parameters.
List themes installed on a WordPress installation, including their status,\navailable updates and known vulnerabilities.\n\nProvide the WordPress installation (software) identifier in the path. It can\nbe obtained from GET /api/hosting/v1/wordpress/installations (the `id` field).
Takes no parameters.
List WordPress themes available to install.\n\nUse the returned `slug` values with\nPOST /api/hosting/v1/accounts/{username}/wordpress/{software}/themes/install.
Takes no parameters.
Deploy a node-static Agency Plan (h5g) website from an archive file. WARNING: this overwrites the website
Takes no parameters.
Deploy a PHP (or other non-build) Agency Plan (h5g) website from an archive file. WARNING: this overwrites the website
Takes no parameters.
Changes the primary domain for an Agency Plan website.\n\nProvide the current domain in the path and the new domain in the request body.\nSet domain to null to revert to the temporary domain.
Takes no parameters.
Links a domain to the specified Agency Plan website so it can serve traffic for that domain.
Takes no parameters.
Returns a paginated list of domains associated with Agency Plan websites accessible to the authenticated client.\n\nUse the website_uuids filter to narrow results to specific websites.
Takes no parameters.
Generate a file browser upload URL with authentication credentials for uploading files\nto an Agency Plan website
Takes no parameters.
Imports an Agency Plan website from an already-uploaded archive.\n\nUpload the archive to the website
Takes no parameters.
Returns aggregated disk and inode usage for the Agency Plan order over the\nselected time frame, plus the plan quotas. Figures cover the whole order\naccount. Values may be up to one hour stale. CPU, memory, and process usage\nare on the resource-usage-metrics endpoint.
Takes no parameters.
Returns a paginated list of Agency Plan orders accessible to the authenticated client.
Takes no parameters.
Lists every PHP extension available to an Agency Plan website and whether it is currently enabled.
Takes no parameters.
Replaces the set of PHP extensions enabled on an Agency Plan website with the ones provided. Any toggleable extension not in the request is disabled, so call the extensions endpoint first and send the full desired set. Extensions compiled into PHP, reported with the \
Takes no parameters.
Lists the php.ini directives that can be configured for an Agency Plan website, each with its default, the value currently in effect, and the values it accepts.
Takes no parameters.
Replaces the custom php.ini values on an Agency Plan website with the ones provided. Any option not in the request is reset to its default, so call the options endpoint first and send the full desired set. Sending an empty array resets every option to its default.
Takes no parameters.
Lists the PHP versions available to websites created under an Agency Plan order, determined by the server the order is hosted on. Use this before creating a website; for a website that already exists, call the website-scoped versions endpoint instead.
Takes no parameters.
Lists the PHP versions an Agency Plan website can be switched to. The version the website is currently running is returned as settings.php.version by the website details endpoint.
Takes no parameters.
Switches an Agency Plan website to a different PHP version. Call the available versions endpoint first to see which versions can be selected. The website restarts on the new version, so requests served during the switch may fail and code that is incompatible with the target version will break.
Takes no parameters.
Returns the current status of an Agency Plan website setup started via the setups\nendpoint.\n\nPoll this endpoint using the `setup_uuid` returned from the provisioning request until\n`status` becomes `completed`, at which point `website_uid` identifies the new website.
Takes no parameters.
Clears cache for all domains associated with an Agency Plan website, including its preview domain.\n\nThis operation clears all cache types for the website.
Takes no parameters.
Returns a paginated list of cron jobs configured for an Agency Plan website.\n\nEach entry includes the schedule expression and the command executed on that schedule.
Takes no parameters.
Creates a cron job for an Agency Plan website from a schedule expression and a command.\n\nReturns the created cron job, including its uuid, which is required to delete the cron job.
Takes no parameters.
Permanently deletes the cron job identified by its uuid from an Agency Plan website.\n\nThe operation is idempotent: deleting a cron job that does not exist succeeds without error.
Takes no parameters.
Returns a paginated list of MySQL databases created for an Agency Plan website.\n\nEach entry includes the database
Takes no parameters.
Creates a MySQL database with a dedicated user for an Agency Plan website.\n\nThe database name, username, and password must all be provided by the caller.
Takes no parameters.
Permanently deletes a MySQL database and all its data from an Agency Plan website, including its users.\n\nThe operation is idempotent: deleting a database that does not exist succeeds without error.
Takes no parameters.
Creates a user for an existing database on an Agency Plan website.\n\nEach database supports a single non-system user; creating a user for a database that already has one fails.
Takes no parameters.
Permanently deletes a database user from an Agency Plan website database, revoking all access it had.\n\nThe operation is idempotent: deleting a user that does not exist succeeds without error.
Takes no parameters.
Retrieves detailed information about a specific Agency Plan website, including configuration,\nstatus, metadata, hosting plan details, and resource quotas.
Takes no parameters.
Permanently deletes an Agency Plan website. Deletion is processed asynchronously: the\nwebsite is immediately transitioned to a deleting state and the underlying server\nresources are removed in the background.
Takes no parameters.
Lists active and recently completed asynchronous processes for an Agency Plan website.\n\nEach process has a unique ID (for tracking), a type, and a status (running, completed, failed).\nPoll this endpoint after initiating async operations (SSL setup, backups, cloning) to track progress.
Takes no parameters.
Changes the installed WordPress core version on an Agency Plan website to one of the versions available for installation.
Takes no parameters.
Returns the current WordPress settings for an Agency Plan website: installed core version,\nLiteSpeed Cache plugin status, object cache status, and maintenance mode status.
Takes no parameters.
Lists the WordPress core versions available for installation on an Agency Plan website.
Takes no parameters.
Retrieve a list of pending and completed domain verifications.
Takes no parameters.
Suggest available domain names based on a free-text description of your project.\n\nSuggestions are generated by an AI model, so they differ between calls.\n\nEndpoint has rate limit of 90 requests per minute.\n\nUse this endpoint to find a domain name when you only know what the website is about.
Takes no parameters.
Suggest available domain names based on a domain name you already have in mind.\n\nSuggestions are generated by an AI model, so they differ between calls.\n\nEndpoint has rate limit of 90 requests per minute.\n\nUse this endpoint when the domain you wanted is taken and you need close alternatives.
Takes no parameters.
Retrieve domain forwarding data.\n\nUse this endpoint to view current redirect configuration for domains.
Takes no parameters.
Update domain forwarding configuration.\n\nUse this endpoint to modify existing redirect configuration for domains.
Takes no parameters.
Delete domain forwarding data.\n\nUse this endpoint to remove redirect configuration from domains.
Takes no parameters.
Create domain forwarding configuration.\n\nUse this endpoint to set up domain redirects to other URLs.
Takes no parameters.
Retrieve a pending IRTP verification for a domain.\n\nBoth the old and new registrant must confirm it before the WHOIS change takes effect.\n\nUse this endpoint to check the status of a WHOIS change awaiting registrant confirmation.
Takes no parameters.
Cancel a pending IRTP verification.\n\nUse this endpoint to back out of a WHOIS change that is stuck waiting on registrant confirmation,\nfor example when the confirmation email cannot be received, without waiting out the 5-day expiry.
Takes no parameters.
Retrieve the incoming move for a specified domain.\n\nReturns 404 when no account is moving this domain to you.\n\nUse this endpoint to check whether a domain addressed to you is still waiting to be accepted.
Takes no parameters.
Reject an incoming move for a specified domain.\n\nThe domain stays in the account which initiated the move.\nMoves you have already accepted cannot be rejected anymore.\n\nUse this endpoint to decline a domain you do not want to take over.
Takes no parameters.
Retrieve all domains other Hostinger accounts are moving to your account.\n\nMoves of every status are returned, including the ones which already completed.\n\nUse this endpoint to find domains waiting for you to accept them.
Takes no parameters.
Retrieve the outgoing move for a specified domain.\n\nReturns 404 when the domain has no move in progress.\n\nUse this endpoint to track the status of a move you have initiated for a single domain.
Takes no parameters.
Cancel an outgoing move for a specified domain.\n\nThe move can only be cancelled while the receiving account has not accepted it yet.\nThe domain stays in your account.\n\nUse this endpoint to withdraw a move you no longer want to complete.
Takes no parameters.
Retrieve all domains you are moving to other Hostinger accounts.\n\nOnly moves which have not completed yet are returned.\n\nUse this endpoint to track moves you have initiated and the accounts they are addressed to.
Takes no parameters.
Retrieve the authorization (EPP) code for a specified domain so it can be transferred\naway from Hostinger to another registrar.\n\nRequesting a new code invalidates any code retrieved previously.\n\nUse this endpoint to obtain the code required to transfer a domain to another registrar.
Takes no parameters.
Enable domain lock for the domain.\n\nWhen domain lock is enabled,\nthe domain cannot be transferred to another registrar without first disabling the lock.\n\nUse this endpoint to secure domains against unauthorized transfers.
Takes no parameters.
Disable domain lock for the domain.\n\nDomain lock needs to be disabled before transferring the domain to another registrar.\n\nUse this endpoint to prepare domains for transfer to other registrars.
Takes no parameters.
Retrieve detailed information for specified domain.\n\nUse this endpoint to view comprehensive domain configuration and status.
Takes no parameters.
Retrieve all domains associated with your account.\n\nUse this endpoint to view user
Takes no parameters.
Enable privacy protection for the domain.\n\nWhen privacy protection is enabled, domain owner
Takes no parameters.
Disable privacy protection for the domain.\n\nWhen privacy protection is disabled, domain owner
Takes no parameters.
Retrieve renewal information for a specified domain, including its status and current\nexpiration date.\n\nUse this endpoint to build renewal automation and expiry monitoring for a single domain.
Takes no parameters.
Set nameservers for a specified domain.\n\nBe aware, that improper nameserver configuration can lead to the domain being unresolvable or unavailable.\n\nUse this endpoint to configure custom DNS hosting for domains.
Takes no parameters.
Retrieve the transfer for a specified domain.\n\nUse this endpoint to track an incoming or outgoing registrar transfer and its status.
Takes no parameters.
Retrieve all domain transfers in your portfolio.\n\nUse this endpoint to monitor incoming and outgoing registrar transfers across your domains.
Takes no parameters.
Set WHOIS contact profile as default.\n\nThe default profile is pre-selected for the TLD it belongs to when registering new domains.\n\nUse this endpoint to avoid picking contact information for every registration.
Takes no parameters.
Unset WHOIS contact profile as default.\n\nThe profile itself is kept, it is only no longer pre-selected for its TLD.\n\nUse this endpoint to stop reusing contact information for new registrations.
Takes no parameters.
Retrieve a WHOIS contact profile.\n\nUse this endpoint to view domain registration contact information.
Takes no parameters.
Delete WHOIS contact profile.\n\nUse this endpoint to remove unused contact profiles from account.
Takes no parameters.
Retrieve WHOIS contact profiles.\n\nUse this endpoint to view available contact profiles for domain registration.
Takes no parameters.
- 20,000 calls a month, included
- 240 calls a minute at peak
- Every tool the listing has
- Cancel any time — the unused days are credited
- Runs behind the gateway, so cancelling stops it
- 150,000 calls a month, included
- 1,800 calls a minute at peak
- Every tool the listing has
- Cancel any time — the unused days are credited
- Runs behind the gateway, so cancelling stops it
What counts against your monthly calls
| Tool | Unit | Calls used | Out of the allowance |
|---|
No call is billed on its own, and this plan carries no monthly call limit. $25 a month covers every tool at any volume.
Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.
| Term | Level | What it prices | Points |
|---|---|---|---|
| capability blast radius | high | client exposure if the model is manipulated | −6 |
| publisher verification | source verified | −0 | |
| inspection depth | source | −0 |
What the scan could actually read
A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.
Capability — what it could do if the model were manipulated
Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. high is the level these add up to.
| Tool | Capability tags | Why the tag was assigned |
|---|---|---|
| No per-tool rows for this release — see the note below. | ||
Toxic-flow graph
The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.
The public result for this release does not print the flow graph, so there is nothing to show here. That is not the same as "no paths were found": what the scan did read is above, under coverage.
Supply chain and provenance
Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.
Release history
Pinned to 1.46.0 — the install command below asks for that release. A pin is part of an install, so it is kept for this visit and written down when you install.
No release note was published with this version.
Only accounts with at least 50 real tool calls against this server in the last 90 days can post. Ratings are weighted by how much the reviewer actually uses it, and publishers can reply once per review.
Writing one takes an account with at least 50 real tool calls against Hostinger Api in the last 90 days. That is the whole gate — there is no other way to post, which is why the counts beside each review are worth reading.
Nobody has reviewed this listing. The rating on the card is the mean of the reviews written here and nothing else, so there is no rating until somebody writes the first — which takes an account with 50 real tool calls against it.