This server is an MCP interface for managing a cPanel hosting account through natural language/AI, covering files, databases, email, DNS, security, and deployment.
File & Disk: list/create/read/edit/delete files; view disk quota and usage
Databases: full CRUD for MySQL and PostgreSQL databases, users, privileges, and server info
Email: manage accounts, forwarders, autoresponders, routing, filters, SpamAssassin, greylisting, and spam box
Email Auth: enable/validate DKIM, install/validate SPF, validate PTR records
DNS & DNSSEC: view/add/edit/delete DNS records; enable/disable DNSSEC, fetch DS records, export DNSKEY, manage NSEC3
Domains: list domains, manage addon/subdomains/parked domains, create/delete redirects
Cron & PHP: list/create/edit/delete cron jobs; manage PHP versions and INI directives
SSL/TLS: list/install/delete certificates, generate CSRs, check AutoSSL, list private keys
Security: IP blocker, SSH keys, hotlink protection, directory privacy, ModSecurity WAF, two-factor auth
Virus Scanning: run ClamAV scans, check status, view/quarantine/disinfect results
Metrics & Logs: bandwidth, resource usage, error logs, visitor stats, account stats
Backups & FTP: create/restore backups; manage FTP accounts, quotas, sessions, and port
Applications & Deployment: list WordPress installs; manage Node.js/Python/Ruby apps via Passenger; manage Git repos and deployments
Account Admin: manage API tokens, check features, view account/server info
Manages cPanel hosting accounts including files, disk usage, email, DNS, domains, SSL, security, backups, FTP, and more via cPanel's UAPI/API2.
Creates, lists, updates, deletes Git repositories and manages deployment via .cpanel.yml (requires Git Version Control feature).
Full CRUD for MySQL databases, users, and privileges, with server info and privilege management.
Registers, unregisters, enables, disables, and installs dependencies for Node.js apps via Phusion Passenger.
Lists installed PHP versions, gets/sets PHP version per domain, and reads/modifies PHP INI directives.
Full CRUD for PostgreSQL databases, users, and privileges, with grant/revoke access per database.
Registers, unregisters, enables, disables, and installs dependencies for Python apps via Phusion Passenger.
Registers, unregisters, enables, disables, and installs dependencies for Ruby apps via Phusion Passenger.
Lists WordPress installations (requires WP Toolkit/Instance Manager).
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@cPanel MCP Server Create a new MySQL database called mydb"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A comprehensive Model Context Protocol (MCP) server for managing cPanel hosting accounts through AI assistants. Connects directly to cPanel's UAPI and API2, enabling natural language management of web hosting — DNS, DNSSEC, email (with DKIM/SPF), databases, domains, SSL/AutoSSL, PHP, cron jobs, security (WAF, IP blocker, virus scanner, 2FA), Git deployment, Node.js/Python apps, and more.
List, create, read, edit, and delete files in your hosting account
Account quota info — check disk space consumption and limits
Full CRUD for databases, users, and privileges
Server info — version and restriction details
Privilege management — grant/revoke per database
Full CRUD for databases, users, and privileges
Grant/revoke access per database
Email accounts — create, delete, change password, set quotas, list with disk usage
Forwarders — create, list, and delete email forwarding rules
Autoresponders — create, list, and delete out-of-office / autoresponse messages
Email routing — view mail domain configuration
DKIM — enable, disable, validate, and ensure keys exist for all domains
SPF — validate and install/update SPF records
PTR — validate reverse DNS records
Email filters — list, add/update, delete, and trace/test filters
SpamAssassin — enable/disable, configure spam box, get settings, clear spam
Greylisting — enable/disable for all domains
Get zone records for any domain (via API2 ZoneEdit)
Add, edit, and delete DNS records (A, AAAA, CNAME, MX, TXT, SRV, CAA)
Enable/disable DNSSEC for domains
DS records — fetch for registrar configuration
DNSKEY export — export zone keys
NSEC3 — enable/disable (prevents zone enumeration)
List all domains — main, addon, subdomains, and parked
Addon domains — create and delete
Subdomains — create and delete with custom document roots
Parked domains (aliases) — park and unpark
Redirects — create and delete URL redirects (301/302)
List, create, edit, and delete cron jobs (via API2)
Notification email — get and set the cron notification address
List installed PHP versions available on the server
Get/set PHP version per domain
PHP INI directives — read and modify (memory_limit, upload_max_filesize, etc.)
List certificates and SSL status per domain
Install and delete SSL certificates
Generate CSR for certificate requests
AutoSSL — check status and trigger renewal
List private keys
IP Blocker — list, block, and unblock IP addresses/ranges
SSH Keys — list, import, delete, authorize, and deauthorize keys
Hotlink Protection — get status, enable with custom settings, disable
Directory Privacy — list protected directories and add users
Status — check if ModSecurity is installed, list domain status
Enable/disable globally or per domain
Status — check if 2FA is configured
Setup — generate secret/QR code, enable with verification
Remove — disable 2FA
Scan — start virus scan on a directory
Status — check scan progress
Results — list infected files, quarantine/disinfect
Bandwidth usage statistics
Resource usage — CPU, memory, I/O, entry processes
Error logs — recent error entries
Visitor stats — per-domain access statistics
Account stats — summary of email accounts, databases, domains, disk, bandwidth
Full account backup to home directory
Partial backups — home directory, databases, and email separately
Restore — database and file restore from backup
List available backups
List FTP accounts with disk usage
Create and delete FTP accounts
Change password and quota
Active sessions — list and terminate
Server port info
WordPress — list installations (requires WP Toolkit / Instance Manager)
Node.js/Python/Ruby apps — register, unregister, enable, disable, install dependencies (requires Phusion Passenger)
Git repositories — create, list, update, delete, and deploy via .cpanel.yml (requires Git Version Control feature)
API tokens — list, create, rename, and revoke
Features — list available features, check if specific features are enabled
Account info — user information, server details
Related MCP server: cPanel MCP Server
Node.js 18+
A cPanel account with API token access
npm install
npm run buildAdd the following to your MCP settings configuration (e.g., claude_desktop_config.json, cline_mcp_settings.json, or your IDE's MCP config):
{
"mcpServers": {
"cpanel": {
"command": "node",
"args": ["/path/to/cPanel-MCP-Server/build/index.js"],
"env": {
"CPANEL_USERNAME": "your_cpanel_username",
"CPANEL_API_TOKEN": "your_cpanel_api_token",
"CPANEL_SERVER_URL": "https://your-domain.com:2083"
}
}
}
}Replace the placeholder values with your actual cPanel credentials.
Variable | Required | Default | Description |
| Yes | — | cPanel account username |
| Yes | — | API token for authentication |
| Yes | — | cPanel server URL (e.g., |
| No |
| Allow plain HTTP only for explicit loopback development endpoints |
| No |
| Request timeout in milliseconds |
| No |
| Set to |
Log in to cPanel
Go to Security > Manage API Tokens
Create a new token with a descriptive name
Copy the token — it won't be shown again
Category | Count |
File Management | 5 |
Disk Usage | 1 |
MySQL | 9 |
PostgreSQL | 8 |
Email (accounts, forwarders, autoresponders) | 12 |
Email Authentication (DKIM/SPF/PTR) | 7 |
Email Filters & Spam | 13 |
DNS | 4 |
DNSSEC | 6 |
Domains (addon, sub, parked, redirects) | 14 |
Cron Jobs | 6 |
PHP | 5 |
SSL/TLS & AutoSSL | 8 |
Security (IP blocker, SSH, hotlink, privacy) | 13 |
ModSecurity (WAF) | 5 |
Two-Factor Auth | 4 |
Virus Scanner (ClamAV) | 4 |
Metrics & Logs | 5 |
Backups | 7 |
FTP | 8 |
WordPress | 1 |
Passenger Apps (Node.js/Python/Ruby) | 6 |
Git Version Control & Deployment | 6 |
API Tokens | 4 |
Account & Server Info | 4 |
src/
├── index.ts # MCP server entry point — registers all 25 tool modules
├── cpanel-api.ts # cPanel API client (UAPI + API2, token auth, error handling)
└── tools/
├── files.ts # File operations (Fileman)
├── disk.ts # Disk usage (Quota, DiskUsage)
├── mysql.ts # MySQL databases (Mysql)
├── postgresql.ts # PostgreSQL databases (Postgresql)
├── email.ts # Email accounts, forwarders, autoresponders (Email)
├── email-auth.ts # DKIM, SPF, PTR validation (EmailAuth)
├── email-filters.ts # Filters, SpamAssassin, Greylisting
├── dns.ts # DNS zone records (DNS)
├── dnssec.ts # DNSSEC management (DNSSEC)
├── domains.ts # Domains, subdomains, redirects
├── cron.ts # Cron jobs (API2 Cron)
├── php.ts # PHP version & INI (LangPHP)
├── ssl.ts # SSL/TLS & AutoSSL (SSL)
├── security.ts # IP blocker, SSH, hotlink, privacy
├── modsecurity.ts # ModSecurity WAF
├── twofa.ts # Two-factor authentication
├── virus-scanner.ts # ClamAV virus scanner
├── metrics.ts # Bandwidth, resources, logs, stats
├── backups.ts # Full & partial backups, restore
├── ftp.ts # FTP accounts & sessions
├── wordpress.ts # WordPress installations
├── passenger.ts # Node.js/Python/Ruby apps
├── version-control.ts # Git repos & deployment
├── tokens.ts # API token management
└── features.ts # Feature checks & server infoUAPI (preferred) — used for most modules
API2 (legacy) — used where cPanel has no UAPI equivalent:
Cron jobs — Cron::fetchcron, add_line, edit_line, remove_line, get_email, set_email
DNS records — ZoneEdit::fetchzone_records, add_zone_record, edit_zone_record, remove_zone_record
Subdomains — SubDomain::listsubdomains, addsubdomain, delsubdomain
Addon domains — AddonDomain::listaddondomains, addaddondomain, deladdondomain
Parked domains — Park::listparkeddomains, park, unpark
IP blocking list — DenyIp::listdenyips
Both API versions share the same authenticated client with retry logic and error handling
Your cPanel credentials are loaded from environment variables at runtime and are never stored in the repository. The API token should be treated as a secret — do not commit it to version control.
The server requires HTTPS by default. Plain HTTP is accepted only for parsed loopback hosts when CPANEL_ALLOW_INSECURE_HTTP=true; remote HTTP endpoints are always rejected. Path validation is defense in depth, while cPanel remains responsible for enforcing account-home containment on the remote filesystem.
ISC
Add a user to a password-protected directory
Inputs: dir (required), user (required), password (required).
Add a DNS zone record (A, AAAA, CNAME, MX, TXT, SRV, CAA)
Inputs: name (required), type (required), domain (required), address (required), +3 more.
Authorize an SSH key for login
Inputs: name (required).
Block an IP address or range
Inputs: ip (required).
Change password for an email account
Inputs: email (required), password (required).
Change mailbox quota for an email account
Inputs: email (required), quota (required).
Change an FTP account password
Inputs: user (required), domain (required), password (required).
Change an FTP account's disk quota
Inputs: user (required), quota (required), domain (required).
Check if a specific feature is enabled for the account
Inputs: feature (required).
Clear all messages from the SpamAssassin spam box
Inputs: no named parameters.
Create a new addon domain
Inputs: domain (required), subdomain (required), document_root (required).
Create a new cPanel API token with full access
Inputs: name (required).
Create an email autoresponder
Inputs: body (required), from (required), email (required), subject (required), +1 more.
Create a new cron job
Inputs: command (required), day, hour, month, +2 more.
Create a backup of a specific MySQL database
Inputs: database (required).
Create a new email account
Inputs: email (required), password (required), quota.
Create a backup of email configurations and data
Inputs: no named parameters.
Create an email forwarder
Inputs: email (required), forward_to (required).
Create a new file with specified content
Inputs: path (required), content (required).
Create a new FTP account
Inputs: user (required), password (required), quota, domain, +1 more.
Create a full account backup
Inputs: port, rdir, user, email, +3 more.
Create a new Git repository in cPanel
Inputs: name (required), repository_root (required), source_repository.
Create a backup of the home directory files
Inputs: no named parameters.
Create a new MySQL database
Inputs: name (required).
Create a new MySQL database user
Inputs: name (required), password (required).
Park/alias a domain to the main domain
Inputs: domain (required).
Create a new PostgreSQL database
Inputs: name (required).
Create a new PostgreSQL user
Inputs: name (required), password (required).
Create a URL redirect
Inputs: domain (required), redirect_url (required), path, type, +1 more.
Create a new subdomain
Inputs: domain (required), subdomain (required), document_root.
Deauthorize an SSH key (revoke login access)
Inputs: name (required).
Delete an addon domain
Inputs: domain (required), subdomain (required).
Delete an email autoresponder
Inputs: email (required).
Delete a cron job
Inputs: linekey (required).
Delete a DNS zone record by line number
Inputs: line (required), domain (required).
Delete an email account
Inputs: email (required).
Delete an email filter
Inputs: account (required), filtername (required).
Delete an email forwarder
Inputs: email (required), forward_to (required).
Delete a file or directory
Inputs: path (required).
Delete an FTP account
Inputs: user (required), domain (required), destroy.
Delete a Git repository from cPanel
Inputs: repository_root (required).
Delete a MySQL database
Inputs: name (required).
Delete a MySQL database user
Inputs: name (required).
Remove a parked/aliased domain
Inputs: domain (required).
Delete a PostgreSQL database
Inputs: name (required).
Delete a PostgreSQL user
Inputs: name (required).
Delete a URL redirect
Inputs: path (required), domain (required).
Delete an SSH key
Inputs: name (required), type (required).
Delete/uninstall an SSL certificate from a domain
Inputs: domain (required).
Delete a subdomain
Inputs: subdomain (required).
Deploy a Git repository (trigger deployment via .cpanel.yml)
Inputs: repository_root (required).
Disable DKIM for a domain
Inputs: domain (required).
Disable DNSSEC for a domain
Inputs: domain (required).
Disable greylisting for all domains
Inputs: no named parameters.
Disable hotlink protection
Inputs: no named parameters.
Disable ModSecurity (WAF) for all domains
Inputs: no named parameters.
Disable ModSecurity for specific domains
Inputs: domains (required).
Disable/stop a registered application
Inputs: name (required).
Disable SpamAssassin spam filtering
Inputs: no named parameters.
Disable the spam box
Inputs: no named parameters.
Quarantine/disinfect files detected as infected
Inputs: no named parameters.
Edit an existing cron job
Inputs: command (required), linekey (required), day, hour, +3 more.
Edit an existing DNS zone record
Inputs: line (required), name (required), type (required), domain (required), +2 more.
Update the contents of an existing file
Inputs: path (required), content (required).
Enable DKIM (DomainKeys Identified Mail) for a domain
Inputs: domain (required).
Enable DNSSEC for a domain
Inputs: domain (required).
Enable greylisting for all domains (delays first-time senders to block spam)
Inputs: no named parameters.
Enable hotlink protection
Inputs: urls (required), extensions, redirect_url.
Enable ModSecurity (WAF) for all domains
Inputs: no named parameters.
Enable ModSecurity for specific domains
Inputs: domains (required).
Enable/start a registered application
Inputs: name (required).
Enable SpamAssassin spam filtering for the account
Inputs: no named parameters.
Enable the spam box (auto-deliver spam to a separate folder)
Inputs: no named parameters.
Ensure DKIM keys exist for all domains (generates missing keys)
Inputs: no named parameters.
Install/update dependencies for a registered application (npm install, pip install, etc.)
Inputs: name (required).
Export a DNSSEC DNSKEY record for a domain
Inputs: domain (required).
Generate a new two-factor authentication secret (returns QR code data)
Inputs: no named parameters.
Generate a Certificate Signing Request (CSR)
Inputs: city (required), email (required), state (required), domain (required), +3 more.
Check if two-factor authentication is configured for the account
Inputs: no named parameters.
Get general server and account information
Inputs: no named parameters.
Get general account statistics (email count, db count, domains, etc.)
Inputs: no named parameters.
Check AutoSSL status and pending requests
Inputs: no named parameters.
Get bandwidth usage statistics for the account
Inputs: no named parameters.
Get the email address for cron job notifications
Inputs: no named parameters.
Get account disk space usage summary (quota, used, limits)
Inputs: no named parameters.
Get all DNS records for a zone/domain
Inputs: domain (required).
Fetch DS records for a DNSSEC-enabled domain (needed for registrar configuration)
Inputs: domain (required).
Get detailed information about a specific domain
Inputs: domain (required).
Get email routing configuration for all mail domains
Inputs: no named parameters.
Get the most recent entries from the site error log
Inputs: domain (required).
Get the FTP server port number
Inputs: no named parameters.
Get the deployment status of a Git repository
Inputs: repository_root (required).
Check if greylisting is enabled for the account
Inputs: no named parameters.
Get current hotlink protection settings
Inputs: no named parameters.
Check if ModSecurity (WAF) is installed and get domain status
Inputs: no named parameters.
Get MySQL server information and restrictions
Inputs: no named parameters.
Get current PHP INI directives for the account
Inputs: no named parameters.
Get the current PHP version assigned to a domain
Inputs: domain (required).
Get current resource usage (CPU, memory, I/O, entry processes)
Inputs: no named parameters.
Get server information (hostname, OS, IP addresses)
Inputs: no named parameters.
Get SpamAssassin settings and score threshold
Inputs: no named parameters.
Get SSL status for all domains on the account
Inputs: no named parameters.
Check the status of a running virus scan
Inputs: no named parameters.
Get visitor/access statistics for a domain
Inputs: domain (required).
Import an SSH public or private key
Inputs: key (required), name (required), type.
Install/update SPF records for all domains
Inputs: no named parameters.
Install an SSL certificate for a domain
Inputs: key (required), cert (required), domain (required), cabundle.
Terminate an active FTP session
Inputs: id (required).
List all addon domains
Inputs: no named parameters.
List all cPanel API tokens for the account
Inputs: no named parameters.
List all email autoresponders
Inputs: no named parameters.
List available backups on the account
Inputs: no named parameters.
List all blocked IP addresses
Inputs: no named parameters.
List all cron jobs on the account
Inputs: no named parameters.
List directories with password protection configured
Inputs: path.
List all domains on the account (main, addon, sub, parked)
Inputs: no named parameters.
List all email accounts with disk usage info
Inputs: no named parameters.
List all email filters for an account
Inputs: account (required).
List all email forwarders
Inputs: no named parameters.
List all features available to the cPanel account
Inputs: no named parameters.
List files and directories in a specified path
Inputs: path.
List all FTP accounts with disk usage
Inputs: no named parameters.
List active FTP sessions
Inputs: no named parameters.
List all Git repositories managed by cPanel
Inputs: no named parameters.
List files detected as infected by ClamAV
Inputs: no named parameters.
List all MySQL databases on the account
Inputs: no named parameters.
List all MySQL database users
Inputs: no named parameters.
List all parked/aliased domains
Inputs: no named parameters.
List all registered Node.js/Python/Ruby applications
Inputs: no named parameters.
List all installed PHP versions available on the server
Inputs: no named parameters.
List all PostgreSQL databases
Inputs: no named parameters.
List all PostgreSQL users
Inputs: no named parameters.
List all URL redirects
Inputs: no named parameters.
List all SSH keys on the account
Inputs: no named parameters.
List all installed SSL certificates
Inputs: no named parameters.
List all SSL private keys on the account
Inputs: no named parameters.
List all subdomains
Inputs: no named parameters.
List all WordPress installations managed by cPanel (requires WP Toolkit or Instance Manager on server)
Inputs: no named parameters.
Read the contents of a file
Inputs: path (required).
Register a new Node.js, Python, or Ruby application
Inputs: name (required), path (required), domain (required), base_uri, +3 more.
Remove/disable two-factor authentication from the account
Inputs: no named parameters.
Rename an existing API token
Inputs: name (required), new_name (required).
Restore a MySQL database from a backup file
Inputs: backup_file (required), timeout.
Restore a file from a backup
Inputs: backup_file (required), directory.
Revoke/delete an API token
Inputs: name (required).
Revoke all privileges for a MySQL user on a database
Inputs: user (required), database (required).
Revoke a PostgreSQL user's access to a database
Inputs: user (required), database (required).
Enable two-factor authentication with a secret and verification code
Inputs: code (required), secret (required).
Set the email address for cron job notifications
Inputs: email (required).
Enable NSEC3 for a DNSSEC domain (prevents zone enumeration)
Inputs: domain (required).
Set privileges for a MySQL user on a database
Inputs: user (required), database (required), privileges.
Set PHP INI directives (e.g., memory_limit, upload_max_filesize)
Inputs: content (required).
Set the PHP version for a domain
Inputs: domain (required), version (required).
Grant a PostgreSQL user access to a database
Inputs: user (required), database (required).
Start a ClamAV virus scan on a directory (requires ClamAV plugin on server)
Inputs: path.
Test email filters against a message to see which rules match
Inputs: msg (required), account (required).
Trigger an AutoSSL check/renewal for the account
Inputs: no named parameters.
Unblock a previously blocked IP address
Inputs: ip (required).
Unregister/remove a Node.js, Python, or Ruby application
Inputs: name (required).
Disable NSEC3 for a DNSSEC domain (revert to NSEC)
Inputs: domain (required).
Pull/update a Git repository
Inputs: repository_root (required), branch.
Validate current DKIM configuration for all domains
Inputs: no named parameters.
Validate current PTR (reverse DNS) records
Inputs: no named parameters.
Validate current SPF records for all domains
Inputs: no named parameters.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 164 tools
The 164 tools are organized into clear functional domains (email, DNS, databases, files, etc.) with each tool targeting a distinct resource and action. Even similar operations on different resources (e.g., MySQL vs PostgreSQL) are explicitly distinguished, leaving no ambiguity.
Tool names follow a consistent verb_noun pattern throughout, using list_, create_, delete_, get_, set_, enable_, and disable_ prefixes. Minor variations like 'change' vs 'set' do not disrupt the overall predictability.
With 164 tools, this server has an extreme count that overwhelms any agent's ability to select the right tool efficiently. This far exceeds the practical upper limit for a coherent MCP server, even for a broad domain like cPanel.
The server covers a wide range of cPanel features, but notable gaps remain: no way to change MySQL/PostgreSQL user passwords, no create/edit for email filters (only list/delete), and no restore for full/home backups. These missing lifecycle operations hinder complete domain coverage.
MCP server that lets your AI assistant build and deploy apps, hosting each one at a live URL.
Hosted MySQL MCP server for Claude, ChatGPT and Cursor, with each action switched per account.
Hosted MCP server connecting AI assistants to 9,000+ apps and 40,000+ actions via Zapier.
One MCP server for the services your AI needs: memory, files, Microsoft 365, kanban and more.
