Which integrations are available for this server?

Provides tools for managing 1Panel v2 clusters, including multi-node discovery, website and reverse-proxy/HTTPS configuration, SSL certificate management, App Store app lifecycle and upgrades, Docker container operations, database inspection/creation, and main/child node upgrades and rollback.

How do I use mcp-1panel-plus?

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@mcp-1panel-plus list my 1Panel nodes and their status" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

mcp-1panel-plus

by EC061

Overview Schema Source Related Servers Discussions Admin

TypeScript

Hybrid

mcp-1panel-plus

Unified Multi-Node Model Context Protocol (MCP) Server for 1Panel v2 — control both your 1Panel Main Node ("local") and all connected X-Pack Child Nodes (nodeId) from a single MCP connection.

While upstream 1Panel-dev/mcp-1panel stops at 20 read/basic-create tools, mcp-1panel-plus covers the complete day-2 self-hosting lifecycle across every node in a 1Panel v2 cluster (39 tools):

End-to-End Reverse-Proxy Websites & HTTPS: Create proxy/static websites, list/create/edit/delete upstream reverse-proxy rules (Host, TLS SNI, headers, caching, sub-filters), bind existing or ACME SSL certificates to enable HTTPS / HSTS / HTTP/3, and start/stop/delete sites on any node.
App Store Updates & Lifecycle: Sync remote App Store catalogs across main & child nodes, inspect available app upgrade versions, upgrade installed apps (with automatic pre-upgrade backup), and start / stop / restart / rebuild apps.
Multi-Node 1Panel Self-Upgrade & Rollback: Check available 1Panel releases against Main & Child versions, upgrade the Main Node (1panel-core + 1panel-agent with automatic restart-reconnect polling), upgrade X-Pack Child Nodes (enforcing Main-before-Child ordering), inspect upgrade logs, and trigger child-node rollback.
Docker Container Operations: List all containers (including custom Compose & standalone containers outside the App Store), start / stop / restart containers, and fetch bounded, ANSI-cleaned, secret-scrubbed container logs.
Built-in Auto-Reconnecting SSH Loopback Tunnel (PANEL_SSH_HOST): Connect locally to 127.0.0.1:20005 over SSH without exposing 1Panel's API port publicly, fighting CDN/WAF timeouts, or losing the MCP process when 1panel-core restarts during an upgrade.

Architecture

flowchart LR
  Client["AI Client\n(Claude Code / Cursor / Codex / T3 Code)"]
  MCP["mcp-1panel-plus\n(Local Process • stdio or HTTP)"]
  Tunnel["Auto-Reconnecting SSH Tunnel\n127.0.0.1:ephemeral -> 127.0.0.1:20005\n(or Direct HTTPS)"]
  Main["1Panel Main Node\nCurrentNode: local\n(1panel-core + 1panel-agent)"]
  Child1["1Panel Child Node #1\nCurrentNode: <resolved-name>\n(1panel-agent mTLS)"]
  ChildN["1Panel Child Node #N\nCurrentNode: <resolved-name>\n(1panel-agent mTLS)"]

  Client <-->|"MCP (stdio)"| MCP
  MCP -->|"1Panel-Token (MD5)\n+ CurrentNode Header"| Tunnel
  Tunnel --> Main
  Main <-->|"X-Pack mTLS"| Child1
  Main <-->|"X-Pack mTLS"| ChildN

Security & Reliability Design

Safe Multi-Node Routing (CurrentNode): Every node-scoped tool accepts nodeId ("local" default, or a numeric string ID like "3" from list_nodes). Child node names are resolved dynamically from /api/v2/core/nodes/list — caller strings are never interpolated into CurrentNode, and missing/offline child nodes never silently fall back to "local".
Nginx Directive Injection Guard: Upstream URLs (proxy_address / proxy_pass), location paths, and headers are validated against whitespace, control/format characters, and Nginx directive syntax (;{}'"\$#).
Defense-in-Depth Secret Redaction: Private keys, PEM certificate bodies, database passwords, SSH credentials, X-Pack licenses, docker-compose.yml contents, and app .env maps are stripped from every tool output.
Zero Auto-Retry on Mutations: Write operations are never retried on network drop or HTTP 5xx; uncertain outcomes are surfaced explicitly so the agent inspects state before acting again.

Related MCP server: mcp-1panel

Quick Start

Prerequisites

Node.js >= 20 (v22 or v24 recommended) and pnpm / npm.
1Panel v2 API Key: Enable Panel Settings -> Security -> API Interface on your 1Panel Main Node and copy the 32-character API Key.
- Tip: When using PANEL_SSH_HOST, you can lock 1Panel's IP Whitelist (AllowIPs) to 127.0.0.1 so the API Key cannot be used from the public internet.
- Domain Binding Note: If your 1Panel has Domain Binding (BindDomain) enabled, also set PANEL_BIND_DOMAIN=panel.example.com so loopback requests send the expected HTTP Host header.

Build from Source

git clone https://github.com/EC061/mcp-1panel-plus.git
cd mcp-1panel-plus
pnpm install
pnpm test

MCP Client Configuration

1. Recommended: SSH Loopback Mode (`stdio`)

Works identically in Claude Code (~/.claude.json), Cursor (~/.cursor/mcp.json), Claude Desktop, and T3 Code:

{
  "mcpServers": {
    "1panel-plus": {
      "command": "npx",
      "args": ["-y", "github:EC061/mcp-1panel-plus"],
      "env": {
        "PANEL_SSH_HOST": "my-1panel-main",
        "PANEL_REMOTE_PORT": "20005",
        "PANEL_ACCESS_TOKEN": "your_32_char_1panel_api_key",
        "PANEL_BIND_DOMAIN": "panel.example.com",
        "PANEL_ACCESS_LEVEL": "readwrite"
      }
    }
  }
}

Or pointing directly to a local clone (dist/index.js) for instant zero-network startup:

{
  "mcpServers": {
    "1panel-plus": {
      "command": "node",
      "args": ["/absolute/path/to/mcp-1panel-plus/dist/index.js"],
      "env": {
        "PANEL_SSH_HOST": "my-1panel-main",
        "PANEL_REMOTE_PORT": "20005",
        "PANEL_ACCESS_TOKEN": "your_32_char_1panel_api_key",
        "PANEL_BIND_DOMAIN": "panel.example.com",
        "PANEL_ACCESS_LEVEL": "readwrite"
      }
    }
  }
}

2. Codex (`~/.codex/config.toml`)

[mcp_servers.1panel_plus]
command = "node"
args = ["/absolute/path/to/mcp-1panel-plus/dist/index.js"]

[mcp_servers.1panel_plus.env]
PANEL_SSH_HOST = "my-1panel-main"
PANEL_REMOTE_PORT = "20005"
PANEL_ACCESS_TOKEN = "your_32_char_1panel_api_key"
PANEL_BIND_DOMAIN = "panel.example.com"
PANEL_ACCESS_LEVEL = "readwrite"

3. Direct HTTPS Mode (Without SSH)

{
  "mcpServers": {
    "1panel-plus": {
      "command": "node",
      "args": ["/absolute/path/to/mcp-1panel-plus/dist/index.js"],
      "env": {
        "PANEL_HOST": "https://panel.example.com",
        "PANEL_ACCESS_TOKEN": "your_32_char_1panel_api_key",
        "PANEL_ACCESS_LEVEL": "readwrite"
      }
    }
  }
}

4. Docker & Streamable HTTP Mode

docker build -t mcp-1panel-plus .

# Run as Streamable HTTP on 127.0.0.1:8000/mcp with Bearer authentication
docker run --rm -p 127.0.0.1:8000:8000 \
  -e PANEL_HOST="https://panel.example.com" \
  -e PANEL_ACCESS_TOKEN="your_32_char_1panel_api_key" \
  -e PANEL_ACCESS_LEVEL="readonly" \
  -e MCP_TRANSPORT="http" \
  -e MCP_HTTP_ADDR="0.0.0.0:8000" \
  -e MCP_ALLOW_REMOTE="true" \
  -e MCP_AUTH_TOKEN="replace_with_random_bearer_token" \
  mcp-1panel-plus

Access Levels (`PANEL_ACCESS_LEVEL` / `--access-level`)

Tools are filtered from tools/list and enforced again on tools/call:

Level	Tools Exposed	Permitted Operations
`readonly`	23	Node discovery, OS/dashboard telemetry, website/proxy/HTTPS/SSL metadata, installed app & upgrade checks, panel release checks, container list & logs, MySQL/PostgreSQL inspection
`readwrite` (default)	33	Everything in `readonly` plus `create_website`, `enable_website_https`, `upsert_website_proxy`, `delete_website_proxy`, `operate_website`, `create_ssl`, `sync_app_store`, `operate_installed_app` (`upgrade`/`restart`/`start`/`stop`/`rebuild`), `operate_container`, `create_database`
`full` (or `admin`)	39	Everything in `readwrite` plus `delete_website`, `install_mysql`, `install_openresty`, `upgrade_main_panel`, `upgrade_child_node`, `rollback_child_node`

Complete Tool Catalog (39 Tools)

System & Multi-Node Discovery (3)

Tool	Access	Scope	Description
`list_nodes`	`readonly`	Main	List `"local"` and all X-Pack Child Node IDs, statuses, and versions
`get_system_info`	`readonly`	`nodeId`	OS, platform, kernel version/architecture, total disk bytes
`get_dashboard_info`	`readonly`	`nodeId`	Resource counts + live CPU, load, RAM, swap, network, and disk usage

Websites, Reverse Proxy & HTTPS (11)

Tool	Access	Scope	Description
`list_websites`	`readonly`	`nodeId`	Search/list websites on the selected node
`get_website`	`readonly`	`nodeId`	Read safe website metadata by `website_id`
`list_website_domains`	`readonly`	`nodeId`	List domains & ports bound to `website_id`
`get_website_https`	`readonly`	`nodeId`	Inspect HTTPS, TLS versions, HSTS, HTTP/3, and bound cert metadata
`create_website`	`readwrite`	`nodeId`	Create a `static` or `proxy` site (with optional one-shot `ssl_id` HTTPS bind)
`enable_website_https`	`readwrite`	`nodeId`	Bind an existing SSL certificate (`ssl_id`) for HTTPS/HSTS/HTTP3, or disable HTTPS
`list_website_proxies`	`readonly`	`nodeId`	List reverse-proxy location rules on `website_id`
`upsert_website_proxy`	`readwrite`	`nodeId`	Create or edit a reverse-proxy rule (`proxy_pass`, `proxy_host`, SNI, cache, sub-filters)
`delete_website_proxy`	`readwrite`	`nodeId`	Delete a named reverse-proxy rule on `website_id`
`operate_website`	`readwrite`	`nodeId`	`start` or `stop` a website
`delete_website`	`full`	`nodeId`	Delete a website (`deleteApp: false`, `deleteDB: false` safety defaults)

SSL Certificates (3)

Tool	Access	Scope	Description
`list_ssls`	`readonly`	`nodeId`	List SSL certificate metadata (private keys & PEM stripped)
`get_ssl_metadata`	`readonly`	`nodeId`	Get certificate details by `ssl_id`
`create_ssl`	`readwrite`	`nodeId`	Submit ACME DNS-01 or HTTP-01 certificate issuance

App Store Updates & Lifecycle (8)

Tool	Access	Scope	Description
`list_installed_apps`	`readonly`	`nodeId`	List installed apps (`canUpdate`, versions, ports; strips `.env` & compose)
`get_installed_app`	`readonly`	`nodeId`	Inspect a single installed app by `app_install_id`
`list_app_versions`	`readonly`	`nodeId`	List catalog versions for an `app_key`
`sync_app_store`	`readwrite`	`nodeId`	Sync remote App Store catalog across Main & Child nodes
`get_app_update_versions`	`readonly`	`nodeId`	List available target `detailId` upgrade versions for an installed app
`operate_installed_app`	`readwrite`	`nodeId`	`upgrade` (with backup), `restart`, `start`, `stop`, or `rebuild` an app
`install_mysql`	`full`	`nodeId`	Install MySQL from the App Store
`install_openresty`	`full`	`nodeId`	Install OpenResty from the App Store

1Panel Self-Upgrade & Rollback (5)

Tool	Access	Scope	Description
`check_panel_upgrades`	`readonly`	Cluster	Compare Main & Child 1Panel versions against upstream releases
`upgrade_main_panel`	`full`	Main	Upgrade Main Node (`1panel-core` + `1panel-agent`) and poll across restart
`upgrade_child_node`	`full`	Child	Upgrade X-Pack Child Node `1panel-agent` (enforces Main-first rule)
`get_child_node_upgrade_logs`	`readonly`	Child	List upgrade history & backup availability for a Child Node
`rollback_child_node`	`full`	Child	Roll back a Child Node using a verified `upgrade_log_id`

Docker Containers (3)

Tool	Access	Scope	Description
`list_containers`	`readonly`	`nodeId`	List App Store + custom Docker containers (`state`, `ports`, `imageName`)
`operate_container`	`readwrite`	`nodeId`	`start`, `stop`, or `restart` a container
`get_container_logs`	`readonly`	`nodeId`	Fetch bounded tail logs (`<= 500` lines / `64 KiB`, ANSI & secret scrubbed)

Databases — MySQL & PostgreSQL (6)

Tool	Access	Scope	Description
`list_mysql_instances`	`readonly`	`nodeId`	List local MySQL/MariaDB instances
`list_databases`	`readonly`	`nodeId`	List schemas inside a local MySQL instance
`get_mysql_status`	`readonly`	`nodeId`	Read MySQL uptime, connection, thread, and traffic counters
`create_database`	`readwrite`	`nodeId`	Create a UTF8MB4 database in a local MySQL instance
`list_postgresql_instances`	`readonly`	`nodeId`	List local PostgreSQL instances
`list_postgresql_databases`	`readonly`	`nodeId`	List databases inside a local PostgreSQL instance

Safe Multi-Node Panel Upgrade Workflow

When upgrading 1Panel across a Main + Child cluster (PANEL_ACCESS_LEVEL=full):

Run check_panel_upgrades to inspect current versions on "local" and all Child Nodes against upstream releases.
Run upgrade_main_panel (target_version: "v2.x.y") first. When connected via PANEL_SSH_HOST, the local MCP server survives 1panel-core restarting and polls until the Main Node reports healthy on v2.x.y.
Run upgrade_child_node (nodeId: "3") for each Child Node so X-Pack pushes the matching v2.x.y 1panel-agent binary.
Use get_child_node_upgrade_logs (and rollback_child_node if ever needed) to verify completion.

Environment Variables Reference

Variable	CLI Flag	Default	Description
`PANEL_SSH_HOST`	`--ssh-host`	—	SSH config alias or `user@host` for auto-reconnecting loopback tunnel
`PANEL_REMOTE_PORT`	`--remote-port`	`20005`	Remote 1Panel port forwarded over SSH
`PANEL_SSH_PORT`	`--ssh-port`	—	Optional custom SSH port
`PANEL_SSH_KEY_PATH`	`--ssh-key-path`	—	Optional SSH identity key file
`PANEL_HOST`	`--host`	—	Direct `http(s)://` 1Panel URL (when not using `PANEL_SSH_HOST`)
`PANEL_ACCESS_TOKEN`	`--token`	(required)	1Panel API Key (alias: `PANEL_API_KEY`)
`PANEL_KEY_ID`	`--key-id`	—	Optional `1Panel-Key-ID` header
`PANEL_BIND_DOMAIN`	`--bind-domain`	—	Optional HTTP `Host` header override when 1Panel Domain Binding is active
`PANEL_TLS_INSECURE`	`--tls-insecure`	`false`	Skip TLS certificate verification on self-signed `PANEL_HOST`
`PANEL_ACCESS_LEVEL`	`--access-level`	`readwrite`	`readonly` \| `readwrite` \| `full` (`admin`)
`MCP_TRANSPORT`	`--transport`	`stdio`	`stdio` \| `http` (`streamable-http`)
`MCP_HTTP_ADDR`	`--addr`	`127.0.0.1:8000`	Listen address for Streamable HTTP transport (`/mcp`)
`MCP_AUTH_TOKEN`	`--mcp-token`	—	Required Bearer token for Streamable HTTP transport

License

Licensed under the Apache License, Version 2.0. Clean-room TypeScript implementation inspired by and compatible with 1Panel v2 and 1Panel-dev/mcp-1panel.

Available Tools

33 tools

check_panel_upgradesCheck 1Panel Main & Child UpgradesA

Read-only

Inspect current 1Panel versions on the Main Node and all X-Pack Child Nodes, check available upstream 1Panel releases, and report which nodes have pending upgrades.

Inputs: max_releases, include_release_notes.

create_databaseCreate MySQL DatabaseA

Create a UTF8MB4 database in a local MySQL instance on the selected node. Access defaults to localhost; passwords are never echoed back.

Inputs: name (required), database (required), nodeId, password, +2 more.

create_sslIssue ACME SSL CertificateA

Submit asynchronous ACME certificate issuance for a domain (or bare IP with HTTP validation) using configured ACME and DNS accounts on the selected node. Credentials and private keys are never returned.

Inputs: domain (required), provider (required), nodeId, dnsAccount, +2 more.

create_websiteCreate Static or Reverse-Proxy WebsiteA

Create a static or reverse-proxy website in the default website group on the selected node. Optionally bind an existing SSL certificate ID (ssl_id) immediately after creation.

Inputs: domain (required), website_type (required), IPV6, port, +5 more.

delete_website_proxyDelete Website Reverse-Proxy RuleB

Destructive

Delete a named reverse-proxy rule from a website on the selected node.

Inputs: name (required), website_id (required), nodeId.

enable_website_httpsEnable or Disable Website HTTPSA

Bind an existing 1Panel SSL certificate (ssl_id) to enable HTTPS/HSTS/HTTP3 on a website, or disable HTTPS (enable: false).

Inputs: website_id (required), hsts, http3, enable, +6 more.

get_app_update_versionsGet Available App Upgrade VersionsA

Read-only

List target upgrade versions (detailId and version) available for a specific installed app ID on the selected node.

Inputs: app_install_id (required), nodeId.

get_child_node_upgrade_logsGet Child Node Upgrade LogsA

Read-only

List historical upgrade records (id, oldVersion, newVersion, isOk, createdAt) for a specific X-Pack Child Node.

Inputs: nodeId (required), page, page_size.

get_container_logsGet Bounded Docker Container LogsA

Read-only

Fetch recent tail logs from a Docker container on the selected node (bounded to at most 500 lines / 64 KiB, ANSI-stripped, with inline secret redaction).

Inputs: container (required), tail, since, nodeId, +1 more.

get_dashboard_infoGet Node Dashboard TelemetryA

Read-only

Read dashboard resource counts (websites, apps, databases, cronjobs) and real-time CPU, load, memory, swap, network, and disk utilization on the selected node.

Inputs: nodeId.

get_installed_appGet Installed App InfoA

Read-only

Read status, version, and ports for a specific installed application ID on the selected node. Environment variables and compose files are excluded.

Inputs: app_install_id (required), nodeId.

get_mysql_statusGet MySQL Runtime StatusA

Read-only

Read connection, thread, traffic, and uptime counters from a local MySQL instance on the selected node.

Inputs: database (required), nodeId.

get_ssl_metadataGet SSL Certificate MetadataB

Read-only

Read safe metadata for a single SSL certificate ID on the selected node. Private keys, PEM contents, and DNS provider secrets are excluded.

Inputs: ssl_id (required), nodeId.

get_system_infoGet Node OS & System InfoA

Read-only

Read operating system, platform, kernel architecture/version, and total disk size (in bytes) on the selected node.

Inputs: nodeId.

get_websiteGet Website MetadataA

Read-only

Get website metadata by explicit website ID on the selected node. Filesystem paths and raw Nginx configuration are excluded.

Inputs: website_id (required), nodeId.

get_website_httpsGet Website HTTPS SettingsA

Read-only

Read HTTPS status, TLS protocols, HSTS, HTTP/3, and certificate metadata for a website ID. Private keys and PEM certificate contents are stripped.

Inputs: website_id (required), nodeId.

list_app_versionsList Catalog App VersionsA

Read-only

List available catalog versions for an exact App Store application key (e.g. openresty, mysql, halo) on the selected node.

Inputs: app_key (required), page, nodeId, page_size.

list_containersList Docker ContainersB

Read-only

List Docker containers (including both App Store and custom Compose/standalone containers) on the selected node.

Inputs: name, page, state, nodeId, +3 more.

list_databasesList MySQL DatabasesA

Read-only

List databases inside an explicitly named local MySQL instance on the selected node. Passwords are never returned.

Inputs: database (required), page, nodeId, page_size.

list_installed_appsList Installed AppsA

Read-only

List installed App Store applications on the selected node, including canUpdate flags and ports. Environment secrets and docker-compose contents are strictly stripped.

Inputs: name, page, nodeId, page_size, +2 more.

list_mysql_instancesList Local MySQL InstancesA

Read-only

List local MySQL/MariaDB server instances on the selected node. Remote database connections and credentials are excluded.

Inputs: page, nodeId, page_size.

list_nodesList 1Panel NodesA

Read-only

List the Main Node ("local") and all connected X-Pack Child Nodes (numeric string IDs) managed by this 1Panel cluster. Use the returned id as nodeId in other tools.

Inputs: no named parameters.

list_postgresql_databasesList PostgreSQL DatabasesA

Read-only

List databases in an explicitly named local PostgreSQL instance on the selected node. Credentials are excluded.

Inputs: database (required), info, page, nodeId, +1 more.

list_postgresql_instancesList Local PostgreSQL InstancesA

Read-only

List local PostgreSQL instances managed by 1Panel on the selected node. Remote instances and credentials are excluded.

Inputs: page, nodeId, page_size.

list_sslsList SSL CertificatesA

Read-only

List SSL certificates on the selected node. Private keys and PEM certificate contents are strictly excluded.

Inputs: page, nodeId, page_size.

list_website_domainsList Website DomainsA

Read-only

List recorded domains and ports bound to an explicit website ID on the selected node.

Inputs: website_id (required), page, nodeId, page_size.

list_website_proxiesList Website Reverse-Proxy RulesA

Read-only

List configured reverse-proxy rules on a website ID on the selected node. Raw Nginx file paths and config snippets are excluded.

Inputs: website_id (required), nodeId.

list_websitesList WebsitesA

Read-only

List websites on the selected node with optional name filter. Internal filesystem paths are excluded.

Inputs: name, page, nodeId, page_size.

operate_containerStart, Stop, or Restart ContainerB

Execute a safe container lifecycle operation (start, stop, or restart) on a Docker container on the selected node.

Inputs: container (required), operation (required), nodeId.

operate_installed_appUpgrade or Operate Installed AppA

Perform lifecycle operations (upgrade, restart, start, stop, rebuild) on an installed App Store application on the selected node. When operate is "upgrade" and detail_id is omitted, automatically selects the newest available version from get_app_update_versions.

Inputs: operate (required), install_id (required), backup, nodeId, +2 more.

operate_websiteStart or Stop WebsiteB

Start or stop an existing website (operate: "start" | "stop") on the selected node.

Inputs: operate (required), website_id (required), nodeId.

sync_app_storeSync App Store CatalogB

Trigger remote App Store catalog synchronization on the selected node (and optionally refresh X-Pack child-node app update status) so newly published app versions become visible.

Inputs: nodeId, sync_child_nodes.

upsert_website_proxyCreate or Update Website Reverse-Proxy RuleB

Create (operate: "create") or edit (operate: "edit") a reverse-proxy location rule on a website. Sanitizes upstream URL, match path, and headers against Nginx directive injection.

Inputs: name (required), operate (required), proxy_pass (required), website_id (required), +12 more.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

Deploy Server

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

A3.5/5.0

Scored 2026-11-11 23:27 across 33 tools

Disambiguation5/5

Each tool has a distinct resource-and-action purpose, and even potentially close pairs (system info vs dashboard info, installed apps vs containers, MySQL instances vs databases) are clearly separated by explicit descriptions. No true duplicate or overlapping operations are apparent.

Naming Consistency5/5

Names consistently use snake_case with predictable verb_noun phrasing such as list_websites, get_website, create_ssl, and operate_container. Longer names like get_child_node_upgrade_logs are still readable and follow the same convention.

Tool Count2/5

The server exposes 33 tools, which is heavy for an agent-facing surface and exceeds the well-scoped range. Although the domain is broad, several website, app, and database operations could be consolidated or scoped more tightly to reduce selection cost.

Completeness3/5

The surface covers many reads and some lifecycle operations across websites, SSL, apps, containers, databases, nodes, and upgrades. However, it lacks notable operations such as website/database/SSL deletion, app install/uninstall, and cronjob management, leaving gaps for full 1Panel administration.

Maintenance

ActivityMaintained

ResponsivenessNo recent community issues

Resources

Related MCP Connectors

Speakeasy Platform MCP
com.speakeasy.ai
Secure and manage MCP servers through the Speakeasy AI Control Plane from your agent.
Developer Tools Security Agent Orchestration
1277
https://ai.speakeasy.com/platform-mcp
Meandr
com.meandr
MCP gateway and cloud hosting for MCP servers, agents and apps like RAG, managed from your agent.
Agent Orchestration Autonomous Agents Security
1
https://mcp.meandr.com
noBGP
com.nobgp
Private networking for AI agents: networks, nodes, commands, files, services via hosted MCP.
Networking & Infrastructure Agent Orchestration Command Line
1
https://mcp.nobgp.com/mcp
daemoon
io.github.jaylee7777
One PAT, any MCP agent: Vercel, GitHub, Cloudflare, Supabase, GCP — unified dev infra gateway.
Cloud Platforms Developer Tools CI/CD & DevOps
3
https://daemoon.dev/api/mcp

Related MCP Servers

SSH MCP Server
Shell Access Command Line Networking & Infrastructure
XNet-NGO
A
license
A
quality
D
maintenance
Enables AI assistants to perform comprehensive SSH operations including command execution, file transfers, port forwarding, and key management through a stateless, Docker-ready MCP server.
Updated 10 months ago (2026-01-21 15:06 UTC)
15
MIT
mcp-1panel
Developer Tools Virtualization Databases
Guoyin-Wen
A
license
Not graded
quality
D
maintenance
Full-featured MCP server for 1Panel server management panel. Provides 490+ tools for managing websites, databases, containers, files, and more through natural language.
Updated 4 months ago (2026-07-25 01:33 UTC)
MIT
Enterprise DevOps MCP Server
Shell Access Virtualization OS Automation
zhifengjin050-arch
A
license
Not graded
quality
B
maintenance
Enables AI agents to securely manage Linux, Docker, Kubernetes, and SSH infrastructure through MCP with permission control, audit logging, and dangerous command filtering.
Updated 8 days ago (2026-11-05 17:03 UTC)
MIT
1Panel MCP Server V1
Virtualization Networking & Infrastructure Cloud Platforms
ffdkj
A
license
D
quality
C
maintenance
Enables AI clients such as Claude Desktop, Cursor, and Claude Code to administer a 1Panel v1.x server through 257 MCP tools covering containers and images, apps and runtimes, files, backups, databases, websites, firewall, and monitoring. Supports both stdio and token-authenticated HTTP/SSE transports for local or remote access.
Updated 2 months ago (2026-09-13 12:18 UTC)
257
MIT

mcp-1panel-plus

Architecture

Security & Reliability Design

Quick Start

Prerequisites

Build from Source

MCP Client Configuration

1. Recommended: SSH Loopback Mode (stdio)

2. Codex (~/.codex/config.toml)

3. Direct HTTPS Mode (Without SSH)

4. Docker & Streamable HTTP Mode

Access Levels (PANEL_ACCESS_LEVEL / --access-level)

Complete Tool Catalog (39 Tools)

System & Multi-Node Discovery (3)

Websites, Reverse Proxy & HTTPS (11)

SSL Certificates (3)

App Store Updates & Lifecycle (8)

1Panel Self-Upgrade & Rollback (5)

Docker Containers (3)

Databases — MySQL & PostgreSQL (6)

Safe Multi-Node Panel Upgrade Workflow

Environment Variables Reference

License

Available Tools

Tool Schema Changelog

TDQS

Maintenance

Resources

Related MCP Connectors

Related MCP Servers

SSH MCP Server

mcp-1panel

Enterprise DevOps MCP Server

1Panel MCP Server V1

1. Recommended: SSH Loopback Mode (`stdio`)

2. Codex (`~/.codex/config.toml`)

Access Levels (`PANEL_ACCESS_LEVEL` / `--access-level`)