Provides tools for reissuing Let's Encrypt SSL certificates for domains and the server hostname, configuring ACME, and managing certificate-related operations.
Provides tools for interacting with Redis, likely for security or data-related management in the panel context.
Enables interaction with the DirectAdmin New JSON API defined by the bundled Swagger spec, allowing discovery of endpoints and execution of API operations.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@DirectAdmin MCP Server Reissue the Let's Encrypt cert for shop.example.com"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A production Model Context Protocol control plane for DirectAdmin. An AI agent (helpdesk, owner, or emergency sysadmin) talks to this process; the process talks to the panel. Every call is authenticated as a named hashed token, authorised by a profile (readonly / helpdesk / operator / break-glass), optionally confirmed, logged as structured JSON, rate-limited, and refused outside a maintenance window. SSL reissue and CSF/BFM unlock are first-class helpdesk actions — they are not the whole product.
The intended layout is an ops host, not an install on every DirectAdmin
server. Bind a read-only listener for inspection and a separate write
listener for approved changes (SSL reissue, CSF/BFM unlock). Per-server
facts such as CloudLinux and the policy profile live in inventory.json
on that host.
It covers the DirectAdmin New JSON API
(320 operations from the official swagger) and the legacy CMD_API_*
admin calls the New API still does not replace (create user, DNS, backups, BFM).
Read docs/agent.md and docs/tokens.md before pointing a model at production.
┌────────────┐ stdio / SSE ┌─────────────────────────┐ HTTPS ┌──────────────┐
│ Claude / │ ────────────► │ directadmin-mcp-server │ ──────► │ DirectAdmin │
│ Cursor / │ │ confirm · audit.jsonl │ key │ :2222 + CSF │
│ any MCP │ ◄──────────── │ │ │ │
└────────────┘ └─────────────────────────┘ └──────────────┘You say | Tool |
“Reissue the Let's Encrypt cert for shop.example.com” |
|
“The hostname cert expired, renew it” |
|
“Customer 203.0.113.44 is locked out of CSF” |
|
“Is that IP blocked? Why? Tell the customer.” |
|
“List users over quota” |
|
“Restart php-fpm74” |
|
Anything else in |
|
Write-shaped calls (delete, deny, restart, reissue, unblock, but
also add, set, update, import, deploy, …) require confirm=true.
The model must get an explicit go-ahead.
Related MCP server: cPanel MCP Server
Python 3.10+ (3.12 recommended) or Docker
DirectAdmin with API access and a login key (not the main password)
For CSF tools: the ConfigServer Security & Firewall DirectAdmin plugin
Network path from the MCP host to https://your-panel:2222
git clone https://github.com/OpenIaaS/directadmin-mcp-server.git
cd directadmin-mcp-server
python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt
cp .env.sample .env
# edit .env — DA_URL, DA_USERNAME, DA_LOGIN_KEYGenerate a login key in Admin Level → Account Manager → Login Keys. Restrict
it to this machine's IP. Put the key in .env:
DA_URL=https://panel.example.com:2222
DA_USERNAME=admin
DA_LOGIN_KEY=...
DA_SSL_VERIFY=trueClaude Desktop (claude_desktop_config.json):
{
"mcpServers": {
"directadmin": {
"command": "/absolute/path/to/directadmin-mcp/.venv/bin/python",
"args": ["/absolute/path/to/directadmin-mcp/server.py"],
"env": {
"DA_URL": "https://panel.example.com:2222",
"DA_USERNAME": "admin",
"DA_LOGIN_KEY": "your-login-key"
}
}
}
}Cursor / other MCP clients use the same command + args + env shape.
python -c "import secrets; print(secrets.token_urlsafe(48))" # MCP_AUTH_TOKEN
# put the token in .env, keep MCP_HOST=127.0.0.1
python main.pyPut Caddy or nginx in front with TLS. Clients send
Authorization: Bearer <MCP_AUTH_TOKEN> to /sse.
Do not put the token in the query string.
Docker (loopback only):
cp .env.sample .env # fill DA_* and MCP_AUTH_TOKEN
docker compose up -d --build
curl -sS http://127.0.0.1:8888/healthThe image runs as UID 10001, drops all capabilities, and uses a read-only root filesystem. See SECURITY.md.
Admin SSL icon (all customer domains, Pro Pack, not in the New API):
ssl_admin_list
ssl_admin_reissue domains=["shop.example.com","blog.example.com"] confirm=trueThis is CMD_ADMIN_SSL action=multiple — the same action as Admin Level →
Admin SSL. The login key must be allowed to run that command.
One domain (New API, DirectAdmin 1.660+ / current Evolution):
ssl_get_domain_acme_config domain=shop.example.com impersonate=alice
ssl_reissue_domain domain=shop.example.com impersonate=alice confirm=true
ssl_reissue_domain domain=shop.example.com dry_run=true
ssl_reissue_server confirm=truessl_reissue_domain is POST /api/domain-tls/{domain}/provision-certs.
ssl_reissue_server is POST /api/server-tls/obtain.
On older panels the same intent is ssl_reissue_domain_legacy (CMD_API_SSL
Let's Encrypt request). Always impersonate the owning user when you are
logged in as admin — domain TLS is a user-level resource.
Related: ssl_list_domain_certs, ssl_set_domain_acme_config,
ssl_upload_cert_files, ssl_create_csr, ssl_install_self_signed,
ssl_acme_dns_providers.
CSF is not in the New JSON API. These tools POST to the official plugin
/CMD_PLUGINS_ADMIN/csf/. The plugin must be installed.
An IP is often blocked in two places (LFD and DirectAdmin BFM). Use the combined tool when a customer is locked out:
csf_search_ip ip=203.0.113.44
bfm_ip_reason ip=203.0.113.44
ip_block_reason ip=203.0.113.44
firewall_unblock_everywhere ip=203.0.113.44 confirm=true
csf_unblock_ip ip=203.0.113.44 also_allow=true confirm=true
bfm_unblock_ip ip=203.0.113.44 confirm=truecsf_unblock_ip runs the plugin Quick Unblock (action=kill → csf -dr +
csf -tr + drop states). also_allow=true adds a 1-hour temporary allow so
the next handshake is not immediately re-banned.
Other CSF tools: csf_allow_ip, csf_deny_ip, csf_ignore_ip,
csf_flush_temp, csf_restart, csf_enable, csf_disable, csf_status.
csf_disable is denied by default (TOOL_DENYLIST + ENABLE_CSF_DISABLE=false). Unlock customers with firewall_unblock_everywhere instead.
Curated tools are grouped by module. Everything else is reachable with
da_api / da_legacy. Playbooks: docs/agent.md,
docs/operations.md, docs/ssl.md,
docs/csf.md, docs/propack.md,
docs/cloudlinux.md, docs/hardening.md,
docs/audit.md, docs/tokens.md.
Inventory: docs/tools.json (303 curated tools + 320 swagger ops).
Module | Tools (prefix) | Notes |
SSL |
| Domain + hostname ACME, reissue, upload |
CSF |
| Plugin; needs ENABLE_CSF=true |
BFM |
| Native panel blocks |
Accounts |
| New API + CMD_API_ACCOUNT_* |
Packages |
| User / reseller packages |
System |
| Version, OS updates, usage |
Services |
| start/stop/restart/reload/logs |
Settings |
| directadmin.conf |
Auth |
| Prefer scoped keys |
Security |
| WAF / AV |
Data |
| Admin day-2 |
Build |
| CustomBuild / apps |
Pro Pack |
| Unit + templates; no web terminal |
CloudLinux |
| Opt-in ( |
Policy |
| Live |
Audit |
| Who did what, when, in-window? |
Escape hatches |
| Full swagger |
da_api only accepts paths that exist in the bundled
tools/api_spec.json (exported from
https://demo.directadmin.com:2222/static/swagger.json). /api/execute is
blocked unless ENABLE_EXECUTE=true.
See .env.sample. Important knobs:
Variable | Default | Purpose |
| required |
|
| required | Login key, not the password |
| empty | Default login-as; prefer per-tool |
|
| Verify the panel certificate |
|
| HTTP bind |
| empty | Required for HTTP in production |
| empty | Optional client allow-list |
| empty / | Reduce blast radius |
|
| Destructive tools need |
|
| CSF plugin calls |
|
|
|
|
| Per client identity |
|
| Redacted JSON lines |
Read SECURITY.md. Short version:
Login key + IP restriction on the DirectAdmin side
Bearer token + loopback bind + TLS proxy on the MCP side
Confirm gate, allow/deny tool lists, no wildcard CORS
Secrets never written to logs
Docker: non-root, cap_drop: ALL, read-only root
If a token or key leaks, rotate both immediately. A login key that was pasted into a chat is burned.
pip install -r requirements-dev.txt
pytest -q
ruff check .Adding a curated tool: create a function in tools/, decorate with
@mcp.tool() + @log_tool_call, and validate inputs (validate_ip,
validate_domain, validate_username). @log_tool_call itself gates the
call on confirm=true when needs_confirm() says so — no per-tool
guard_confirm to remember.
The generic catalog picks up new swagger paths when you replace
tools/api_spec.json with a fresh export from your own panel
(/static/swagger.json).
Transport | File | When |
stdio |
| Claude Desktop, Cursor, local agents |
SSE |
| Older remote MCP clients |
HTTP health / tool list |
|
|
Tested against the official New API swagger (info.version = 1.0, 269 paths /
320 operations). Legacy calls follow
docs.directadmin.com/developer/api/legacy-api.html.
MIT. Use it, modify it, and ship it with your panel tooling.
This repository is an independent implementation, first published by OpenIaaS in August 2026. A 2025 MIT release (omryatia/directadmin-mcp) supplied the original layout — entrypoints and module names. That starting point is preserved as a derivative-work notice in LICENSE. As of 20 August 2026 it is a small fraction of the tree: about one in twenty of the original unique code lines still appear verbatim; the Python sources are roughly three and a half times larger, and the domain tools (SSL, CSF, policy, audit) are new.
With thanks to the DirectAdmin community — the documentation, the forum, and the operators who have been running these boxes for 23+ years.
Create another admin account.
Args: username: New admin. email: Contact email. password: Initial password. notify: Send welcome email. confirm: Required.
Inputs: email (required), password (required), username (required), notify, +1 more. Returns: result
List all admin accounts.
Inputs: no named parameters. Returns: result
Current admin's resource usage.
Inputs: no named parameters. Returns: result
Last N audit events (newest first). Same log as audit_search.
Inputs: limit. Returns: result
Search the structured MCP audit log.
Answers: which agent restarted which service, who triggered an update, whether a call was denied by policy or outside the maintenance window.
Args: tool: Tool name or prefix (services_restart, ssl_). actor: Agent id (X-Agent-Id / MCP_ACTOR). event: tool_call, tool_ok, tool_denied, tool_window_denied, … query: Substring match on the redacted JSON line. since: ISO timestamp (inclusive). until: ISO timestamp (inclusive). limit: Max rows (1–200).
Inputs: tool, actor, event, limit, +3 more. Returns: result
List admin-level backups / backup settings.
Inputs: no named parameters. Returns: result
Kick an admin-level backup now.
Args: who: all | or a username. where: Destination the panel understands. confirm: Required.
Inputs: who, where, confirm. Returns: result
Create a backup for one user.
Args: username: Account to back up. where: Backup destination the panel understands (local / ftp / …). confirm: Required.
Inputs: username (required), where, confirm. Returns: result
Restore a user from a local backup file.
Args: username: Account to restore into. file: Backup filename as listed by the panel. confirm: Required.
Inputs: file (required), username (required), confirm. Returns: result
Why Brute Force Monitor listed this IP (service, user, attempts, log line).
Returns operator reason and customer_message (en + bg) you can paste
to the client. Prefer ip_block_reason when you also need the CSF/LFD side.
Args: ip: IPv4 or IPv6 to explain.
Inputs: ip (required). Returns: result
List Brute Force Monitor state (blocked IPs, failed logins).
For one IP use bfm_ip_reason — that is the 'why was this blocked' view.
Args: blocked_only: Hint for the client; the panel still returns the full JSON.
Inputs: blocked_only. Returns: result
Add an IP to the BFM skip / never-block list.
Args: ip: Address to skip. confirm: Required.
Inputs: ip (required), confirm. Returns: result
Remove an IP from DirectAdmin Brute Force Monitor blocks.
Use together with csf_unblock_ip — an IP is often listed in BOTH places.
Args: ip: IPv4 or IPv6 to unblock. confirm: Required.
Inputs: ip (required), reason, confirm, idempotency_key. Returns: result
Available CustomBuild actions.
Inputs: no named parameters. Returns: result
Kill a running CustomBuild job.
Args: confirm: Required.
Inputs: confirm. Returns: result
CustomBuild log names.
Inputs: no named parameters. Returns: result
CustomBuild options (options.conf).
Inputs: no named parameters. Returns: result
Patch CustomBuild options.
Args: values: Options object. confirm: Required.
Inputs: values (required), confirm. Returns: result
Software CustomBuild can remove.
Inputs: no named parameters. Returns: result
Start a CustomBuild run (build / update / rewrite).
Args: payload: Run arguments (action, software, …). confirm: Required.
Inputs: confirm, payload. Returns: result
Installed / available software.
Inputs: no named parameters. Returns: result
CustomBuild current state.
Inputs: no named parameters. Returns: result
Available CustomBuild updates.
Inputs: no named parameters. Returns: result
Component versions.
Inputs: no named parameters. Returns: result
Kill a running ClamAV scan.
Args: pid: Process id from clamav_status. confirm: Required.
Inputs: pid (required), confirm. Returns: result
Start a ClamAV scan.
Args: payload: Scan options as the panel expects. confirm: Required.
Inputs: confirm, payload. Returns: result
ClamAV status / start a scan (GET).
Inputs: no named parameters. Returns: result
Disable CageFS for one user. The account leaves the cage.
Args: username: Account. confirm: Required.
Inputs: username (required), confirm. Returns: result
Enable CageFS for one user.
Args: username: Account. confirm: Required.
Inputs: username (required), confirm. Returns: result
LVE limits for one user.
Args: username: DirectAdmin account.
Inputs: username (required). Returns: result
Set LVE limits for one user (CPU/RAM/IO/processes).
Only numeric values, percents, or 'unlimited'. This is the CloudLinux equivalent of Pro Pack cgroups throttle.
Args: username: Account. speed: CPU (e.g. 100% or 200). pmem: Physical memory (e.g. 1024 or 1G-style numbers the plugin accepts as digits). io: Disk IO. nproc: Max processes. ep: Entry processes. iops: IOPS. confirm: Required.
Inputs: username (required), ep, io, iops, +4 more. Returns: result
List LVE users / current limits (LVE Manager action=users).
Inputs: no named parameters. Returns: result
Read CloudLinux PHP Selector for a user (plugin).
On non-CL boxes use domains_set_php (DirectAdmin PHP selector) instead.
Args: username: Account.
Inputs: username (required). Returns: result
Set CloudLinux PHP Selector version for a user.
Args: username: Account. version: alt-php version the plugin understands (e.g. 8.2, 8.3, native). confirm: Required.
Inputs: version (required), username (required), confirm. Returns: result
Detect CloudLinux / LVE Manager on this box.
Reads the plugin list and pings LVE Manager. Does not change anything.
Inputs: no named parameters. Returns: result
Check a remote cPanel server before import.
Args: payload: Host / credentials body.
Inputs: payload (required). Returns: result
cPanel import tasks.
Inputs: no named parameters. Returns: result
Create a cron job.
Args: minute: Cron minute (0-59 or *). hour: Cron hour. day_of_month: Day of month. month: Month. day_of_week: Day of week. command: Command to run (no shell metachar redirection from untrusted input). impersonate: Owning user. confirm: Required.
Inputs: hour (required), month (required), minute (required), command (required), +4 more. Returns: result
Delete a cron job by its panel id / select key.
Args: job_id: Id from cron_list (select0 value). impersonate: Owning user. confirm: Required.
Inputs: job_id (required), confirm, impersonate. Returns: result
List cron jobs for the current (or impersonated) user.
Args: impersonate: Owning user.
Inputs: impersonate. Returns: result
Whitelist an IP in CSF (csf -a / temporary allow).
Allowed IPs bypass closed ports but LFD can still block them unless ignored.
Args: ip: IPv4, IPv6, or CIDR. comment: Note stored with the rule. temporary: Use a TTL instead of a permanent allow. ttl_seconds: Lifetime when temporary=true. confirm: Required.
Inputs: ip (required), comment, confirm, temporary, +1 more. Returns: result
Block an IP in CSF (csf -d / temporary deny).
Args: ip: IPv4, IPv6, or CIDR. comment: Note stored with the rule. temporary: Use a TTL instead of a permanent deny. ttl_seconds: Lifetime when temporary=true. confirm: Required.
Inputs: ip (required), comment, confirm, temporary, +1 more. Returns: result
Disable CSF (csf -x). Dangerous — the host is unprotected until re-enabled.
Blocked unless ENABLE_CSF_DISABLE=true. Prefer csf_unblock_ip instead.
Args: confirm: Required.
Inputs: confirm. Returns: result
Enable CSF (csf -e).
Args: confirm: Required.
Inputs: confirm. Returns: result
Flush all CSF temporary allow/deny rules (csf -tf).
Args: confirm: Required.
Inputs: confirm. Returns: result
Add an IP to csf.ignore so LFD never blocks it.
Args: ip: IPv4, IPv6, or CIDR. comment: Note. confirm: Required.
Inputs: ip (required), comment, confirm. Returns: result
Why CSF/LFD listed this IP (list + LFD comment). Safe to show an operator.
Parses csf -g via the plugin. Typical comment:
lfd: (sshd) Failed SSH login … 8 in the last 3600 secs.
Pair with bfm_ip_reason or use ip_block_reason for both + a customer text.
Args: ip: IPv4 or IPv6.
Inputs: ip (required). Returns: result
Remove an IP from the CSF allow list (csf -ar).
Args: ip: Address to remove. confirm: Required.
Inputs: ip (required), confirm. Returns: result
Restart CSF, and optionally LFD.
Args: also_lfd: Restart both csf and lfd (csf -ra). confirm: Required.
Inputs: confirm, also_lfd. Returns: result
Search CSF/iptables/LFD for an IP (csf -g). Shows why it is blocked.
Args: ip: IPv4 or IPv6 address.
Inputs: ip (required). Returns: result
Best-effort CSF plugin landing / status page (HTML or structured).
Inputs: no named parameters. Returns: result
Unblock an IP in CSF/LFD (permanent deny + temporary ban).
This is the primary 'unlock from firewall' action. It:
Runs the plugin Quick Unblock (action=kill) — csf -dr + csf -tr + drop states
Also sends qrm when the plugin supports it
Optionally adds a temporary allow so the next connection is not re-banned
Pair with bfm_unblock_ip if DirectAdmin Brute Force Monitor also listed the IP.
Args: ip: IPv4 or IPv6 to unblock. also_allow: After unblock, temporarily whitelist the IP. allow_ttl_seconds: TTL for the optional temporary allow (default 1h). comment: Note stored next to the allow rule. confirm: Required.
Inputs: ip (required), reason, comment, confirm, +3 more. Returns: result
Call any documented DirectAdmin New API endpoint.
Use this for operations that do not yet have a dedicated curated tool. The path must exist in the bundled swagger. /api/execute is blocked unless ENABLE_EXECUTE=true.
Args: method: GET POST PUT PATCH DELETE path: Template from da_list_endpoints (keep {placeholders}). path_params: Values for {placeholders}. query: Query string parameters. body: JSON body for non-GET requests. impersonate: Optional user to act as. confirm: Required for destructive methods / paths.
Inputs: path (required), method (required), body, query, +3 more. Returns: result
Currently applied directadmin.conf (merged).
Inputs: no named parameters. Returns: result
Default directadmin.conf values.
Inputs: no named parameters. Returns: result
Local overrides in directadmin.conf.
Inputs: no named parameters. Returns: result
Patch selected directadmin.conf keys.
Args: values: Partial local config. confirm: Required.
Inputs: values (required), confirm. Returns: result
Replace local directadmin.conf overrides (PUT).
Args: values: Full local config object as the panel expects. confirm: Required.
Inputs: values (required), confirm. Returns: result
Show parameters for one New API operation.
Args: method: HTTP method. path: Path template, e.g. /api/domain-tls/{domain}/provision-certs
Inputs: path (required), method (required). Returns: result
Call a legacy CMD_API_* / CMD_* endpoint.
Only commands that start with CMD_API_ or CMD_ are accepted.
Args: command: e.g. CMD_API_SHOW_ALL_USERS or /CMD_API_SSL method: GET or POST data: Form fields. json=yes is added automatically. impersonate: Optional user. confirm: Required for POST.
Inputs: command (required), data, method, confirm, +1 more. Returns: result
List New API operations bundled with this server (from official swagger).
Args: prefix: Path prefix filter, e.g. /api/domain-tls or /api/users. method: Optional HTTP method filter (GET/POST/…).
Inputs: method, prefix. Returns: result
Connectivity check — hits /api/version.
Inputs: no named parameters. Returns: result
Change a database user password.
Args: dbuser: Name. password: New password. confirm: Required.
Inputs: dbuser (required), password (required), confirm. Returns: result
Check a database.
Args: database: Name.
Inputs: database (required). Returns: result
Create a database.
Args: payload: Create body (name, charset, …). confirm: Required.
Inputs: payload (required), confirm. Returns: result
Create a database user.
Args: payload: User body. confirm: Required.
Inputs: payload (required), confirm. Returns: result
Create a database and a user in one call.
Args: payload: Combined create body. confirm: Required.
Inputs: payload (required), confirm. Returns: result
Drop a database.
Args: database: Name. confirm: Required.
Inputs: database (required), confirm. Returns: result
Drop a database user.
Args: dbuser: Name. confirm: Required.
Inputs: dbuser (required), confirm. Returns: result
Details for one database.
Args: database: Database name.
Inputs: database (required). Returns: result
Database server info.
Inputs: no named parameters. Returns: result
Kill a database process.
Args: process_id: Process id. confirm: Required.
Inputs: process_id (required), confirm. Returns: result
List databases visible to the current/impersonated account.
Inputs: no named parameters. Returns: result
Optimize a database.
Args: database: Name. confirm: Required.
Inputs: database (required), confirm. Returns: result
Show process list (admin).
Inputs: no named parameters. Returns: result
Repair a database.
Args: database: Name. confirm: Required.
Inputs: database (required), confirm. Returns: result
SQL server connection settings used by the panel.
Inputs: no named parameters. Returns: result
Test the configured SQL connection.
Inputs: no named parameters. Returns: result
Update SQL server settings.
Args: values: Config object. confirm: Required.
Inputs: values (required), confirm. Returns: result
One database user.
Args: dbuser: DB username.
Inputs: dbuser (required). Returns: result
List database users.
Inputs: no named parameters. Returns: result
List DNS zones (admin).
Inputs: no named parameters. Returns: result
Add a DNS record.
Args: domain: Zone. record_type: A | AAAA | CNAME | MX | TXT | NS | SRV | CAA … name: Record name (use @ or the domain for the apex). value: Record value. ttl: TTL seconds. confirm: Required.
Inputs: name (required), value (required), domain (required), record_type (required), +2 more. Returns: result
Delete a DNS record.
Args: domain: Zone. record_type: Type. name: Name. value: Value (required by most DA versions). confirm: Required.
Inputs: name (required), domain (required), record_type (required), value, +1 more. Returns: result
Get records for a zone.
Args: domain: Zone name.
Inputs: domain (required). Returns: result
Add a domain pointer / alias.
Args: domain: Existing parent domain. from_domain: New hostname that should point at the parent. alias: True = alias (same site), False = pointer (redirect). impersonate: Owning user. confirm: Required.
Inputs: domain (required), from_domain (required), alias, confirm, +1 more. Returns: result
Remove a domain pointer.
Args: domain: Parent domain. pointer: Pointer hostname. impersonate: Owning user. confirm: Required.
Inputs: domain (required), pointer (required), confirm, impersonate. Returns: result
List domain pointers (aliases) for a domain.
Args: domain: Parent domain. impersonate: Owning user.
Inputs: domain (required), impersonate. Returns: result
Create an additional domain on the current (or impersonated) user.
Args: domain: FQDN to add. bandwidth: MB or 'unlimited'. quota: MB or 'unlimited'. ssl: Enable SSL for the domain. cgi: Enable CGI. php: Enable PHP. impersonate: Owning user (admin should set this). confirm: Required.
Inputs: domain (required), cgi, php, ssl, +4 more. Returns: result
Delete a domain from an account.
Args: domain: Domain to remove. impersonate: Owning user. confirm: Required.
Inputs: domain (required), confirm, impersonate. Returns: result
List domains owned by a user (admin) or the current account.
Args: username: Optional account. Empty = current session (CMD_API_SHOW_DOMAINS).
Inputs: username. Returns: result
Set the PHP version selector for a domain.
Args: domain: Domain. php1_select: Selector index from the panel (often '1', '2', … mapping to php versions). impersonate: Owning user. confirm: Required.
Inputs: domain (required), php1_select (required), confirm, impersonate. Returns: result
List autoresponders on a domain.
Args: domain: Domain. impersonate: Owning user.
Inputs: domain (required), impersonate. Returns: result
Create an email forwarder.
Args: domain: Domain. user: Local part (source). destination: Destination address or comma-separated list. impersonate: Owning user. confirm: Required.
Inputs: user (required), domain (required), destination (required), confirm, +1 more. Returns: result
Delete a forwarder.
Args: domain: Domain. user: Local part. impersonate: Owning user. confirm: Required.
Inputs: user (required), domain (required), confirm, impersonate. Returns: result
List forwarders on a domain.
Args: domain: Domain. impersonate: Owning user.
Inputs: domain (required), impersonate. Returns: result
Global email logs (admin).
Inputs: no named parameters. Returns: result
Email log summary.
Inputs: no named parameters. Returns: result
Current/impersonated user email logs.
Inputs: no named parameters. Returns: result
Apple mobileconfig for the current email account.
Inputs: no named parameters. Returns: result
Outbound email filter settings.
Inputs: no named parameters. Returns: result
Update outbound email filter.
Args: values: Filter object. confirm: Required.
Inputs: values (required), confirm. Returns: result
Create a mailbox (user@domain).
Args: domain: Domain. user: Local part only (before @). password: Mailbox password. quota_mb: 0 = unlimited. impersonate: Owning user. confirm: Required.
Inputs: user (required), domain (required), password (required), confirm, +2 more. Returns: result
Delete a mailbox.
Args: domain: Domain. user: Local part. impersonate: Owning user. confirm: Required.
Inputs: user (required), domain (required), confirm, impersonate. Returns: result
List POP/IMAP accounts on a domain.
Args: domain: Domain. full: Use action=full_list (quota + usage) when true. impersonate: Owning user.
Inputs: domain (required), full, impersonate. Returns: result
Change mailbox password and/or quota.
Args: domain: Domain. user: Local part. password: New password (empty = leave unchanged). quota_mb: New quota; -1 = leave unchanged, 0 = unlimited. impersonate: Owning user. confirm: Required.
Inputs: user (required), domain (required), confirm, password, +2 more. Returns: result
Global email / exim configuration.
Inputs: no named parameters. Returns: result
Update global email configuration.
Args: values: Config object. confirm: Required.
Inputs: values (required), confirm. Returns: result
Delete a vacation message.
Args: domain: Domain. user: Local part. confirm: Required.
Inputs: user (required), domain (required), confirm. Returns: result
One vacation message.
Args: domain: Domain. user: Local part.
Inputs: user (required), domain (required). Returns: result
Vacation / autoresponder list for a domain.
Args: domain: Domain.
Inputs: domain (required). Returns: result
Create/update a vacation message.
Args: domain: Domain. user: Local part. values: Vacation body. confirm: Required.
Inputs: user (required), domain (required), values (required), confirm. Returns: result
Unblock an IP in CSF and DirectAdmin Brute Force Monitor.
This is the 'customer is locked out' button. It does not disable the firewall.
Args: ip: IPv4 or IPv6. also_allow: Also add a temporary CSF allow (1 hour). confirm: Required.
Inputs: ip (required), reason, confirm, also_allow, +1 more. Returns: result
Change permissions.
Args: payload: Paths + mode. confirm: Required.
Inputs: payload (required), confirm. Returns: result
Copy files.
Args: payload: Source/destination body. confirm: Required.
Inputs: payload (required), confirm. Returns: result
Disk usage for a path.
Args: path: Path.
Inputs: path. Returns: result
List a directory.
Args: path: Absolute path inside the account home.
Inputs: path. Returns: result
Create a directory.
Args: path: New directory path. confirm: Required.
Inputs: path (required), confirm. Returns: result
Move files.
Args: payload: Source/destination body. confirm: Required.
Inputs: payload (required), confirm. Returns: result
Move paths to trash (or delete, depending on panel settings).
Args: paths: List of paths. confirm: Required.
Inputs: paths (required), confirm. Returns: result
Search file names.
Args: query: Filename fragment. path: Root to search.
Inputs: query (required), path. Returns: result
Search file contents.
Args: query: Text. path: Root to search.
Inputs: query (required), path. Returns: result
List trash.
Inputs: no named parameters. Returns: result
Directory tree.
Args: path: Starting path.
Inputs: path. Returns: result
Create an FTP account.
Args: domain: Domain. user: FTP username (local part). password: FTP password. path_type: domain | ftp | user | custom custom_path: Required when path_type=custom. impersonate: Owning user. confirm: Required.
Inputs: user (required), domain (required), password (required), confirm, +3 more. Returns: result
Delete an FTP account.
Args: domain: Domain. user: FTP username. impersonate: Owning user. confirm: Required.
Inputs: user (required), domain (required), confirm, impersonate. Returns: result
List FTP accounts for a domain.
Args: domain: Domain. impersonate: Owning user.
Inputs: domain (required), impersonate. Returns: result
Trigger a git deploy.
Args: uuid: Application uuid. confirm: Required.
Inputs: uuid (required), confirm. Returns: result
Fetch remotes for a git application.
Args: uuid: Application uuid.
Inputs: uuid (required). Returns: result
One git application.
Args: uuid: Application uuid.
Inputs: uuid (required). Returns: result
List git applications on a domain.
Args: domain: Domain.
Inputs: domain (required). Returns: result
Create or rotate the deploy webhook for a git application.
Args: username: Owning user. uuid: Application uuid. confirm: Required — webhook URLs are secrets.
Inputs: uuid (required), username (required), confirm. Returns: result
Change the server hostname.
Args: hostname: New FQDN. confirm: Required. Reissue the hostname SSL afterwards with ssl_reissue_server.
Inputs: hostname (required), confirm. Returns: result
Cancel a running IMAP migration.
Args: migration_id: Id from imapsync_migrations. confirm: Required.
Inputs: migration_id (required), confirm. Returns: result
Export mail from this box to a remote IMAP server.
Args: payload: Panel imapsync export body. confirm: Required.
Inputs: payload (required), confirm. Returns: result
Import mail from a remote IMAP server into this box.
Args: payload: Panel imapsync import body (host, user, password, dest). confirm: Required. Passwords in the payload are redacted in logs.
Inputs: payload (required), confirm. Returns: result
IMAP migration tasks.
Inputs: no named parameters. Returns: result
Look up one server in the hops inventory.
Args: server_id: id from inventory_list.
Inputs: server_id (required). Returns: result
Fleet catalog on the hops host (no secrets). Who has CloudLinux, which profile.
Inputs: no named parameters. Returns: result
The DirectAdmin box this MCP process is wired to.
Inputs: no named parameters. Returns: result
Why this IP is blocked — CSF/LFD and Brute Force Monitor together.
This is the tool to call when the operator (or the customer) asks "защо е блокиран". Read-only. Returns:
operator_reason: technical (lists, LFD comment, BFM log line)
customer_message.en / .bg: paste-ready, no host paths
If there is no recorded reason, says so instead of inventing one.
Args: ip: IPv4 or IPv6.
Inputs: ip (required). Returns: result
Add an IP to the admin IP manager.
Args: ip: Address to add. netmask: Netmask (IPv4) or prefix hint. confirm: Required.
Inputs: ip (required), confirm, netmask. Returns: result
Admin-level IP list (CMD_API_IP_MANAGER).
Inputs: no named parameters. Returns: result
Assign an IP to a reseller/user.
Args: ip: Address. username: Destination account. confirm: Required.
Inputs: ip (required), username (required), confirm. Returns: result
Details for one IP.
Args: ip: Address.
Inputs: ip (required). Returns: result
List IPs visible to this reseller/admin.
Inputs: no named parameters. Returns: result
Remove an IP from the admin IP manager.
Args: ip: Address to remove. confirm: Required.
Inputs: ip (required), confirm. Returns: result
DirectAdmin license details.
Inputs: no named parameters. Returns: result
License proof document.
Inputs: no named parameters. Returns: result
Install a new license key.
Args: key: License key. confirm: Required.
Inputs: key (required), confirm. Returns: result
Current account login history.
Inputs: no named parameters. Returns: result
Commands a login key can be restricted to.
Inputs: no named parameters. Returns: result
Create a login key. Prefer IP-restricted, command-restricted keys.
Args: payload: Create body as documented by /api/login-keys/keys (name, expires, ips, commands, …). confirm: Required.
Inputs: payload (required), confirm. Returns: result
Delete a login key.
Args: key_id: Key id. confirm: Required.
Inputs: key_id (required), confirm. Returns: result
Get one login key.
Args: key_id: Key id.
Inputs: key_id (required). Returns: result
Usage history for a login key.
Args: key_id: Key id.
Inputs: key_id (required). Returns: result
List login keys on the current account.
Inputs: no named parameters. Returns: result
Update a login key.
Args: key_id: Key id. payload: Patch body. confirm: Required.
Inputs: key_id (required), payload (required), confirm. Returns: result
Create a one-shot panel login URL (POST /api/login/url).
Args: payload: Optional body the panel expects.
Inputs: payload. Returns: result
Create a login URL.
Args: payload: Create body. confirm: Required.
Inputs: payload (required), confirm. Returns: result
Delete a login URL.
Args: url_id: URL id. confirm: Required.
Inputs: url_id (required), confirm. Returns: result
List one-time / login-as URLs.
Inputs: no named parameters. Returns: result
Run a maintenance check.
Args: task: Task id from maintenance_list.
Inputs: task (required). Returns: result
Apply a maintenance fix.
Args: task: Task id. confirm: Required.
Inputs: task (required), confirm. Returns: result
Maintenance tasks / health checks the panel exposes.
Inputs: no named parameters. Returns: result
Read one message.
Args: message_id: Message id.
Inputs: message_id (required). Returns: result
Message center list.
Inputs: no named parameters. Returns: result
Disable MFA.
Args: payload: Usually includes the current password / OTP. confirm: Required.
Inputs: confirm, payload. Returns: result
Enable multi-factor authentication on the current account.
Args: payload: Panel-specific body (otp, password, …). confirm: Required.
Inputs: confirm, payload. Returns: result
Generate a new TOTP secret (enrolment).
Inputs: no named parameters. Returns: result
List MFA recovery codes.
Inputs: no named parameters. Returns: result
All ModSecurity per-host configs.
Inputs: no named parameters. Returns: result
One ModSecurity audit entry.
Args: entry_id: Optional entry identifier (query).
Inputs: entry_id. Returns: result
ModSecurity audit log summary.
Inputs: no named parameters. Returns: result
Global ModSecurity configuration.
Inputs: no named parameters. Returns: result
Update global ModSecurity configuration.
Args: values: Config object. confirm: Required.
Inputs: values (required), confirm. Returns: result
ModSecurity config for one hostname.
Args: hostname: vhost name.
Inputs: hostname (required). Returns: result
Current user's ModSecurity configs.
Inputs: no named parameters. Returns: result
Apply a Pro Pack Nginx CMS template (WordPress, Drupal, FastCGI cache, …).
Args: domain: Domain. template: wordpress | wordpress_cache | drupal | joomla | magento | laravel | default | none impersonate: Owning user. confirm: Required.
Inputs: domain (required), template (required), confirm, impersonate. Returns: result
List reseller packages (legacy), or one package.
Args: package: Optional package name.
Inputs: package. Returns: result
Reseller packages via the New API.
Args: package: Optional package name for /api/reseller-packages/{package}.
Inputs: package. Returns: result
Delete a user package.
Args: package: Package name. confirm: Required.
Inputs: package (required), confirm. Returns: result
List user packages, or show one package.
Args: package: Optional package name.
Inputs: package. Returns: result
Create or overwrite a user package.
Args: name: Package name. bandwidth: MB or unlimited. quota: MB or unlimited. vdomains: Domain limit or unlimited. nemails: Mailbox limit or unlimited. mysql: Database limit or unlimited. php: ON | OFF ssl: ON | OFF cgi: ON | OFF confirm: Required.
Inputs: name (required), cgi, php, ssl, +6 more. Returns: result
Create a phpMyAdmin SSO session.
Args: database: Optional database name for database-scoped SSO.
Inputs: database. Returns: result
Activate a plugin.
Args: plugin_id: Plugin id. confirm: Required.
Inputs: plugin_id (required), confirm. Returns: result
Deactivate a plugin.
Args: plugin_id: Plugin id. confirm: Required.
Inputs: plugin_id (required), confirm. Returns: result
Uninstall a plugin.
Args: plugin_id: Plugin id. confirm: Required.
Inputs: plugin_id (required), confirm. Returns: result
Install a plugin from a URL.
Args: url: https URL to a .tar.gz plugin. confirm: Required.
Inputs: url (required), confirm. Returns: result
Installed plugins (user-facing list).
Inputs: no named parameters. Returns: result
Plugin manager inventory (admin).
Inputs: no named parameters. Returns: result
Update a plugin from its update_url.
Args: plugin_id: Plugin id. confirm: Required.
Inputs: plugin_id (required), confirm. Returns: result
Show which optional capabilities are on.
A denied tool means the matching ENABLE_* flag is false. Do not try to bypass it. Ask the operator to flip the flag on the host if they want that class of action.
Inputs: no named parameters. Returns: result
Current profile settings.
Inputs: no named parameters. Returns: result
Patch profile settings.
Args: values: Partial settings object.
Inputs: values (required). Returns: result
Map every Pro Pack feature to the curated tool that covers it.
Modern licenses include Pro Pack. Web Terminal is intentionally not wrapped.
Inputs: no named parameters. Returns: result
Create a site redirect.
Args: domain: Domain. path: Source path (e.g. /old). destination: Target URL. redirect_type: 301 | 302 | 303. impersonate: Owning user. confirm: Required.
Inputs: path (required), domain (required), destination (required), confirm, +2 more. Returns: result
List site redirects for a domain.
Args: domain: Domain. impersonate: Owning user.
Inputs: domain (required), impersonate. Returns: result
Disable Redis.
Args: confirm: Required.
Inputs: confirm. Returns: result
Enable Redis for the current/impersonated user.
Args: confirm: Required.
Inputs: confirm. Returns: result
Per-user Redis status.
Inputs: no named parameters. Returns: result
Demote a reseller to a regular user.
Args: username: Reseller to demote. confirm: Required.
Inputs: username (required), confirm. Returns: result
Create a reseller from a reseller package.
Args: username: New reseller. email: Contact email. password: Initial password. domain: Primary domain. package: Reseller package name. ip: shared | sharedreseller | assign. notify: Send welcome email. confirm: Required.
Inputs: email (required), domain (required), package (required), password (required), +4 more. Returns: result
Reseller configuration.
Args: username: Reseller name.
Inputs: username (required). Returns: result
Combined reseller + owned-users usage.
Args: username: Reseller name.
Inputs: username (required). Returns: result
List all reseller accounts.
Inputs: no named parameters. Returns: result
Search panel resources (domains, dbs, emails, …).
Args: q: Query.
Inputs: q (required). Returns: result
security.txt status.
Inputs: no named parameters. Returns: result
Details for one service.
Args: service: Service name (e.g. httpd, exim, dovecot, named, proftpd).
Inputs: service (required). Returns: result
List managed services (httpd, exim, dovecot, named, …).
Inputs: no named parameters. Returns: result
Read a service log.
Args: service: Service name. cursor: Pagination cursor from a previous response. limit: Max lines. level: Optional log level filter.
Inputs: service (required), level, limit, cursor. Returns: result
Reload a service configuration.
Args: service: Service name. confirm: Required.
Inputs: service (required), confirm. Returns: result
Restart a service.
Args: service: Service name. confirm: Required.
Inputs: service (required), confirm. Returns: result
Start a service.
Args: service: Service name. confirm: Required.
Inputs: service (required), confirm. Returns: result
Stop a service.
Args: service: Service name. confirm: Required.
Inputs: service (required), confirm. Returns: result
Toggle the service watchdog.
Args: service: Service name. enabled: True to watch, False to stop watching. confirm: Required.
Inputs: enabled (required), service (required), confirm. Returns: result
Current session (who am I, level, selected domain).
Inputs: no named parameters. Returns: result
Switch the session into another account (login-as).
Prefer the impersonate= argument on individual tools — it does not mutate the long-lived session.
Args: username: Account to impersonate. confirm: Required.
Inputs: username (required), confirm. Returns: result
Leave a login-as session and return to the admin.
Inputs: no named parameters. Returns: result
Search users available for login-as.
Args: q: Query. limit: Max rows.
Inputs: q, limit. Returns: result
Current reseller config (when logged in as reseller/admin).
Inputs: no named parameters. Returns: result
Destroy one other session.
Args: public_id: Session public id. confirm: Required.
Inputs: public_id (required), confirm. Returns: result
Destroy every other session (force logout everywhere else).
Args: confirm: Required.
Inputs: confirm. Returns: result
List active sessions for this account.
Inputs: no named parameters. Returns: result
Session UI state.
Inputs: no named parameters. Returns: result
Switch the active domain in the session.
Args: domain: Domain to select.
Inputs: domain (required). Returns: result
Current account user.conf.
Inputs: no named parameters. Returns: result
Current account usage.
Inputs: no named parameters. Returns: result
List ACME DNS-01 providers the panel knows about (Cloudflare, …).
Inputs: no named parameters. Returns: result
Read admin_ssl_* and letsencrypt_* flags from directadmin.conf.
These control the automatic Admin SSL poller (install-to-missing, replace-expired, cert-on-create). Change them with da_config_local_patch.
Inputs: no named parameters. Returns: result
List every user/domain certificate the Admin SSL page shows.
This is the Admin Level → Admin SSL overview (CMD_ADMIN_SSL?json=yes). It is not in the New JSON API. Requires Pro Pack and a login key that is allowed to run CMD_ADMIN_SSL.
Use this to see which customer domains are missing, expired, or valid before calling ssl_admin_reissue.
Inputs: no named parameters. Returns: result
Request Let's Encrypt certificates for selected customer domains.
This is the Admin SSL icon action: POST CMD_ADMIN_SSL action=multiple. The panel queues ACME in the background (dataskq) — no impersonation. Prefer this when an operator says “reissue SSL for these clients” from the Admin SSL page.
For a single domain on a modern panel, ssl_reissue_domain (New API, impersonate the owner) is more precise.
Args: domains: Customer domain names as listed by ssl_admin_list (max 50). wildcard: Request *.domain (dns-01). Default is http-01 / per-host. confirm: Required.
Inputs: domains (required), reason, confirm, wildcard, +1 more. Returns: result
Create a CSR for a domain certificate slot (commercial CA flow).
Args: domain: Domain. cert_id: Certificate id. common_name: CN, defaults to the domain. impersonate: Owning user.
Inputs: domain (required), cert_id (required), common_name, impersonate. Returns: result
Delete one certificate from a domain.
Args: domain: Domain. cert_id: Certificate id from ssl_list_domain_certs. update_acme_skiplist: Let ACME manage this name again after delete. impersonate: Owning user. confirm: Required.
Inputs: domain (required), cert_id (required), confirm, impersonate, +1 more. Returns: result
Download certificate + chain + key files for a domain cert id.
The private key is returned by DirectAdmin — treat the response as secret.
Args: domain: Domain. cert_id: Certificate id. impersonate: Owning user.
Inputs: domain (required), cert_id (required), impersonate. Returns: result
Read ACME (Let's Encrypt / ZeroSSL) configuration for a domain.
Args: domain: Fully-qualified domain. impersonate: Optional user to act as.
Inputs: domain (required), impersonate. Returns: result
Install a self-signed certificate on a domain (lab / placeholder only).
Args: domain: Domain. cert_id: Certificate id. dns_names: SANs. Defaults to [domain]. key_type: rsa2048 | rsa4096 | ec256 | ec384 overwrite: Replace existing material. impersonate: Owning user. confirm: Required.
Inputs: domain (required), cert_id (required), confirm, key_type, +3 more. Returns: result
List TLS certificates installed on a user domain.
Args: domain: Fully-qualified domain (example.com). impersonate: Optional user to act as (admin login-as).
Inputs: domain (required), impersonate. Returns: result
Reissue / provision the Let's Encrypt (or configured ACME) certificate for a domain.
This is the primary 'renew/reissue SSL' action. It calls POST /api/domain-tls/{domain}/provision-certs (or the dry-run sibling). DirectAdmin must have ACME enabled for the domain — use ssl_get_domain_acme_config first if you are unsure. For hostname/server certs use ssl_reissue_server.
Args: domain: Fully-qualified domain to reissue. impersonate: User that owns the domain (recommended for admin). dry_run: If true, validate only — do not hit the CA. confirm: Required unless dry_run is true.
Inputs: domain (required), reason, confirm, dry_run, +2 more. Returns: result
Fallback Let's Encrypt request via legacy CMD_API_SSL (older DirectAdmin).
Use ssl_reissue_domain first. This exists for panels that predate /api/domain-tls.
Args: domain: Domain to issue. wildcard: Include *.domain (needs DNS challenge). entries: Extra hostnames (www, mail, …). Defaults to domain + www.domain. keysize: secp384r1 | ecdsa | 4096 | 2048 encryption: sha256 impersonate: Owning user. confirm: Required.
Inputs: domain (required), confirm, entries, keysize, +3 more. Returns: result
Force-obtain / reissue the DirectAdmin hostname TLS certificate.
Calls POST /api/server-tls/obtain. Use this when the panel hostname cert is expired or the hostname changed.
Args: confirm: Required.
Inputs: reason, confirm, idempotency_key. Returns: result
Read ACME configuration used for the server hostname certificate.
Inputs: no named parameters. Returns: result
Read the current hostname certificate metadata.
Inputs: no named parameters. Returns: result
Enable TLS on the DirectAdmin service itself.
Args: force: Force the switch even if a cert looks incomplete. confirm: Required.
Inputs: force, confirm. Returns: result
Download the hostname certificate and key (secret).
Inputs: no named parameters. Returns: result
Hostname / DirectAdmin service TLS status (not a user domain).
Inputs: no named parameters. Returns: result
Replace the hostname certificate with uploaded PEM files.
Args: certificate: PEM cert (+ optional chain). key: PEM private key. force: Allow an invalid cert. confirm: Required.
Inputs: key (required), certificate (required), force, confirm. Returns: result
Update ACME settings for a domain before issuing or reissuing a cert.
Args: domain: Fully-qualified domain. enabled: Whether ACME auto-management is on. provider: '' | letsencrypt | letsencrypt-staging | zerossl key_type: rsa2048 | rsa4096 | ec256 | ec384 prefer_wildcard: Request *.domain when DNS challenge is available. dns_provider: Optional DNS plugin name (cloudflare, …) for DNS-01. skip_dns_names: Names that ACME should ignore. dns_environment: Provider env vars (tokens are redacted in logs). impersonate: Optional user to act as. confirm: Must be true — writes ACME secrets.
Inputs: domain (required), confirm, enabled, key_type, +6 more. Returns: result
Update ACME settings for the DirectAdmin hostname certificate.
Args: account: ACME account email. enabled: Enable ACME for the hostname. provider: '' | letsencrypt | letsencrypt-staging | zerossl key_type: rsa2048 | rsa4096 | ec256 | ec384 additional_domains: Extra names on the hostname cert. dns_provider: Optional DNS-01 provider. dns_environment: Provider secrets. confirm: Required.
Inputs: account (required), confirm, enabled, key_type, +4 more. Returns: result
Replace a domain certificate with uploaded PEM files.
Args: domain: Domain. cert_id: Certificate id. certificate: PEM certificate body. key: PEM private key. chain: Optional intermediate PEM list. force: Allow a certificate that fails validation. dry_run: Validate only. impersonate: Owning user. confirm: Required unless dry_run.
Inputs: key (required), domain (required), cert_id (required), certificate (required), +5 more. Returns: result
Create a subdomain.
Args: domain: Parent domain. subdomain: Left-most label only (e.g. 'shop', not shop.example.com). impersonate: Owning user. confirm: Required.
Inputs: domain (required), subdomain (required), confirm, impersonate. Returns: result
Delete a subdomain.
Args: domain: Parent domain. subdomain: Label to remove. contents: Also delete files under the subdomain document root. impersonate: Owning user. confirm: Required.
Inputs: domain (required), subdomain (required), confirm, contents, +1 more. Returns: result
List subdomains of a domain.
Args: domain: Parent domain. impersonate: Owning user.
Inputs: domain (required), impersonate. Returns: result
CPU information.
Inputs: no named parameters. Returns: result
Filesystem usage.
Inputs: no named parameters. Returns: result
Global resource usage history for one user.
Args: user: Username.
Inputs: user (required). Returns: result
Latest global resource usage.
Inputs: no named parameters. Returns: result
High-level panel info (/api/info).
Inputs: no named parameters. Returns: result
1/5/10 minute load averages.
Inputs: no named parameters. Returns: result
Memory information.
Inputs: no named parameters. Returns: result
History of OS package upgrade tasks.
Inputs: no named parameters. Returns: result
Apply OS package upgrades.
Args: packages: Optional package name list. Empty = all pending. confirm: Required.
Inputs: confirm, packages. Returns: result
Available OS package upgrades.
Inputs: no named parameters. Returns: result
Dry-run OS package upgrade.
Args: packages: Optional package name list. Empty = all pending.
Inputs: packages. Returns: result
Historical resource usage.
Inputs: no named parameters. Returns: result
Latest per-user resource usage snapshot.
Inputs: no named parameters. Returns: result
Restart the DirectAdmin service.
Args: confirm: Required.
Inputs: confirm. Returns: result
Services occupancy snapshot (not the systemd list).
Inputs: no named parameters. Returns: result
Change the DirectAdmin update channel.
Args: channel: current | stable | beta | alpha (panel-dependent). confirm: Required.
Inputs: channel (required), confirm. Returns: result
Update DirectAdmin itself to the latest build on the current channel.
Args: confirm: Required.
Inputs: confirm. Returns: result
Host uptime.
Inputs: no named parameters. Returns: result
DirectAdmin version and update channel.
Inputs: no named parameters. Returns: result
Ticket requests queue.
Inputs: no named parameters. Returns: result
Support tickets.
Inputs: no named parameters. Returns: result
Current server timezone.
Inputs: no named parameters. Returns: result
Available timezones.
Inputs: no named parameters. Returns: result
Set server timezone.
Args: timezone: IANA name, e.g. Europe/Sofia. confirm: Required.
Inputs: timezone (required), confirm. Returns: result
Create an empty Nginx Unit application stub (then edit JSON in the panel).
Args: domain: Domain. name: Application name (saved as domain_name). impersonate: Owning user. confirm: Required.
Inputs: name (required), domain (required), confirm, impersonate. Returns: result
Delete one or more Nginx Unit applications.
Args: domain: Domain. names: Application names. impersonate: Owning user. confirm: Required.
Inputs: names (required), domain (required), confirm, impersonate. Returns: result
List Nginx Unit applications and routes for a domain (CMD_UNIT).
Args: domain: Domain that owns the Unit apps. impersonate: Owning user.
Inputs: domain (required), impersonate. Returns: result
Move a user to a different reseller/creator.
Args: username: User to move. new_creator: Destination reseller/admin. confirm: Required.
Inputs: username (required), new_creator (required), confirm. Returns: result
Change another account's password (admin).
Args: username: Target account. Empty / current user uses /api/change-password. new_password: New password. confirm: Required.
Inputs: username (required), new_password (required), confirm. Returns: result
Promote a user account to reseller.
Args: username: User to promote. confirm: Required.
Inputs: username (required), confirm. Returns: result
Create a user from a package (legacy CMD_API_ACCOUNT_USER).
Args: username: New username (usually 3–16 alphanumeric). email: Contact email. password: Initial password (prefer sending a login-key later). domain: Primary domain. package: Existing user package name. ip: shared | sharedreseller | a free IP. notify: Email the welcome message. confirm: Required.
Inputs: email (required), domain (required), package (required), password (required), +4 more. Returns: result
Permanently delete a user/reseller/admin account.
Args: username: Account to delete. confirm: Required.
Inputs: username (required), confirm. Returns: result
Check whether an account name already exists (admin).
Args: username: Candidate username.
Inputs: username (required). Returns: result
Get user.conf style configuration (limits, domains, suspended flag).
Args: username: Account name.
Inputs: username (required). Returns: result
Get live usage + limits for a user.
Args: username: Account name.
Inputs: username (required). Returns: result
List users owned by the current reseller, or by reseller if given.
Args: reseller: Optional reseller username.
Inputs: reseller. Returns: result
List every user on the server (admin).
Inputs: no named parameters. Returns: result
Login history for a specific user.
Args: username: Account name.
Inputs: username (required). Returns: result
Customize limits on an existing user (CMD_API_MODIFY_USER).
Empty strings leave that field unchanged. Use 'unlimited' or a number.
Args: username: Account. bandwidth: Bandwidth MB or unlimited. quota: Disk MB or unlimited. vdomains: Domain limit or unlimited. nemails: Mailbox limit or unlimited. mysql: Database limit or unlimited. php: ON | OFF ssl: ON | OFF ssh: ON | OFF confirm: Required.
Inputs: username (required), php, ssh, ssl, +6 more. Returns: result
Search users via the New API.
Args: q: Query string (username / domain / email fragment). extended: Use /api/search/users-extended.
Inputs: q (required), extended. Returns: result
Toggle suspend/unsuspend for an account (DirectAdmin toggle).
Args: username: Account. confirm: Required.
Inputs: username (required), confirm. Returns: result
Unsuspend an account (same toggle endpoint as users_suspend).
Args: username: Account. confirm: Required.
Inputs: username (required), confirm. Returns: result
Directory password-protection list.
Inputs: no named parameters. Returns: result
Dashboard widgets.
Inputs: no named parameters. Returns: result
Is the maintenance window open right now? Reads still work when it is closed.
Inputs: no named parameters. Returns: result
Remove a WordPress location from the manager.
Args: location_id: Location id. confirm: Required.
Inputs: location_id (required), confirm. Returns: result
WordPress instance details.
Args: location_id: Location id.
Inputs: location_id (required). Returns: result
Install WordPress.
Args: payload: Install body (domain, path, title, admin user, …). confirm: Required.
Inputs: payload (required), confirm. Returns: result
Quick WordPress install.
Args: payload: Quick-install body. confirm: Required.
Inputs: payload (required), confirm. Returns: result
List WordPress installations.
Inputs: no named parameters. Returns: result
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 303 tools
The heavy prefixing (ssl_, dns_, email_, users_, csf_) keeps most tools clearly separated, but several near-duplicates exist: users_suspend vs users_unsuspend, email_autoresponder_list vs email_vacation_list, and the ssl_reissue_domain vs ssl_reissue_omain_legacy pair. Descriptions usually clarify intent, but with 303 tools an agent can easily misselect.
Names overwhelmingly follow a consistent snake_case prefix_action pattern such as ssl_list_domain_certs, users_create, dns_record_add, services_restart. Minor deviations like search_resources, policy_status, system_cpu, and prop_inventory break the strict pattern but do not make navigation chaotic.
303 tools is far beyond any reasonable agent-facing surface; even for a broad control panel like DirectAdmin this is extreme. Most endpoints are thin wrappers and are supplemented by generic da_api/da_legacy escape hatches, so the count could be drastically reduced.
The curated surface covers most core lifecycles: accounts, DNS records, email, SSL, firewall, databases, backups, files, system services, packages, plugins, WordPress, and CloudLinux. Minor gaps exist (git create/delete, unit editing, file upload/download, some automation config), but the da_api/da_legacy tools provide a workaround for uncovered endpoints.
MCP server for AI agents to plan, verify, and deploy Cloudflare-native apps.
MCP server for building and testing AI agents with multi-model experimentation and insights.
MCP server that lets your AI assistant build and deploy apps, hosting each one at a live URL.
MCP server for your apps' tools and custom tools, plus hosted AI agents and approval-gated workflows
