Which integrations are available for this server?

Provides tools for managing Infomaniak account administration, including web hosting, mail security, DNS, domains, kDrive, kChat, account governance, and more, with two-phase commit for destructive operations.

How do I use infomaniak-admin-mcp?

1. Click on "Install Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@infomaniak-admin-mcp audit example.com hosting and show quota warnings" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

infomaniak-admin-mcp

by henrikogaard

Overview Schema Related Servers Score Discussions

TypeScript

Hybrid

@henrikogard/infomaniak-admin-mcp

License: MIT Node TypeScript strict MCP npm version npm downloads Tools PRs Welcome

Drive your entire Infomaniak account from Claude — agentic, two-phase commit, open-source.

@henrikogard/infomaniak-admin-mcp is Henrik Øgård's admin-focused fork of Mogacode-ma/infomaniak-mcp-agent. It exposes a broad Infomaniak administration surface as 169 tools an LLM can call directly: web hosting, mail security and admin, account governance, kDrive admin audits, kChat governance, domains, DNS, DNSSEC, FTP/SSH users, AI products, persistent audit logs, and more. Every destructive operation goes through a strict two-phase commit, so an agent can never silently delete or mutate something on your account.

You → Claude:  "audit the example.com hosting and tell me which mailboxes are over quota"
Claude → MCP:  infomaniak_audit_account → infomaniak_list_mail_hostings → infomaniak_list_mailboxes
Claude → You:  3 mailboxes >85% — paul@ (94%), notify@ (88%), team@ (87%). Want me to add an alert?

Why · What it does · How it differs
Install · Authentication · Quick example
Tools (169 total) · Admin scope · Limitations · FAQ
Contributing · License

Related MCP server: Corben MCP Server

Why this exists

Infomaniak is one of the very few independent, Swiss-owned, open-source-friendly cloud providers in Europe — running its own datacentres in Switzerland, on hydro and wind power, with no parent in the US or China. Its product range is huge (web hosting, mail, kDrive, kChat, DNS, AI cloud, Swiss Backup, …) but its API is split between a documented public surface and a private manager-only one — which means automating real workflows usually requires a browser session, custom scripts, or both.

The upstream project closes that gap by exposing broad Infomaniak operations through a single MCP server. This fork keeps that architecture and pushes it toward admin operations: mail security, spam control, mail administration, account governance, confirmed offboarding helpers, kDrive/domain admin audits, tool discovery, API coverage reporting, and persistent local audit logs.

🎒 Built in the open, in real time, by vibe-coding

This project was built rapidly by an LLM driving a terminal session ("vibe-coding"), with live tests against a real Infomaniak account at every step. It works perfectly on the maintainer's local setup and the full pipeline is green (TypeScript strict, ESLint, Prettier, tests, build, CodeQL, gitleaks).

That said — given how it was built and given that some manager-session-backed routes used here sit outside the public docs (see API-REFERENCE.md) — it is entirely possible that you'll hit (potentially big) bugs depending on your account topology, plan tier, scopes, or Infomaniak's own changes. We are here to fix them as they show up. Please:

Open an issue with the exact tool call, the input, the response, and your environment (Node version, OS, MCP client). Sanitize tokens / cookies / customer names before pasting.
Or, even better, send a PR with a failing test and we will work from there together.

We move fast and ship often. Don't be shy.

⚠️ Status: unofficial

This project is not affiliated with, endorsed by, or sponsored by Infomaniak Network SA. It is a community-driven tool that combines:

The public Infomaniak API (api.infomaniak.com), used with a Bearer token you generate yourself.
Manager-session-backed endpoints (manager.infomaniak.com/proxy/...), required for write operations on web hosting that the public API silently ignores.

For integration notes and current API caveats, read API-REFERENCE.md. Infomaniak may change these endpoints without notice; we do our best to keep up but cannot guarantee long-term compatibility.

Fork status

This repository is a fork with substantial admin-focused additions. The original Mogacode architecture, MIT license, and attribution are preserved; the new fork work is attributed separately in LICENSE and NOTICE.

The end-user-focused sibling repo is infomaniak-mcp; this fork stays intentionally admin-only.

kMeet scheduling and user-focused kChat conversations are out of scope. kChat is now limited to administrator/team/channel governance tools.

What you can do with it

Once installed, you can ask Claude things like:

"List every domain on my account that expires in less than 60 days, sorted by date."
"Create a new site staging.example.com on hosting WP1234567, PHP 8.3, root in /sites/staging."
"Add a TXT record on example.com for the new Postmark DKIM, then verify it resolves."
"Block spam@example.net from sending to info@example.com, and show me the diff before applying it."
"How much disk does the database myprefix_wp123456 use, and which application is wired to it?"
"Create a mailbox hello@example.com with a 16-character random password and forward it to my Gmail."
"Create an invitation for contractor@example.com, add them to the Security team, and tag the account for review."
"Grant kSuite, drive, or mailbox access through an invitation, but show me the current snapshot first."
"Replace the aliases and forwarding on info@example.com, then set an auto-reply and rotate DKIM."
"Show me which kDrives I'm an admin on and how full they are."
"Tune the AI, link, office, and preference settings on kDrive 44311."
"Inspect the kChat channels on a team, review moderation and member roles, then update a bot or command with confirmation."
"Audit account users and tell me who has privileged app access before I offboard someone."
"Audit my whole account: any locked product, expiring SSL, broken DNSSEC, ongoing operations?"
"Undo the last DNS change I made through this session."

It will not silently mutate anything destructive: every change goes through a plan + confirmation token round-trip. You stay in control even if the model gets creative.

High-value admin use cases

These are the workflows this MCP is especially good at because they combine admin inventory, safety checks, and confirmed writes.

Block senders and spam campaigns

Tell Claude:

Block spam@example.net from info@example.com.

Claude can call infomaniak_block_sender, which reads the mailbox's current authorized_senders and blocked_senders, returns a diff, and only applies the block after you confirm with the returned token. If the sender was previously authorized, the tool removes it from the trusted list while adding it to the blocked list. The matching unblock and allow-list tools are infomaniak_unblock_sender, infomaniak_authorize_sender, and infomaniak_unauthorize_sender.

Harden mailbox security

Ask:

Audit and harden info@example.com against spam, but show me exactly what would change first.

Claude can use infomaniak_get_mailbox_security, infomaniak_audit_mailbox_security, and infomaniak_harden_mailbox_security to review spam movement, smart filtering, trusted senders, blocked senders, notes, and mailbox filter state. Writes use the same two-phase confirmation pattern.

Govern account invitations, teams, and tags

Ask:

Create an invitation for contractor@example.com, add them to the Security team, and tag the account for review.

Claude can use infomaniak_create_account_invitation, infomaniak_update_account_invitation, infomaniak_delete_account_invitation, infomaniak_create_account_team, infomaniak_update_account_team, infomaniak_delete_account_team, infomaniak_add_account_team_users, infomaniak_remove_account_team_users, infomaniak_create_account_tag, infomaniak_update_account_tag, and infomaniak_delete_account_tag. Each write tool plans first and applies only after confirmation with a fresh current-state check.

Grant product access through an invitation

Ask:

Show me the current invitation snapshot, then grant drive and mailbox access on invitation 77.

Claude can use infomaniak_get_account_invitation_access to inspect the current invitation, then infomaniak_manage_account_invitation_access to create, update, invite, or revoke kSuite, drive, mailbox, or kChat access with a fresh snapshot guard and confirmation token.

Reconfigure mailbox routing

Ask:

Replace the aliases and forwarding on info@example.com, then set an auto-reply and rotate DKIM.

Claude can use infomaniak_manage_mailbox_aliases, infomaniak_manage_mailbox_forwarding, infomaniak_manage_mailbox_auto_reply, infomaniak_manage_service_redirections, and infomaniak_rotate_mail_dkim to adjust mailbox-level and service-level mail routing. These are also two-phase writes with current-state guards.

Manage mail signatures and templates

Ask:

List mailbox signatures and then update the template before I roll it out.

Claude can use infomaniak_get_mail_signatures to inspect mailbox or service signature templates, then infomaniak_manage_mail_signatures to create, update, delete, or apply defaults with confirmation.

Review webmail access

Ask:

Show me who can use webmail on this mailbox, then revoke the stale account.

Claude can use infomaniak_get_mail_webmail_access to review current user and team access, then infomaniak_manage_mail_webmail_access to add, update, or remove access with a fresh state check.

Clean up mail device sessions

Ask:

List the mailbox device sessions and remove the suspicious one.

Claude can use infomaniak_get_mail_device_access to inspect device/session inventory, then infomaniak_manage_mail_device_access to delete a device or clear a user's mailbox device access with confirmation.

Ask:

List newsletter groups and subscribers for example.com, then clean up the stale ones.

Claude can use infomaniak_get_newsletter_admin for read-only inventory and infomaniak_manage_newsletter_admin for confirmed create, update, delete, assign, unassign, and forget operations.

Offboard users safely

Ask:

Prepare offboarding for user 7890 on account 123456.

Claude can use infomaniak_plan_user_offboarding and infomaniak_audit_account_access to show app access and pending invitations. For pending invitations, infomaniak_cancel_user_pending_invitations cancels only after a confirmation token and a fresh state check.

Audit admin posture

Useful prompts:

Audit account access and highlight privileged users.
Audit kDrive 44311 for risky share links and external users.
Audit example.com for DNSSEC, MX, SPF, DMARC, wildcard records, and low TTLs.

These map to infomaniak_audit_account_access, infomaniak_audit_kdrive_admin, and infomaniak_audit_domain_dns_admin.

Ask:

List risky share links on kDrive 44311 and remove anything public with no expiry.
Tighten the share link on file 888 so it has a password and expiry.

Claude can use infomaniak_list_drive_share_links and infomaniak_get_drive_share_link for review, then infomaniak_update_drive_share_link, infomaniak_remove_drive_share_link, or infomaniak_invite_drive_share_link. Writes are two-phase and guarded by the current share-link state.

Manage kDrive file permissions safely

Ask:

Review who can access file 888 on kDrive 44311, then grant team 33 read access.
Invite external@example.com to the same file, but show me the plan first.

Claude can use infomaniak_list_drive_file_access_users, infomaniak_list_drive_file_access_teams, and infomaniak_list_drive_file_access_invitations to review current file access, then infomaniak_create_drive_file_access_user, infomaniak_update_drive_file_access_user, infomaniak_remove_drive_file_access_user, infomaniak_create_drive_file_access_team, infomaniak_update_drive_file_access_team, infomaniak_remove_drive_file_access_team, or infomaniak_create_drive_file_access_invitation. Every write uses two-phase confirmation and refetches the current access list before applying.

Review kDrive activity

Ask:

Show me kDrive 44311 storage, user activity, shared-file activity, and share-link activity this month.
Export share-link activity for kDrive 44311.

Claude can call infomaniak_get_drive_statistics for storage size charts and exports, activity charts and exports, user activity, shared-file activity, and share-link activity.

Tune kDrive settings

Ask:

Read the current kDrive settings snapshot, then tighten AI, link, office, and preferences policy.

Claude can use infomaniak_get_drive_settings to inspect the current policy snapshot, then infomaniak_manage_drive_settings to update the AI, share-link, office, or preferences settings with a fresh state check and confirmation.

Manage kDrive users safely

Ask:

Add new@example.com to kDrive 44311 as a user, but show me the plan before applying.
Lock user 7890 on kDrive 44311 until we finish the offboarding review.

Claude can use infomaniak_list_drive_users to review current access, then infomaniak_create_drive_user, infomaniak_update_drive_user, infomaniak_lock_drive_user, infomaniak_unlock_drive_user, infomaniak_set_drive_user_manager, or infomaniak_delete_drive_user. Every write reads the current user/list state first and requires the returned confirmation token before it mutates kDrive access.

Review what the MCP did

Every MCP tool call is written to an append-only JSONL audit log by default. Writes include explicit plan, apply_attempt, applied, and failed phases; read-only successes can be included or disabled. Secrets are redacted, including API tokens, cookies, passwords, private keys, certificates, and confirmation tokens.

Ask:

Show me every applied change from today.
Show me failed or destructive MCP actions.
Tail the last 25 audit log entries.

Claude can use infomaniak_audit_log_tail and infomaniak_audit_log_search. The default log path is ./logs/infomaniak-mcp-audit.jsonl.

Why "agentic" and not "wrapper"

Most MCP servers expose one tool per HTTP endpoint and call it a day. This one is built differently:

Guided dialogues — creating a site walks you through "which organization? which hosting? root domain or subdomain? what type? recap?" instead of asking you to know the right tool to call upfront.
Two-phase commit — every destructive operation returns a plan with a single-use confirmation token (60 s TTL). Nothing is mutated until you call back with the token.
Pre-flight checks — the server checks for conflicts (existing FQDN, busy hosting, expired domain) before hitting the API.
Actionable errors — every error tells you what happened, why, and the next step you can take.
Introspection — infomaniak_tool_catalog, infomaniak_overview, infomaniak_help and infomaniak_explain give the agent context-on-demand instead of forcing it to memorize a tool catalog.
Session memory — infomaniak_history lists every destructive action of the current session, and infomaniak_undo reverses the ones that are reversible.

See ARCHITECTURE.md for the full design rationale.

Install

Install the public package from npm:

npm install @henrikogard/infomaniak-admin-mcp
npx -y @henrikogard/infomaniak-admin-mcp

If you want to develop from source instead:

git clone https://github.com/henrikogaard/infomaniak-admin-mcp.git
cd infomaniak-admin-mcp
npm ci
npm run build
npm start

The built server entry point is ./dist/server.js.

To produce a shareable MCPB bundle, run npm run bundle:mcpb after building.

Configure Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %AppData%\Claude\claude_desktop_config.json (Windows):

{
  "mcpServers": {
    "infomaniak-admin": {
      "command": "npx",
      "args": ["-y", "@henrikogard/infomaniak-admin-mcp"],
      "env": {
        "INFOMANIAK_API_TOKEN": "paste-your-token-here",
        "INFOMANIAK_AUTH_MODE": "auto"
      }
    }
  }
}

Restart Claude Desktop to pick up the change.

Configure Claude Code

claude mcp add infomaniak \
  -e INFOMANIAK_API_TOKEN=paste-your-token-here \
  -e INFOMANIAK_AUTH_MODE=auto \
  -- npx -y @henrikogard/infomaniak-admin-mcp

Authentication

Two distinct credentials are needed because Infomaniak runs two APIs side-by-side:

API	Auth	Purpose
`api.infomaniak.com/{1,2}/...`	Bearer token	Read-mostly: profile, products, mail, drive, dns, domains, billing
`manager.infomaniak.com/proxy/...`	SASESSION cookie + CSRF token	Writes on web hosting (sites, databases, applications)

1. Bearer token (required)

Sign in to your Infomaniak account.
Go to manager.infomaniak.com/v3/ng/profile/user/token/list.
Click "Create a token", give it a long lifetime, copy the value.
Set it in INFOMANIAK_API_TOKEN.

2. Manager session (auto, recommended)

The manager-private API does not accept Bearer tokens or OAuth (Infomaniak only exposes openid profile email phone scopes to third-party apps; web, mail, etc. are reserved). Instead, we read the SASESSION and MANAGER-XSRF-TOKEN cookies that your local Chrome already has when you are logged into manager.infomaniak.com.

With INFOMANIAK_AUTH_MODE=auto (the default), the MCP reads these cookies on demand using chrome-cookies-secure. Nothing is ever written to disk; cookies live in memory for the duration of one operation.

When the session expires, simply reload manager.infomaniak.com in Chrome — the MCP will pick up the fresh cookies on the next call.

3. Manager session (manual fallback)

For headless environments or troubleshooting:

INFOMANIAK_AUTH_MODE=manual
INFOMANIAK_SASESSION=...
INFOMANIAK_XSRF_TOKEN=...

To copy them: open Chrome DevTools on manager.infomaniak.com, Application → Cookies, copy SASESSION and MANAGER-XSRF-TOKEN (URL-encoded — paste as-is, the MCP decodes).

Quick example

A typical first conversation, end-to-end:

You:    What's on my account?
Claude: [calls infomaniak_overview]
        You have 16 organizations, 311 products: 47 web hostings, 73 domains,
        12 mail hostings, 3 kDrives, 2 AI Tools subscriptions.

You:    Any domain expiring soon?
Claude: [calls infomaniak_audit_account on each org]
        2 domains expire in <30 days: example.com (April 22), demo.org (May 04).
        4 SSL certificates were auto-renewed in the last 7 days. No locked products.

You:    Create a TXT record on example.com saying "v=spf1 include:spf.example.net ~all".
Claude: [calls infomaniak_dns_create_record → returns plan + token]
        Plan: CREATE TXT record on example.com → "v=spf1 include:spf.example.net ~all", TTL 3600.
        Confirm with token abc-123 within 60 s.

You:    Confirm.
Claude: [calls infomaniak_dns_create_record again with the token]
        Done. Record id 84219113. Logged in session history (undoable).

Tools

169 tools across the admin surface. Use infomaniak_tool_catalog to browse what the MCP can do by category/risk, infomaniak_help to fuzzy-search by intent, or infomaniak_explain to dump a tool's full JSON schema. For admin-focused examples and scope boundaries, see ADMIN-SCOPE.md.

Introspection (start here)

Tool	Annotation	Purpose
`infomaniak_overview`	read-only	Summary of organizations + products. Best first call.
`infomaniak_tool_catalog`	read-only	Browse the MCP toolbox by admin category, risk, capability, and high-value use cases. Best answer to "what can this MCP do for me?"
`infomaniak_help`	read-only	Suggest tools matching a free-form intent ("create site", "list mailboxes"…).
`infomaniak_explain`	read-only	Returns the full definition (description + schemas) of a specific tool.
`infomaniak_audit_account`	read-only	Scan an organization for expirations / locked products / ongoing ops.
`infomaniak_history`	read-only	List destructive actions taken in this session.
`infomaniak_undo`	destructive	Reverse a session action when reversible (two-phase commit).

Organizations & products

Tool	Annotation	Purpose
`infomaniak_list_organizations`	read-only	Accounts you have technical access to.
`infomaniak_list_hostings`	read-only	Web hostings (classic + Node.js) for one organization.
`infomaniak_list_domains`	read-only	Domains for one organization, with creation + expiration dates.
`infomaniak_get_domain`	read-only	Detail of one domain (DNS managed?, DNSSEC, errors).

Web hosting sites

Tool	Annotation	Purpose
`infomaniak_find_site`	read-only	Domain-first lookup. Resolves a public domain (e.g. `broz.be`) to `{account_id, hosting_id, hosting_label, site_id, full site object}`. Use this BEFORE any tool that needs `hosting_id + site_id`. Replaces iterating every hosting's `list_sites` (46+ API calls on a real fleet).
`infomaniak_list_sites`	read-only	Sites on a given web hosting (with applications).
`infomaniak_create_site`	destructive	Two-phase: returns a plan + token, second call with token actually creates.
`infomaniak_delete_site`	destructive	Two-phase delete (full preview of the site to be removed).

SSL certificates

Tool	Annotation	Purpose
`infomaniak_get_certificate`	read-only	Current cert status (`updating`/`ok`/`error`), issuer, expiry, ACME identifier errors.
`infomaniak_request_certificate`	destructive	Two-phase. Issue or renew a cert. Three `type` values: `free` (Let's Encrypt), `paid` (Sectigo, requires `certificate_id`), `custom` (BYO PEM, requires `certificate` + `private_key`).
`infomaniak_delete_certificate`	destructive	Two-phase. Remove the cert from a site. Undo via `request_certificate` with `type: "free"`.

Databases

Tool	Annotation	Purpose
`infomaniak_list_databases`	read-only	MariaDB databases attached to a hosting (with disk usage).
`infomaniak_get_database`	read-only	Detail of one database.
`infomaniak_create_database`	destructive	Two-phase create.
`infomaniak_delete_database`	destructive	Two-phase delete (plan shows disk usage + linked app).
`infomaniak_list_database_users`	read-only	MariaDB-level user accounts attached to a hosting (`applications`, `permissions`, phpMyAdmin link).
`infomaniak_get_database_user`	read-only	Detail of a single MariaDB user.

⚠️ Note: this MCP intentionally does not expose a tool that changes a database user's password through the public API — see API-REFERENCE.md for the operational note that keeps it out of the typed tool surface. Rotate database passwords via direct MariaDB ALTER USER over SSH instead.

FTP / SSH users

Tool	Annotation	Purpose
`infomaniak_list_hosting_users`	read-only	FTP / SSH users on a web hosting.
`infomaniak_create_hosting_user`	destructive	Two-phase create with `connection_type`: `ftp` (SFTP-only) or `ssh` (full shell + FTP).
`infomaniak_delete_hosting_user`	destructive	Two-phase revoke (files preserved).

DNS & DNSSEC

Tool	Annotation	Purpose
`infomaniak_dns_list_records`	read-only	Every DNS record on an Infomaniak-managed zone.
`infomaniak_dns_create_record`	destructive	Two-phase create record (A, AAAA, CNAME, MX, TXT, SRV, NS, CAA, PTR, SPF).
`infomaniak_dns_update_record`	destructive	Two-phase update (current vs proposed diff in the plan).
`infomaniak_dns_delete_record`	destructive	Two-phase delete record (with full preview before commit).
`infomaniak_manage_dnssec`	mixed	Unified DNSSEC: `action: check` (read-only, KSK/DS records), `action: enable` or `action: disable` (two-phase commit destructive). Replaces the v0.9 trio `dnssec_check` / `dnssec_enable` / `dnssec_disable`.

Mail

Tool	Annotation	Purpose
`infomaniak_list_mail_hostings`	read-only	Mail hostings for one organization.
`infomaniak_list_mailboxes`	read-only	Mailboxes on a given mail hosting.
`infomaniak_get_mailbox_info`	read-only	Unified mailbox read: pass `fields: ["aliases" \| "signatures" \| "backups"]` (subset or all). Fetches in parallel, per-section errors returned independently. Replaces the v0.9 trio `get_mailbox_aliases` / `get_mailbox_signatures` / `get_mailbox_backups`.
`infomaniak_get_mailbox_security`	read-only	Mailbox spam/security posture: authorized senders, blocked senders, spam movement, smart filtering folders, and admin note.
`infomaniak_list_mailbox_filters`	read-only	Mailbox Sieve filter and script inventory for admin review.
`infomaniak_list_mailbox_filter_scripts`	read-only	Focused list of advanced Sieve scripts configured on a mailbox.
`infomaniak_audit_mailbox_security`	read-only	Review a mailbox for spam/security findings and recommended hardening steps.
`infomaniak_create_mailbox`	destructive	Two-phase create with password policy enforcement.
`infomaniak_delete_mailbox`	destructive	Two-phase delete (also wipes stored mail).
`infomaniak_create_mailbox_alias`	destructive	Two-phase add alias to a mailbox.
`infomaniak_block_sender`	destructive	Two-phase sender block. Adds the sender to `blocked_senders` and removes it from `authorized_senders` if needed.
`infomaniak_unblock_sender`	destructive	Two-phase sender unblock. Removes the sender from `blocked_senders`.
`infomaniak_authorize_sender`	destructive	Two-phase allow-list update. Adds the sender to `authorized_senders` and removes it from `blocked_senders` if needed.
`infomaniak_unauthorize_sender`	destructive	Two-phase removal from `authorized_senders`.
`infomaniak_set_mailbox_spam_policy`	destructive	Two-phase spam policy update for spam movement, smart filtering, folder targets, and admin note.
`infomaniak_harden_mailbox_security`	destructive	Two-phase hardening workflow based on the mailbox security audit.
`infomaniak_update_mailbox_folders`	destructive	Two-phase mailbox folder mapping update for archives, drafts, sent, trash, spam, commercials, and social-network folders.
`infomaniak_purge_spam_folder`	destructive	Two-phase purge of all messages currently in the mailbox spam folder. Not undoable.
`infomaniak_list_redirections`	read-only	Server-side mail redirection rules.
`infomaniak_create_redirection`	destructive	Two-phase create rule (forward `name@…` to N targets).
`infomaniak_delete_redirection`	destructive	Two-phase delete rule.
`infomaniak_manage_mailbox_aliases`	destructive	Two-phase mailbox alias management: list, replace, add, or delete aliases with current-state guards.
`infomaniak_manage_mailbox_forwarding`	destructive	Two-phase mailbox forwarding management: list, replace, add, delete, or clear forwarding targets.
`infomaniak_manage_mailbox_auto_reply`	destructive	Two-phase mailbox auto-reply management for list/create/update/delete/reset flows.
`infomaniak_manage_service_redirections`	destructive	Two-phase service-level redirection management, including confirmation resend and target updates.
`infomaniak_rotate_mail_dkim`	destructive	Two-phase DKIM rotation / check for a mail hosting.
`infomaniak_get_mail_signatures`	read-only	Mailbox or service signature/template inventory for admin review.
`infomaniak_manage_mail_signatures`	destructive	Two-phase signature/template create, update, delete, and defaults management.
`infomaniak_get_mail_webmail_access`	read-only	Webmail user/team access inventory for a mailbox or account.
`infomaniak_manage_mail_webmail_access`	destructive	Two-phase webmail access add, update, revoke, or invite flows.
`infomaniak_get_mail_device_access`	read-only	Mailbox device/session inventory for admin cleanup.
`infomaniak_manage_mail_device_access`	destructive	Two-phase mailbox device/session deletion or cleanup.
`infomaniak_get_newsletter_admin`	read-only	Newsletter groups and subscriber inventory for a domain.
`infomaniak_manage_newsletter_admin`	destructive	Two-phase newsletter group/subscriber create, update, delete, assign, unassign, and forget operations.

kChat governance

Tool	Annotation	Purpose
`infomaniak_list_kchat_channels`	read-only	All kChat channels in the account.
`infomaniak_list_kchat_team_channels`	read-only	Public, private, or deleted channels for one team.
`infomaniak_get_kchat_channel`	read-only	One kChat channel snapshot.
`infomaniak_list_kchat_channel_members`	read-only	Channel members, plus an optional specific member snapshot.
`infomaniak_get_kchat_channel_moderation`	read-only	Channel moderation settings.
`infomaniak_list_kchat_groups`	read-only	Groups linked to a team, channel, or user for permission audits.
`infomaniak_list_kchat_bots`	read-only	Bot inventory.
`infomaniak_get_kchat_bot`	read-only	One bot snapshot.
`infomaniak_list_kchat_commands`	read-only	Slash command inventory.
`infomaniak_get_kchat_command`	read-only	One slash command snapshot.
`infomaniak_list_kchat_roles`	read-only	Role catalog for kChat permission auditing.
`infomaniak_manage_kchat_channel`	destructive	Two-phase create, update, patch, move, restore, delete, privacy, scheme, or moderation changes.
`infomaniak_manage_kchat_channel_members`	destructive	Two-phase add/remove/update member roles, scheme roles, or notification props.
`infomaniak_manage_kchat_bot`	destructive	Two-phase create, update, enable, disable, or delete bot.
`infomaniak_manage_kchat_command`	destructive	Two-phase create, update, delete, or regenerate a slash command token.

Identity ("who am I?")

Tool	Annotation	Purpose
`infomaniak_get_my_profile`	read-only	Name, email, language, country, timezone, current account, security posture (2FA, devices, last login).
`infomaniak_get_my_security`	read-only	Focused security report — 2FA method + status, recovery email, validated phone, Yubikey, rescue codes, password age, trusted devices with IP/time.

Account / Org

Tool	Annotation	Purpose
`infomaniak_get_account_full`	read-only	Full org detail: legal entity, billing addresses, VAT, locale, support tier, 2FA-required policy, your role, tags.
`infomaniak_list_teams_and_tags`	read-only	Teams (owners + counts) + tags (with products carrying each tag) in a single call.
`infomaniak_list_account_users`	read-only	Users on an organization, with roles and access metadata.
`infomaniak_get_user_app_accesses`	read-only	Per-user app access detail for audits and offboarding.
`infomaniak_plan_user_offboarding`	read-only	Step-by-step offboarding plan from current account, user, and invitation state.
`infomaniak_audit_account_access`	read-only	Cross-user access posture review and privileged app-access detection.
`infomaniak_cancel_user_pending_invitations`	destructive	Two-phase cancellation of pending account invitations for one user.
`infomaniak_get_account_invitation_access`	read-only	Invitation snapshot for kSuite, drive, mailbox, or kChat access review.
`infomaniak_manage_account_invitation_access`	destructive	Two-phase grant/update/invite/revoke of invitation-scoped product access.
`infomaniak_create_account_invitation`	destructive	Two-phase create of an account invitation, guarded by a fresh account snapshot.
`infomaniak_update_account_invitation`	destructive	Two-phase update of an account invitation, guarded by a fresh invitation snapshot.
`infomaniak_delete_account_invitation`	destructive	Two-phase delete of an account invitation, guarded by a fresh invitation snapshot.
`infomaniak_create_account_team`	destructive	Two-phase create of an account team, guarded by the current team list.
`infomaniak_update_account_team`	destructive	Two-phase update of an account team, guarded by a fresh team snapshot.
`infomaniak_delete_account_team`	destructive	Two-phase delete of an account team, guarded by a fresh team snapshot.
`infomaniak_add_account_team_users`	destructive	Two-phase add of one or more users to an account team, guarded by a fresh team-members snapshot.
`infomaniak_remove_account_team_users`	destructive	Two-phase removal of one or more users from an account team, guarded by a fresh team-members snapshot.
`infomaniak_create_account_tag`	destructive	Two-phase create of an account tag, guarded by the current tag list.
`infomaniak_update_account_tag`	destructive	Two-phase update of an account tag, guarded by a fresh tag snapshot.
`infomaniak_delete_account_tag`	destructive	Two-phase delete of an account tag, guarded by a fresh tag snapshot.

Mail (deep)

Tool	Annotation	Purpose
`infomaniak_get_mail_hosting_full`	read-only	DNS health diagnostic (MX/SPF/DKIM/DMARC), quotas, admin, parent kSuite link, FQDNs, team access.
`infomaniak_get_mailbox_full`	read-only	Auto-responder, aliases, IMAP/POP3 last login, password age, mailbox size, devices, DKIM, SMTP ban, mail filtering (commercials/social), authorized/blocked senders.

Domain (deep)

Tool	Annotation	Purpose
`infomaniak_get_domain_full`	read-only	`auth_code` (EPP), transfer/trade status, glue records, TLD/registry, attached service, DNS detail + health, associated products, DNS logs URL. Accepts id or FQDN.

kDrive (deep, manager-private)

Tool	Annotation	Purpose
`infomaniak_get_drive_full`	read-only	Drive name, total size, used size, maintenance.
`infomaniak_list_drive_users`	read-only	Users with access to a kDrive (access audits).
`infomaniak_list_drive_trash`	read-only	Items in the trash bin with deletion timestamps.

VPS / Cloud Server

Tool	Annotation	Purpose
`infomaniak_list_vps`	read-only	List Cloud Server (Jelastic) products of an org.
`infomaniak_get_vps_full`	read-only	Datacenter, IPs, CPU/RAM, bandwidth + traffic, disk usage, MySQL/PHP versions, firewall, premium support contacts, migration history.

Node.js apps (Cloud Server `hosting_3`)

Tool	Annotation	Purpose
`infomaniak_list_nodejs_apps`	read-only	Discover the apps on a Node.js hosting. Returns each app's `vhost_route_id` (handle for every other Node.js tool) and its serving FQDNs.
`infomaniak_get_nodejs_app`	read-only	Full app config: Node version, listen port, `start_command`, `build_command`, public IPs (v4 + v6), SSL state, directory, storage quota.
`infomaniak_nodejs_app_status`	read-only	Live status — `Running` or `Stopped`. Cheap, safe to poll.
`infomaniak_nodejs_app_aliases`	read-only	All FQDNs serving the app (primary + auto `xxx.preview.hosting-ik.com`).
`infomaniak_nodejs_app_jobs`	read-only	Recent jobs (build / restart / …) with per-job log_stream JWT.
`infomaniak_nodejs_app_logs`	read-only	Returns a short-lived JWT + SSE endpoint URL to consume the live stdout/stderr stream of the running app.
`infomaniak_nodejs_app_thumbnail`	read-only	Screenshot of the live page as a base64 JPEG — visual smoke test without HTTP-probing.
`infomaniak_nodejs_app_action`	destructive	Two-phase. Start / stop / restart / build. `stop` records an undo to `start`. `build` returns the spawned job's `resource_id` + live `log_stream` to tail the output.

All Node.js tools are manager-private (the public Bearer API exposes only a state-check for Node.js hostings). They require INFOMANIAK_AUTH_MODE=auto (Chrome cookies) or manual (SASESSION + MANAGER-XSRF-TOKEN env vars). See API-REFERENCE.md.

kDrive

Tool	Annotation	Purpose
`infomaniak_list_drives`	read-only	All kDrives the account has access to (with quota).
`infomaniak_list_drive_files`	read-only	Files / subfolders of a drive root or any folder, paginated.
`infomaniak_list_drive_share_links`	read-only	Share-link inventory for admin exposure review.
`infomaniak_get_drive_share_link`	read-only	Share-link settings for one kDrive file or folder.
`infomaniak_list_drive_file_access_users`	read-only	User access entries for a kDrive file or folder.
`infomaniak_list_drive_file_access_teams`	read-only	Team access entries for a kDrive file or folder.
`infomaniak_list_drive_file_access_invitations`	read-only	Pending file-access invitations for a kDrive file or folder.
`infomaniak_get_drive_statistics`	read-only	kDrive storage, activity, user activity, shared-file activity, and share-link activity charts/exports.
`infomaniak_get_drive_settings`	read-only	Current kDrive AI, link, office, and preferences policy snapshot.
`infomaniak_create_drive_share_link`	destructive	Two-phase create of a kDrive share link, guarded by current share-link state.
`infomaniak_update_drive_share_link`	destructive	Two-phase update of a kDrive share link, guarded by current share-link state.
`infomaniak_remove_drive_share_link`	destructive	Two-phase removal of a kDrive share link, guarded by current share-link state.
`infomaniak_invite_drive_share_link`	destructive	Two-phase share-link invitation, guarded by current share-link state.
`infomaniak_manage_drive_settings`	destructive	Two-phase update of kDrive AI, link, office, or preferences settings with a fresh snapshot guard.
`infomaniak_create_drive_file_access_user`	destructive	Two-phase grant of a file/folder user permission, guarded by the current access list.
`infomaniak_update_drive_file_access_user`	destructive	Two-phase update of a file/folder user permission, guarded by the current access list.
`infomaniak_remove_drive_file_access_user`	destructive	Two-phase removal of a file/folder user permission, guarded by the current access list.
`infomaniak_create_drive_file_access_team`	destructive	Two-phase grant of a file/folder team permission, guarded by the current access list.
`infomaniak_update_drive_file_access_team`	destructive	Two-phase update of a file/folder team permission, guarded by the current access list.
`infomaniak_remove_drive_file_access_team`	destructive	Two-phase removal of a file/folder team permission, guarded by the current access list.
`infomaniak_create_drive_file_access_invitation`	destructive	Two-phase invitation to a file or folder, guarded by the current invitation list.
`infomaniak_create_drive_user`	destructive	Two-phase create of a kDrive user, guarded by the current drive user list.
`infomaniak_update_drive_user`	destructive	Two-phase update of a kDrive user's role/access payload, guarded by the current user snapshot.
`infomaniak_delete_drive_user`	destructive	Two-phase removal of a kDrive user from the drive, guarded by the current user snapshot.
`infomaniak_lock_drive_user`	destructive	Two-phase lock of a kDrive user, guarded by the current user snapshot.
`infomaniak_unlock_drive_user`	destructive	Two-phase unlock of a kDrive user, guarded by the current user snapshot.
`infomaniak_set_drive_user_manager`	destructive	Two-phase manager-right update for a kDrive user.
`infomaniak_empty_drive_trash`	destructive	Two-phase empty of all kDrive trash items, guarded by the current trash count. Not undoable.
`infomaniak_restore_drive_trash_item`	destructive	Two-phase restore of one trashed file or folder, guarded by the current trash item details.
`infomaniak_remove_drive_trash_item`	destructive	Two-phase permanent removal of one trashed file or folder. Not undoable.
`infomaniak_update_drive_trash_settings`	destructive	Two-phase update of kDrive trash settings, guarded by the current drive settings snapshot.

URL shortener

Tool	Annotation	Purpose
`infomaniak_list_short_urls`	read-only	Short URLs configured on a domain.
`infomaniak_create_short_url`	destructive	Two-phase create.
`infomaniak_delete_short_url`	destructive	Two-phase delete.

Swiss Backup

Tool	Annotation	Purpose
`infomaniak_list_swiss_backups`	read-only	Swiss Backup slots on the account.

AI Tools

Tool	Annotation	Purpose
`infomaniak_list_ai_products`	read-only	AI subscriptions the account owns.
`infomaniak_list_ai_models`	read-only	Public catalogue of Swiss-sovereign LLM/STT models.

Workflows (multi-step)

Tool	Annotation	Purpose
`infomaniak_provision_site_full`	destructive	Site + DB + DNS in one orchestrated, plan-then-apply flow.
`infomaniak_audit_dns_zones`	read-only	Cross-zone audit: missing SPF/DMARC, dangling records, ….

Escape hatch (everything else)

Tool	Annotation	Purpose
`infomaniak_api_call`	destructive	Reach any endpoint on `api.infomaniak.com` directly. GET runs immediately, POST/PUT/PATCH/DELETE follow the two-phase commit. Refuses paths outside the documented `/{1,2,3}/...` namespace and refuses manager-private `/proxy/...` (use a typed tool).

Limitations

Hard rate limit of 60 req/min on api.infomaniak.com. The MCP throttles automatically with a token-bucket. You will see brief queueing delays on heavy bursts; this is intentional and protects your token from blacklisting.
No directory outside /sites/ when creating a site. Required by the manager backend (silently no-ops otherwise — see API-REFERENCE.md).
Manager session cookies expire (typically every few hours / when you sign out of Chrome). Re-open manager.infomaniak.com to refresh.
One concurrent operation per hosting — Infomaniak rejects concurrent POSTs on the same hosting with 400 operation_in_progress. The MCP serializes write calls per hosting.
WordPress installation is intentionally out of scope. Create the empty site with this MCP, then install WP from the manager's wizard (the applications/add flow uses an undocumented per-step wizard that is too brittle to automate cleanly today).

FAQ

Is this an official Infomaniak product?

No. It is community-driven, MIT-licensed, and not affiliated with, endorsed by, or sponsored by Infomaniak Network SA. See the disclaimers in NOTICE and API-REFERENCE.md.

Does it work with clients other than Claude?

Yes. It speaks the standard Model Context Protocol over stdio, so it works with any MCP-capable client — Claude Desktop, Claude Code, Cursor, Cline, Continue, Zed AI, and the MCP Inspector for debugging.

Will my Infomaniak token / session ever leave my machine?

No. The server runs locally over stdio. Your Bearer token is read from INFOMANIAK_API_TOKEN (env or .env) and used only to call api.infomaniak.com. The Chrome cookies (SASESSION, MANAGER-XSRF-TOKEN) live in memory for the duration of a single tool call and are never persisted. Logs redact every sensitive value (tokens, cookies, passwords).

Does it support self-hosting / running outside macOS?

Yes — INFOMANIAK_AUTH_MODE=manual lets you paste cookies straight into env vars, which is the path to use on Linux servers, Docker containers, or CI. Auto-extraction from Chrome works on macOS, Windows, and Linux when Chrome is installed locally.

Why does site creation use a manager-private endpoint and not the public API?

Because the public POST /1/products/{id}/web_hostings/{hid}/sites endpoint silently returns a success response without actually creating anything. The manager-private endpoint requires force_fqdn: true, directory: /sites/..., and environment: apache_php — none of which are documented in the public API. Full note in API-REFERENCE.md.

Can it install WordPress automatically?

Not today. The manager's applications/add flow is a multi-step wizard with per-step tokens that is brittle to script. The recommended pattern is: create the empty site with this MCP, then install WordPress (or any other CMS) from the manager wizard or by uploading via FTP/SSH.

Is there a hosted / SaaS version?

No. By design — this server runs against your own credentials on your own machine. There is no hosted SaaS, no hosted proxy, no telemetry.

How do I report a bug or request a tool?

Open an issue in this fork's repository. Include the exact tool call, the input, the response (sanitized — strip tokens, cookies, customer names), and your environment (Node version, OS, MCP client, plan tier). PRs with a failing test are doubly welcome. For upstream-only issues, use the original Mogacode-ma/infomaniak-mcp-agent repository.

What about Infomaniak's own AI Tools?

Infomaniak runs a Swiss-sovereign AI cloud hosting Llama, Mixtral, Whisper and other open-weights models. This MCP exposes infomaniak_list_ai_products and infomaniak_list_ai_models so an agent can discover what's available and what models are public on your account; we deliberately do not wrap their inference endpoints (use the OpenAI-compatible API directly for that).

Contributing

Contributions are welcome. Please read CONTRIBUTING.md and follow the CODE_OF_CONDUCT.md. Security issues should be reported privately per SECURITY.md.

License

MIT. This fork preserves the original Mogacode MIT copyright and adds separate copyright attribution for the admin-focused fork additions. See NOTICE for upstream attribution and the trademark disclaimer.

This project is not affiliated with Infomaniak Network SA. "Infomaniak", "kDrive", "kChat", "kMeet", "kSuite", "Swiss Backup" are trademarks of Infomaniak Network SA.

This server cannot be installed

license - permissive license

quality - not tested

maintenance

How are these scores calculated?

Maintenance

–Maintainers

–Response time

–Release cycle

–Releases (12mo)

Commit activity

Resources

GitHub Repository

Need Help?

Related Servers

Latest Blog Posts

Lightport: Open-Sourcing Glama's AI Gateway
By punkpeye on April 27, 2026.
open source
OpenAI
Tool Definition Quality Score (TDQS)
By punkpeye on April 3, 2026.
mcp
The Hackers Who Tracked My Sleep Cycle
By punkpeye on March 26, 2026.
security

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/henrikogaard/infomaniak-admin-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server

@henrikogard/infomaniak-admin-mcp

Table of contents

Why this exists

🎒 Built in the open, in real time, by vibe-coding

⚠️ Status: unofficial

Fork status

What you can do with it

High-value admin use cases

Block senders and spam campaigns

Harden mailbox security

Govern account invitations, teams, and tags

Grant product access through an invitation

Reconfigure mailbox routing

Manage mail signatures and templates

Review webmail access

Clean up mail device sessions

Manage newsletter groups and subscribers

Offboard users safely

Audit admin posture

Clean up kDrive share links

Manage kDrive file permissions safely

Review kDrive activity

Tune kDrive settings

Manage kDrive users safely

Review what the MCP did

Why "agentic" and not "wrapper"

Install

Configure Claude Desktop

Configure Claude Code

Authentication

1. Bearer token (required)

2. Manager session (auto, recommended)

3. Manager session (manual fallback)

Quick example

Tools

Introspection (start here)

Organizations & products

Web hosting sites

SSL certificates

Databases

FTP / SSH users

DNS & DNSSEC

Mail

kChat governance

Identity ("who am I?")

Account / Org

Mail (deep)

Domain (deep)

kDrive (deep, manager-private)

VPS / Cloud Server

Node.js apps (Cloud Server hosting_3)

kDrive

URL shortener

Swiss Backup

AI Tools

Workflows (multi-step)

Escape hatch (everything else)

Limitations

FAQ

Is this an official Infomaniak product?

Does it work with clients other than Claude?

Will my Infomaniak token / session ever leave my machine?

Does it support self-hosting / running outside macOS?

Why does site creation use a manager-private endpoint and not the public API?

Can it install WordPress automatically?

Is there a hosted / SaaS version?

How do I report a bug or request a tool?

What about Infomaniak's own AI Tools?

Contributing

License

Maintenance

Resources

Latest Blog Posts

MCP directory API

Node.js apps (Cloud Server `hosting_3`)