Returns a summary of all Infomaniak organizations and products you have access to. Best called first in a session.

List the MCP's Infomaniak tools by admin category, risk, and capability. Best for asking 'what can this MCP do?' before choosing a specific workflow.

Suggest which Infomaniak tools to use for a given intent expressed in natural language. Lightweight keyword matching against tool names and descriptions.

Returns the full definition of a specific tool — description, annotations, input parameters and output shape.

Scan an Infomaniak organization for actionable issues: products expiring soon, products in maintenance, locked products, ongoing operations.

Fetch the Infomaniak developer portal navigation and report MCP endpoint coverage, admin candidates, risky writes, and user-focused surfaces that are intentionally out of scope.

Read the newest entries from the persistent MCP audit log. Use this to inspect recent tool calls, write confirmations, applied changes, and failures.

Search the persistent MCP audit log by tool name, phase, risk, timestamp range, or free text. Useful for answering 'what changed today?' and 'did anything destructive run?'

Bulk-read every domain owned by an account: number of DNS records and DNSSEC status per zone. Useful for spot-checking large fleets.

List the destructive actions taken in the current session, most recent first. Each entry includes whether it can be reversed via infomaniak_undo.

Reverse a destructive action recorded in the session history (when reversible). Two-phase commit: returns a plan first, then applies the undo on the second call.

Get the identity of the currently-authenticated Infomaniak user: name, email, language, country, timezone, current_account_id (= the organization being managed by default), and the full security posture (2FA status, recovery email, validated phone, trusted devices, last login). Use this first to confirm which user + account the MCP is acting on behalf of. Manager-private — requires SASESSION cookie.

Security posture report for the current user: 2FA status & method, recovery email, validated phone, Yubikey, remaining rescue codes, last login timestamp, password age, and the list of trusted (auth-paired) devices with their last connection IP and time. Useful as a periodic security review or pre-action sanity check. Manager-private.

Provision a complete website end-to-end: web site + MariaDB database + DNS A record. Two-phase commit at the workflow level. The plan lists every step that will run; on apply, each step is executed and reported in order so you can see partial completion if anything fails mid-way.

Lists all Infomaniak organizations (accounts) the current token has technical access to.

Full organization detail: legal entity, billing address(es), VAT, locale, timezone, logo URLs, support tier (premium=2), 2FA-required policy, your role (owner/admin/billing/user), user/owner counts, tags. Manager-private.

List the teams (with owners + user/product counts) AND the tags (with products carrying each tag) of an organization, in a single call. Both are useful to understand how an org partitions access and labels its products. Manager-private.

List users attached to an Infomaniak account. Read-only admin inventory for access review and offboarding.

List app accesses for one account user. Read-only admin inventory for access audit and offboarding planning.

Build a read-only initial offboarding plan for one account user from app accesses and invitations. This does not revoke anything.

Read-only admin audit of account users and their app accesses. Highlights privileged access, broad access, and per-user fetch errors.

Cancel pending account invitations for a user. Two-phase commit: first call returns the pending invitation list and confirmation token; second call deletes only invitations still pending in the fresh apply prefetch.

Inspect a single account invitation and its current access snapshot before granting or revoking kSuite, drive, mailbox, or kChat access.

Grant, update, invite, or revoke invitation-scoped product access for kSuite, drive, mailbox, or kChat. Two-phase confirmation with a fresh invitation snapshot guard.

Create an account invitation. Two-phase commit with a fresh account snapshot guard. The payload is passed through to Infomaniak as-is.

Patch an account invitation. Two-phase commit with a fresh invitation snapshot guard.

Delete an account invitation. Two-phase commit with a fresh invitation snapshot guard.

Create an account team. Two-phase commit with a fresh team list snapshot guard. The payload is passed through to Infomaniak as-is.

Update an account team. Two-phase commit with a fresh team snapshot guard.

Delete an account team. Two-phase commit with a fresh team snapshot guard.

Add one or more users to an account team. Two-phase commit with a fresh team-members snapshot guard.

Remove one or more users from an account team. Two-phase commit with a fresh team-members snapshot guard.

Create an account tag. Two-phase commit with a fresh tag-list snapshot guard. The payload is passed through to Infomaniak as-is.

Update an account tag. Two-phase commit with a fresh tag snapshot guard.

Delete an account tag. Two-phase commit with a fresh tag snapshot guard.

Read account inventory and governance drill-down resources: accounts, products, services, tags, basic teams, team members, and B2B invitation customers.

Assign or unassign B2B customer partnerships on an account invitation. Two-phase confirmation with a fresh partnership snapshot.

Lists web hostings (classic + Node.js) for a given Infomaniak organization. Use infomaniak_list_organizations first to discover account IDs.

List every domain owned by an Infomaniak organization, with creation and expiration dates.

Get detailed information about a domain (DNS management status, DNSSEC, IDN, errors).

Full domain detail including auth_code (EPP transfer code), transfer_status, trade_status, termination state, glue records, TLD/registry info, attached service (web hosting), DNS detail, DNS health diagnostic, owner (registrant), associated products on the domain AND its subdomains, and the DNS logs API URL. Accepts either domain_id or FQDN. Manager-private.

Read canonical v2 domain, zone, DNSSEC, and DNS-record resources from the Infomaniak public API.

Update a domain's nameservers or restore Infomaniak nameservers. Two-phase confirmation with a current domain snapshot.

Locate a domain (e.g. broz.be) in the Infomaniak account tree. Returns {account_id, hosting_id, site_id, hosting_label, full site object}. Use this BEFORE any tool that requires hosting_id + site_id (get_certificate, request_certificate, list_databases, etc.) when you only know the domain name. Significantly cheaper than calling list_hostings + list_sites manually because it short-circuits on the first match.

Lists all sites on a given web hosting (with applications attached).

Creates a new site on an Infomaniak web hosting. Two-phase commit: first call returns a plan with a confirmation_token, second call (same params + token) actually creates the site.

Delete a site from an Infomaniak web hosting. Two-phase commit: first call returns a plan with the site preview + token, second call (same params + token) actually deletes. WARNING: this also wipes the site directory on the FTP backend after a short grace period.

List the FQDNs (main + aliases) bound to a web hosting site. The site responds to all of them via the same Apache vhost / DocumentRoot — adding an alias is how you serve more domains from a single WordPress install without provisioning a new site. Manager-private.

Bind one or more additional FQDNs (including wildcards like *.example.com) to a web hosting site. Lets the site's Apache vhost / DocumentRoot serve those new domains too — no new site provisioning required. Two-phase commit. Asynchronous: returns a progress_id; the alias appears in infomaniak_list_site_aliases after a few seconds of provisioning. Manager-private.

Remove one alias FQDN from a web hosting site (the main FQDN cannot be removed). Two-phase commit. After this, the site's Apache vhost will no longer respond to the alias. Manager-private.

Return the full SSL certificate detail for one site on a web hosting: provisioning state (installed, updating, error, ...), type (free/paid/custom) and sub-type (lets_encrypt, ...), issuer + organization, validity flags (is_valid, is_expired, is_selfsigned), issue and expiry timestamps, SHA-256 fingerprint, main FQDN in IDN form, ACME identifier errors and the timestamp of the last issuance attempt.

Request a new SSL certificate (or re-issue / renew an existing one) for a site on a web hosting. Two-phase commit. Three types supported: free (Let's Encrypt, no extra fields), paid (Sectigo, requires certificate_id), custom (BYO PEM, requires certificate + private_key). Returns an operation_uuid; poll infomaniak_get_certificate to track progress.

Delete the SSL certificate of a site (the site will fall back to no HTTPS or Infomaniak's default cert until a new one is requested). Two-phase commit. The plan pulls the current certificate status so the caller can see what is about to be removed.

List every MariaDB database attached to a web hosting (with disk usage and any running operations).

Get the full detail of a specific database (disk usage, application, permissions, backups).

Create a new MariaDB database on a web hosting. Two-phase commit. Goes through the manager-private API because the public one silently no-ops on database POSTs.

Delete a MariaDB database. Two-phase commit, manager-private API. WARNING: the database content (tables, rows) is wiped and cannot be recovered without an Infomaniak backup.

List the MariaDB-level user accounts attached to a web hosting (each has its own password and a permissions array listing the databases they can read/write/administer). For WordPress sites the user account has the same name as its database and is marked protected: true.

Fetch the detail of a single MariaDB-level user (applications, permissions, link to phpMyAdmin).

List the FTP / SSH users that have access to a web hosting (with environment and SSH flag).

Create a new FTP / SSH user on a web hosting. Two-phase commit. Connection types: ftp (SFTP-only, no shell) or ssh (full shell + FTP). The password follows Infomaniak's default policy.

Revoke a hosting user (FTP / SSH access). Two-phase commit. Existing files are not deleted.

List every DNS record on a zone managed by Infomaniak. Use the root domain (e.g. 'example.com'), not a subdomain.

Create a DNS record on an Infomaniak-managed zone. Two-phase commit: first call returns a plan + token, second call (same params + token) actually creates the record.

Update one or more fields of a DNS record. Two-phase commit: first call shows current vs proposed values + token; second call (same params + token) applies the update.

Delete a DNS record from an Infomaniak-managed zone. Two-phase commit: first call returns a plan with a preview of the record to delete + token, second call (same params + token) actually deletes.

Read-only domain/DNS admin posture audit: DNSSEC, MX, SPF, DMARC, wildcard records, and very low TTLs for an Infomaniak-managed zone.

Unified DNSSEC management for a domain: check (read state + KSK/DS records), enable (publish DS record at registry), or disable (remove DS record). enable and disable use a two-phase commit: the first call returns a plan + confirmation_token (TTL ~60s), the second call applies the change. Replaces the v0.9 trio dnssec_check / dnssec_enable / dnssec_disable with no loss of capability.

List every mail hosting (a.k.a. email_hosting) attached to an Infomaniak organization.

List every mailbox on a given mail hosting.

Read mailbox metadata in one call. Pick any subset of {aliases, signatures, backups} via the fields argument; the tool hits only the corresponding endpoints in parallel. Replaces the v0.9 trio get_mailbox_aliases / get_mailbox_signatures / get_mailbox_backups with no loss of capability.

Read mailbox security and spam-control state: authorized senders, blocked senders, spam move policy, mail filtering folders, and note.

List Sieve filters, scripts, and available templates for a mailbox. Read-only admin inventory for spam/filter policy auditing.

List only the advanced Sieve scripts configured on a mailbox. Focused read-only view derived from the mailbox filter inventory endpoint.

Read-only admin audit for a mailbox security posture: spam policy, sender conflicts, Sieve scripts, and disabled filters.

Full mail hosting detail with diagnostic_dns (MX/SPF/DKIM/DMARC health check), quotas (mailboxes + redirections + per-mailbox disk), admin user, parent kSuite link, FQDN list, and team access flag. Use this for mail-config sanity checks. Manager-private.

Full mailbox detail: auto-responder (vacation reply) state + content, aliases, redirections, IMAP/POP3 last login, password age, size on disk, trusted devices count, DKIM signature flag, SMTP ban status, Gmail-style filtering (commercials/social_networks), authorized/blocked senders, attached users + teams. Useful for mailbox audits and onboarding flows. Manager-private.

Inspect mailbox signatures and signature templates at the mailbox or service level. Read-only inventory for admin review and template selection.

Inspect mailbox webmail access for users and teams, plus admin audit lookups for account-scoped access records. Read-only inventory for webmail governance.

Inspect mailbox device/session access for a selected mailbox user, or list mailbox/service device inventories for cleanup planning.

Create a new mailbox on a mail hosting. Two-phase commit: plan + token first, then apply with token. The password never appears in the plan output.

Delete a mailbox. Two-phase commit. WARNING: this also deletes all stored emails for that mailbox.

Add a new alias to an existing mailbox. Two-phase commit. The alias will receive emails delivered to the underlying mailbox.

Block this sender. Two-phase commit: first call returns the current-state diff and confirmation token, second call with the token applies the PATCH if the mailbox sender lists have not changed.

Unblock this sender. Two-phase commit: first call returns the current-state diff and confirmation token, second call with the token applies the PATCH if the mailbox sender lists have not changed.

Authorize this sender. Two-phase commit: first call returns the current-state diff and confirmation token, second call with the token applies the PATCH if the mailbox sender lists have not changed.

Remove this authorized sender. Two-phase commit: first call returns the current-state diff and confirmation token, second call with the token applies the PATCH if the mailbox sender lists have not changed.

Update mailbox spam movement, smart filtering folders, and admin note. Two-phase commit: returns a current-state diff and confirmation token, then applies only if the policy state has not changed.

Plan and apply conservative mailbox security hardening: enable spam movement, enable mail filtering, and optionally set filtering folders. Two-phase commit with audit/current-state guard.

Update mailbox folder mappings for archives, drafts, sent, trash, spam, commercials, and social-network folders. Two-phase commit with mailbox security state guard.

Delete all messages currently in a mailbox spam folder. Destructive two-phase commit with mailbox security state guard.

Create a mailbox Sieve filter. Two-phase commit: first call returns current filter inventory and confirmation token, second call applies the POST if inventory is unchanged.

Update or rename a mailbox Sieve filter. Two-phase commit with current filter inventory guard before PATCH.

Delete a mailbox Sieve filter by name. Two-phase commit with current filter inventory guard before DELETE.

Create or update a mailbox Sieve script. Omit old_name to create; provide old_name to update/rename. Two-phase commit with current inventory guard.

Delete a mailbox Sieve script by name. Two-phase commit with current filter/script inventory guard before DELETE.

List email-import jobs and their state for a mailbox.

Enable/disable mailbox filters or Sieve scripts, or reorder filters. All changes use two-phase confirmation with a fresh filter snapshot.

Permanently delete all messages in a mailbox trash folder after confirmation.

List mailing lists configured on a mail hosting.