List configured backup plans (FastPanel v2 backup system). Maps to GET /api/v2/backup/plans. Empty data array means no backup plans are configured.

Issue a Let's Encrypt SSL certificate for an existing site. This is ASYNC — response returns immediately with status 'CREATING'. Poll queue_active to track issuance progress. REQUIREMENTS: site must be publicly accessible with correct DNS for HTTP-01 challenge to succeed. WRITE operation — confirm:true to execute.

List all SSL certificates stored in FastPanel (Let's Encrypt and custom). Returns id, name, type, common_name, alternative_name, expiration, linked site. Also injects computed crt_path/key_path — the on-disk paths FastPanel writes certs to (/var/www/httpd-cert/.crt|.key). These are needed when hand-writing a 443 server block after a site is in manual_changes mode. NOTE: the paths are derived from FastPanel's naming convention, not returned by the API — verify on disk (ls /var/www/httpd-cert/) if a cert was imported rather than issued by the panel.

Create a new database (MySQL or PostgreSQL) with a dedicated DB user. WRITE operation — set dry_run:true to preview, confirm:true to execute.

Dump a database to a .sql file ON the FastPanel host via SSH (mysqldump). Writes a file you can then download (scp/sftp); returns the path and byte size. The file can only be written inside the staging dir (default /root/fastpanel-mcp-dumps, override with FASTPANEL_DUMP_DIR) — arbitrary output paths are rejected. Targets the host's LOCAL MySQL via root socket auth; remote servers and non-MySQL engines are rejected. WRITE (it creates a root-owned file) — set dry_run:true to preview, confirm:true to execute. Requires SSH configured (FASTPANEL_SSH_HOST).

Load a .sql dump file (already present on the host) INTO a database via SSH (mysql). DESTRUCTIVE: the SQL runs as-is, so a dump containing DROP/CREATE will replace existing tables and data. The source file must live inside the staging dir (default /root/fastpanel-mcp-dumps, override with FASTPANEL_DUMP_DIR) — paths elsewhere are rejected, so scp the file there first (or produce it with database_dump). Targets the local MySQL via root socket auth. WRITE — set dry_run:true to preview the command, confirm:true to execute. Requires SSH configured (FASTPANEL_SSH_HOST).

List available database servers (MySQL, PostgreSQL). Use the returned ids as server_id in database_create and site_create.

List all MySQL and PostgreSQL databases. Returns id, name, charset, size, owner, linked site, server, last dump timestamp.

List all DNS zones managed by FastPanel's DNS service. Empty if DNS is not configured.

List all DNS records for a specific domain (zone) by its id. Use dns_domains_list first to get ids.

Get the DKIM DNS record (name, type, TXT content with the public key) for an email domain. Maps to GET /api/email/domains/{domain_id}/dkim. Use it to publish/verify the DKIM record when DNS is hosted outside the panel.

List email (mail) domains — the containers that mailboxes live in. Maps to GET /api/email/domains, or GET /api/sites/{site_id}/email/domains when site_id is given. Use the returned id as domain_id for mailboxes_list / mailbox_create. Compact by default (the full object embeds the whole SSL certificate record).

Create a mailbox in an email domain. Maps to POST /api/email/domains/{domain_id}/boxs. WRITE operation — set dry_run:true first, then confirm:true to execute. Pass either password or generate_password:true (recommended): the generated password is returned ONCE in the result as generated_password and can never be read back afterwards (FastPanel keeps only a hash) — store it in a password manager immediately. If the local password store is enabled (FASTPANEL_PASSWORD_STORE=keychain) the password — generated or explicit — is also saved there automatically and stays retrievable via mailbox_password_get. redirects forwards incoming mail to other addresses; with redirects set, save_in_box decides whether a copy also stays in this box. aliases are extra local parts on the same domain delivering to this box. Async: the response comes back with action:"CREATING" and the box becomes usable a second or two later (mailbox_get shows action:null when done).

List mailboxes of one email domain: address, enabled, size (bytes used), quota, redirects (forwarding targets), aliases, save_in_box (keep a local copy when forwarding), spam_to_junk. Maps to GET /api/email/domains/{domain_id}/boxs (sic — 'boxs'). Passwords are NOT returned: FastPanel exposes no API/CLI path to read a mailbox password back (it keeps a one-way IMAP hash plus a reversible copy only the panel process itself can decrypt). To give someone access to an existing box, reset it with mailbox_update generate_password:true. When the local password store is enabled (FASTPANEL_PASSWORD_STORE), each box also carries password_stored — true means mailbox_password_get can return its password.

Get one mailbox by id (full object: redirects, aliases, quota, size, flags, owner). Maps to GET /api/mail/box/{box_id} — note the different URL family from the list endpoint. The password is never returned — FastPanel has no endpoint that reveals it.

Return the password of a mailbox from the operator's LOCAL password store (macOS Keychain) — not from FastPanel, which never reveals a mailbox password through its API or CLI. Works only when FASTPANEL_PASSWORD_STORE=keychain is set and only for passwords that were set through mailbox_create / mailbox_update while the store was enabled (mailboxes_list shows password_stored per box). If nothing is stored, the only way to get a known password is a reset via mailbox_update generate_password:true — which breaks clients using the old one. SENSITIVE: the result contains a plaintext credential; only call it when the user asks for that mailbox's password. The stored value can be stale if the password was later changed in the panel UI.

Change an existing mailbox: reset its password, enable/disable it, change quota, redirects (forwarding), aliases, save_in_box, spam_to_junk. Maps to PUT /api/mail/box/{box_id}. WRITE operation — set dry_run:true first, then confirm:true to execute. Only the fields you pass change: the tool reads the current box and re-sends the rest (the panel form PUTs the whole object). redirects and aliases REPLACE the whole list — pass the full desired list, [] to clear. Password reset: password or generate_password:true (returned ONCE as generated_password, never retrievable later). WARNING: a password reset immediately breaks every mail client / integration still using the old password — existing passwords cannot be viewed through FastPanel, only replaced. Omitting the password keeps the current one. With the local password store enabled, any new password is saved there automatically (mailbox_password_get). Async: the response has action:"UPDATING"; poll mailbox_get until action is null.

Identify the FastPanel account behind the current READ token — username, roles, home dir, ssh access. Maps to GET /api/me. Use to confirm which user/token the server is authenticated as. NOTE: this always reflects the read token; it does not tell you whether a write token is configured.

Run nginx -t on the FastPanel host (over SSH) to validate the live nginx config — use it before and after site_configuration_update to catch syntax errors that would otherwise take nginx (and every site on it) down. Read-only: does NOT reload or modify anything. Requires SSH configured (FASTPANEL_SSH_HOST); uses your own ssh client.

Poll FastPanel background tasks and get a deterministic done/not-done signal. The raw /api/queue endpoint also returns recently-FINISHED tasks (status SUCCESS/FAILED), which makes naive polling ambiguous. This tool filters to genuinely in-flight tasks by default and adds meta.all_done (true when nothing is still running) so you can loop until done. Set include_finished:true to also see the just-completed tasks (useful to learn whether an async op SUCCEEDED or FAILED).

List active and recent FastPanel background tasks (backups, migrations, SSL issuance, screenshots, etc) including completed ones.

Read panel-wide settings — OS release, license type, upload limit, email notification config, statistics toggles, etc. Maps to GET /api/settings.

Update backend settings of an existing site: PHP version, handler (php_fpm/fcgi), app file, port, socket path, env vars. Pass the SITE id (from sites_list) — this tool resolves the backend id internally (the API endpoint is PUT /api/sites/backend/{backend_id}, where backend_id = main_backend.id, NOT the site id; passing a site id there 404s). All settings except site_id are optional: omitted fields keep the site's current backend values (fetched via site_get). NOTE: this does NOT change the site's document root (site.index_dir) — nginx renders root from the site object, not the backend. Use site_update for docroot. WRITE — confirm:true required.

Read the raw nginx (frontend), apache (backend) and php.ini configs for a site. Returns the literal config text as stored by FastPanel. Use before site_configuration_update to see current state — FastPanel's default configs often miss hardening (no .git/.env blocking, etc). Endpoint: GET /api/sites/{site_id}/configuration.

Replace the nginx (frontend), apache (backend) and php.ini config for a site. DANGEROUS: invalid syntax can take down the site or the whole nginx/apache service. SAFETY NET: when SSH is configured (FASTPANEL_SSH_HOST) and validate:true (the default), the tool runs nginx -t right after applying and AUTO-REVERTS to the previous config if it fails, so a bad edit can't leave nginx unable to reload. Without SSH there is NO validation — preview with dry_run and double-check by hand. ⚠️ SIDE EFFECT — manual mode: the first config update flips the site to manual_changes=true on the panel side. After that, FastPanel STOPS managing this site's config: it will no longer auto-insert the 443 server block, the HTTP→HTTPS redirect, or Let's Encrypt renewal/acme-challenge locations when you issue or renew SSL. You become responsible for the full HTTPS block (including ssl_certificate paths — get them from certificates_list crt_path/key_path). Partial update IS supported here (unlike the raw API): omit any of frontend/backend/phpini and the tool fetches the current value via site_configuration_get and sends it back unchanged, so you can safely change just one block. Endpoint: PUT /api/sites/{site_id}/configuration. WRITE — confirm:true required.

Create a new website in FastPanel using the /api/master wizard endpoint. Can create owner/database/FTP inline atomically. Does NOT issue SSL — call certificate_create_letsencrypt after site is active. WRITE operation — set dry_run:true first, then confirm:true to execute. Flow: (1) POST /api/master/domain probes for existing email/DNS zones, (2) PUT /api/master creates the site with everything.

Diagnose the common reasons a FastPanel site serves errors — runs host-level checks over SSH and returns a structured report. Catches the classic traps: docroot missing, a parent directory without o+x so nginx (www-data) can't traverse to the docroot (the 750 → '404 File not found' / 'permission denied' problem), missing PHP-FPM socket, dead backend service, and broken nginx config. Read-only. Requires SSH configured (FASTPANEL_SSH_HOST).

Write a single small file into a site's web root from inline content, over SSH, then chown it to the site's system user. For quick one-off files (index.html placeholder, .htaccess, robots.txt) — the content travels through the model, so keep it small; use site_files_upload/site_files_deploy for real payloads. rel_path is the file path relative to the web root; parent directories are created as needed. WRITE — dry_run:true to preview, confirm:true to execute. Requires SSH (FASTPANEL_SSH_HOST).

Deploy site files onto the host by fetching them ON the server (no local copy needed) — git clone or a downloaded tarball — into the site's web root, then chowning to the site's system user. Resolves index_dir + owner via site_get. The fetch runs as root on the panel host; only https:// sources are accepted. source_type 'git': shallow-clones source (optionally at ref) and copies the tree (excluding .git) into the destination. source_type 'tarball': curls the archive and extracts it; a single wrapping top-level directory (e.g. GitHub's repo-main/) is descended into automatically. Existing files are overwritten; nothing is deleted. dest_subpath is relative to the web root. WRITE — dry_run:true to preview, confirm:true to execute. Requires SSH (FASTPANEL_SSH_HOST).

Upload a local file or directory from THIS machine into a site's web root, over SSH (rsync, scp fallback). Resolves the site's index_dir + owner via site_get, transfers with your own ssh key (bytes never pass through the model), then chowns to the site's system user AND normalises perms on the destination subtree to FastPanel's web defaults (dirs 755, files 644) so nginx/PHP-FPM can serve it (local file modes are not relied on). rsync TRAILING-SLASH semantics: local_path 'build/' uploads the CONTENTS of build into the destination; 'build' (no slash) uploads the build dir itself, creating /build. dest_subpath is relative to the web root (omit to target the root). delete:true mirrors the source (rsync --delete removes remote files absent locally) — needs rsync, gated behind confirm. WRITE — set dry_run:true to preview, confirm:true to execute. Requires SSH configured (FASTPANEL_SSH_HOST).

Get full details for a single site by id. Returns all 40 fields including SSL certificate, backend config, permissions, backup plan, stats.

Tail a site's nginx/apache access or error log — no SSH needed. Maps to GET /api/sites/{site_id}/log/{lines}/{type}. Use type=frontend_error to debug 404/permission/realpath problems (nginx), backend_error for PHP-FPM/Apache app errors. FastPanel quirk: this endpoint returns the log tail inside an 'errors' JSON field and responds with HTTP 400 even on success — an empty log shows as '\n', a missing file shows a 'Path … not exists' message. This tool normalises that: the log text is always returned under log, and 400 is not treated as a failure. Log files live at <user_home>/data/logs/-.log.

List the resources attached to a site — linked databases, sub-domains, DNS zones and email domains. Maps to GET /api/sites/{site_id}/resources. Handy before deleting or migrating a site, or to find which database(s) belong to it.

List all websites managed by FastPanel. Compact mode (default) returns only essential fields — full response is ~3KB per site and can overflow context. Use site_get(id) for full details of a specific site.

Attach, replace, or detach an SSL certificate on an existing site, and toggle HTTPS flags. Maps to PUT /api/sites/{site_id}. Use for wildcard flow: create site in *.icstudio.space, then attach an existing wildcard cert. Pass certificate_id=null to detach. WRITE — confirm:true required.

Change a site's document root (index_dir) and/or directory index, via PUT /api/sites/{site_id}. This is the ONLY way to repoint a site's docroot — nginx renders root from site.index_dir, NOT from the backend, so site_backend_update can't do it. Common need: frameworks that serve from a subfolder (Laravel/Symfony → /public). Pass framework:'laravel' to auto-append '/public' to the current docroot without computing the path yourself. This tool does a read-modify-write: it fetches the current site via site_get and resends the writable fields (docroot, index page, current certificate id, https/http2/http3/hsts flags) so the partial PUT doesn't blank out SSL or flags. ⚠️ UNVERIFIED ENDPOINT: the index_dir write path was not confirmable from the API spec (FastPanel has no OpenAPI). Run with dry_run:true, then a real call on a throwaway site, and check site_get afterwards. If index_dir does NOT change, capture the DevTools request the panel UI fires when you edit the docroot and report it so this can be corrected. WRITE — confirm:true required.

Get current server load metrics — CPU, memory, disk, uptime. Source: FastPanel's internal /api/loads/full endpoint.

Create a new FastPanel system user (site owner). This is a WRITE operation — set dry_run:true to preview, confirm:true to execute.

List all FastPanel system users (site owners). Returns id, username, home_dir, roles, PHP version, quota, ssh_access, enabled flag.