List all websites managed by FastPanel. Compact mode (default) returns only essential fields — full response is ~3KB per site and can overflow context. Use site_get(id) for full details of a specific site.

Get full details for a single site by id. Returns all 40 fields including SSL certificate, backend config, permissions, backup plan, stats.

List all MySQL and PostgreSQL databases. Returns id, name, charset, size, owner, linked site, server, last dump timestamp.

List available database servers (MySQL, PostgreSQL). Use the returned ids as server_id in database_create and site_create.

List all FastPanel system users (site owners). Returns id, username, home_dir, roles, PHP version, quota, ssh_access, enabled flag.

List all DNS zones managed by FastPanel's DNS service. Empty if DNS is not configured.

List all DNS records for a specific domain (zone) by its id. Use dns_domains_list first to get ids.

List all SSL certificates stored in FastPanel (Let's Encrypt and custom). Returns id, name, type, common_name, alternative_name, expiration, linked site. Also injects computed crt_path/key_path — the on-disk paths FastPanel writes certs to (/var/www/httpd-cert/.crt|.key). These are needed when hand-writing a 443 server block after a site is in manual_changes mode. NOTE: the paths are derived from FastPanel's naming convention, not returned by the API — verify on disk (ls /var/www/httpd-cert/) if a cert was imported rather than issued by the panel.

Get current server load metrics — CPU, memory, disk, uptime. Source: FastPanel's internal /api/loads/full endpoint.

List active and recent FastPanel background tasks (backups, migrations, SSL issuance, screenshots, etc) including completed ones.

Poll FastPanel background tasks and get a deterministic done/not-done signal. The raw /api/queue endpoint also returns recently-FINISHED tasks (status SUCCESS/FAILED), which makes naive polling ambiguous. This tool filters to genuinely in-flight tasks by default and adds meta.all_done (true when nothing is still running) so you can loop until done. Set include_finished:true to also see the just-completed tasks (useful to learn whether an async op SUCCEEDED or FAILED).

Tail a site's nginx/apache access or error log — no SSH needed. Maps to GET /api/sites/{site_id}/log/{lines}/{type}. Use type=frontend_error to debug 404/permission/realpath problems (nginx), backend_error for PHP-FPM/Apache app errors. FastPanel quirk: this endpoint returns the log tail inside an 'errors' JSON field and responds with HTTP 400 even on success — an empty log shows as '\n', a missing file shows a 'Path … not exists' message. This tool normalises that: the log text is always returned under log, and 400 is not treated as a failure. Log files live at /data/logs/-.log.

List the resources attached to a site — linked databases, sub-domains, DNS zones and email domains. Maps to GET /api/sites/{site_id}/resources. Handy before deleting or migrating a site, or to find which database(s) belong to it.

List configured backup plans (FastPanel v2 backup system). Maps to GET /api/v2/backup/plans. Empty data array means no backup plans are configured.

Identify the FastPanel account behind the current READ token — username, roles, home dir, ssh access. Maps to GET /api/me. Use to confirm which user/token the server is authenticated as. NOTE: this always reflects the read token; it does not tell you whether a write token is configured.

Read panel-wide settings — OS release, license type, upload limit, email notification config, statistics toggles, etc. Maps to GET /api/settings.

Run nginx -t on the FastPanel host (over SSH) to validate the live nginx config — use it before and after site_configuration_update to catch syntax errors that would otherwise take nginx (and every site on it) down. Read-only: does NOT reload or modify anything. Requires SSH configured (FASTPANEL_SSH_HOST); uses your own ssh client.

Diagnose the common reasons a FastPanel site serves errors — runs host-level checks over SSH and returns a structured report. Catches the classic traps: docroot missing, a parent directory without o+x so nginx (www-data) can't traverse to the docroot (the 750 → '404 File not found' / 'permission denied' problem), missing PHP-FPM socket, dead backend service, and broken nginx config. Read-only. Requires SSH configured (FASTPANEL_SSH_HOST).

Dump a database to a .sql file ON the FastPanel host via SSH (mysqldump). Writes a file you can then download (scp/sftp); returns the path and byte size. The file can only be written inside the staging dir (default /root/fastpanel-mcp-dumps, override with FASTPANEL_DUMP_DIR) — arbitrary output paths are rejected. Targets the host's LOCAL MySQL via root socket auth; remote servers and non-MySQL engines are rejected. WRITE (it creates a root-owned file) — set dry_run:true to preview, confirm:true to execute. Requires SSH configured (FASTPANEL_SSH_HOST).

Load a .sql dump file (already present on the host) INTO a database via SSH (mysql). DESTRUCTIVE: the SQL runs as-is, so a dump containing DROP/CREATE will replace existing tables and data. The source file must live inside the staging dir (default /root/fastpanel-mcp-dumps, override with FASTPANEL_DUMP_DIR) — paths elsewhere are rejected, so scp the file there first (or produce it with database_dump). Targets the local MySQL via root socket auth. WRITE — set dry_run:true to preview the command, confirm:true to execute. Requires SSH configured (FASTPANEL_SSH_HOST).

Upload a local file or directory from THIS machine into a site's web root, over SSH (rsync, scp fallback). Resolves the site's index_dir + owner via site_get, transfers with your own ssh key (bytes never pass through the model), then chowns to the site's system user AND normalises perms on the destination subtree to FastPanel's web defaults (dirs 755, files 644) so nginx/PHP-FPM can serve it (local file modes are not relied on). rsync TRAILING-SLASH semantics: local_path 'build/' uploads the CONTENTS of build into the destination; 'build' (no slash) uploads the build dir itself, creating /build. dest_subpath is relative to the web root (omit to target the root). delete:true mirrors the source (rsync --delete removes remote files absent locally) — needs rsync, gated behind confirm. WRITE — set dry_run:true to preview, confirm:true to execute. Requires SSH configured (FASTPANEL_SSH_HOST).

Deploy site files onto the host by fetching them ON the server (no local copy needed) — git clone or a downloaded tarball — into the site's web root, then chowning to the site's system user. Resolves index_dir + owner via site_get. The fetch runs as root on the panel host; only https:// sources are accepted. source_type 'git': shallow-clones source (optionally at ref) and copies the tree (excluding .git) into the destination. source_type 'tarball': curls the archive and extracts it; a single wrapping top-level directory (e.g. GitHub's repo-main/) is descended into automatically. Existing files are overwritten; nothing is deleted. dest_subpath is relative to the web root. WRITE — dry_run:true to preview, confirm:true to execute. Requires SSH (FASTPANEL_SSH_HOST).

Write a single small file into a site's web root from inline content, over SSH, then chown it to the site's system user. For quick one-off files (index.html placeholder, .htaccess, robots.txt) — the content travels through the model, so keep it small; use site_files_upload/site_files_deploy for real payloads. rel_path is the file path relative to the web root; parent directories are created as needed. WRITE — dry_run:true to preview, confirm:true to execute. Requires SSH (FASTPANEL_SSH_HOST).

Create a new FastPanel system user (site owner). This is a WRITE operation — set dry_run:true to preview, confirm:true to execute.

Create a new database (MySQL or PostgreSQL) with a dedicated DB user. WRITE operation — set dry_run:true to preview, confirm:true to execute.

Attach, replace, or detach an SSL certificate on an existing site, and toggle HTTPS flags. Maps to PUT /api/sites/{site_id}. Use for wildcard flow: create site in *.icstudio.space, then attach an existing wildcard cert. Pass certificate_id=null to detach. WRITE — confirm:true required.

Change a site's document root (index_dir) and/or directory index, via PUT /api/sites/{site_id}. This is the ONLY way to repoint a site's docroot — nginx renders root from site.index_dir, NOT from the backend, so site_backend_update can't do it. Common need: frameworks that serve from a subfolder (Laravel/Symfony → /public). Pass framework:'laravel' to auto-append '/public' to the current docroot without computing the path yourself. This tool does a read-modify-write: it fetches the current site via site_get and resends the writable fields (docroot, index page, current certificate id, https/http2/http3/hsts flags) so the partial PUT doesn't blank out SSL or flags. ⚠️ UNVERIFIED ENDPOINT: the index_dir write path was not confirmable from the API spec (FastPanel has no OpenAPI). Run with dry_run:true, then a real call on a throwaway site, and check site_get afterwards. If index_dir does NOT change, capture the DevTools request the panel UI fires when you edit the docroot and report it so this can be corrected. WRITE — confirm:true required.

Issue a Let's Encrypt SSL certificate for an existing site. This is ASYNC — response returns immediately with status 'CREATING'. Poll queue_active to track issuance progress. REQUIREMENTS: site must be publicly accessible with correct DNS for HTTP-01 challenge to succeed. WRITE operation — confirm:true to execute.

Read the raw nginx (frontend), apache (backend) and php.ini configs for a site. Returns the literal config text as stored by FastPanel. Use before site_configuration_update to see current state — FastPanel's default configs often miss hardening (no .git/.env blocking, etc). Endpoint: GET /api/sites/{site_id}/configuration.

Replace the nginx (frontend), apache (backend) and php.ini config for a site. DANGEROUS: invalid syntax can take down the site or the whole nginx/apache service — this tool does NOT validate nginx syntax before applying (no nginx -t), so preview with dry_run and double-check by hand. ⚠️ SIDE EFFECT — manual mode: the first config update flips the site to manual_changes=true on the panel side. After that, FastPanel STOPS managing this site's config: it will no longer auto-insert the 443 server block, the HTTP→HTTPS redirect, or Let's Encrypt renewal/acme-challenge locations when you issue or renew SSL. You become responsible for the full HTTPS block (including ssl_certificate paths — get them from certificates_list crt_path/key_path). Partial update IS supported here (unlike the raw API): omit any of frontend/backend/phpini and the tool fetches the current value via site_configuration_get and sends it back unchanged, so you can safely change just one block. Endpoint: PUT /api/sites/{site_id}/configuration. WRITE — confirm:true required.

Update backend settings of an existing site: PHP version, handler (php_fpm/fcgi), app file, port, socket path, env vars. Pass the SITE id (from sites_list) — this tool resolves the backend id internally (the API endpoint is PUT /api/sites/backend/{backend_id}, where backend_id = main_backend.id, NOT the site id; passing a site id there 404s). All settings except site_id are optional: omitted fields keep the site's current backend values (fetched via site_get). NOTE: this does NOT change the site's document root (site.index_dir) — nginx renders root from the site object, not the backend. Use site_update for docroot. WRITE — confirm:true required.

Create a new website in FastPanel using the /api/master wizard endpoint. Can create owner/database/FTP inline atomically. Does NOT issue SSL — call certificate_create_letsencrypt after site is active. WRITE operation — set dry_run:true first, then confirm:true to execute. Flow: (1) POST /api/master/domain probes for existing email/DNS zones, (2) PUT /api/master creates the site with everything.