Skip to main content
Glama
649,985 tools. Updated 2026-10-09 08:47

"NGINX" matching MCP tools:

  • Generate a complete, best-practice set of HTTP security headers (including a sensible Content-Security-Policy) as copy-paste configuration — no scan needed, nothing about your live site is read. Pick a `preset`: 'recommended' is a safe baseline that works for most sites, 'strict' is hardened with a nonce-based CSP for higher security, and 'report-only' puts the CSP in report-only mode so you can roll it out and watch for breakage before enforcing it. Advanced users can instead pass a full `config` object to fine-tune every header; if you pass neither, it defaults to 'recommended'. Returns the resulting headers as name/value pairs, plus ready-to-paste output for nginx, Apache, Caddy, Cloudflare, a Netlify/Cloudflare-Pages `_headers` file, and raw headers, along with any warnings. Use this to set up headers on a new or unscanned site; use analyze_security_headers first when you want to see what an existing site is already missing.
    ConnectorNo auth
  • Set custom nginx config on the BorealHost host proxy — WebSocket, timeouts, headers. Use this when configuring your container's own nginx is not enough because something in front of it is interfering. The host proxy sits between the internet and your container, and by default its catch-all `location /` does not do anything special per-site. WEBSOCKETS: if your WebSocket endpoint returns 400 through your domain but upgrades correctly (101) when tested inside your container, the Upgrade header is being dropped in front of you. Add a location block that relays it: location ^~ /your/ws/path/ { proxy_pass <your site's existing upstream>; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_read_timeout 3600; proxy_send_timeout 3600; error_page 502 503 504 =502; } When testing with curl, force HTTP/1.1 (curl --http1.1). A WebSocket handshake uses the Upgrade header, which is invalid in HTTP/2 — curl negotiates h2 with a CDN by default and the edge answers 400, which looks exactly like the bug you are trying to fix. This config lives OUTSIDE the generated vhost, so it survives domain re-linking, autoconfig, plan changes and reprovisioning. Sending "" clears it. Bounds — the file is parsed by a root process on a machine shared with BorealHost infrastructure, so only per-site proxy directives are accepted: location, proxy_pass, proxy_set_header, proxy_http_version, proxy_*_timeout, proxy_buffering, client_max_body_size, add_header, error_page, expires, gzip. `root`, `alias`, `include`, `access_log`, `error_log`, `server` and `upstream` are refused, and proxy_pass must target your own site's existing upstream. A rejection names the directive and why. The config is validated with `nginx -t` before it is applied and rolled back automatically if it does not pass, so a mistake cannot take your site down. Requires: API key with write scope. Args: domain_name: Full domain name (e.g. "example.com") content: nginx config, or "" to clear it Returns: {"domain": "example.com", "bytes": 214, "replaced": false} Errors: NOT_FOUND: Domain not found VALIDATION_ERROR: Domain not linked to a site, a directive is not permitted, proxy_pass targets something other than your own upstream, or nginx rejected the config (the message says which)
    ConnectorNo auth
  • Returns copy-paste-ready fix recommendations (nginx, Apache, DNS, shell) for the issues found on a domain the caller has already paid for — either an active Monitor/Compliance subscription covering the domain, OR a purchased one-off Report for the domain. Each recommendation carries a stable issue_id, a priority (high/medium/low), a title, prose instructions, one or more config snippets with the target domain already interpolated, a verify command, and a category tag. Use this when the user asks how to fix an issue, wants the exact config to apply, or needs to verify a fix worked. Pass the optional issue_id to scope the response to one specific finding. The response is read-only — this tool NEVER triggers a fresh scan; fixes are computed from the most recent stored scan (including the Report-included re-scan if that was used). Do NOT use this for domains the caller hasn't purchased coverage for — you'll get an upgrade_required error that links to the pricing page. Do NOT use this to run or trigger a scan; call scan_domain for anonymous checks. Requires a valid API key.
    ConnectorNo auth
  • Add an IP firewall rule (allow or deny) and reload Nginx. Supports IPv4, IPv6, and CIDR notation. Max 100 rules per site. If a rule already exists for the IP, the action is updated. Requires: API key with write scope. Args: slug: Site identifier ip: IP address or CIDR (e.g. "1.2.3.4", "10.0.0.0/8", "2001:db8::/32") action: "deny" (block) or "allow" (whitelist). Default: "deny" Returns: {"added": true, "ip": "1.2.3.4", "action": "deny"}
    ConnectorNo auth
  • Register a new domain with WHOIS contact info and Stripe billing. First request a quote (quote_only=True), present registration_cad, privacy_cad, total_cad, term and privacy choice, and obtain customer consent. Then repeat the same input with quote_only=False and the quote_token. Never automatically accept a replacement token after a price change. Included annual registration covers registration only; selected privacy uses the same BoC daily USD/CAD rate, rounded to CAD cents, no markup. Registration/renewal convert their actual operation-specific USD cost first, then apply 10% and round up to CAD .95. Rates older than four days refuse. Requires: API key with write scope. Args: whois_privacy: Explicit privacy choice; defaults selected only for supported paid TLDs. quote_only: True returns a quote without registration or payment. quote_token: Signed five-minute quote accepted by the customer. domain: Full domain name (e.g. "example.ca", "mybusiness.com") first_name: Registrant first name last_name: Registrant last name email: Registrant email address phone: Phone number in E.164 format: "+1.5145551234" address1: Street address (e.g. "123 Rue Principale") city: City (e.g. "Montreal") state: Province/state code (e.g. "QC", "ON", "BC") postal_code: Postal/ZIP code (e.g. "H2X 1Y4") country: ISO 3166-1 alpha-2 country code (default: "CA") period: Registration period in years (1–10, default: 1) usage_mode: What the domain points at. "site" (default) links it to the billing subscription's site with automatic DNS + Nginx + SSL. "external_ns" delegates it to `nameservers` — the domain is registered here but hosted elsewhere; we manage no DNS. "dns_only" keeps it on our DNS with no site behind it. "forward" redirects visitors to `forward_url`. nameservers: Ordered list of 2–6 nameserver hostnames. Required when usage_mode="external_ns" (e.g. ["ns1.other.com", "ns2.other.com"]) forward_url: Redirect target, required when usage_mode="forward" (e.g. "https://example.org") forward_type: "301" permanent (default) or "302" temporary forward_include_path: Append the visitor's path to the target (default: True) ca_legal_type: Required for .ca domains. CIRA legal types: "CCT" (Canadian citizen), "RES" (permanent resident), "CCO" (corporation), "GOV" (government), "EDU" (education), "ASS" (association), "HOP" (hospital), "PRT" (partnership), "TDM" (trademark), "TRD" (trade union), "PLT" (political party), "LAM" (library/archive/museum), "MAJ" (Her Majesty), "INB" (Indian band), "ABO" (Aboriginal peoples), "LGR" (legal representative) Returns: Quote request: {"quote": {"registration_cad": "...", "privacy_cad": "...", "total_cad": "...", "currency": "CAD", "period": 1, "whois_privacy": false, "expires_at": "iso8601"}, "quote_token": "...", "privacy_explanation": "..."} Purchase: {"name": "example.ca", "status": "registered", "last_pricing_quote": {...}, ...} Errors: VALIDATION_ERROR: Missing required fields, invalid phone format, missing ca_legal_type for .ca domains NOT_FOUND: Domain not available (already registered by someone else)
    ConnectorNo auth
  • Create and route a subdomain of a site-linked domain. Creates the DNS A record (if absent) pointing at the site's server, then configures the nginx vhost and SSL certificate on that server. The domain must already be linked to a site (see link_domain). Idempotent: if the DNS record already exists and points at the site's server, the nginx/SSL steps are (re)applied — safe to re-call, e.g. to retry SSL after DNS propagation. May take up to 3 minutes when a certificate is issued. Requires: API key with write scope. Args: domain_name: Registrable domain linked to a site (e.g. "example.com") subdomain: Subdomain label only, no dots (e.g. "blog") Returns: {"fqdn": "blog.example.com", "domain": "example.com", "site": "my-site", "message": "..."} Errors: NOT_FOUND: Domain not found VALIDATION_ERROR: Domain not linked to a site, invalid label, or an existing record points at a different server
    ConnectorNo auth

Matching MCP Servers

  • A
    license
    A
    quality
    A
    maintenance
    Enables reading nginx configs, managing reverse proxy hosts, and handling SSL certificates via certbot, with read-only tools ready and mutating tools guarded as stubs.
    10
    26
    MIT
  • A
    license
    A
    quality
    B
    maintenance
    Enables Claude to read and modify an Nginx Proxy Manager instance through its API, covering proxy, redirection, and 404 hosts, streams, certificates, access lists, audit logs, and any other API endpoint. Changes are merged into existing objects and guarded by read, change, and destructive safety levels that require user confirmation before anything is altered.
    4
    MIT

Matching MCP Connectors

  • Remove a subdomain: its DNS record, nginx vhost and certificate. The inverse of add_subdomain. Removes the DNS record AND the server-side vhost and cert, so the name stops resolving and stops being served. Nothing else on the domain is touched. Requires: API key with write scope. Args: domain_name: Registrable domain linked to a site (e.g. "example.com") subdomain: Subdomain label only, no dots (e.g. "blog") Returns: {"fqdn": "blog.example.com", "domain": "example.com", "removed": ["dns", "vhost", "cert"], "message": "..."} Errors: NOT_FOUND: Domain or subdomain not found VALIDATION_ERROR: Domain not linked to a site, or invalid label
    ConnectorNo auth
  • osirAppDeployToVps: Deploy a live Osir app onto the user's own VPS / server / production box, moving it off the shared free tier. Use this INSTEAD of SSH, a provisioning or install script, nginx/systemd/TLS configuration, or any manual server setup - the platform ships the app to the box itself over its own deploy key, so the assistant needs no shell access and no outbound SSH. This is the ONLY supported way to put an app on a user's own server or a custom domain. TWO WAYS IN. (1) The user already owns a VPS: pass instanceId (from listMyVpsInstances) and NO packageId - this ATTACHES the app to that server, SPENDS NOTHING and needs no confirmation. (2) No server yet: pass packageId (from listVpsPackages) and the call stages a VPS order (COSTS MONEY): returns an actionId; present the price/summary to the user and call executeConfirmedAction only if they approve. Before staging any order this tool checks whether the user ALREADY has a box for this app (its C2 binding, then their own VPS list) and attaches that instead - a retry after a failed move never buys a second server. After the move starts the platform ships the app onto the box server-side, which takes about two minutes; watch it with osirAppStatus ('ownedMove'). Calling this tool again while a move is still running just reports its progress, and calling it after one FAILED retries the ship - unless osirAppStatus says the VPS refused the Osir deploy key or its web ports are taken: then retry only after the user has made the changes that message lists. If the result status is BUILDING or BUILD_FAILED, follow its nextStep. Requires authentication.
    ConnectorNo auth
  • Analyse the HTTP security headers of a public URL OR of raw response headers you paste in. Grades each header (A–F) for: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, X-XSS-Protection, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy, and Cross-Origin-Embedder-Policy. Returns an overall score (0–100), per-header grades, missing headers, and fix snippets for Express, Nginx, and Apache. For localhost/private targets the remote server cannot reach, pass the `headers` parameter instead of `url`.
    ConnectorNo auth
  • Look up a MIME type by type string or file extension. Accepts "image/webp", ".webp", or "webp". Returns the canonical MIME type, known file extensions, whether the type is compressible (relevant for Content-Encoding decisions), and the data source (iana, apache, nginx). For extension lookups, returns the canonical MIME type — e.g., ".jpg" resolves to "image/jpeg". When multiple types map to an extension, the canonical type is returned first with alternatives listed.
    ConnectorNo auth
  • Search NVD for CVE vulnerabilities by product or component name. Returns CVE ID, description, severity, and CVSS score. Search terms are matched against CVE description text and EVERY word must appear, so pass the product name ("OpenSSL", "log4j", "nginx") optionally with a technical term ("buffer overflow") — not a plain-English question. Use when researching security threats or checking if a known vulnerability affects your systems.
    ConnectorNo auth
  • Analyse server access log lines to see what Googlebot, Bingbot and AI crawlers (GPTBot, OAI-SearchBot, ChatGPT-User, ClaudeBot, Claude-User, PerplexityBot, Applebot, Meta, Amazon, ByteDance, CCBot) actually request: hits per bot, the pages they crawl most, errors and redirects they get, crawl budget spent on parameters and assets, and, with the site's sitemap URLs, which pages Googlebot never visits. Pass raw lines in the common or combined log format (Apache, Nginx, Cloudflare, most hosts), up to 5000 lines. Logs can hold visitor IP addresses: only send them when the user agrees.
    ConnectorNo auth
  • Search CVE database with filters: product/vendor, severity, published date range, EPSS score, CWE, CVSS range, CISA KEV status. Default response is SLIM per-result (cve_id, summary, severity, cvss_v3, cwe_id, epss, kev, total_products, published, modified, sources) — pass include='full' for description, cvss_breakdown, affected_products, references, first_seen_*. Verdict (sources_queried, falsifiable_fields, completeness, data_age) is at the response root — applies to the whole batch, not per-row. Product/vendor filters are EXACT NVD-canonical-token matches (not the common name — e.g. nginx is 'nginx_open_source'/'nginx_plus', vendor 'f5'); a low/zero count for a well-known product means the token differs, so for dependency/package lists use check_dependencies and for a domain's whole stack tech_stack_cve_audit (both auto-normalize tokens). Use for vulnerability discovery by criteria; pass cwe_id (e.g. CWE-79) to enumerate every CVE in our database mapped to a weakness — pair with cwe_lookup for the category description and mitigations. Use cve_lookup for single CVE by ID, kev_detail when kev=true filtering and the agent needs federal patch deadlines per result. Response carries a global hint pointing at cve_lookup — drill into any returned cve_id for full detail and chained pivots (exploit_lookup, kev_detail, cwe_lookup). Free: 30/hr, Pro: 500/hr. Returns {count, total, truncated, offset, summary, results, query_echo, next_offset, verdict, hint}.
    ConnectorNo auth
  • Remove an IP firewall rule and reload Nginx. Requires: API key with write scope. Args: slug: Site identifier ip: IP address or CIDR to remove (must match exactly) Returns: {"removed": true, "ip": "1.2.3.4"}
    ConnectorNo auth
  • Link a domain to a hosted site. Attaches the domain to the specified site and triggers automatic DNS configuration and SSL provisioning. WARNING: Regenerates this site's nginx vhost on the host from scratch. Any config applied to that vhost by hand is lost, silently — the site keeps serving and only the hand-added behaviour disappears. Config set via the nginx-snippet endpoint is NOT affected: it lives in a separate file the regenerated vhost re-includes, which is what that endpoint is for. Requires: API key with write scope. Args: domain_name: Full domain name (e.g. "example.com") site_slug: Site identifier to link the domain to Returns: {"success": true, "domain": "example.com", "linked_site": "my-site", "message": "Domain linked"} Errors: NOT_FOUND: Domain or site not found VALIDATION_ERROR: Domain already linked to another site
    ConnectorNo auth
  • Scan a live website and report which HTTP security headers it currently sends. These headers tell the browser how to behave more safely — the main ones are HSTS (force HTTPS), Content-Security-Policy / CSP (block injected scripts and XSS), X-Frame-Options (stop clickjacking), X-Content-Type-Options (stop MIME sniffing), Referrer-Policy (limit what the URL leaks to other sites), and Permissions-Policy (turn off camera/mic/geolocation by default). Read-only — fetches the page once over HTTPS, nothing is changed. Returns: whether HTTPS works, each expected header with present/missing and its current value, a list of the ones that are missing, a recommended best-practice config, and ready-to-paste server snippets (nginx/Apache/Caddy/Cloudflare/_headers) so a beginner can just copy the fix in. Use this to audit a real site's header posture; use generate_security_headers when you just want a fresh best-practice config to apply without scanning anything first.
    ConnectorNo auth
  • List IP allow/deny firewall rules for a site. Rules are implemented as Nginx allow/deny directives per container. Requires: API key with read scope. Args: slug: Site identifier Returns: {"rules": [{"ip": "1.2.3.4", "action": "deny"}, {"ip": "10.0.0.0/8", "action": "allow"}]}
    ConnectorNo auth
  • Creates a raw compute instance for custom OS/cloud-init workflows. For app/source deployments, prefer check_deploy_prerequisites -> plan_deploy -> deploy_app/deploy_compose; do not use create_instance as a shortcut around the deployment plan. Requires a recent plan_instance. For reduOS, set cloud_init_template='reduos' and flavor m1.xlarge (16GB). SSH keypair must exist. For a public web app on a raw VM, pass dns_entries (gives a .redu.cloud URL through redu's automatic public proxy). The origin app should listen on dns_entries[].port; do not install nginx on the VM unless the app itself needs it, because redu.cloud already creates the public Nginx proxy host.
    ConnectorNo auth
  • Full normalized details for one package by registry + name, in a single unified Package shape across npm, PyPI, Docker Hub, and the VS Code Marketplace. name handles scoped npm ids (e.g. @types/node), Docker namespaces (e.g. library/nginx or a bare nginx for official images), and VS Code publisher.extension ids. With registry=all the request fans out to every registry in parallel and returns a packages array (missing registries are silently dropped); otherwise a single package is returned.
    ConnectorNo auth
  • Return the live MCP discovery server card for https://hodlxxi.com/agent/mcp, which nginx routes to the separate read-only sidecar rather than the Flask monolith.
    ConnectorNo auth
  • Retrieve container logs (error, access, or PHP). Requires: API key with read scope. Args: slug: Site identifier log_type: "error" (Nginx/Apache errors), "access" (HTTP request log), or "php" (PHP-FPM errors, WordPress sites only) lines: Number of lines to retrieve (1–500, default: 100) search: Optional keyword filter — only lines containing this string Returns: {"log_type": "error", "lines": ["2024-01-15 ... error ...", ...], "count": 42, "truncated": false} Errors: NOT_FOUND: Unknown slug VALIDATION_ERROR: Invalid log_type or lines out of range
    ConnectorNo auth