hostinger-api-mcp 2.0.0 → 2.2.0

package/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "hostinger-api-mcp",
-  "version": "2.0.0",
+  "version": "2.2.0",
   "description": "Hostinger API — manage domains, DNS, hosting, VPS, billing and more from Gemini CLI.",
   "mcpServers": {
     "hostinger": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hostinger-api-mcp",
-  "version": "2.0.0",
+  "version": "2.2.0",
   "mcpName": "io.github.hostinger/hostinger-api-mcp",
   "description": "MCP server for Hostinger API",
   "repository": {
@@ -38,13 +38,14 @@
     "start:ts": "npx tsc && node dist/src/servers/all.js"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.10.0",
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "axios": "^1.8.0",
     "cors": "^2.8.5",
     "dotenv": "^18.0.1",
     "express": "^5.2.1",
     "minimist": "^1.2.8",
-    "tus-js-client": "^4.1.0"
+    "tus-js-client": "^4.1.0",
+    "zod": "^4.1.0"
   },
   "devDependencies": {
     "@types/node": "^26.1.1",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/hostinger/api-mcp-server",
     "source": "github"
   },
-  "version": "2.0.0",
+  "version": "2.2.0",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@hostinger/mcp",
-      "version": "2.0.0",
+      "version": "2.2.0",
       "transport": {
         "type": "stdio"
       },

package/skills/headless/SKILL.md

@@ -52,5 +52,5 @@ Run non-interactively wherever possible. The exceptions that must involve the us
 
 The inputSchema returned by search is authoritative for request shapes — read it before calling. Two live sources supersede anything written here when they disagree:
 
-- The ecommerce operation `ecommerce_getCustomStorefrontSetupInstructionsV1` returns the current storefront integration guide from the server — execute it at the start of any store run.
+- The ecommerce operation `ecommerce_miscellaneous_custom-storefront-setup-instructions` returns the current storefront integration guide from the server — execute it at the start of any store run.
 - The Hostinger API reference at https://developers.hostinger.com describes every endpoint behind the operations.

package/skills/headless/references/DATABASE.md

@@ -4,8 +4,8 @@ Use this when the app needs MySQL, or when a deploy "succeeded" but the app cann
 
 ## 1. Create the database
 
-1. `hosting_createAccountDatabaseV1` on the site's `username` with a database name, a user and a password you generate — name and user are prefixed with the account username automatically.
-2. Read the full, prefixed `name` and `user` back from `hosting_listAccountDatabasesV1`; every other database operation wants the full name.
+1. `hosting_databases_create` on the site's `username` with a database name, a user and a password you generate — name and user are prefixed with the account username automatically.
+2. Read the full, prefixed `name` and `user` back from `hosting_databases_list`; every other database operation wants the full name.
 3. Do not print the password to the user once it is stored, and never commit it.
 
 ## 2. Which host the app connects to
@@ -14,13 +14,13 @@ Use this when the app needs MySQL, or when a deploy "succeeded" but the app cann
 | --- | --- | --- | --- |
 | PHP on the website | `localhost` or `127.0.0.1` | 3306 | `localhost` uses the MySQL socket; both are granted |
 | Node.js on the website | `127.0.0.1` | 3306 | `localhost` may resolve to IPv6 `::1`, and not every database user has that grant |
-| Outside Hostinger (a laptop, another server) | the `host` from `hosting_listAccountDatabasesV1` (`srvNNNN.hstgr.io`) | 3306 | needs `hosting_createDatabaseRemoteConnectionV1` for that client's IP first — never `%`, it opens the database to every address on the internet |
+| Outside Hostinger (a laptop, another server) | the `host` from `hosting_databases_list` (`srvNNNN.hstgr.io`) | 3306 | needs `hosting_databases_create-remote-connection` for that client's IP first — never `%`, it opens the database to every address on the internet |
 
 Do not put the remote `host` into the deployed app — it has no grant for connections that come from the server itself.
 
 ## 3. Hand credentials to the app
 
-- **Node.js:** environment variables via `hosting_replaceNode_jsEnvironmentVariablesV1`. Conventional keys: `DB_HOST=127.0.0.1`, `DB_PORT=3306`, `DB_NAME`, `DB_USER`, `DB_PASSWORD`, plus `DATABASE_URL=mysql://USER:PASSWORD@127.0.0.1:3306/NAME` for ORMs that want one string — URL-encode `USER` and `PASSWORD` there (`encodeURIComponent`), or a password containing `@`, `:`, `/` or `#` breaks the URL. The call is a **full replace**: list the current keys with `hosting_listNode_jsEnvironmentVariablesV1` (values come back masked as `********` — never copy those), then send the complete set with real values. Saving restarts the process; frameworks that bake variables into the build (Next.js, `NEXT_PUBLIC_*`) need a new `hosting_startNode_jsBuildV1` afterwards.
+- **Node.js:** environment variables via `hosting_nodejs_replace-environment-variables`. Conventional keys: `DB_HOST=127.0.0.1`, `DB_PORT=3306`, `DB_NAME`, `DB_USER`, `DB_PASSWORD`, plus `DATABASE_URL=mysql://USER:PASSWORD@127.0.0.1:3306/NAME` for ORMs that want one string — URL-encode `USER` and `PASSWORD` there (`encodeURIComponent`), or a password containing `@`, `:`, `/` or `#` breaks the URL. The call is a **full replace**: list the current keys with `hosting_nodejs_list-environment-variables` (values come back masked as `********` — never copy those), then send the complete set with real values. Saving restarts the process; frameworks that bake variables into the build (Next.js, `NEXT_PUBLIC_*`) need a new `hosting_nodejs_start-build` afterwards.
 - **PHP:** a config file on the server that the app reads (its own `config.php`, WordPress's `wp-config.php`). Ship it with the deploy, keep it out of git.
 - **Never** in client-side JavaScript, in a committed `.env`, or in chat replies.
 
@@ -28,22 +28,22 @@ Do not put the remote `host` into the deployed app — it has no grant for conne
 
 | You called | Poll this until | Typical wait |
 | --- | --- | --- |
-| `hosting_createWebsiteV1` | `hosting_listWebsitesV1` lists the domain | up to a few minutes |
-| `hosting_deployJsApplication` | `hosting_listJsDeployments` shows the build finished | minutes |
-| `hosting_startNode_jsBuildV1` | `hosting_getNode_jsBuildDetailsV1` state is `completed` or `failed` | minutes |
-| `hosting_installWordPressV1`, plugin/theme/core jobs | `hosting_listWordPressInstallationsV1` lists the install | 1–2 minutes |
-| `hosting_repairDatabaseV1`, `hosting_deleteWebsiteV1` | nothing to poll — runs in the background | minutes |
-| `agency-hosting_createANewWebsiteV1` | `agency-hosting_getWebsiteSetupStatusV1` with `setup_uuid` is `completed` | minutes |
+| `hosting_websites_create` | `hosting_websites_list` lists the domain | up to a few minutes |
+| `hosting_deploy-js-application` | `hosting_list-js-deployments` shows the build finished | minutes |
+| `hosting_nodejs_start-build` | `hosting_nodejs_build` state is `completed` or `failed` | minutes |
+| `wordpress_installations_install`, plugin/theme/core jobs | `wordpress_installations_list` lists the install | 1–2 minutes |
+| `hosting_databases_repair`, `hosting_websites_delete` | nothing to poll — runs in the background | minutes |
+| `agency-hosting_website-setups_create` | `agency-hosting_website-setups_status` with `setup_uuid` is `completed` | minutes |
 
 Poll with backoff (a few seconds, then tens of seconds). A queued response is not a failure, and re-sending the write does not speed it up.
 
 ## 5. When the app is up but broken
 
-- Build failed: `hosting_getNodeJSBuildLogsV1` for the raw log, `hosting_analyseFailedNode_jsBuildV1` for a diagnosis.
-- Build passed, app errors: `hosting_getNode_jsRuntimeLogsV1` with a `period` such as `1h`; entries before `last_deployed_at` belong to the previous deploy.
+- Build failed: `hosting_nodejs_build-logs` for the raw log, `hosting_nodejs_analyse-failed-build` for a diagnosis.
+- Build passed, app errors: `hosting_nodejs_runtime-logs` with a `period` such as `1h`; entries before `last_deployed_at` belong to the previous deploy.
 - `Access denied for user 'x'@'::1'`: the app used `localhost` from Node.js — set `DB_HOST` to `127.0.0.1`.
-- PHP limits (memory, upload size): `hosting_getPHPDetailsV1`, then `hosting_updatePHPOptionsV1`.
+- PHP limits (memory, upload size): `hosting_php_get`, then `hosting_php_update-options`.
 
 ## Agency Plan websites (`agency-hosting_*`)
 
-`agency-hosting_createWebsiteDatabaseV1` creates the database and its single user; the user is granted on `localhost`, so the PHP app connects to `localhost`. Deploys are synchronous there — `agency-hosting_deployPhpApplication` returns when the site is live. Other jobs (SSL, backups) show up in `agency-hosting_listWebsiteProcessesV1`.
+`agency-hosting_databases_create-website` creates the database and its single user; the user is granted on `localhost`, so the PHP app connects to `localhost`. Deploys are synchronous there — `agency-hosting_deploy-php-application` returns when the site is live. Other jobs (SSL, backups) show up in `agency-hosting_websites_list-processes`.

package/skills/headless/references/DEPLOYMENT.md

@@ -2,7 +2,7 @@
 
 Match the deploy method to what the project actually is — this is the single most common failure point.
 
-## Static site → `hosting_deployStaticWebsite`
+## Static site → `hosting_deploy-static-website`
 
 For pre-built files only: plain HTML/CSS/JS, or the **build output** of a framework (run the build locally first).
 
@@ -10,15 +10,15 @@ For pre-built files only: plain HTML/CSS/JS, or the **build output** of a framew
 - Name it `name_YYYYMMDD_HHMMSS.zip`; pass `removeArchive: true` to clean up after upload.
 - Deployment is effectively immediate — verify right after.
 
-## Node.js app → `hosting_deployJsApplication`
+## Node.js app → `hosting_deploy-js-application`
 
 For anything that needs a server or a server-side build (Express, Next.js, NestJS, SSR frameworks).
 
 - Archive the **source**, not the output: exclude `node_modules/`, `dist/`, `.next/`, `build/`, and everything matched by `.gitignore`. The install and build run on Hostinger.
 - Hard cap: **50 MB** archive.
-- The upload starts a build. Track it with `hosting_listJsDeployments`; on failure pull `hosting_showJsDeploymentLogs`, fix, and redeploy. Poll with backoff — builds take minutes, not seconds.
+- The upload starts a build. Track it with `hosting_list-js-deployments`; on failure pull `hosting_show-js-deployment-logs`, fix, and redeploy. Poll with backoff — builds take minutes, not seconds.
 
-## WordPress → `hosting_importWordpressWebsite` / plugin & theme operations
+## WordPress → `hosting_import-wordpress-website` / plugin & theme operations
 
 Only when the user explicitly wants a WordPress *site* migrated or themed. Site imports take an archive plus a `.sql` dump and can run for several minutes. (WordPress as a headless content backend behind an agent-built frontend is a different flow — that's `WORDPRESS.md`, installed fresh via the API, not imported here.)
 
@@ -29,6 +29,6 @@ curl -s -o /dev/null -w "%{http_code}\n" https://YOURDOMAIN/
 curl -s https://YOURDOMAIN/ | grep -o "SOME_REAL_HEADLINE_TEXT"
 ```
 
-Replace the grep target with copy you actually rendered — a 200 alone can be a placeholder page. A freshly created site may serve a default page for a short while; if content doesn't match, clear the cache (`hosting_clearWebsiteCacheV1`) and retry before assuming the deploy failed. For store runs, also run the checkout verification in `STORE.md`.
+Replace the grep target with copy you actually rendered — a 200 alone can be a placeholder page. A freshly created site may serve a default page for a short while; if content doesn't match, clear the cache (`hosting_cache_clear-website`) and retry before assuming the deploy failed. For store runs, also run the checkout verification in `STORE.md`.
 
 When the site is live, report the URL and remind the user the site is managed from hPanel (https://hpanel.hostinger.com).

package/skills/headless/references/SETUP.md

@@ -6,24 +6,24 @@ Everything here uses the **hosting** MCP operations. If they're missing, ask the
 
 A website can only be created on an active hosting plan.
 
-1. `hosting_listWebsitesV1` — if it returns websites, the account has a working plan; note any existing `order_id` and `username` for step 2.
-2. Otherwise `hosting_listOrdersV1` — look for an order in a usable state. A fresh order that has never hosted a website still works; note its `order_id`.
+1. `hosting_websites_list` — if it returns websites, the account has a working plan; note any existing `order_id` and `username` for step 2.
+2. Otherwise `hosting_orders_list` — look for an order in a usable state. A fresh order that has never hosted a website still works; note its `order_id`.
 3. If there is no usable order: **stop and tell the user** that an active Hostinger hosting plan is required to deploy, link https://www.hostinger.com/web-hosting, and offer to continue building the site locally in the meantime. When they confirm the purchase, re-run this check.
 
 Never purchase a plan, domain, or any paid item without the user explicitly approving that specific purchase.
 
 ## 2. Choose the domain
 
-- **Default: free subdomain.** `hosting_generateAFreeSubdomainV1` returns a `*.hostingersite.com` domain. No verification needed. Tell the user a custom domain can be connected later.
-- **User-owned domain:** `hosting_verifyDomainOwnershipV1` first. If not accessible, relay the TXT record it returns, remind them propagation can take ~10 minutes, and re-verify before continuing.
-- **New domain purchase:** only on explicit request — check availability with `domains_checkDomainAvailabilityV1`, state the price, and get an explicit yes before `domains_purchaseNewDomainV1` (needs the domains product group).
+- **Default: free subdomain.** `hosting_domains_generate-free-subdomain` returns a `*.hostingersite.com` domain. No verification needed. Tell the user a custom domain can be connected later.
+- **User-owned domain:** `hosting_domains_verify-ownership` first. If not accessible, relay the TXT record it returns, remind them propagation can take ~10 minutes, and re-verify before continuing.
+- **New domain purchase:** only on explicit request — check availability with `domains_availability_check`, state the price, and get an explicit yes before `domains_portfolio_purchase` (needs the domains product group).
 
 ## 3. Create the website and wait for it
 
 Generating a subdomain does **not** create a website — deploying straight to it fails with `No website found for domain`. The working sequence:
 
-1. `hosting_createWebsiteV1 { domain, order_id }` — `datacenter_code` is required only for the first website on a brand-new plan (pick the first entry from `hosting_listAvailableDatacentersV1`).
-2. **Poll** `hosting_listWebsitesV1` filtered by the domain until the site appears. Creation takes up to a few minutes — poll with backoff, don't fail fast.
+1. `hosting_websites_create { domain, order_id }` — `datacenter_code` is required only for the first website on a brand-new plan (pick the first entry from `hosting_datacenters_list`).
+2. **Poll** `hosting_websites_list` filtered by the domain until the site appears. Creation takes up to a few minutes — poll with backoff, don't fail fast.
 3. Note the site's `username` — deployment and database operations are keyed on it.
 
 If the domain already has a website (an `iterate` run, or the user pointed at an existing site), skip creation entirely.
@@ -31,4 +31,4 @@ If the domain already has a website (an `iterate` run, or the user pointed at an
 ## 4. Optional extras (only when the run needs them)
 
 - **Database:** when the app needs MySQL, follow `DATABASE.md` — creating it, which host each runtime connects to (Node.js must use `127.0.0.1`), and handing the credentials to the app without hard-coding them.
-- **DNS records:** the DNS operations (`DNS_updateDNSRecordsV1` etc.) for custom-domain records; take a snapshot (`DNS_getDNSSnapshotListV1` context) before destructive changes.
+- **DNS records:** the DNS operations (`dns_records_update` etc.) for custom-domain records; take a snapshot (`dns_snapshots_list` context) before destructive changes.

package/skills/headless/references/STORE.md

@@ -1,6 +1,6 @@
 # Store — Hostinger Ecommerce with a custom storefront
 
-**Primary source:** execute `ecommerce_getCustomStorefrontSetupInstructionsV1` at the start of every store run — it returns the current, server-maintained integration guide, and it supersedes this file wherever they disagree. This file carries the essentials so the run can be planned before that call, and a fallback when the ecommerce operations aren't enabled.
+**Primary source:** execute `ecommerce_miscellaneous_custom-storefront-setup-instructions` at the start of every store run — it returns the current, server-maintained integration guide, and it supersedes this file wherever they disagree. This file carries the essentials so the run can be planned before that call, and a fallback when the ecommerce operations aren't enabled.
 
 ## Mental model
 
@@ -17,9 +17,9 @@ Two API surfaces — don't mix them:
 
 ## Backend setup (management tools)
 
-1. Resolve the `custom` sales channel: `ecommerce_getStoresV1` → `ecommerce_listSalesChannelsV1`. If a `custom` channel already exists, confirm with the user that it's the one to use; otherwise add one to the existing store with `ecommerce_createCustomSalesChannelV1`, or create a store with `ecommerce_createStoreV1` (with a `custom` sales channel) when no suitable store exists. Set the channel `url` to the storefront's public domain at creation when it's already known.
-2. For checkout to work the store needs all three: ≥ 1 product, ≥ 1 payment method, ≥ 1 shipping zone. Payment, shipping, and currency are store-level — check `ecommerce_getStoreMetadataV1` (`has_payment_methods` and `has_shipping` must be `true`; the same response carries `default_currency` with `code`, `decimal_digits`, `template` — read it here rather than guessing). Products are **per sales channel** — verify by listing products for the resolved channel on the Storefront API and confirming the list is non-empty. Seed what's missing with `ecommerce_createPhysicalProductV1` / `ecommerce_createDigitalProductV1`, `ecommerce_enableManualPaymentMethodV1`, and `ecommerce_setStoreShippingV1` (price `0` = free shipping) — confirming with the user before writing to a store that already has real data.
-3. After deploy, point the channel at the live site: `ecommerce_updateSalesChannelV1 { store_id, sales_channel_id, url }`.
+1. Resolve the `custom` sales channel: `ecommerce_stores_list` → `ecommerce_sales-channels_list`. If a `custom` channel already exists, confirm with the user that it's the one to use; otherwise add one to the existing store with `ecommerce_sales-channels_create`, or create a store with `ecommerce_stores_create` (with a `custom` sales channel) when no suitable store exists. Set the channel `url` to the storefront's public domain at creation when it's already known.
+2. For checkout to work the store needs all three: ≥ 1 product, ≥ 1 payment method, ≥ 1 shipping zone. Payment, shipping, and currency are store-level — check `ecommerce_stores_metadata` (`has_payment_methods` and `has_shipping` must be `true`; the same response carries `default_currency` with `code`, `decimal_digits`, `template` — read it here rather than guessing). Products are **per sales channel** — verify by listing products for the resolved channel on the Storefront API and confirming the list is non-empty. Seed what's missing with `ecommerce_products_create-physical` / `ecommerce_products_create-digital`, `ecommerce_payments_enable-manual-method`, and `ecommerce_shipping_set-store` (price `0` = free shipping) — confirming with the user before writing to a store that already has real data.
+3. After deploy, point the channel at the live site: `ecommerce_sales-channels_update { store_id, sales_channel_id, url }`.
 
 If the ecommerce operations aren't available, ask the user to enable the Ecommerce product group in the Hostinger Connector — or to provide the `sales_channel_id` directly, after which the public endpoints suffice for the frontend work.
 

package/skills/headless/references/WORDPRESS.md

@@ -20,11 +20,11 @@ Two surfaces, like the store recipe:
 
 ## Setup (management tools)
 
-1. **Check for an existing installation first**: `hosting_listWordPressInstallationsV1` filtered by the site's username/domain. Reuse a valid install when the user agrees — never overwrite one silently.
-2. **Choose where WordPress lives.** Default: a dedicated subdomain of the site, e.g. `cms.<domain>` — create it with `hosting_createWebsiteSubdomainV1` so the main domain stays free for the frontend. A separate free-subdomain website (per `SETUP.md`) also works when the plan allows another website.
-3. **Install**: `hosting_installWordPressV1` on that domain. The call only queues the job — **poll** `hosting_listWordPressInstallationsV1` until the installation appears (typically 1–2 minutes). Don't proceed on the queued response alone.
-4. **Hand the owner their editor**: mint a one-click wp-admin link with `hosting_createLoginLinksV1` and show it to the user. Content authoring happens in wp-admin — the skill does not seed posts (there is no anonymous write path, by design). The fresh install ships with a sample post, which is enough to build and verify the frontend against.
-5. **Caching** (recommended before finishing): enable the object cache with `hosting_toggleMemcachedObjectCacheV1`; after config changes, purge with `hosting_purgeLiteSpeedCacheV1`.
+1. **Check for an existing installation first**: `wordpress_installations_list` filtered by the site's username/domain. Reuse a valid install when the user agrees — never overwrite one silently.
+2. **Choose where WordPress lives.** Default: a dedicated subdomain of the site, e.g. `cms.<domain>` — create it with `hosting_domains_create-website-subdomain` so the main domain stays free for the frontend. A separate free-subdomain website (per `SETUP.md`) also works when the plan allows another website.
+3. **Install**: `wordpress_installations_install` on that domain. The call only queues the job — **poll** `wordpress_installations_list` until the installation appears (typically 1–2 minutes). Don't proceed on the queued response alone.
+4. **Hand the owner their editor**: mint a one-click wp-admin link with `wordpress_login_create-links` and show it to the user. Content authoring happens in wp-admin — the skill does not seed posts (there is no anonymous write path, by design). The fresh install ships with a sample post, which is enough to build and verify the frontend against.
+5. **Caching** (recommended before finishing): enable the object cache with `wordpress_object-cache_toggle-memcached`; after config changes, purge with `wordpress_litespeed-cache_purge-lite-speed`.
 
 ## Frontend contract
 

package/src/core/instructions.js

@@ -1,2 +1,2 @@
 // Auto-generated server instructions
-export default "Hostinger API notes for agents. Find operations with search; the inputSchema it returns is authoritative for request shapes. Run one with execute, or chain several with multi-execute.\n\nDatabases (web hosting, hosting_* operations)\n- MySQL runs on the same server as the website. From the deployed app connect to host 127.0.0.1, port 3306. PHP may also use localhost (Unix socket). Node.js should use 127.0.0.1: localhost can resolve to IPv6 (::1) and not every database user has that grant.\n- The `host` from hosting_listAccountDatabasesV1 (srvNNNN.hstgr.io) is only for connections from outside Hostinger, after hosting_createDatabaseRemoteConnectionV1. Never use it from the app.\n- Agency Plan (agency-hosting_* operations) database users are created for localhost; the PHP app connects there.\n\nAsynchronous operations\n- A success response often means \"queued\", not \"done\". Poll the matching read operation with backoff (seconds, then minutes). Never re-send the write.\n- hosting_createWebsiteV1 -> poll hosting_listWebsitesV1 until the domain appears (a few minutes).\n- hosting_startNode_jsBuildV1 -> hosting_getNode_jsBuildDetailsV1; logs via hosting_getNodeJSBuildLogsV1; on failure hosting_analyseFailedNode_jsBuildV1.\n- hosting_installWordPressV1 and WordPress plugin/theme/core jobs -> poll hosting_listWordPressInstallationsV1.\n- agency-hosting_createANewWebsiteV1 -> poll agency-hosting_getWebsiteSetupStatusV1 with setup_uuid; other Agency Plan jobs -> agency-hosting_listWebsiteProcessesV1.\n- Website deletion, database repair and domain contact changes finish in the background.\n\nCredentials\n- Never write database passwords or API tokens into source code, client-side JavaScript or committed .env files.\n- Node.js apps read them from environment variables: set the full set with hosting_replaceNode_jsEnvironmentVariablesV1 (full replace; values are masked on read). Build-time variables (Next.js) need a new build afterwards.\n- PHP apps read them from a config file on the server, outside the repository.\n- Generate strong passwords and do not echo them back once stored.\n\nFor end-to-end site builds install the headless skill: npx skills add hostinger/api-mcp-server";
+export default "Hostinger API notes for agents. Find operations with search; the inputSchema it returns is authoritative for request shapes. Run one with execute, or chain several with multi-execute.\n\nDatabases (web hosting, hosting_* operations)\n- MySQL runs on the same server as the website. From the deployed app connect to host 127.0.0.1, port 3306. PHP may also use localhost (Unix socket). Node.js should use 127.0.0.1: localhost can resolve to IPv6 (::1) and not every database user has that grant.\n- The `host` from hosting_databases_list (srvNNNN.hstgr.io) is only for connections from outside Hostinger, after hosting_databases_create-remote-connection. Never use it from the app.\n- Agency Plan (agency-hosting_* operations) database users are created for localhost; the PHP app connects there.\n\nAsynchronous operations\n- A success response often means \"queued\", not \"done\". Poll the matching read operation with backoff (seconds, then minutes). Never re-send the write.\n- hosting_websites_create -> poll hosting_websites_list until the domain appears (a few minutes).\n- hosting_nodejs_start-build -> hosting_nodejs_build; logs via hosting_nodejs_build-logs; on failure hosting_nodejs_analyse-failed-build.\n- wordpress_installations_install and WordPress plugin/theme/core jobs -> poll wordpress_installations_list.\n- agency-hosting_website-setups_create -> poll agency-hosting_website-setups_status with setup_uuid; other Agency Plan jobs -> agency-hosting_websites_list-processes.\n- Website deletion, database repair and domain contact changes finish in the background.\n\nCredentials\n- Never write database passwords or API tokens into source code, client-side JavaScript or committed .env files.\n- Node.js apps read them from environment variables: set the full set with hosting_nodejs_replace-environment-variables (full replace; values are masked on read). Build-time variables (Next.js) need a new build afterwards.\n- PHP apps read them from a config file on the server, outside the repository.\n- Generate strong passwords and do not echo them back once stored.\n\nFor end-to-end site builds install the headless skill: npx skills add hostinger/api-mcp-server";

package/src/core/instructions.ts

@@ -1,3 +1,3 @@
 // Auto-generated server instructions
-const instructions: string = "Hostinger API notes for agents. Find operations with search; the inputSchema it returns is authoritative for request shapes. Run one with execute, or chain several with multi-execute.\n\nDatabases (web hosting, hosting_* operations)\n- MySQL runs on the same server as the website. From the deployed app connect to host 127.0.0.1, port 3306. PHP may also use localhost (Unix socket). Node.js should use 127.0.0.1: localhost can resolve to IPv6 (::1) and not every database user has that grant.\n- The `host` from hosting_listAccountDatabasesV1 (srvNNNN.hstgr.io) is only for connections from outside Hostinger, after hosting_createDatabaseRemoteConnectionV1. Never use it from the app.\n- Agency Plan (agency-hosting_* operations) database users are created for localhost; the PHP app connects there.\n\nAsynchronous operations\n- A success response often means \"queued\", not \"done\". Poll the matching read operation with backoff (seconds, then minutes). Never re-send the write.\n- hosting_createWebsiteV1 -> poll hosting_listWebsitesV1 until the domain appears (a few minutes).\n- hosting_startNode_jsBuildV1 -> hosting_getNode_jsBuildDetailsV1; logs via hosting_getNodeJSBuildLogsV1; on failure hosting_analyseFailedNode_jsBuildV1.\n- hosting_installWordPressV1 and WordPress plugin/theme/core jobs -> poll hosting_listWordPressInstallationsV1.\n- agency-hosting_createANewWebsiteV1 -> poll agency-hosting_getWebsiteSetupStatusV1 with setup_uuid; other Agency Plan jobs -> agency-hosting_listWebsiteProcessesV1.\n- Website deletion, database repair and domain contact changes finish in the background.\n\nCredentials\n- Never write database passwords or API tokens into source code, client-side JavaScript or committed .env files.\n- Node.js apps read them from environment variables: set the full set with hosting_replaceNode_jsEnvironmentVariablesV1 (full replace; values are masked on read). Build-time variables (Next.js) need a new build afterwards.\n- PHP apps read them from a config file on the server, outside the repository.\n- Generate strong passwords and do not echo them back once stored.\n\nFor end-to-end site builds install the headless skill: npx skills add hostinger/api-mcp-server";
+const instructions: string = "Hostinger API notes for agents. Find operations with search; the inputSchema it returns is authoritative for request shapes. Run one with execute, or chain several with multi-execute.\n\nDatabases (web hosting, hosting_* operations)\n- MySQL runs on the same server as the website. From the deployed app connect to host 127.0.0.1, port 3306. PHP may also use localhost (Unix socket). Node.js should use 127.0.0.1: localhost can resolve to IPv6 (::1) and not every database user has that grant.\n- The `host` from hosting_databases_list (srvNNNN.hstgr.io) is only for connections from outside Hostinger, after hosting_databases_create-remote-connection. Never use it from the app.\n- Agency Plan (agency-hosting_* operations) database users are created for localhost; the PHP app connects there.\n\nAsynchronous operations\n- A success response often means \"queued\", not \"done\". Poll the matching read operation with backoff (seconds, then minutes). Never re-send the write.\n- hosting_websites_create -> poll hosting_websites_list until the domain appears (a few minutes).\n- hosting_nodejs_start-build -> hosting_nodejs_build; logs via hosting_nodejs_build-logs; on failure hosting_nodejs_analyse-failed-build.\n- wordpress_installations_install and WordPress plugin/theme/core jobs -> poll wordpress_installations_list.\n- agency-hosting_website-setups_create -> poll agency-hosting_website-setups_status with setup_uuid; other Agency Plan jobs -> agency-hosting_websites_list-processes.\n- Website deletion, database repair and domain contact changes finish in the background.\n\nCredentials\n- Never write database passwords or API tokens into source code, client-side JavaScript or committed .env files.\n- Node.js apps read them from environment variables: set the full set with hosting_nodejs_replace-environment-variables (full replace; values are masked on read). Build-time variables (Next.js) need a new build afterwards.\n- PHP apps read them from a config file on the server, outside the repository.\n- Generate strong passwords and do not echo them back once stored.\n\nFor end-to-end site builds install the headless skill: npx skills add hostinger/api-mcp-server";
 export default instructions;

package/src/core/runtime.js

@@ -10,9 +10,13 @@ import { config as dotenvConfig } from "dotenv";
 import {
   ListToolsRequestSchema,
   CallToolRequestSchema,
+  ListResourcesRequestSchema,
+  ListResourceTemplatesRequestSchema,
+  ReadResourceRequestSchema,
   ErrorCode,
   McpError,
 } from "@modelcontextprotocol/sdk/types.js";
+import { z } from "zod";
 import { OAuthProvider, getEnvToken } from "./oauth.js";
 import * as tus from "tus-js-client";
 import fs from "fs";
@@ -43,17 +47,33 @@ const SECURITY_SCHEMES = {
   }
 };
 
+// MCP Skills extension (io.modelcontextprotocol/skills). The SDK has no built-in
+// support yet, so the two methods are registered as custom requests.
+const SKILLS_EXTENSION = "io.modelcontextprotocol/skills";
+const SKILLS_CACHE = { ttlMs: 300000, cacheScope: "public" };
+const ListSkillsRequestSchema = z.object({
+  method: z.literal("skills/list"),
+  params: z.object({ cursor: z.string().optional() }).passthrough().optional(),
+});
+const GetSkillRequestSchema = z.object({
+  method: z.literal("skills/get"),
+  // Lenient on purpose: a missing or non-string uri must surface as InvalidParams
+  // from the handler, not as a zod parse failure (InternalError).
+  params: z.object({ uri: z.unknown().optional() }).passthrough().optional(),
+});
+
 /**
  * MCP Server for Hostinger API
  * Generated from OpenAPI spec version 1.54.2
  */
 class MCPServer {
-  constructor({ name, version, tools, instructions }) {
+  constructor({ name, version, tools, instructions, skills = [] }) {
     // Initialize class properties
     this.name = name;
     this.version = version;
     this.toolList = tools;
     this.instructions = instructions;
+    this.skills = skills;
     this.server = null;
     this.operations = new Map();
     this.debug = process.env.DEBUG === "true";
@@ -73,6 +93,7 @@ class MCPServer {
       {
         capabilities: {
           tools: {}, // Enable tools capability
+          ...(this.skills.length > 0 ? { resources: {}, extensions: { [SKILLS_EXTENSION]: {} } } : {}),
         },
         instructions: this.instructions,
       }
@@ -186,6 +207,60 @@ class MCPServer {
         return { isError: true, content: [{ type: "text", text: errorText }] };
       }
     });
+
+    if (this.skills.length > 0) {
+      this.setupSkillHandlers();
+    }
+  }
+
+  /**
+   * Serve the bundled agent skills over the MCP Skills extension: skills/list and
+   * skills/get return the manifest entries, and every listed file is a skill://
+   * resource readable with resources/read.
+   */
+  setupSkillHandlers() {
+    const entry = (skill) => ({
+      uri: skill.uri,
+      frontmatter: skill.frontmatter,
+      resources: skill.resources.map(({ uri, digest, size }) => ({ uri, digest, size })),
+    });
+    const skillsByUri = new Map(this.skills.map((skill) => [skill.uri, skill]));
+    const files = new Map(this.skills.flatMap((skill) => skill.resources.map((file) => [file.uri, file])));
+
+    this.server.setRequestHandler(ListSkillsRequestSchema, async () => ({
+      resultType: "complete",
+      skills: this.skills.map(entry),
+      ...SKILLS_CACHE,
+    }));
+
+    this.server.setRequestHandler(GetSkillRequestSchema, async (request) => {
+      const uri = request.params?.uri;
+      const skill = typeof uri === "string" ? skillsByUri.get(uri) : undefined;
+      if (!skill) {
+        throw new McpError(ErrorCode.InvalidParams, typeof uri === "string" ? `Unknown skill: ${uri}` : "Missing or invalid skill uri");
+      }
+      return { resultType: "complete", skill: entry(skill), ...SKILLS_CACHE };
+    });
+
+    this.server.setRequestHandler(ListResourcesRequestSchema, async () => ({
+      resources: Array.from(files.values()).map((file) => ({
+        uri: file.uri,
+        name: file.uri.slice("skill://".length),
+        mimeType: file.mimeType,
+        size: file.size,
+      })),
+    }));
+
+    // resources is advertised, so answer templates/list too (skills have none).
+    this.server.setRequestHandler(ListResourceTemplatesRequestSchema, async () => ({ resourceTemplates: [] }));
+
+    this.server.setRequestHandler(ReadResourceRequestSchema, async (request) => {
+      const file = files.get(request.params.uri);
+      if (!file) {
+        throw new McpError(ErrorCode.InvalidParams, `Unknown resource: ${request.params.uri}`);
+      }
+      return { contents: [{ uri: file.uri, mimeType: file.mimeType, text: file.text }] };
+    });
   }
 
   /**
@@ -218,23 +293,23 @@ class MCPServer {
 
   async executeCustomTool(tool, params) {
     switch (tool.name) {
-      case 'agency-hosting_deployNodeStaticWebsite':
+      case 'agency-hosting_deploy-node-static-website':
         return await this.handleNodeStaticDeploy(params);
-      case 'agency-hosting_deployPhpApplication':
+      case 'agency-hosting_deploy-php-application':
         return await this.handlePhpAppDeploy(params);
-      case 'hosting_importWordpressWebsite':
+      case 'hosting_import-wordpress-website':
         return await this.handleWordpressWebsiteImport(params);
-      case 'hosting_deployWordpressPlugin':
+      case 'hosting_deploy-wordpress-plugin':
         return await this.handleWordpressPluginDeploy(params);
-      case 'hosting_deployWordpressTheme':
+      case 'hosting_deploy-wordpress-theme':
         return await this.handleWordpressThemeDeploy(params);
-      case 'hosting_deployJsApplication':
+      case 'hosting_deploy-js-application':
         return await this.handleJavascriptApplicationDeploy(params);
-      case 'hosting_deployStaticWebsite':
+      case 'hosting_deploy-static-website':
         return await this.handleStaticWebsiteDeploy(params);
-      case 'hosting_listJsDeployments':
+      case 'hosting_list-js-deployments':
         return await this.handleListJavascriptDeployments(params);
-      case 'hosting_showJsDeploymentLogs':
+      case 'hosting_show-js-deployment-logs':
         return await this.handleShowJsDeploymentLogs(params);
       default:
         throw new Error(`Unknown custom tool: ${tool.name}`);
@@ -2636,7 +2711,7 @@ class MCPServer {
   }
 }
 
-export async function startServer({ name, version, tools, instructions }) {
+export async function startServer({ name, version, tools, instructions, skills }) {
   const argv = minimist(process.argv.slice(2), {
     string: ['host'],
     boolean: ['stdio', 'http', 'help', 'version', 'login', 'logout'],
@@ -2694,7 +2769,7 @@ export async function startServer({ name, version, tools, instructions }) {
     }
   }
 
-  const server = new MCPServer({ name, version, tools, instructions });
+  const server = new MCPServer({ name, version, tools, instructions, skills });
   if (argv.http) {
     await server.startHttp(argv.host, argv.port);
   } else {

package/src/core/runtime.ts

@@ -10,10 +10,14 @@ import { config as dotenvConfig } from "dotenv";
 import {
   ListToolsRequestSchema,
   CallToolRequestSchema,
+  ListResourcesRequestSchema,
+  ListResourceTemplatesRequestSchema,
+  ReadResourceRequestSchema,
   ErrorCode,
   McpError,
   Tool,
 } from "@modelcontextprotocol/sdk/types.js";
+import { z } from "zod";
 import { OAuthProvider, getEnvToken } from "./oauth.js";
 import axios,{ AxiosRequestConfig, AxiosError, AxiosResponse } from "axios";
 import * as tus from "tus-js-client";
@@ -70,6 +74,24 @@ const SECURITY_SCHEMES: Record<string, SecurityScheme> = {
   }
 };
 
+// MCP Skills extension (io.modelcontextprotocol/skills). The SDK has no built-in
+// support yet, so the two methods are registered as custom requests.
+const SKILLS_EXTENSION = "io.modelcontextprotocol/skills";
+const SKILLS_CACHE = { ttlMs: 300000, cacheScope: "public" };
+const ListSkillsRequestSchema = z.object({
+  method: z.literal("skills/list"),
+  params: z.object({ cursor: z.string().optional() }).passthrough().optional(),
+});
+const GetSkillRequestSchema = z.object({
+  method: z.literal("skills/get"),
+  // Lenient on purpose: a missing or non-string uri must surface as InvalidParams
+  // from the handler, not as a zod parse failure (InternalError).
+  params: z.object({ uri: z.unknown().optional() }).passthrough().optional(),
+});
+
+interface SkillFile { uri: string; digest: string; size: number; mimeType: string; text: string }
+interface Skill { uri: string; frontmatter: Record<string, unknown>; resources: SkillFile[] }
+
 /**
  * MCP Server for Hostinger API
  * Generated from OpenAPI spec version 1.54.2
@@ -81,17 +103,19 @@ class MCPServer {
   private server: Server;
   private operations: Map<string, OpenApiTool> = new Map();
   private instructions?: string;
+  private skills: Skill[];
   private debug: boolean;
   private baseUrl: string;
   private headers: Record<string, string>;
   private oauth: OAuthProvider;
 
-  constructor({ name, version, tools, instructions }: { name: string; version: string; tools: OpenApiTool[]; instructions?: string }) {
+  constructor({ name, version, tools, instructions, skills = [] }: { name: string; version: string; tools: OpenApiTool[]; instructions?: string; skills?: Skill[] }) {
     // Initialize class properties
     this.name = name;
     this.version = version;
     this.toolList = tools;
     this.instructions = instructions;
+    this.skills = skills;
     this.debug = process.env.DEBUG === "true";
     this.baseUrl = process.env.API_BASE_URL || "https://developers.hostinger.com";
     this.headers = this.parseHeaders(process.env.API_HEADERS || "");
@@ -109,6 +133,7 @@ class MCPServer {
       {
         capabilities: {
           tools: {}, // Enable tools capability
+          ...(this.skills.length > 0 ? { resources: {}, extensions: { [SKILLS_EXTENSION]: {} } } : {}),
         },
         instructions: this.instructions,
       }
@@ -217,6 +242,62 @@ class MCPServer {
         return { isError: true, content: [{ type: "text", text: errorText }] };
       }
     });
+
+    if (this.skills.length > 0) {
+      this.setupSkillHandlers();
+    }
+  }
+
+  /**
+   * Serve the bundled agent skills over the MCP Skills extension: skills/list and
+   * skills/get return the manifest entries, and every listed file is a skill://
+   * resource readable with resources/read.
+   */
+  private setupSkillHandlers(): void {
+    const entry = (skill: Skill) => ({
+      uri: skill.uri,
+      frontmatter: skill.frontmatter,
+      resources: skill.resources.map(({ uri, digest, size }) => ({ uri, digest, size })),
+    });
+    const skillsByUri = new Map<string, Skill>(this.skills.map((skill) => [skill.uri, skill]));
+    const files = new Map<string, SkillFile>(this.skills.flatMap((skill) => skill.resources.map((file) => [file.uri, file] as [string, SkillFile])));
+
+    // Widened return types below satisfy setRequestHandler's inferred result type
+    // for these two custom (non-SDK) schemas.
+    this.server.setRequestHandler(ListSkillsRequestSchema, async (): Promise<Record<string, unknown>> => ({
+      resultType: "complete",
+      skills: this.skills.map(entry),
+      ...SKILLS_CACHE,
+    }));
+
+    this.server.setRequestHandler(GetSkillRequestSchema, async (request): Promise<Record<string, unknown>> => {
+      const uri = request.params?.uri;
+      const skill = typeof uri === "string" ? skillsByUri.get(uri) : undefined;
+      if (!skill) {
+        throw new McpError(ErrorCode.InvalidParams, typeof uri === "string" ? `Unknown skill: ${uri}` : "Missing or invalid skill uri");
+      }
+      return { resultType: "complete", skill: entry(skill), ...SKILLS_CACHE };
+    });
+
+    this.server.setRequestHandler(ListResourcesRequestSchema, async () => ({
+      resources: Array.from(files.values()).map((file) => ({
+        uri: file.uri,
+        name: file.uri.slice("skill://".length),
+        mimeType: file.mimeType,
+        size: file.size,
+      })),
+    }));
+
+    // resources is advertised, so answer templates/list too (skills have none).
+    this.server.setRequestHandler(ListResourceTemplatesRequestSchema, async () => ({ resourceTemplates: [] }));
+
+    this.server.setRequestHandler(ReadResourceRequestSchema, async (request) => {
+      const file = files.get(request.params.uri);
+      if (!file) {
+        throw new McpError(ErrorCode.InvalidParams, `Unknown resource: ${request.params.uri}`);
+      }
+      return { contents: [{ uri: file.uri, mimeType: file.mimeType, text: file.text }] };
+    });
   }
 
   private async executeOperation(operation: unknown, params: unknown): Promise<any> {
@@ -242,23 +323,23 @@ class MCPServer {
 
   private async executeCustomTool(tool: OpenApiTool, params: Record<string, any>): Promise<any> {
     switch (tool.name) {
-      case 'agency-hosting_deployNodeStaticWebsite':
+      case 'agency-hosting_deploy-node-static-website':
         return await this.handleNodeStaticDeploy(params);
-      case 'agency-hosting_deployPhpApplication':
+      case 'agency-hosting_deploy-php-application':
         return await this.handlePhpAppDeploy(params);
-      case 'hosting_importWordpressWebsite':
+      case 'hosting_import-wordpress-website':
         return await this.handleWordpressWebsiteImport(params);
-      case 'hosting_deployWordpressPlugin':
+      case 'hosting_deploy-wordpress-plugin':
         return await this.handleWordpressPluginDeploy(params);
-      case 'hosting_deployWordpressTheme':
+      case 'hosting_deploy-wordpress-theme':
         return await this.handleWordpressThemeDeploy(params);
-      case 'hosting_deployJsApplication':
+      case 'hosting_deploy-js-application':
         return await this.handleJavascriptApplicationDeploy(params);
-      case 'hosting_deployStaticWebsite':
+      case 'hosting_deploy-static-website':
         return await this.handleStaticWebsiteDeploy(params);
-      case 'hosting_listJsDeployments':
+      case 'hosting_list-js-deployments':
         return await this.handleListJavascriptDeployments(params);
-      case 'hosting_showJsDeploymentLogs':
+      case 'hosting_show-js-deployment-logs':
         return await this.handleShowJsDeploymentLogs(params);
       default:
         throw new Error(`Unknown custom tool: ${tool.name}`);
@@ -2681,7 +2762,7 @@ class MCPServer {
   }
 }
 
-export async function startServer({ name, version, tools, instructions }: { name: string; version: string; tools: OpenApiTool[]; instructions?: string }): Promise<void> {
+export async function startServer({ name, version, tools, instructions, skills }: { name: string; version: string; tools: OpenApiTool[]; instructions?: string; skills?: Skill[] }): Promise<void> {
   const argv = minimist(process.argv.slice(2), {
     string: ['host'],
     boolean: ['stdio', 'http', 'help', 'version', 'login', 'logout'],
@@ -2739,7 +2820,7 @@ export async function startServer({ name, version, tools, instructions }: { name
     }
   }
 
-  const server = new MCPServer({ name, version, tools, instructions });
+  const server = new MCPServer({ name, version, tools, instructions, skills });
   if (argv.http) {
     await server.startHttp(argv.host, argv.port);
   } else {