hostinger-api-mcp 3.17.4 → 3.18.0

package/CHANGELOG.md

@@ -4,6 +4,26 @@ Generated at release time from the diff between the previous and current
 build. Tool changes are listed individually; everything else is summarised
 by area.
 
+## v3.18.0 — 2026-10-28
+
+### Operations
+
+- Added `hosting_websites_get-settings` — Get website SSL, CDN and cache settings
+- Added `hosting_websites_update-settings` — Update website HTTPS redirect, CDN and cache settings
+- Added `hosting_cache_clear` — Clear website cache
+- Added `reach_integrations_connect-ecommerce-store` — Connect Ecommerce store
+- Hid 10 operations from search (they still run through `execute`): `hosting_cache_clear-website`, `hosting_cache_status`, `hosting_cache_toggle-cacheless`, `hosting_cache_toggle-website`, `hosting_cdn_disable`, `hosting_cdn_enable`, `hosting_cdn_purge-cache`, `hosting_cdn_status`, `hosting_ssl_status`, `hosting_ssl_toggle-https-redirect`
+- Changed the description of `reach_integrations_disconnect-ecommerce-store`
+- Changed the description of `reach_integrations_list-ecommerce-stores`
+
+### Also in this release
+
+- Documentation: `README.md`
+- Bundled agent skills: 4 files
+- Request handling and authentication: `src/core/runtime.js`, `src/core/runtime.ts`
+- Other files: `src/core/skills.js`, `src/core/skills.ts`
+- Build and packaging: `types.d.ts`
+
 ## v3.17.4 — 2026-10-28
 
 ### Also in this release

package/README.md

@@ -69,7 +69,7 @@ pnpm update -g @hostinger/mcp
 
 This package installs the following MCP server commands:
 
-- `hostinger-api-mcp` — unified server over every operation (418 total)
+- `hostinger-api-mcp` — unified server over every operation (412 total)
 - `hostinger-agency-hosting-mcp` — 42 operations for agency-hosting
 - `hostinger-agent-readiness-mcp` — 3 operations for agent-readiness
 - `hostinger-billing-mcp` — 9 operations for billing
@@ -77,9 +77,9 @@ This package installs the following MCP server commands:
 - `hostinger-domains-mcp` — 42 operations for domains
 - `hostinger-ecommerce-mcp` — 29 operations for ecommerce
 - `hostinger-horizons-mcp` — 6 operations for horizons
-- `hostinger-hosting-mcp` — 68 operations for hosting
+- `hostinger-hosting-mcp` — 61 operations for hosting
 - `hostinger-mail-mcp` — 38 operations for mail
-- `hostinger-reach-mcp` — 69 operations for reach
+- `hostinger-reach-mcp` — 70 operations for reach
 - `hostinger-vps-mcp` — 67 operations for vps
 - `hostinger-wordpress-mcp` — 40 operations for wordpress
 
@@ -1828,123 +1828,33 @@ Check deployment status, build status, build logs and why a build failed (failur
 - **Method**: `custom`
 - **Path**: `custom`
 
-#### hosting_websites_trigger-event
+#### hosting_websites_get-settings
 
-Tell Hostinger that something happened on this website, so Hostinger services such as hPanel can react to it. `event.name` picks the event and decides which `event.params` it takes. The call changes nothing on the website.
+Read a website's SSL certificate, HTTPS redirect, CDN and server cache settings in one call. ssl is the SSL status as hosting_ssl_status returns it: the certificate status (active, installing, waiting_for_retry, failed, expired or not_installed) and provider, whether it is a lifetime certificate, whether HTTP is redirected to HTTPS, when it expires and the last installation error. cdn.is_enabled says whether the Hostinger CDN serves the website. cache.is_enabled says whether server-side caching is on, and cache.is_cacheless_mode_enabled whether development (cacheless) mode bypasses it. Use it before hosting_websites_update-settings, and to follow an SSL installation started by hosting_ssl_install: poll until ssl.status is active or failed, with growing pauses. A section that cannot be read comes back as { error } and the others are still returned; cache is null with a cacheNote when cache status is not available. To install or remove a certificate use hosting_ssl_install or hosting_ssl_uninstall. Works for Shared and Cloud hosting websites.
 
 - **Method**: `custom`
 - **Path**: `custom`
 
-#### hosting_cache_clear-website
-
-Permanently clears all server-side cache for the website at once. Use it when content was
-updated and needs to be visible immediately, or after making major changes.
-
-Also purges the Hostinger CDN cache when CDN is enabled on the website. To purge only the CDN
-cache and leave the server cache untouched, use `Purge CDN cache`. For a WordPress
-installation living in a subdirectory, pass the directory query parameter to clear its cache.
-
-- **Method**: `DELETE`
-- **Path**: `/api/hosting/v1/accounts/{username}/websites/{domain}/cache/clear`
-
-#### hosting_cache_status
-
-Returns the caching state of the website: whether server-side caching is enabled and whether
-development (cacheless) mode is on. Works for the main domain, addon websites, parked domains
-and subdomains of the account; each reports its own settings and does not inherit them from
-its parent website.
-
-`is_enabled` is the setting changed by `Toggle website cache` and reflects a toggle
-immediately. `is_cacheless_mode_enabled` is true while development mode is on; caching is then
-bypassed even when `is_enabled` is true. `Toggle cacheless mode` is applied in the background,
-so this flag can take a few minutes to follow it.
-
-The domain must be the exact website name as listed on the account, without a `www.` prefix.
-Returns 404 when the domain is not a website on the account.
-
-- **Method**: `GET`
-- **Path**: `/api/hosting/v1/accounts/{username}/websites/{domain}/cache/status`
-
-#### hosting_cache_toggle-cacheless
-
-Turns development (cacheless) mode on or off, based on the enabled flag. When enabled, nothing
-is cached, effectively turning off all caching for the website; use it while actively developing,
-testing changes, debugging issues, or when real-time updates must be visible. Disable it after
-finishing development work to restore the performance benefits of caching.
-
-The change is applied in the background and can take a few minutes. Use `Get cache status` to
-check the current state.
-
-- **Method**: `PATCH`
-- **Path**: `/api/hosting/v1/accounts/{username}/websites/{domain}/cacheless-mode/toggle`
-
-#### hosting_cache_toggle-website
-
-Turns server-side caching for the website on or off, based on the enabled flag. Enable it for
-faster page loads, reduced server load, and improved user experience; recommended for production
-websites. Disabling may impact performance; to temporarily bypass caching while developing or
-debugging, prefer toggling cacheless mode instead.
-
-Does nothing if caching is already in the requested state. Use `Get cache status` to check the
-current state.
-
-- **Method**: `PATCH`
-- **Path**: `/api/hosting/v1/accounts/{username}/websites/{domain}/cache/toggle`
-
-#### hosting_cdn_disable
-
-Turns off the Hostinger CDN for the website domain. Once DNS propagation completes, the
-website content is served directly from the origin server. Repeating the call is safe; when
-CDN is already disabled, it applies the DNS change again.
-
-Returns 422 for platform-managed domains (for example `*.hostingersite.com` and
-`*.app-preview.com`), where CDN cannot be disabled, even when CDN is already off. Also returns
-422 while the account is being moved to another server (retry after the move finishes), or
-when the CDN provider rejects the change. Returns 404 when the domain is not a website on the
-account.
-
-- **Method**: `POST`
-- **Path**: `/api/hosting/v1/accounts/{username}/websites/{domain}/cdn/disable`
-
-#### hosting_cdn_enable
-
-Turns on the Hostinger CDN for the website domain, which speeds up page loads and reduces the
-load on the server. Works for the main domain, parked domains and subdomains of the account.
-
-Enabling changes the domain's DNS records and usually takes a few seconds. After that, DNS
-propagation can take a few more minutes before visitors are served through the CDN.
+#### hosting_websites_update-settings
 
-Repeating the call is safe, for example after a timeout. When CDN is already enabled, it
-applies the DNS change again and refreshes the CDN SSL certificate.
+Change a website's HTTPS redirect, CDN and server cache settings in one call. Pass only the settings to change, at least one. Settings are applied in the order cache, cachelessMode, cdn, httpsRedirect, and the call stops at the first failure. applied lists the settings that were changed. When a setting fails, the call returns an error whose text is the same JSON: failed names the setting and why, and skipped lists the ones not attempted; a multi-execute batch stops there too. Turning httpsRedirect on needs an active SSL certificate: the call checks it first and changes nothing when there is none. Install one with hosting_ssl_install and wait until hosting_websites_get-settings shows ssl.status active. cachelessMode is applied in the background and takes effect within a few minutes; enabling the CDN changes DNS records, so visitors are served through it after a few minutes of propagation. Certificates are not installed or removed here: use hosting_ssl_install and hosting_ssl_uninstall. Read the current values with hosting_websites_get-settings. Works for Shared and Cloud hosting websites.
 
-Returns 422 when the account is disabled, while the account is being moved to another
-server (retry after the move finishes), or when the CDN provider rejects the change.
-Returns 404 when the domain is not a website on the account.
-
-- **Method**: `POST`
-- **Path**: `/api/hosting/v1/accounts/{username}/websites/{domain}/cdn/enable`
-
-#### hosting_cdn_purge-cache
-
-Purges the website's content from the Hostinger CDN edge cache only. The origin server cache
-is not touched; to clear both, use `Clear website cache`.
+- **Method**: `custom`
+- **Path**: `custom`
 
-Returns 422 when CDN is not enabled on the website. Returns 404 when the domain is not a
-website on the account.
+#### hosting_cache_clear
 
-- **Method**: `DELETE`
-- **Path**: `/api/hosting/v1/accounts/{username}/websites/{domain}/cdn/purge`
+Clear a website's server cache (the hosting server's page cache) and Hostinger CDN cache, so updated content shows at once. By default (scope: all) it clears the server cache and, when the CDN is on, purges the CDN too. scope: cdn purges only the CDN edge cache and leaves the server cache alone; that fails with 422 when the CDN is off. For a WordPress site installed in a subdirectory, pass directory to clear that installation's cache (only with scope all). This does not purge the WordPress LiteSpeed Cache plugin: that is a separate WordPress operation (wordpress_litespeed-cache_purge-lite-speed). To turn caching or the CDN on or off use hosting_websites_update-settings. Works for Shared and Cloud hosting websites.
 
-#### hosting_cdn_status
+- **Method**: `custom`
+- **Path**: `custom`
 
-Returns whether the Hostinger CDN is enabled for the website domain. Works for the main
-domain, parked domains and subdomains of the account.
+#### hosting_websites_trigger-event
 
-The domain must be the exact website name as listed on the account, without a `www.` prefix.
-Returns 404 when the domain is not a website on the account.
+Tell Hostinger that something happened on this website, so Hostinger services such as hPanel can react to it. `event.name` picks the event and decides which `event.params` it takes. The call changes nothing on the website.
 
-- **Method**: `GET`
-- **Path**: `/api/hosting/v1/accounts/{username}/websites/{domain}/cdn/status`
+- **Method**: `custom`
+- **Path**: `custom`
 
 #### hosting_cron-jobs_list
 
@@ -2562,32 +2472,6 @@ one has to be uninstalled first.
 - **Method**: `POST`
 - **Path**: `/api/hosting/v1/accounts/{username}/websites/{domain}/ssl/setup`
 
-#### hosting_ssl_status
-
-Returns the SSL state of the website: the certificate `status` and `provider`, whether the
-certificate is a lifetime one managed by the platform, whether HTTP requests are redirected to
-HTTPS, when the certificate stops being valid and the last installation error.
-
-`installing` and `waiting_for_retry` mean an installation is in progress. `failed` means the
-last installation gave up, or the website was not updated for 60 minutes while `installing`;
-`last_error` holds the reason when it is a known message, otherwise it is null. `expired`
-means the assigned certificate's validity has ended. `not_installed` means no certificate is
-assigned. Free subdomains use a platform-managed certificate: with no installation recorded
-they report `active` with `provider` and `expires_at` null.
-
-- **Method**: `GET`
-- **Path**: `/api/hosting/v1/accounts/{username}/websites/{domain}/ssl/status`
-
-#### hosting_ssl_toggle-https-redirect
-
-Turns the HTTP to HTTPS redirect of the website on or off, based on `is_enabled`. Does
-nothing when the redirect is already in the requested state. Turning it on requires an
-installed certificate (`status` `active` or `expired` on `Get SSL status`) and returns 422
-when there is none; turning it off is always accepted.
-
-- **Method**: `PATCH`
-- **Path**: `/api/hosting/v1/accounts/{username}/websites/{domain}/ssl/https-redirect/toggle`
-
 #### hosting_ssl_uninstall
 
 Removes the SSL certificate assigned to the website, turns the HTTPS redirect off and cancels
@@ -3720,6 +3604,21 @@ a connected domain cannot be changed here. Returns the settings after the change
 - **Method**: `PATCH`
 - **Path**: `/api/reach/v1/profiles/{profileUuid}/settings`
 
+#### reach_integrations_connect-ecommerce-store
+
+Connect one of the customer's eCommerce stores to the profile, so Reach receives its
+customers and orders.
+
+Take `store_id` from the list eCommerce stores endpoint. Fails with not found
+(`ECOMMERCE_STORE_NOT_FOUND`) when the store is not one of the customer's own stores, also
+when the eCommerce service cannot be reached. Fails with a conflict
+(`ECOMMERCE_CONNECTION_ALREADY_EXISTS`) when the store is connected to any profile or this
+profile already has a store - to move a store to another plan, disconnect it from the
+profile that holds it first.
+
+- **Method**: `POST`
+- **Path**: `/api/reach/v1/profiles/{profileUuid}/ecommerce/stores/{storeId}`
+
 #### reach_integrations_disconnect-ecommerce-store
 
 Disconnect an eCommerce store from the profile.
@@ -3728,8 +3627,8 @@ Reach stops receiving the store's customers and orders, and its products and cou
 removed from Reach; contacts and past orders stay. Take `store_id` from the list eCommerce
 stores endpoint; for a store that is `connected_to_other_profile`, call this with that
 profile. Also succeeds when the store is not connected to this profile, so success is not
-proof that anything was disconnected. Confirm the store and the plan with the customer
-before calling.
+proof that anything was disconnected. To move the store to another plan, connect it to the
+new profile afterwards. Confirm the store and the plan with the customer before calling.
 
 - **Method**: `DELETE`
 - **Path**: `/api/reach/v1/profiles/{profileUuid}/ecommerce/stores/{storeId}`
@@ -3741,8 +3640,8 @@ Get all of the customer's Hostinger eCommerce stores, each with its `store_id` a
 
 A store is connected to at most one profile. `connected_to_other_profile` does not name that
 profile - call this for each profile to find it. The list is empty, not an error, when the
-eCommerce service cannot be reached. Pass `store_id` to the disconnect eCommerce store
-endpoint. Connecting an AI Website Builder site connects the store selling on it.
+eCommerce service cannot be reached. Pass `store_id` to the connect or disconnect eCommerce
+store endpoint.
 
 - **Method**: `GET`
 - **Path**: `/api/reach/v1/profiles/{profileUuid}/ecommerce/stores`

package/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "hostinger-api-mcp",
-  "version": "3.17.4",
+  "version": "3.18.0",
   "description": "Hostinger API — manage domains, DNS, hosting, VPS, billing and more from Gemini CLI.",
   "mcpServers": {
     "hostinger": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hostinger-api-mcp",
-  "version": "3.17.4",
+  "version": "3.18.0",
   "mcpName": "io.github.hostinger/hostinger-api-mcp",
   "description": "MCP server for Hostinger API",
   "repository": {

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/hostinger/api-mcp-server",
     "source": "github"
   },
-  "version": "3.17.4",
+  "version": "3.18.0",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@hostinger/mcp",
-      "version": "3.17.4",
+      "version": "3.18.0",
       "transport": {
         "type": "stdio"
       },

package/skills/audit-hosting/SKILL.md

@@ -29,7 +29,7 @@ Tell the user the size (plans, websites, WordPress installs) before the checks.
 
 Per Shared and Cloud website (skip `builder` and `horizons`):
 
-- `hosting_ssl_status` — flag `failed` (with `last_error`), `expired`, `not_installed` on a custom domain, `is_https_redirect_enabled: false`, and `expires_at` within 30 days when `is_lifetime` is false. Lifetime certificates renew on their own.
+- `hosting_websites_get-settings` — in `ssl`, flag `failed` (with `last_error`), `expired`, `not_installed` on a custom domain, `is_https_redirect_enabled: false`, and `expires_at` within 30 days when `is_lifetime` is false; lifetime certificates renew on their own. In `cache`, flag `is_cacheless_mode_enabled: true` (development mode left on) and `is_enabled: false`.
 - Node.js sites: `hosting_get-deployment` (latest build failed? `build.state`) and `hosting_nodejs_list-vulnerabilities` with `severities: ["critical", "high"]`.
 
 Per hosting account (`username`): `hosting_databases_list` — flag `disk_usage_mb` above 80% of `max_size_mb`.

package/skills/connect-domain/SKILL.md

@@ -53,7 +53,7 @@ Agency Plan:
 
 Start only once `dig` shows the domain resolving to Hostinger — the certificate authority checks the domain against the server.
 
-- Shared and Cloud: `hosting_ssl_status`. When it is not `active`, call `hosting_ssl_install` and poll the status until `active` (or `failed` with `last_error`), then `hosting_ssl_toggle-https-redirect` with `is_enabled: true` (it returns 422 until a certificate exists).
+- Shared and Cloud: `ssl` in `hosting_websites_get-settings`. When `ssl.status` is not `active`, call `hosting_ssl_install` and poll `hosting_websites_get-settings` until it is `active` (or `failed` with `last_error`), then `hosting_websites_update-settings` with `httpsRedirect: true` (it changes nothing until the certificate is `active`).
 - Agency: `agency-hosting_ssl_install-website` for each domain, then poll `agency-hosting_ssl_website-status`. A domain allows three setups per seven days and one request a minute — install once DNS is right and never loop.
 - A `CAA` record at the apex that does not allow `letsencrypt.org` blocks issuance; the user adds `0 issue "letsencrypt.org"` beside the existing ones.
 

package/skills/deploy-to-hosting/SKILL.md

@@ -130,6 +130,6 @@ curl -s -o /dev/null -w "%{http_code}\n" https://DOMAIN/
 curl -s https://DOMAIN/ | grep -o "TEXT THE PROJECT RENDERS"
 ```
 
-A `200` alone can be a placeholder page; match real copy. A new site may serve a default page briefly — clear it with `hosting_cache_clear-website` and retry before calling the deploy failed.
+A `200` alone can be a placeholder page; match real copy. A new site may serve a default page briefly — clear it with `hosting_cache_clear` and retry before calling the deploy failed.
 
 Write `.hostinger/site.json` in the project so later runs reuse the target: `{ "domain", "username" or "website_uid", "type": "static" | "nodejs" | "php" }`, keeping any fields already there.

package/skills/troubleshoot-website/SKILL.md

@@ -35,7 +35,7 @@ dig +short NS DOMAIN; dig +short A DOMAIN; dig +short CAA DOMAIN
 - Hostinger responses carry `platform: hostinger` and `panel: hpanel`. Without them, or with DNS pointing elsewhere, traffic is not reaching this hosting — hand over to the `connect-domain` skill.
 - Certificate or TLS errors → [SSL](#ssl).
 - `5xx`, a blank page or an error page → [By website type](#3-by-website-type).
-- `200` with old content → cache: `hosting_cache_clear-website` (also purges the Hostinger CDN; pass `directory` for WordPress in a subfolder), plus `wordpress_litespeed-cache_purge-lite-speed` for WordPress; Agency: `agency-hosting_cache_clear-website`.
+- `200` with old content → cache: `hosting_cache_clear` (also purges the Hostinger CDN; pass `directory` for WordPress in a subfolder), plus `wordpress_litespeed-cache_purge-lite-speed` for WordPress; Agency: `agency-hosting_cache_clear-website`.
 - Slow first byte → [Slow site](#slow-site). Behind the Hostinger CDN, `x-hcdn-upstream-rt` is the origin's own response time in seconds; a small value there means the server is not the bottleneck.
 
 ## 3. By website type
@@ -76,19 +76,19 @@ Batch `hosting_get-deployment` (the latest build with its log, failure analysis
 
 ## SSL
 
-Shared and Cloud, `hosting_ssl_status`:
+Shared and Cloud, `ssl` in `hosting_websites_get-settings`:
 
-- `not_installed` or `failed` (`last_error` says why): the domain must resolve to Hostinger, and any CAA record must allow `letsencrypt.org`, before `hosting_ssl_install` can succeed. Poll the status until `active` or `failed`.
+- `not_installed` or `failed` (`last_error` says why): the domain must resolve to Hostinger, and any CAA record must allow `letsencrypt.org`, before `hosting_ssl_install` can succeed. Poll `hosting_websites_get-settings` until `ssl.status` is `active` or `failed`.
 - `installing` or `waiting_for_retry`: wait — another install request returns 422.
 - Free `*.hostingersite.com` subdomains use a platform certificate; installing returns 422 by design.
-- Browser still warns while the certificate is `active`: turn on the redirect with `hosting_ssl_toggle-https-redirect` when `is_https_redirect_enabled` is false, otherwise the page loads `http://` assets (mixed content) that the app has to change.
+- Browser still warns while the certificate is `active`: turn on the redirect with `hosting_websites_update-settings` (`httpsRedirect: true`) when `is_https_redirect_enabled` is false, otherwise the page loads `http://` assets (mixed content) that the app has to change.
 
 Agency, `agency-hosting_ssl_website-status` for each domain: every domain allows three certificate setups per seven days and one request a minute. Check `agency-hosting_websites_list-processes` before `agency-hosting_ssl_install-website` or `agency-hosting_ssl_reinstall-website`, and never retry in a loop.
 
 ## Slow site
 
 - WordPress: `wordpress_litespeed-cache_show-lite-speed-status` and `wordpress_object-cache_show-memcached-status`. Turning on Memcached with `wordpress_object-cache_toggle-memcached` is the usual quick win.
-- Other sites: server caching may be off or development mode left on, and neither has a read operation. `hosting_cache_toggle-website` with `enabled: true` does nothing when caching is already on; `hosting_cache_toggle-cacheless` with `enabled: false` turns development mode off.
+- Other sites: server caching may be off or development mode left on. `hosting_websites_get-settings` shows both in `cache` (`is_enabled`, `is_cacheless_mode_enabled`); fix them with `hosting_websites_update-settings` (`cache: true`, `cachelessMode: false`). Development mode takes a few minutes to turn off.
 - PHP 7.x runs markedly slower than 8.x; propose a supported 8.x version from `hosting_php_get` when the app allows it.
 - Agency: `agency-hosting_metrics_list-order-resource-usage` with `time_frame_hours: 24` shows CPU, memory and processes per website against the plan quota.
 - Shared and Cloud have no CPU or memory metrics in the API. When the evidence points at resource limits, send the user to hPanel's resource usage page.

package/src/core/runtime.js

@@ -66,7 +66,7 @@ const GetSkillRequestSchema = z.object({
 
 /**
  * MCP Server for Hostinger API
- * Generated from OpenAPI spec version 2.4.4
+ * Generated from OpenAPI spec version 2.5.0
  */
 class MCPServer {
   constructor({ name, version, tools, instructions, skills = [] }) {
@@ -302,6 +302,12 @@ class MCPServer {
         return await this.handleHostingDeploy(params);
       case 'hosting_get-deployment':
         return await this.handleHostingGetDeployment(params);
+      case 'hosting_websites_get-settings':
+        return await this.handleHostingWebsitesGetSettings(params);
+      case 'hosting_websites_update-settings':
+        return await this.handleHostingWebsitesUpdateSettings(params);
+      case 'hosting_cache_clear':
+        return await this.handleHostingCacheClear(params);
       case 'hosting_import-wordpress-website':
         return await this.handleWordpressWebsiteImport(params);
       case 'hosting_deploy-wordpress-plugin':
@@ -559,7 +565,7 @@ class MCPServer {
         // Agency Plan (U4S) websites come back without a username, and every later call would fail with
         // an unclear API error.
         if (typeof site.username !== 'string') {
-          throw new Error(site.domain + ' is an Agency Plan website: Git deploys and build status here work only for Shared and Cloud hosting websites. Use the agency-hosting operations for it.');
+          throw new Error(site.domain + ' is an Agency Plan website: this tool works only for Shared and Cloud hosting websites. Use the agency-hosting operations for it.');
         }
         return site;
       }
@@ -1330,6 +1336,150 @@ class MCPServer {
     };
   }
 
+  // A 404 means the domain is not a website on the account, which fails the whole call; any other
+  // failure only fails its own section.
+  async hosting_websitesGetSettings_section(request, pick) {
+    try {
+      return pick(await request);
+    } catch (error) {
+      if (error instanceof ApiExecutionError && error.status === 404) {
+        throw error;
+      }
+      return { error: this.formatToolError(error) };
+    }
+  }
+
+  async handleHostingWebsitesGetSettings(params) {
+    const { domain: requestedDomain } = params;
+
+    if (!requestedDomain || typeof requestedDomain !== 'string') {
+      throw new Error('domain is required and must be a string');
+    }
+
+    const { username, domain } = await this.findWebsite(requestedDomain);
+    const target = { username, domain };
+    // hosting_cache_status joined the spec after this tool: a catalog without it gets cache: null.
+    // Once every catalog has it, make this true (and drop cacheNote).
+    const cacheAvailable = this.operations.has('hosting_cache_status');
+
+    const [ssl, cdn, cache] = await Promise.all([
+      this.hosting_websitesGetSettings_section(this.callOperation('hosting_ssl_status', target), (response) => response),
+      this.hosting_websitesGetSettings_section(this.callOperation('hosting_cdn_status', target), (response) => ({ is_enabled: response.is_enabled })),
+      cacheAvailable
+        ? this.hosting_websitesGetSettings_section(this.callOperation('hosting_cache_status', target), (response) => ({
+          is_enabled: response.is_enabled,
+          is_cacheless_mode_enabled: response.is_cacheless_mode_enabled,
+        }))
+        : Promise.resolve(null),
+    ]);
+
+    return {
+      domain,
+      ssl,
+      cdn,
+      cache,
+      ...(cacheAvailable ? {} : { cacheNote: 'cache status not available yet' }),
+    };
+  }
+
+  // Application order, and how each setting maps to its operation.
+  hosting_websitesUpdateSettings_steps = [
+    { setting: 'cache', run: (target, value) => this.callOperation('hosting_cache_toggle-website', { ...target, enabled: value }) },
+    { setting: 'cachelessMode', run: (target, value) => this.callOperation('hosting_cache_toggle-cacheless', { ...target, enabled: value }) },
+    { setting: 'cdn', run: (target, value) => this.callOperation(value ? 'hosting_cdn_enable' : 'hosting_cdn_disable', target) },
+    { setting: 'httpsRedirect', run: (target, value) => this.callOperation('hosting_ssl_toggle-https-redirect', { ...target, is_enabled: value }) },
+  ];
+
+  async handleHostingWebsitesUpdateSettings(params) {
+    const { domain: requestedDomain } = params;
+
+    // Models send null for settings they leave unset.
+    const requested = this.hosting_websitesUpdateSettings_steps.filter(step => params[step.setting] !== undefined && params[step.setting] !== null);
+    for (const step of requested) {
+      if (typeof params[step.setting] !== 'boolean') {
+        throw new Error(step.setting + ' must be a boolean when provided');
+      }
+    }
+    if (requested.length === 0) {
+      throw new Error('Pass at least one of cache, cachelessMode, cdn, httpsRedirect');
+    }
+    if (!requestedDomain || typeof requestedDomain !== 'string') {
+      throw new Error('domain is required and must be a string');
+    }
+
+    const { username, domain } = await this.findWebsite(requestedDomain);
+    const target = { username, domain };
+
+    // The redirect needs an installed certificate: check it before changing anything, so a
+    // missing certificate does not leave the other settings half applied.
+    if (params.httpsRedirect === true) {
+      const ssl = await this.callOperation('hosting_ssl_status', target);
+      const status = ssl ? ssl.status : undefined;
+      if (status !== 'active') {
+        const shown = ['string', 'number', 'boolean'].includes(typeof status) ? String(status) : 'unknown';
+        throw new Error('HTTPS redirect needs an active SSL certificate, but the SSL status of ' + domain + ' is ' + shown + '. Install SSL first with hosting_ssl_install and wait until hosting_websites_get-settings shows ssl.status active; no settings were changed.');
+      }
+    }
+
+    const applied = {};
+    let failed = null;
+    const skipped = [];
+    for (const step of requested) {
+      const value = params[step.setting];
+      if (failed) {
+        skipped.push(step.setting);
+        continue;
+      }
+      try {
+        await step.run(target, value);
+        applied[step.setting] = value;
+      } catch (error) {
+        failed = { setting: step.setting, error: this.formatToolError(error) };
+      }
+    }
+
+    const result = {
+      domain,
+      applied,
+      failed,
+      skipped,
+      ...('cachelessMode' in applied ? { note: 'cachelessMode takes effect in the background within a few minutes; hosting_websites_get-settings shows it once applied.' } : {}),
+    };
+    // A failed setting is a tool error carrying the same JSON, so execute reports it and a
+    // multi-execute batch stops at this step.
+    if (failed) {
+      throw new Error(JSON.stringify(result));
+    }
+    return result;
+  }
+
+  async handleHostingCacheClear(params) {
+    const { domain: requestedDomain } = params;
+    // Models send null for fields they leave unset.
+    const scope = params.scope ?? 'all';
+    const directory = params.directory ?? null;
+
+    if (scope !== 'all' && scope !== 'cdn') {
+      throw new Error('scope must be one of: all, cdn');
+    }
+    if (directory !== null && (typeof directory !== 'string' || directory === '')) {
+      throw new Error('directory must be a non-empty string when provided');
+    }
+    if (scope === 'cdn' && directory !== null) {
+      throw new Error('directory applies only when scope is all: the CDN purge clears the whole website');
+    }
+    if (!requestedDomain || typeof requestedDomain !== 'string') {
+      throw new Error('domain is required and must be a string');
+    }
+
+    const { username, domain } = await this.findWebsite(requestedDomain);
+
+    const response = scope === 'cdn'
+      ? await this.callOperation('hosting_cdn_purge-cache', { username, domain })
+      : await this.callOperation('hosting_cache_clear-website', { username, domain, ...(directory !== null ? { directory } : {}) });
+    return { domain, cleared: scope, directory, response };
+  }
+
   hosting_importWordpressWebsite_validateArchiveFormat(filePath) {
     const validExtensions = ['zip', 'tar', 'tar.gz', 'tgz', '7z', 'gz', 'gzip'];
     const fileName = path.basename(filePath).toLowerCase();