hostinger-api-mcp 3.27.0 → 3.27.1

package/CHANGELOG.md

@@ -4,6 +4,13 @@ Generated at release time from the diff between the previous and current
 build. Tool changes are listed individually; everything else is summarised
 by area.
 
+## v3.27.1 — 2026-11-03
+
+### Also in this release
+
+- Bundled agent skills: `skills/headless/VERSION`
+- Request handling and authentication: `src/core/runtime.js`, `src/core/runtime.ts`
+
 ## v3.27.0 — 2026-11-03
 
 ### Operations

package/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "hostinger-api-mcp",
-  "version": "3.27.0",
+  "version": "3.27.1",
   "description": "Hostinger API — manage domains, DNS, hosting, VPS, billing and more from Gemini CLI.",
   "mcpServers": {
     "hostinger": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hostinger-api-mcp",
-  "version": "3.27.0",
+  "version": "3.27.1",
   "mcpName": "io.github.hostinger/hostinger-api-mcp",
   "description": "MCP server for Hostinger API",
   "repository": {

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/hostinger/api-mcp-server",
     "source": "github"
   },
-  "version": "3.27.0",
+  "version": "3.27.1",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@hostinger/mcp",
-      "version": "3.27.0",
+      "version": "3.27.1",
       "transport": {
         "type": "stdio"
       },

package/skills/headless/VERSION

@@ -1,3 +1,3 @@
-version=3.27.0
-commit=dfa3d353b2a7
+version=3.27.1
+commit=f845254a4bae
 built=2026-11-03

package/src/core/runtime.js

@@ -357,6 +357,8 @@ class MCPServer {
 
   // System directories and the roots of the home directories. /var as a whole stays deployable: sites live in /var/www, and macOS keeps its temp dir there.
   systemDirectories = ['/etc', '/root', '/usr', '/bin', '/sbin', '/boot', '/proc', '/sys', '/dev', '/var/lib', '/var/log', '/var/db', '/var/root', '/private/etc', '/private/var/lib', '/private/var/log', '/private/var/db', '/private/var/root', '/System', '/Library',
+    // Container secrets (Docker's /run/secrets, the Kubernetes service-account token under /var/run/secrets) and runtime state.
+    '/run', '/var/run', '/private/var/run',
     // Every user's home directory, whatever the current home is (root's is /root, a container's can be /).
     '/home', '/Users', ...(process.platform === 'win32' ? [path.join(process.env.SystemDrive || 'C:', 'Users')] : [])];
 
@@ -397,10 +399,32 @@ class MCPServer {
     // browser profiles and tokens; .claude-worktrees holds Claude Code's git worktrees.
     const top = path.relative(fold(home), fold(real)).split(path.sep)[0];
     const inHomeData = inHome && top !== '.claude-worktrees' && (top.startsWith('.') || top === fold('Library') || top === fold('AppData') || top === 'snap');
+    // A profile reached outside the home roots (WSL's /mnt/c/Users/me, a home on a mounted disk): the top-level data
+    // of a directory under a Users or home directory, and a profile, or a directory holding profiles (/mnt/c/Users,
+    // /mnt/c), that has the data of one; a project's own users/ or home/ deploys.
+    const looksLikeProfile = (dir) => ['AppData', 'Library', '.ssh', '.aws', '.gnupg', '.kube'].some((name) => fs.existsSync(path.join(dir, name)));
+    const holdsProfiles = (dir) => {
+      try {
+        return fs.readdirSync(dir, { withFileTypes: true }).some((entry) => entry.isDirectory() && looksLikeProfile(path.join(dir, entry.name)));
+      } catch (error) {
+        return false;
+      }
+    };
+    const segments = real.split(path.sep);
+    const inProfile = !inHome && (holdsProfiles(path.join(real, 'Users')) || segments.some((segment, i) => {
+      if (!['users', 'home'].includes(segment.toLowerCase())) {
+        return false;
+      }
+      const top = segments[i + 2];
+      if (top === undefined) {
+        return i + 1 < segments.length ? looksLikeProfile(real) : holdsProfiles(real);
+      }
+      return top !== '.claude-worktrees' && (top.startsWith('.') || ['library', 'appdata', 'snap'].includes(top.toLowerCase()));
+    }));
     const inSystem = !inHome && this.systemDirectories.some((dir) => inside(dir, real));
     // Windows drops trailing dots and spaces from a name: .ssh. is .ssh.
     const inCredentials = real.split(path.sep).some((segment) => this.credentialDirectories.includes((process.platform === 'win32' ? segment.replace(/[. ]+$/, '') : segment).toLowerCase()));
-    if (inside(real, home) || otherHome || inHomeData || inSystem || inCredentials || (fs.statSync(real).isFile() && this.isSecretFile(path.basename(real)))) {
+    if (inside(real, home) || otherHome || inHomeData || inProfile || inSystem || inCredentials || (fs.statSync(real).isFile() && this.isSecretFile(path.basename(real)))) {
       throw new Error('Refusing to deploy ' + localPath + ': it is, or contains, a home, system or credentials location. Pass the project directory or archive.');
     }
   }

package/src/core/runtime.ts

@@ -389,6 +389,8 @@ class MCPServer {
 
   // System directories and the roots of the home directories. /var as a whole stays deployable: sites live in /var/www, and macOS keeps its temp dir there.
   private systemDirectories = ['/etc', '/root', '/usr', '/bin', '/sbin', '/boot', '/proc', '/sys', '/dev', '/var/lib', '/var/log', '/var/db', '/var/root', '/private/etc', '/private/var/lib', '/private/var/log', '/private/var/db', '/private/var/root', '/System', '/Library',
+    // Container secrets (Docker's /run/secrets, the Kubernetes service-account token under /var/run/secrets) and runtime state.
+    '/run', '/var/run', '/private/var/run',
     // Every user's home directory, whatever the current home is (root's is /root, a container's can be /).
     '/home', '/Users', ...(process.platform === 'win32' ? [path.join(process.env.SystemDrive || 'C:', 'Users')] : [])];
 
@@ -429,10 +431,32 @@ class MCPServer {
     // browser profiles and tokens; .claude-worktrees holds Claude Code's git worktrees.
     const top = path.relative(fold(home), fold(real)).split(path.sep)[0];
     const inHomeData = inHome && top !== '.claude-worktrees' && (top.startsWith('.') || top === fold('Library') || top === fold('AppData') || top === 'snap');
+    // A profile reached outside the home roots (WSL's /mnt/c/Users/me, a home on a mounted disk): the top-level data
+    // of a directory under a Users or home directory, and a profile, or a directory holding profiles (/mnt/c/Users,
+    // /mnt/c), that has the data of one; a project's own users/ or home/ deploys.
+    const looksLikeProfile = (dir: string): boolean => ['AppData', 'Library', '.ssh', '.aws', '.gnupg', '.kube'].some((name: string) => fs.existsSync(path.join(dir, name)));
+    const holdsProfiles = (dir: string): boolean => {
+      try {
+        return fs.readdirSync(dir, { withFileTypes: true }).some((entry) => entry.isDirectory() && looksLikeProfile(path.join(dir, entry.name)));
+      } catch (error) {
+        return false;
+      }
+    };
+    const segments = real.split(path.sep);
+    const inProfile = !inHome && (holdsProfiles(path.join(real, 'Users')) || segments.some((segment: string, i: number) => {
+      if (!['users', 'home'].includes(segment.toLowerCase())) {
+        return false;
+      }
+      const top = segments[i + 2];
+      if (top === undefined) {
+        return i + 1 < segments.length ? looksLikeProfile(real) : holdsProfiles(real);
+      }
+      return top !== '.claude-worktrees' && (top.startsWith('.') || ['library', 'appdata', 'snap'].includes(top.toLowerCase()));
+    }));
     const inSystem = !inHome && this.systemDirectories.some((dir: string) => inside(dir, real));
     // Windows drops trailing dots and spaces from a name: .ssh. is .ssh.
     const inCredentials = real.split(path.sep).some((segment: string) => this.credentialDirectories.includes((process.platform === 'win32' ? segment.replace(/[. ]+$/, '') : segment).toLowerCase()));
-    if (inside(real, home) || otherHome || inHomeData || inSystem || inCredentials || (fs.statSync(real).isFile() && this.isSecretFile(path.basename(real)))) {
+    if (inside(real, home) || otherHome || inHomeData || inProfile || inSystem || inCredentials || (fs.statSync(real).isFile() && this.isSecretFile(path.basename(real)))) {
       throw new Error('Refusing to deploy ' + localPath + ': it is, or contains, a home, system or credentials location. Pass the project directory or archive.');
     }
   }

package/src/servers/agency-hosting.js

@@ -4,4 +4,4 @@ import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/agency-hosting.js';
 import instructions from '../core/instructions.agency-hosting.js';
 
-startServer({ name: 'hostinger-agency-hosting-mcp', version: '3.27.0', tools, instructions });
+startServer({ name: 'hostinger-agency-hosting-mcp', version: '3.27.1', tools, instructions });

package/src/servers/agency-hosting.ts

@@ -4,4 +4,4 @@ import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/agency-hosting.js';
 import instructions from '../core/instructions.agency-hosting.js';
 
-startServer({ name: 'hostinger-agency-hosting-mcp', version: '3.27.0', tools, instructions });
+startServer({ name: 'hostinger-agency-hosting-mcp', version: '3.27.1', tools, instructions });

package/src/servers/agent-readiness.js

@@ -3,4 +3,4 @@
 import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/agent-readiness.js';
 
-startServer({ name: 'hostinger-agent-readiness-mcp', version: '3.27.0', tools });
+startServer({ name: 'hostinger-agent-readiness-mcp', version: '3.27.1', tools });

package/src/servers/agent-readiness.ts

@@ -3,4 +3,4 @@
 import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/agent-readiness.js';
 
-startServer({ name: 'hostinger-agent-readiness-mcp', version: '3.27.0', tools });
+startServer({ name: 'hostinger-agent-readiness-mcp', version: '3.27.1', tools });

package/src/servers/all.js

@@ -5,4 +5,4 @@ import tools from '../core/tools/all.js';
 import instructions from '../core/instructions.js';
 import skills from '../core/skills.js';
 
-startServer({ name: 'hostinger-api-mcp', version: '3.27.0', tools, instructions, skills });
+startServer({ name: 'hostinger-api-mcp', version: '3.27.1', tools, instructions, skills });

package/src/servers/all.ts

@@ -5,4 +5,4 @@ import tools from '../core/tools/all.js';
 import instructions from '../core/instructions.js';
 import skills from '../core/skills.js';
 
-startServer({ name: 'hostinger-api-mcp', version: '3.27.0', tools, instructions, skills });
+startServer({ name: 'hostinger-api-mcp', version: '3.27.1', tools, instructions, skills });

package/src/servers/billing.js

@@ -3,4 +3,4 @@
 import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/billing.js';
 
-startServer({ name: 'hostinger-billing-mcp', version: '3.27.0', tools });
+startServer({ name: 'hostinger-billing-mcp', version: '3.27.1', tools });

package/src/servers/billing.ts

@@ -3,4 +3,4 @@
 import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/billing.js';
 
-startServer({ name: 'hostinger-billing-mcp', version: '3.27.0', tools });
+startServer({ name: 'hostinger-billing-mcp', version: '3.27.1', tools });

package/src/servers/dns.js

@@ -3,4 +3,4 @@
 import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/dns.js';
 
-startServer({ name: 'hostinger-dns-mcp', version: '3.27.0', tools });
+startServer({ name: 'hostinger-dns-mcp', version: '3.27.1', tools });

package/src/servers/dns.ts

@@ -3,4 +3,4 @@
 import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/dns.js';
 
-startServer({ name: 'hostinger-dns-mcp', version: '3.27.0', tools });
+startServer({ name: 'hostinger-dns-mcp', version: '3.27.1', tools });

package/src/servers/domains.js

@@ -3,4 +3,4 @@
 import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/domains.js';
 
-startServer({ name: 'hostinger-domains-mcp', version: '3.27.0', tools });
+startServer({ name: 'hostinger-domains-mcp', version: '3.27.1', tools });

package/src/servers/domains.ts

@@ -3,4 +3,4 @@
 import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/domains.js';
 
-startServer({ name: 'hostinger-domains-mcp', version: '3.27.0', tools });
+startServer({ name: 'hostinger-domains-mcp', version: '3.27.1', tools });

package/src/servers/ecommerce.js

@@ -3,4 +3,4 @@
 import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/ecommerce.js';
 
-startServer({ name: 'hostinger-ecommerce-mcp', version: '3.27.0', tools });
+startServer({ name: 'hostinger-ecommerce-mcp', version: '3.27.1', tools });

package/src/servers/ecommerce.ts

@@ -3,4 +3,4 @@
 import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/ecommerce.js';
 
-startServer({ name: 'hostinger-ecommerce-mcp', version: '3.27.0', tools });
+startServer({ name: 'hostinger-ecommerce-mcp', version: '3.27.1', tools });

package/src/servers/gpu.js

@@ -3,4 +3,4 @@
 import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/gpu.js';
 
-startServer({ name: 'hostinger-gpu-mcp', version: '3.27.0', tools });
+startServer({ name: 'hostinger-gpu-mcp', version: '3.27.1', tools });

package/src/servers/gpu.ts

@@ -3,4 +3,4 @@
 import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/gpu.js';
 
-startServer({ name: 'hostinger-gpu-mcp', version: '3.27.0', tools });
+startServer({ name: 'hostinger-gpu-mcp', version: '3.27.1', tools });

package/src/servers/horizons.js

@@ -3,4 +3,4 @@
 import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/horizons.js';
 
-startServer({ name: 'hostinger-horizons-mcp', version: '3.27.0', tools });
+startServer({ name: 'hostinger-horizons-mcp', version: '3.27.1', tools });

package/src/servers/horizons.ts

@@ -3,4 +3,4 @@
 import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/horizons.js';
 
-startServer({ name: 'hostinger-horizons-mcp', version: '3.27.0', tools });
+startServer({ name: 'hostinger-horizons-mcp', version: '3.27.1', tools });

package/src/servers/hosting.js

@@ -4,4 +4,4 @@ import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/hosting.js';
 import instructions from '../core/instructions.js';
 
-startServer({ name: 'hostinger-hosting-mcp', version: '3.27.0', tools, instructions });
+startServer({ name: 'hostinger-hosting-mcp', version: '3.27.1', tools, instructions });

package/src/servers/hosting.ts

@@ -4,4 +4,4 @@ import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/hosting.js';
 import instructions from '../core/instructions.js';
 
-startServer({ name: 'hostinger-hosting-mcp', version: '3.27.0', tools, instructions });
+startServer({ name: 'hostinger-hosting-mcp', version: '3.27.1', tools, instructions });

package/src/servers/mail.js

@@ -3,4 +3,4 @@
 import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/mail.js';
 
-startServer({ name: 'hostinger-mail-mcp', version: '3.27.0', tools });
+startServer({ name: 'hostinger-mail-mcp', version: '3.27.1', tools });

package/src/servers/mail.ts

@@ -3,4 +3,4 @@
 import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/mail.js';
 
-startServer({ name: 'hostinger-mail-mcp', version: '3.27.0', tools });
+startServer({ name: 'hostinger-mail-mcp', version: '3.27.1', tools });

package/src/servers/reach.js

@@ -3,4 +3,4 @@
 import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/reach.js';
 
-startServer({ name: 'hostinger-reach-mcp', version: '3.27.0', tools });
+startServer({ name: 'hostinger-reach-mcp', version: '3.27.1', tools });

package/src/servers/reach.ts

@@ -3,4 +3,4 @@
 import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/reach.js';
 
-startServer({ name: 'hostinger-reach-mcp', version: '3.27.0', tools });
+startServer({ name: 'hostinger-reach-mcp', version: '3.27.1', tools });

package/src/servers/vps.js

@@ -3,4 +3,4 @@
 import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/vps.js';
 
-startServer({ name: 'hostinger-vps-mcp', version: '3.27.0', tools });
+startServer({ name: 'hostinger-vps-mcp', version: '3.27.1', tools });

package/src/servers/vps.ts

@@ -3,4 +3,4 @@
 import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/vps.js';
 
-startServer({ name: 'hostinger-vps-mcp', version: '3.27.0', tools });
+startServer({ name: 'hostinger-vps-mcp', version: '3.27.1', tools });

package/src/servers/wordpress.js

@@ -3,4 +3,4 @@
 import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/wordpress.js';
 
-startServer({ name: 'hostinger-wordpress-mcp', version: '3.27.0', tools });
+startServer({ name: 'hostinger-wordpress-mcp', version: '3.27.1', tools });

package/src/servers/wordpress.ts

@@ -3,4 +3,4 @@
 import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/wordpress.js';
 
-startServer({ name: 'hostinger-wordpress-mcp', version: '3.27.0', tools });
+startServer({ name: 'hostinger-wordpress-mcp', version: '3.27.1', tools });