hostinger-api-mcp 3.27.2 → 3.27.3

package/CHANGELOG.md

@@ -4,6 +4,13 @@ Generated at release time from the diff between the previous and current
 build. Tool changes are listed individually; everything else is summarised
 by area.
 
+## v3.27.3 — 2026-11-03
+
+### Also in this release
+
+- Bundled agent skills: `skills/headless/VERSION`
+- Request handling and authentication: `src/core/runtime.js`, `src/core/runtime.ts`
+
 ## v3.27.2 — 2026-11-03
 
 ### Also in this release

package/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "hostinger-api-mcp",
-  "version": "3.27.2",
+  "version": "3.27.3",
   "description": "Hostinger API — manage domains, DNS, hosting, VPS, billing and more from Gemini CLI.",
   "mcpServers": {
     "hostinger": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hostinger-api-mcp",
-  "version": "3.27.2",
+  "version": "3.27.3",
   "mcpName": "io.github.hostinger/hostinger-api-mcp",
   "description": "MCP server for Hostinger API",
   "repository": {

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/hostinger/api-mcp-server",
     "source": "github"
   },
-  "version": "3.27.2",
+  "version": "3.27.3",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@hostinger/mcp",
-      "version": "3.27.2",
+      "version": "3.27.3",
       "transport": {
         "type": "stdio"
       },

package/skills/headless/VERSION

@@ -1,3 +1,3 @@
-version=3.27.2
-commit=728f90a8ae7c
+version=3.27.3
+commit=fddd58626392
 built=2026-11-03

package/src/core/runtime.js

@@ -357,6 +357,8 @@ class MCPServer {
 
   // System directories and the roots of the home directories. /var as a whole stays deployable: sites live in /var/www, and macOS keeps its temp dir there.
   systemDirectories = ['/etc', '/root', '/usr', '/bin', '/sbin', '/boot', '/proc', '/sys', '/dev', '/var/lib', '/var/log', '/var/db', '/var/root', '/private/etc', '/private/var/lib', '/private/var/log', '/private/var/db', '/private/var/root', '/System', '/Library',
+    // Homebrew on Apple silicon and MacPorts keep service data (databases) and configs under their prefix.
+    '/opt/homebrew', '/opt/local',
     // Container secrets (Docker's /run/secrets, the Kubernetes service-account token under /var/run/secrets) and runtime state.
     '/run', '/var/run', '/private/var/run',
     // Every user's home directory, whatever the current home is (root's is /root, a container's can be /).
@@ -402,10 +404,9 @@ class MCPServer {
     // A profile reached outside the home roots (WSL's /mnt/c/Users/me, a home on a mounted disk): the top-level data
     // of a directory under a Users or home directory, and a profile, or a directory holding profiles (/mnt/c/Users,
     // /mnt/c), that has the data of one; a project's own users/ or home/ deploys.
-    const looksLikeProfile = (dir) => ['AppData', 'Library', '.ssh', '.aws', '.gnupg', '.kube'].some((name) => fs.existsSync(path.join(dir, name)));
     const holdsProfiles = (dir) => {
       try {
-        return fs.readdirSync(dir, { withFileTypes: true }).some((entry) => entry.isDirectory() && looksLikeProfile(path.join(dir, entry.name)));
+        return fs.readdirSync(dir, { withFileTypes: true }).some((entry) => entry.isDirectory() && this.looksLikeProfile(path.join(dir, entry.name)));
       } catch (error) {
         return false;
       }
@@ -417,11 +418,11 @@ class MCPServer {
       }
       const top = segments[i + 2];
       if (top === undefined) {
-        return i + 1 < segments.length ? looksLikeProfile(real) : holdsProfiles(real);
+        return i + 1 < segments.length ? this.looksLikeProfile(real) : holdsProfiles(real);
       }
       return top !== '.claude-worktrees' && (top.startsWith('.') || ['library', 'appdata', 'snap'].includes(top.toLowerCase()));
     }));
-    const inSystem = !inHome && this.systemDirectories.some((dir) => inside(dir, real));
+    const inSystem = !inHome && this.systemDirectories.some((dir) => inside(dir, real) || inside(real, dir));
     // Windows drops trailing dots and spaces from a name: .ssh. is .ssh.
     const inCredentials = real.split(path.sep).some((segment) => this.credentialDirectories.includes((process.platform === 'win32' ? segment.replace(/[. ]+$/, '') : segment).toLowerCase()));
     if (inside(real, home) || otherHome || inHomeData || inProfile || inSystem || inCredentials || (fs.statSync(real).isFile() && this.isSecretFile(path.basename(real)))) {
@@ -429,6 +430,12 @@ class MCPServer {
     }
   }
 
+  // A user's profile, told by its app data or credentials: Library/Application Support rather than Library, which
+  // on a case-insensitive file system also matches a project's own library/.
+  looksLikeProfile(dir) {
+    return ['AppData', path.join('Library', 'Application Support'), '.ssh', '.aws', '.gnupg', '.kube'].some((name) => fs.existsSync(path.join(dir, name)));
+  }
+
   // Env files (examples such as .env.example are kept), credentials and private keys: a deploy would serve them
   // publicly. Matches the CLI's isSecretFile, plus .npmrc and the Hostinger credential files.
   isSecretFile(name) {
@@ -453,6 +460,11 @@ class MCPServer {
   listDeployFiles(dir, exclude) {
     const files = [];
     const skipped = [];
+    // A profile copy deployed as is (a backup disk's me/), told by its app data alone: a project's own .aws/ or .kube/
+    // at the top is skipped below, as before.
+    if (['AppData', path.join('Library', 'Application Support')].some((name) => fs.existsSync(path.join(dir, name)))) {
+      throw new Error('Refusing to deploy ' + dir + ': it is a home directory. Pass the project directory or archive.');
+    }
     const walk = (relativeDir) => {
       for (const entry of fs.readdirSync(path.join(dir, relativeDir), { withFileTypes: true })) {
         if (entry.isSymbolicLink()) {
@@ -464,6 +476,11 @@ class MCPServer {
           if (entry.name !== '.config' && this.credentialDirectories.includes(entry.name.toLowerCase())) {
             skipped.push(relativePath);
           } else if (entry.name !== 'node_modules' && entry.name !== '.git') {
+            // assertDeployablePath judges only the top of the path: a profile copy nested deeper (a backup disk's
+            // Users/<name>) would ship its app data and keys.
+            if (this.looksLikeProfile(path.join(dir, relativePath))) {
+              throw new Error('Refusing to deploy ' + dir + ': ' + relativePath + ' is a home directory. Pass the project directory or archive.');
+            }
             walk(relativePath);
           }
         } else if (entry.isFile() && entry.name !== '.DS_Store' && path.resolve(dir, relativePath) !== exclude) {

package/src/core/runtime.ts

@@ -389,6 +389,8 @@ class MCPServer {
 
   // System directories and the roots of the home directories. /var as a whole stays deployable: sites live in /var/www, and macOS keeps its temp dir there.
   private systemDirectories = ['/etc', '/root', '/usr', '/bin', '/sbin', '/boot', '/proc', '/sys', '/dev', '/var/lib', '/var/log', '/var/db', '/var/root', '/private/etc', '/private/var/lib', '/private/var/log', '/private/var/db', '/private/var/root', '/System', '/Library',
+    // Homebrew on Apple silicon and MacPorts keep service data (databases) and configs under their prefix.
+    '/opt/homebrew', '/opt/local',
     // Container secrets (Docker's /run/secrets, the Kubernetes service-account token under /var/run/secrets) and runtime state.
     '/run', '/var/run', '/private/var/run',
     // Every user's home directory, whatever the current home is (root's is /root, a container's can be /).
@@ -434,10 +436,9 @@ class MCPServer {
     // A profile reached outside the home roots (WSL's /mnt/c/Users/me, a home on a mounted disk): the top-level data
     // of a directory under a Users or home directory, and a profile, or a directory holding profiles (/mnt/c/Users,
     // /mnt/c), that has the data of one; a project's own users/ or home/ deploys.
-    const looksLikeProfile = (dir: string): boolean => ['AppData', 'Library', '.ssh', '.aws', '.gnupg', '.kube'].some((name: string) => fs.existsSync(path.join(dir, name)));
     const holdsProfiles = (dir: string): boolean => {
       try {
-        return fs.readdirSync(dir, { withFileTypes: true }).some((entry) => entry.isDirectory() && looksLikeProfile(path.join(dir, entry.name)));
+        return fs.readdirSync(dir, { withFileTypes: true }).some((entry) => entry.isDirectory() && this.looksLikeProfile(path.join(dir, entry.name)));
       } catch (error) {
         return false;
       }
@@ -449,11 +450,11 @@ class MCPServer {
       }
       const top = segments[i + 2];
       if (top === undefined) {
-        return i + 1 < segments.length ? looksLikeProfile(real) : holdsProfiles(real);
+        return i + 1 < segments.length ? this.looksLikeProfile(real) : holdsProfiles(real);
       }
       return top !== '.claude-worktrees' && (top.startsWith('.') || ['library', 'appdata', 'snap'].includes(top.toLowerCase()));
     }));
-    const inSystem = !inHome && this.systemDirectories.some((dir: string) => inside(dir, real));
+    const inSystem = !inHome && this.systemDirectories.some((dir: string) => inside(dir, real) || inside(real, dir));
     // Windows drops trailing dots and spaces from a name: .ssh. is .ssh.
     const inCredentials = real.split(path.sep).some((segment: string) => this.credentialDirectories.includes((process.platform === 'win32' ? segment.replace(/[. ]+$/, '') : segment).toLowerCase()));
     if (inside(real, home) || otherHome || inHomeData || inProfile || inSystem || inCredentials || (fs.statSync(real).isFile() && this.isSecretFile(path.basename(real)))) {
@@ -461,6 +462,12 @@ class MCPServer {
     }
   }
 
+  // A user's profile, told by its app data or credentials: Library/Application Support rather than Library, which
+  // on a case-insensitive file system also matches a project's own library/.
+  private looksLikeProfile(dir: string): boolean {
+    return ['AppData', path.join('Library', 'Application Support'), '.ssh', '.aws', '.gnupg', '.kube'].some((name: string) => fs.existsSync(path.join(dir, name)));
+  }
+
   // Env files (examples such as .env.example are kept), credentials and private keys: a deploy would serve them
   // publicly. Matches the CLI's isSecretFile, plus .npmrc and the Hostinger credential files.
   private isSecretFile(name: string): boolean {
@@ -485,6 +492,11 @@ class MCPServer {
   private listDeployFiles(dir: string, exclude?: string): { files: string[]; skipped: string[] } {
     const files: string[] = [];
     const skipped: string[] = [];
+    // A profile copy deployed as is (a backup disk's me/), told by its app data alone: a project's own .aws/ or .kube/
+    // at the top is skipped below, as before.
+    if (['AppData', path.join('Library', 'Application Support')].some((name: string) => fs.existsSync(path.join(dir, name)))) {
+      throw new Error('Refusing to deploy ' + dir + ': it is a home directory. Pass the project directory or archive.');
+    }
     const walk = (relativeDir: string): void => {
       for (const entry of fs.readdirSync(path.join(dir, relativeDir), { withFileTypes: true })) {
         if (entry.isSymbolicLink()) {
@@ -496,6 +508,11 @@ class MCPServer {
           if (entry.name !== '.config' && this.credentialDirectories.includes(entry.name.toLowerCase())) {
             skipped.push(relativePath);
           } else if (entry.name !== 'node_modules' && entry.name !== '.git') {
+            // assertDeployablePath judges only the top of the path: a profile copy nested deeper (a backup disk's
+            // Users/<name>) would ship its app data and keys.
+            if (this.looksLikeProfile(path.join(dir, relativePath))) {
+              throw new Error('Refusing to deploy ' + dir + ': ' + relativePath + ' is a home directory. Pass the project directory or archive.');
+            }
             walk(relativePath);
           }
         } else if (entry.isFile() && entry.name !== '.DS_Store' && path.resolve(dir, relativePath) !== exclude) {

package/src/servers/agency-hosting.js

@@ -4,4 +4,4 @@ import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/agency-hosting.js';
 import instructions from '../core/instructions.agency-hosting.js';
 
-startServer({ name: 'hostinger-agency-hosting-mcp', version: '3.27.2', tools, instructions });
+startServer({ name: 'hostinger-agency-hosting-mcp', version: '3.27.3', tools, instructions });

package/src/servers/agency-hosting.ts

@@ -4,4 +4,4 @@ import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/agency-hosting.js';
 import instructions from '../core/instructions.agency-hosting.js';
 
-startServer({ name: 'hostinger-agency-hosting-mcp', version: '3.27.2', tools, instructions });
+startServer({ name: 'hostinger-agency-hosting-mcp', version: '3.27.3', tools, instructions });

package/src/servers/agent-readiness.js

@@ -3,4 +3,4 @@
 import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/agent-readiness.js';
 
-startServer({ name: 'hostinger-agent-readiness-mcp', version: '3.27.2', tools });
+startServer({ name: 'hostinger-agent-readiness-mcp', version: '3.27.3', tools });

package/src/servers/agent-readiness.ts

@@ -3,4 +3,4 @@
 import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/agent-readiness.js';
 
-startServer({ name: 'hostinger-agent-readiness-mcp', version: '3.27.2', tools });
+startServer({ name: 'hostinger-agent-readiness-mcp', version: '3.27.3', tools });

package/src/servers/all.js

@@ -5,4 +5,4 @@ import tools from '../core/tools/all.js';
 import instructions from '../core/instructions.js';
 import skills from '../core/skills.js';
 
-startServer({ name: 'hostinger-api-mcp', version: '3.27.2', tools, instructions, skills });
+startServer({ name: 'hostinger-api-mcp', version: '3.27.3', tools, instructions, skills });

package/src/servers/all.ts

@@ -5,4 +5,4 @@ import tools from '../core/tools/all.js';
 import instructions from '../core/instructions.js';
 import skills from '../core/skills.js';
 
-startServer({ name: 'hostinger-api-mcp', version: '3.27.2', tools, instructions, skills });
+startServer({ name: 'hostinger-api-mcp', version: '3.27.3', tools, instructions, skills });

package/src/servers/billing.js

@@ -3,4 +3,4 @@
 import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/billing.js';
 
-startServer({ name: 'hostinger-billing-mcp', version: '3.27.2', tools });
+startServer({ name: 'hostinger-billing-mcp', version: '3.27.3', tools });

package/src/servers/billing.ts

@@ -3,4 +3,4 @@
 import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/billing.js';
 
-startServer({ name: 'hostinger-billing-mcp', version: '3.27.2', tools });
+startServer({ name: 'hostinger-billing-mcp', version: '3.27.3', tools });

package/src/servers/dns.js

@@ -3,4 +3,4 @@
 import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/dns.js';
 
-startServer({ name: 'hostinger-dns-mcp', version: '3.27.2', tools });
+startServer({ name: 'hostinger-dns-mcp', version: '3.27.3', tools });

package/src/servers/dns.ts

@@ -3,4 +3,4 @@
 import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/dns.js';
 
-startServer({ name: 'hostinger-dns-mcp', version: '3.27.2', tools });
+startServer({ name: 'hostinger-dns-mcp', version: '3.27.3', tools });

package/src/servers/domains.js

@@ -3,4 +3,4 @@
 import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/domains.js';
 
-startServer({ name: 'hostinger-domains-mcp', version: '3.27.2', tools });
+startServer({ name: 'hostinger-domains-mcp', version: '3.27.3', tools });

package/src/servers/domains.ts

@@ -3,4 +3,4 @@
 import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/domains.js';
 
-startServer({ name: 'hostinger-domains-mcp', version: '3.27.2', tools });
+startServer({ name: 'hostinger-domains-mcp', version: '3.27.3', tools });

package/src/servers/ecommerce.js

@@ -3,4 +3,4 @@
 import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/ecommerce.js';
 
-startServer({ name: 'hostinger-ecommerce-mcp', version: '3.27.2', tools });
+startServer({ name: 'hostinger-ecommerce-mcp', version: '3.27.3', tools });

package/src/servers/ecommerce.ts

@@ -3,4 +3,4 @@
 import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/ecommerce.js';
 
-startServer({ name: 'hostinger-ecommerce-mcp', version: '3.27.2', tools });
+startServer({ name: 'hostinger-ecommerce-mcp', version: '3.27.3', tools });

package/src/servers/gpu.js

@@ -3,4 +3,4 @@
 import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/gpu.js';
 
-startServer({ name: 'hostinger-gpu-mcp', version: '3.27.2', tools });
+startServer({ name: 'hostinger-gpu-mcp', version: '3.27.3', tools });

package/src/servers/gpu.ts

@@ -3,4 +3,4 @@
 import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/gpu.js';
 
-startServer({ name: 'hostinger-gpu-mcp', version: '3.27.2', tools });
+startServer({ name: 'hostinger-gpu-mcp', version: '3.27.3', tools });

package/src/servers/horizons.js

@@ -3,4 +3,4 @@
 import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/horizons.js';
 
-startServer({ name: 'hostinger-horizons-mcp', version: '3.27.2', tools });
+startServer({ name: 'hostinger-horizons-mcp', version: '3.27.3', tools });

package/src/servers/horizons.ts

@@ -3,4 +3,4 @@
 import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/horizons.js';
 
-startServer({ name: 'hostinger-horizons-mcp', version: '3.27.2', tools });
+startServer({ name: 'hostinger-horizons-mcp', version: '3.27.3', tools });

package/src/servers/hosting.js

@@ -4,4 +4,4 @@ import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/hosting.js';
 import instructions from '../core/instructions.js';
 
-startServer({ name: 'hostinger-hosting-mcp', version: '3.27.2', tools, instructions });
+startServer({ name: 'hostinger-hosting-mcp', version: '3.27.3', tools, instructions });

package/src/servers/hosting.ts

@@ -4,4 +4,4 @@ import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/hosting.js';
 import instructions from '../core/instructions.js';
 
-startServer({ name: 'hostinger-hosting-mcp', version: '3.27.2', tools, instructions });
+startServer({ name: 'hostinger-hosting-mcp', version: '3.27.3', tools, instructions });

package/src/servers/mail.js

@@ -3,4 +3,4 @@
 import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/mail.js';
 
-startServer({ name: 'hostinger-mail-mcp', version: '3.27.2', tools });
+startServer({ name: 'hostinger-mail-mcp', version: '3.27.3', tools });

package/src/servers/mail.ts

@@ -3,4 +3,4 @@
 import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/mail.js';
 
-startServer({ name: 'hostinger-mail-mcp', version: '3.27.2', tools });
+startServer({ name: 'hostinger-mail-mcp', version: '3.27.3', tools });

package/src/servers/reach.js

@@ -3,4 +3,4 @@
 import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/reach.js';
 
-startServer({ name: 'hostinger-reach-mcp', version: '3.27.2', tools });
+startServer({ name: 'hostinger-reach-mcp', version: '3.27.3', tools });

package/src/servers/reach.ts

@@ -3,4 +3,4 @@
 import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/reach.js';
 
-startServer({ name: 'hostinger-reach-mcp', version: '3.27.2', tools });
+startServer({ name: 'hostinger-reach-mcp', version: '3.27.3', tools });

package/src/servers/vps.js

@@ -3,4 +3,4 @@
 import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/vps.js';
 
-startServer({ name: 'hostinger-vps-mcp', version: '3.27.2', tools });
+startServer({ name: 'hostinger-vps-mcp', version: '3.27.3', tools });

package/src/servers/vps.ts

@@ -3,4 +3,4 @@
 import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/vps.js';
 
-startServer({ name: 'hostinger-vps-mcp', version: '3.27.2', tools });
+startServer({ name: 'hostinger-vps-mcp', version: '3.27.3', tools });

package/src/servers/wordpress.js

@@ -3,4 +3,4 @@
 import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/wordpress.js';
 
-startServer({ name: 'hostinger-wordpress-mcp', version: '3.27.2', tools });
+startServer({ name: 'hostinger-wordpress-mcp', version: '3.27.3', tools });

package/src/servers/wordpress.ts

@@ -3,4 +3,4 @@
 import { startServer } from '../core/runtime.js';
 import tools from '../core/tools/wordpress.js';
 
-startServer({ name: 'hostinger-wordpress-mcp', version: '3.27.2', tools });
+startServer({ name: 'hostinger-wordpress-mcp', version: '3.27.3', tools });