hostinger-api-mcp 3.28.6 → 3.30.0

package/CHANGELOG.md

@@ -4,6 +4,28 @@ Generated at release time from the diff between the previous and current
 build. Tool changes are listed individually; everything else is summarised
 by area.
 
+## v3.30.0 — 2026-11-05
+
+### Operations
+
+- Added `hosting_php_update` — Update website PHP version, extensions and options
+- Hid 4 operations from search (they still run through `execute`): `hosting_php_reset-extensions`, `hosting_php_update-extensions`, `hosting_php_update-options`, `hosting_php_update-version`
+
+### Also in this release
+
+- Documentation: `README.md`
+- Bundled agent skills: `skills/headless/VERSION`, `skills/maintain-wordpress/SKILL.md`, `skills/troubleshoot-website/SKILL.md`
+- Request handling and authentication: `src/core/runtime.js`, `src/core/runtime.ts`
+- Other files: `src/core/skills.js`, `src/core/skills.ts`
+- Build and packaging: `types.d.ts`
+
+## v3.29.0 — 2026-11-05
+
+### Also in this release
+
+- Bundled agent skills: 12 files
+- Other files: `src/core/skills.js`, `src/core/skills.ts`
+
 ## v3.28.6 — 2026-11-05
 
 ### Also in this release

package/README.md

@@ -69,7 +69,7 @@ pnpm update -g @hostinger/mcp
 
 This package installs the following MCP server commands:
 
-- `hostinger-api-mcp` — unified server over every operation (412 total)
+- `hostinger-api-mcp` — unified server over every operation (409 total)
 - `hostinger-agency-hosting-mcp` — 43 operations for agency-hosting
 - `hostinger-agent-readiness-mcp` — 4 operations for agent-readiness
 - `hostinger-billing-mcp` — 10 operations for billing
@@ -78,7 +78,7 @@ This package installs the following MCP server commands:
 - `hostinger-ecommerce-mcp` — 30 operations for ecommerce
 - `hostinger-gpu-mcp` — 5 operations for gpu
 - `hostinger-horizons-mcp` — 7 operations for horizons
-- `hostinger-hosting-mcp` — 57 operations for hosting
+- `hostinger-hosting-mcp` — 54 operations for hosting
 - `hostinger-mail-mcp` — 39 operations for mail
 - `hostinger-reach-mcp` — 71 operations for reach
 - `hostinger-vps-mcp` — 68 operations for vps
@@ -1960,6 +1960,13 @@ Clear a website's server cache (the hosting server's page cache) and Hostinger C
 - **Method**: `custom`
 - **Path**: `custom`
 
+#### hosting_php_update
+
+Change a website's PHP version, extensions and php.ini options in one call. Pass only what to change, at least one of version, resetExtensions, extensions and options. Steps run in the order version, resetExtensions, extensions, options, and the call stops at the first failure. applied lists the steps that ran. When a step fails, the call returns an error whose text is the same JSON: failed names the step and why, and skipped lists the ones not attempted; a multi-execute batch stops there too. WARNING: changing the version resets the website's extensions (PHP 8.0 and later) and its options to their defaults, so pass the extensions and options to keep in the same call; they are applied after the version. Option values above the plan limit are capped silently: read the applied values back with hosting_php_get, which also lists the available versions, extensions and options. Works for Shared and Cloud hosting websites.
+
+- **Method**: `custom`
+- **Path**: `custom`
+
 #### hosting_websites_list-domains
 
 List the extra domains of a website: its parked (alias) domains, which show the same site under another domain name, and its subdomains (e.g. blog.example.com), with each one's root directory. parked items have domain (a domain name or an IP address) and type (domain or ip); subdomains items have domain (the full name), subdomain (the prefix) and root_directory. A list that cannot be read comes back as { error } and the other is still returned. To add or remove one use hosting_websites_add-domain or hosting_websites_remove-domain. Works for Shared and Cloud hosting websites.
@@ -2441,15 +2448,6 @@ or specific order IDs for more targeted results.
 - **Method**: `GET`
 - **Path**: `/api/hosting/v1/orders`
 
-#### hosting_php_reset-extensions
-
-Resets all PHP extensions of the website to their default state.
-
-Use it to recover from extension conflicts or restore the original configuration.
-
-- **Method**: `PATCH`
-- **Path**: `/api/hosting/v1/accounts/{username}/websites/{domain}/php/extensions/reset`
-
 #### hosting_php_get
 
 Returns the full PHP configuration for the website: current version, available versions
@@ -2470,35 +2468,6 @@ Use it to debug PHP issues or inspect the complete PHP environment of the websit
 - **Method**: `GET`
 - **Path**: `/api/hosting/v1/accounts/{username}/websites/{domain}/php/php-info`
 
-#### hosting_php_update-extensions
-
-Enables or disables PHP extensions (modules) for the website.
-
-Use the Get PHP details endpoint to check the current extension states before changing them.
-
-- **Method**: `PATCH`
-- **Path**: `/api/hosting/v1/accounts/{username}/websites/{domain}/php/extensions`
-
-#### hosting_php_update-options
-
-Updates PHP options for the website (e.g. `memory_limit`, `max_execution_time`, `upload_max_filesize`).
-Only provide the options you want to change, inside the `options` object.
-
-Values above the account plan limit are silently capped to that limit, so the request can succeed
-with a smaller applied value. Call the Get PHP details endpoint afterwards to read the applied value.
-
-- **Method**: `PATCH`
-- **Path**: `/api/hosting/v1/accounts/{username}/websites/{domain}/php/options`
-
-#### hosting_php_update-version
-
-Changes the PHP version of the website.
-
-Use the Get PHP details endpoint to see the versions available for the website.
-
-- **Method**: `PATCH`
-- **Path**: `/api/hosting/v1/accounts/{username}/websites/{domain}/php/version`
-
 #### hosting_redirects_list-website
 
 Returns a paginated list of redirects configured for the selected website.

package/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "hostinger-api-mcp",
-  "version": "3.28.6",
+  "version": "3.30.0",
   "description": "Hostinger API — manage domains, DNS, hosting, VPS, billing and more from Gemini CLI.",
   "mcpServers": {
     "hostinger": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hostinger-api-mcp",
-  "version": "3.28.6",
+  "version": "3.30.0",
   "mcpName": "io.github.hostinger/hostinger-api-mcp",
   "description": "MCP server for Hostinger API",
   "repository": {

package/server.json

@@ -17,12 +17,12 @@
     "url": "https://github.com/hostinger/api-mcp-server",
     "source": "github"
   },
-  "version": "3.28.6",
+  "version": "3.30.0",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@hostinger/mcp",
-      "version": "3.28.6",
+      "version": "3.30.0",
       "transport": {
         "type": "stdio"
       },

package/skills/headless/SKILL.md

@@ -239,6 +239,7 @@ took from it.
 | `brief.md` | refine | refined brief, audience, tone, pages, must-haves |
 | `site.json` | provision | chosen backend, username, install id, all URLs |
 | `content-model.md` | content model | entities, fields, pages, navigation |
+| `content.json` | content model (WordPress) | the drafted content `push-content.mjs` pushes |
 | `design.md` (+ `brand/` logo files) | design | chosen design direction: tokens, type, logo, components, per-page composition, accessibility |
 | `src/` | frontend | the website source implementing `design.md`; framework choice is recorded in `state.json → frontend` |
 | `deploy.json` | deploy | build id, deployed at, live URLs |

package/skills/headless/VERSION

@@ -1,3 +1,3 @@
-version=3.28.6
-commit=3ecd304d96fb
+version=3.30.0
+commit=451f245ab30b
 built=2026-11-05

package/skills/headless/hostinger-mcp.mjs

@@ -0,0 +1,88 @@
+// The local Hostinger MCP server (the management API), spoken to over newline-delimited JSON-RPC on
+// stdio. It reuses the sign-in from the connect step. Shared by wait.mjs and push-content.mjs.
+
+import { spawn } from 'node:child_process';
+import { homedir } from 'node:os';
+
+// ── platform-safe binary names (npm/npx are .cmd on Windows), as in connect/bootstrap.mjs ──────────
+const isWin = process.platform === 'win32';
+const bin = (name) => (isWin ? `${name}.cmd` : name);
+const MCP = [bin('npx'), '-y', '--package=@hostinger/mcp@latest', 'hostinger-api-mcp'];
+// Node >= 18.20.2 / 20.12.2 refuses to spawn a .cmd/.bat without a shell
+// (CVE-2024-27980), so npx.cmd needs shell:true on Windows. Our args are all
+// fixed literals, so enabling the shell introduces no injection risk.
+const spawnShell = isWin;
+
+// One server per script run. Once it dies every pending and later call rejects, so the caller ends with
+// exit 2 rather than hanging.
+export function connect(clientName) {
+  const child = spawn(MCP[0], MCP.slice(1), { stdio: ['pipe', 'pipe', 'pipe'], shell: spawnShell, cwd: homedir() });
+  const pending = new Map();
+  let buffer = '';
+  let diag = '';
+  let dead = null;
+  let nextId = 0;
+  const die = (reason) => {
+    dead ??= new Error(`the Hostinger MCP server stopped (${reason}): ${diag.trim().slice(-500)}`);
+    for (const { reject } of pending.values()) reject(dead);
+    pending.clear();
+  };
+  child.on('error', (e) => die(e.message));
+  // 'close' comes after stderr is drained, so the reason is in diag. A write to a dying server fails
+  // with EPIPE before that; 'close' still follows, so the EPIPE itself is ignored.
+  child.on('close', (code) => die(`exit code ${code}`));
+  child.stdin.on('error', () => {});
+  child.stderr.on('data', (chunk) => (diag = (diag + chunk).slice(-2000)));
+  child.stdout.on('data', (chunk) => {
+    buffer += chunk;
+    let i;
+    while ((i = buffer.indexOf('\n')) >= 0) {
+      const line = buffer.slice(0, i);
+      buffer = buffer.slice(i + 1);
+      try {
+        const message = JSON.parse(line);
+        pending.get(message.id)?.resolve(message);
+        pending.delete(message.id);
+      } catch {
+        /* not a JSON-RPC line */
+      }
+    }
+  });
+  // A call can stall on a live server (a stuck upstream request), so each one has its own deadline; past
+  // it, it answers like an error reply. A stalled start ends the run. The start gets longer: a cold `npx`
+  // fetch of the server takes 13-40 s on an idle machine and over 60 s on a busy one.
+  const rpc = (method, params, seconds = 60) =>
+    new Promise((resolve, reject) => {
+      if (dead) return reject(dead);
+      const id = (nextId += 1);
+      const timer = setTimeout(() => {
+        pending.delete(id);
+        resolve({ error: { message: `no reply to ${method} in ${seconds} s` } });
+      }, seconds * 1000);
+      const settle = (fn) => (value) => {
+        clearTimeout(timer);
+        fn(value);
+      };
+      pending.set(id, { resolve: settle(resolve), reject: settle(reject) });
+      child.stdin.write(`${JSON.stringify({ jsonrpc: '2.0', id, method, params })}\n`);
+    });
+  const ready = rpc('initialize', { protocolVersion: '2025-06-18', capabilities: {}, clientInfo: { name: clientName, version: '1' } }, 180)
+    .then((reply) => {
+      if (reply.error) throw new Error(`the Hostinger MCP server didn't start: ${reply.error.message}`);
+      child.stdin.write(`${JSON.stringify({ jsonrpc: '2.0', method: 'notifications/initialized' })}\n`);
+    });
+  // Runs one API operation: { data } on success, else { error, status } with the HTTP status the server
+  // keeps in its error text (NaN when there is none).
+  const execute = async (operation, params) => {
+    await ready;
+    const reply = await rpc('tools/call', { name: 'execute', arguments: { operation, params } });
+    const text = reply.result?.content?.[0]?.text ?? reply.error?.message ?? 'unknown error';
+    if (reply.error || reply.result?.isError) return { error: text.slice(0, 300), status: Number(text.match(/HTTP (\d{3})/)?.[1]) };
+    try {
+      return { data: JSON.parse(text) };
+    } catch {
+      return { error: text.slice(0, 300), status: NaN };
+    }
+  };
+  return { execute, close: () => child.kill() };
+}