hostinger-api-mcp 3.29.0 → 3.30.1

package/CHANGELOG.md

@@ -4,6 +4,28 @@ Generated at release time from the diff between the previous and current
 build. Tool changes are listed individually; everything else is summarised
 by area.
 
+## v3.30.1 — 2026-11-05
+
+### Also in this release
+
+- Bundled agent skills: 10 files
+- Other files: `src/core/skills.js`, `src/core/skills.ts`
+
+## v3.30.0 — 2026-11-05
+
+### Operations
+
+- Added `hosting_php_update` — Update website PHP version, extensions and options
+- Hid 4 operations from search (they still run through `execute`): `hosting_php_reset-extensions`, `hosting_php_update-extensions`, `hosting_php_update-options`, `hosting_php_update-version`
+
+### Also in this release
+
+- Documentation: `README.md`
+- Bundled agent skills: `skills/headless/VERSION`, `skills/maintain-wordpress/SKILL.md`, `skills/troubleshoot-website/SKILL.md`
+- Request handling and authentication: `src/core/runtime.js`, `src/core/runtime.ts`
+- Other files: `src/core/skills.js`, `src/core/skills.ts`
+- Build and packaging: `types.d.ts`
+
 ## v3.29.0 — 2026-11-05
 
 ### Also in this release

package/README.md

@@ -69,7 +69,7 @@ pnpm update -g @hostinger/mcp
 
 This package installs the following MCP server commands:
 
-- `hostinger-api-mcp` — unified server over every operation (412 total)
+- `hostinger-api-mcp` — unified server over every operation (409 total)
 - `hostinger-agency-hosting-mcp` — 43 operations for agency-hosting
 - `hostinger-agent-readiness-mcp` — 4 operations for agent-readiness
 - `hostinger-billing-mcp` — 10 operations for billing
@@ -78,7 +78,7 @@ This package installs the following MCP server commands:
 - `hostinger-ecommerce-mcp` — 30 operations for ecommerce
 - `hostinger-gpu-mcp` — 5 operations for gpu
 - `hostinger-horizons-mcp` — 7 operations for horizons
-- `hostinger-hosting-mcp` — 57 operations for hosting
+- `hostinger-hosting-mcp` — 54 operations for hosting
 - `hostinger-mail-mcp` — 39 operations for mail
 - `hostinger-reach-mcp` — 71 operations for reach
 - `hostinger-vps-mcp` — 68 operations for vps
@@ -1960,6 +1960,13 @@ Clear a website's server cache (the hosting server's page cache) and Hostinger C
 - **Method**: `custom`
 - **Path**: `custom`
 
+#### hosting_php_update
+
+Change a website's PHP version, extensions and php.ini options in one call. Pass only what to change, at least one of version, resetExtensions, extensions and options. Steps run in the order version, resetExtensions, extensions, options, and the call stops at the first failure. applied lists the steps that ran. When a step fails, the call returns an error whose text is the same JSON: failed names the step and why, and skipped lists the ones not attempted; a multi-execute batch stops there too. WARNING: changing the version resets the website's extensions (PHP 8.0 and later) and its options to their defaults, so pass the extensions and options to keep in the same call; they are applied after the version. Option values above the plan limit are capped silently: read the applied values back with hosting_php_get, which also lists the available versions, extensions and options. Works for Shared and Cloud hosting websites.
+
+- **Method**: `custom`
+- **Path**: `custom`
+
 #### hosting_websites_list-domains
 
 List the extra domains of a website: its parked (alias) domains, which show the same site under another domain name, and its subdomains (e.g. blog.example.com), with each one's root directory. parked items have domain (a domain name or an IP address) and type (domain or ip); subdomains items have domain (the full name), subdomain (the prefix) and root_directory. A list that cannot be read comes back as { error } and the other is still returned. To add or remove one use hosting_websites_add-domain or hosting_websites_remove-domain. Works for Shared and Cloud hosting websites.
@@ -2441,15 +2448,6 @@ or specific order IDs for more targeted results.
 - **Method**: `GET`
 - **Path**: `/api/hosting/v1/orders`
 
-#### hosting_php_reset-extensions
-
-Resets all PHP extensions of the website to their default state.
-
-Use it to recover from extension conflicts or restore the original configuration.
-
-- **Method**: `PATCH`
-- **Path**: `/api/hosting/v1/accounts/{username}/websites/{domain}/php/extensions/reset`
-
 #### hosting_php_get
 
 Returns the full PHP configuration for the website: current version, available versions
@@ -2470,35 +2468,6 @@ Use it to debug PHP issues or inspect the complete PHP environment of the websit
 - **Method**: `GET`
 - **Path**: `/api/hosting/v1/accounts/{username}/websites/{domain}/php/php-info`
 
-#### hosting_php_update-extensions
-
-Enables or disables PHP extensions (modules) for the website.
-
-Use the Get PHP details endpoint to check the current extension states before changing them.
-
-- **Method**: `PATCH`
-- **Path**: `/api/hosting/v1/accounts/{username}/websites/{domain}/php/extensions`
-
-#### hosting_php_update-options
-
-Updates PHP options for the website (e.g. `memory_limit`, `max_execution_time`, `upload_max_filesize`).
-Only provide the options you want to change, inside the `options` object.
-
-Values above the account plan limit are silently capped to that limit, so the request can succeed
-with a smaller applied value. Call the Get PHP details endpoint afterwards to read the applied value.
-
-- **Method**: `PATCH`
-- **Path**: `/api/hosting/v1/accounts/{username}/websites/{domain}/php/options`
-
-#### hosting_php_update-version
-
-Changes the PHP version of the website.
-
-Use the Get PHP details endpoint to see the versions available for the website.
-
-- **Method**: `PATCH`
-- **Path**: `/api/hosting/v1/accounts/{username}/websites/{domain}/php/version`
-
 #### hosting_redirects_list-website
 
 Returns a paginated list of redirects configured for the selected website.

package/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "hostinger-api-mcp",
-  "version": "3.29.0",
+  "version": "3.30.1",
   "description": "Hostinger API — manage domains, DNS, hosting, VPS, billing and more from Gemini CLI.",
   "mcpServers": {
     "hostinger": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hostinger-api-mcp",
-  "version": "3.29.0",
+  "version": "3.30.1",
   "mcpName": "io.github.hostinger/hostinger-api-mcp",
   "description": "MCP server for Hostinger API",
   "repository": {

package/server.json

@@ -17,12 +17,12 @@
     "url": "https://github.com/hostinger/api-mcp-server",
     "source": "github"
   },
-  "version": "3.29.0",
+  "version": "3.30.1",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@hostinger/mcp",
-      "version": "3.29.0",
+      "version": "3.30.1",
       "transport": {
         "type": "stdio"
       },

package/skills/headless/VERSION

@@ -1,3 +1,3 @@
-version=3.29.0
-commit=c4c3f98adbe2
+version=3.30.1
+commit=4d02050e3406
 built=2026-11-05

package/skills/headless/connect/SKILL.md

@@ -107,8 +107,8 @@ hostinger-api-mcp --login
 hostinger-api-mcp --logout
 
 # Without a global install:
-npx --yes --package=@hostinger/mcp@latest hostinger-api-mcp --login
-npx --yes --package=@hostinger/mcp@latest hostinger-api-mcp --logout
+npx --yes --prefix="$HOME" --package=@hostinger/mcp@latest hostinger-api-mcp --login
+npx --yes --prefix="$HOME" --package=@hostinger/mcp@latest hostinger-api-mcp --logout
 ```
 
 Credentials live in `~/.config/hostinger-mcp/credentials.json` (macOS/Linux) or `%APPDATA%\hostinger-mcp\credentials.json` (Windows) and are shared by every Hostinger MCP binary. OAuth works only when the tool runs the server over its default local (stdio) transport, which is what every registration below uses; `--http` needs `HOSTINGER_API_TOKEN`.
@@ -127,8 +127,8 @@ one group says nothing about the other:
 
 | Group | Operations | Comes from | Needed by |
 |---|---|---|---|
-| **Hosting** | `hosting_*` (websites, deploy, build report), `wordpress_*` | `hostinger` (`npx -y @hostinger/mcp@latest`), or the scoped servers such as `hostinger-hosting` + `hostinger-wordpress` | every build |
-| **Ecommerce** | `ecommerce_*` (stores, products, shipping, payments) | **only** `hostinger-ecommerce` (`npx --package=@hostinger/mcp@latest hostinger-ecommerce-mcp`), or the Ecommerce MCP in the Hostinger Connector. Neither `hostinger` nor the scoped hosting servers include it | Ecommerce backends (chosen later, in refine) |
+| **Hosting** | `hosting_*` (websites, deploy, build report), `wordpress_*` | `hostinger` (`npx -y --prefix="$HOME" @hostinger/mcp@latest`), or the scoped servers such as `hostinger-hosting` + `hostinger-wordpress` | every build |
+| **Ecommerce** | `ecommerce_*` (stores, products, shipping, payments) | **only** `hostinger-ecommerce` (`npx --prefix="$HOME" --package=@hostinger/mcp@latest hostinger-ecommerce-mcp`), or the Ecommerce MCP in the Hostinger Connector. Neither `hostinger` nor the scoped hosting servers include it | Ecommerce backends (chosen later, in refine) |
 
 Check each group on its own, right here at connect, before anything else:
 
@@ -148,8 +148,8 @@ Most coding tools load MCP servers only when they start, so a server registered
 until the tool restarts. When either tool group above is missing:
 
 1. **Register the missing servers** in the tool's MCP config, as the tool route below shows: `hostinger`
-   (`npx -y @hostinger/mcp@latest`) if the hosting group is missing, and `hostinger-ecommerce`
-   (`npx --package=@hostinger/mcp@latest hostinger-ecommerce-mcp`) if the ecommerce group is missing.
+   (`npx -y --prefix="$HOME" @hostinger/mcp@latest`) if the hosting group is missing, and `hostinger-ecommerce`
+   (`npx --prefix="$HOME" --package=@hostinger/mcp@latest hostinger-ecommerce-mcp`) if the ecommerce group is missing.
    Skip a server that is already registered under its name. When neither group is there, register
    both: the backend isn't chosen until refine, and one restart then covers every backend.
 2. **Write `connect.json`** (Phase 3) before you stop. The skill folder from Phase 1 stays in place,
@@ -163,6 +163,13 @@ until the tool restarts. When either tool group above is missing:
 
 If a tool loads new servers without a restart (VS Code), use them right away and skip steps 3–4.
 
+**Every `npx` command and registration keeps `--prefix` set to the user's home folder.** The tool
+starts the server, and you run commands, in the user's project, often a cloned repository or
+template. Without `--prefix`, npm reads the `.npmrc` there, and whoever wrote it can point npx at
+another registry or run their own code. In shell commands write `--prefix="$HOME"` (the shell expands
+it when you register). In JSON or TOML configs replace `<home>` with the home folder's absolute path
+(`echo $HOME`, e.g. `/Users/me` or `C:\\Users\\me`). Never drop the flag or leave `<home>` in place.
+
 | Tool        | Route                           |
 |-------------|---------------------------------|
 | Claude Code | `connect/tools/claude-code.md`  |

package/skills/headless/connect/tools/antigravity.md

@@ -26,11 +26,11 @@ no tokens to handle:
   "mcpServers": {
     "hostinger": {
       "command": "npx",
-      "args": ["-y", "@hostinger/mcp@latest"]
+      "args": ["-y", "--prefix=<home>", "@hostinger/mcp@latest"]
     },
     "hostinger-ecommerce": {
       "command": "npx",
-      "args": ["--package=@hostinger/mcp@latest", "hostinger-ecommerce-mcp"]
+      "args": ["--prefix=<home>", "--package=@hostinger/mcp@latest", "hostinger-ecommerce-mcp"]
     }
   }
 }

package/skills/headless/connect/tools/claude-code.md

@@ -25,8 +25,8 @@ in, so they reuse the cached sign-in (`~/.config/hostinger-mcp/credentials.json`
 `HOSTINGER_API_TOKEN`) and there are no tokens to handle:
 
 ```bash
-claude mcp add hostinger --scope user -- npx -y @hostinger/mcp@latest                                     # hosting group missing
-claude mcp add hostinger-ecommerce --scope user -- npx --package=@hostinger/mcp@latest hostinger-ecommerce-mcp  # ecommerce group missing
+claude mcp add hostinger --scope user -- npx -y --prefix="$HOME" @hostinger/mcp@latest                                     # hosting group missing
+claude mcp add hostinger-ecommerce --scope user -- npx --prefix="$HOME" --package=@hostinger/mcp@latest hostinger-ecommerce-mcp  # ecommerce group missing
 ```
 
 Claude Code loads MCP servers only at startup, so follow *register, restart, resume* in

package/skills/headless/connect/tools/codex.md

@@ -19,8 +19,8 @@ sign-in (`~/.config/hostinger-mcp/credentials.json`, or `HOSTINGER_API_TOKEN`) a
 to handle:
 
 ```bash
-codex mcp add hostinger -- npx -y @hostinger/mcp@latest
-codex mcp add hostinger-ecommerce -- npx --package=@hostinger/mcp@latest hostinger-ecommerce-mcp
+codex mcp add hostinger -- npx -y --prefix="$HOME" @hostinger/mcp@latest
+codex mcp add hostinger-ecommerce -- npx --prefix="$HOME" --package=@hostinger/mcp@latest hostinger-ecommerce-mcp
 ```
 
 or add them to `~/.codex/config.toml`:
@@ -28,11 +28,11 @@ or add them to `~/.codex/config.toml`:
 ```toml
 [mcp_servers.hostinger]
 command = "npx"
-args = ["-y", "@hostinger/mcp@latest"]
+args = ["-y", "--prefix=<home>", "@hostinger/mcp@latest"]
 
 [mcp_servers.hostinger-ecommerce]
 command = "npx"
-args = ["--package=@hostinger/mcp@latest", "hostinger-ecommerce-mcp"]
+args = ["--prefix=<home>", "--package=@hostinger/mcp@latest", "hostinger-ecommerce-mcp"]
 ```
 
 Codex loads MCP servers only when it starts, so follow *register, restart, resume* in

package/skills/headless/connect/tools/cursor.md

@@ -19,7 +19,7 @@ The Hostinger MCP is the npm package `@hostinger/mcp`. You do **not** need a glo
 
 ```bash
 # Verify the package/binary is reachable
-npx --yes --package=@hostinger/mcp@latest hostinger-api-mcp --version
+npx --yes --prefix="$HOME" --package=@hostinger/mcp@latest hostinger-api-mcp --version
 ```
 
 ### Option B — global install
@@ -49,11 +49,11 @@ OAuth can run:
   "mcpServers": {
     "hostinger": {
       "command": "npx",
-      "args": ["--yes", "--package=@hostinger/mcp@latest", "hostinger-api-mcp"]
+      "args": ["--yes", "--prefix=<home>", "--package=@hostinger/mcp@latest", "hostinger-api-mcp"]
     },
     "hostinger-ecommerce": {
       "command": "npx",
-      "args": ["--yes", "--package=@hostinger/mcp@latest", "hostinger-ecommerce-mcp"]
+      "args": ["--yes", "--prefix=<home>", "--package=@hostinger/mcp@latest", "hostinger-ecommerce-mcp"]
     }
   }
 }
@@ -74,7 +74,7 @@ If the connect bootstrap already emitted `logged_in` / `success`, credentials ar
 Otherwise run the login command. It registers a dynamic OAuth client (once per machine), **opens the user's browser** to Hostinger's authorization page, listens on a localhost callback, stores tokens, and exits:
 
 ```bash
-npx --yes --package=@hostinger/mcp@latest hostinger-api-mcp --login
+npx --yes --prefix="$HOME" --package=@hostinger/mcp@latest hostinger-api-mcp --login
 ```
 
 (With a global install: `hostinger-api-mcp --login`.)
@@ -95,7 +95,7 @@ They are shared across every Hostinger MCP binary. Expired access tokens refresh
 To sign out later:
 
 ```bash
-npx --yes --package=@hostinger/mcp@latest hostinger-api-mcp --logout
+npx --yes --prefix="$HOME" --package=@hostinger/mcp@latest hostinger-api-mcp --logout
 ```
 
 **API token (optional, CI / scripts):** set `HOSTINGER_API_TOKEN` in the environment before launching Cursor. When present it always wins and no OAuth code runs. Do not commit the token.

package/skills/headless/connect/tools/devin.md

@@ -21,18 +21,18 @@ tokens to handle.
 - **Devin CLI:**
 
   ```bash
-  devin mcp add hostinger -- npx -y @hostinger/mcp@latest
-  devin mcp add hostinger-ecommerce -- npx --package=@hostinger/mcp@latest hostinger-ecommerce-mcp
+  devin mcp add hostinger -- npx -y --prefix="$HOME" @hostinger/mcp@latest
+  devin mcp add hostinger-ecommerce -- npx --prefix="$HOME" --package=@hostinger/mcp@latest hostinger-ecommerce-mcp
   ```
 
 - **Devin app:** Settings → MCP Marketplace → **Add Your Own**, transport **STDIO**, once per server:
 
   ```json
-  { "command": "npx", "args": ["-y", "@hostinger/mcp@latest"] }
+  { "command": "npx", "args": ["-y", "--prefix=<home>", "@hostinger/mcp@latest"] }
   ```
 
   ```json
-  { "command": "npx", "args": ["--package=@hostinger/mcp@latest", "hostinger-ecommerce-mcp"] }
+  { "command": "npx", "args": ["--prefix=<home>", "--package=@hostinger/mcp@latest", "hostinger-ecommerce-mcp"] }
   ```
 
 If the tools still aren't in this session, follow *register, restart, resume* in `connect/SKILL.md`:

package/skills/headless/connect/tools/vscode.md

@@ -26,12 +26,12 @@ no tokens to handle. Add them to `.vscode/mcp.json` (workspace) or your user `se
     "hostinger": {
       "type": "stdio",
       "command": "npx",
-      "args": ["-y", "@hostinger/mcp@latest"]
+      "args": ["-y", "--prefix=<home>", "@hostinger/mcp@latest"]
     },
     "hostinger-ecommerce": {
       "type": "stdio",
       "command": "npx",
-      "args": ["--package=@hostinger/mcp@latest", "hostinger-ecommerce-mcp"]
+      "args": ["--prefix=<home>", "--package=@hostinger/mcp@latest", "hostinger-ecommerce-mcp"]
     }
   }
 }
@@ -40,8 +40,8 @@ no tokens to handle. Add them to `.vscode/mcp.json` (workspace) or your user `se
 Or add them in two commands:
 
 ```bash
-code --add-mcp '{"name":"hostinger","command":"npx","args":["-y","@hostinger/mcp@latest"]}'
-code --add-mcp '{"name":"hostinger-ecommerce","command":"npx","args":["--package=@hostinger/mcp@latest","hostinger-ecommerce-mcp"]}'
+code --add-mcp '{"name":"hostinger","command":"npx","args":["-y","--prefix=<home>","@hostinger/mcp@latest"]}'
+code --add-mcp '{"name":"hostinger-ecommerce","command":"npx","args":["--prefix=<home>","--package=@hostinger/mcp@latest","hostinger-ecommerce-mcp"]}'
 ```
 
 VS Code picks up new servers and their tools become available right away, with no editor restart.

package/skills/headless/steps/03-provision/ecommerce/SKILL.md

@@ -22,7 +22,7 @@ Provision a **Hostinger Ecommerce** backend for `<domain>` and prove it is ready
 > aren't (for example, a tool connected before connect registered both servers), register it now. The
 > command for each tool is in its `connect/tools/<tool>.md`; for Claude Code:
 > ```bash
-> claude mcp add hostinger-ecommerce --scope user -- npx --package=@hostinger/mcp@latest hostinger-ecommerce-mcp
+> claude mcp add hostinger-ecommerce --scope user -- npx --prefix="$HOME" --package=@hostinger/mcp@latest hostinger-ecommerce-mcp
 > ```
 > (Or enable the **Ecommerce** MCP in the Hostinger Connector.) A newly added MCP server only loads
 > after a restart, so pause the run with *register, restart, resume* from `connect/SKILL.md`: save

package/skills/headless/steps/08-deploy/SKILL.md

@@ -15,7 +15,7 @@ This is an **instance-barrier** step: run it only after `provision.status == "co
 > **Connected to the hosted server (`mcp.hostinger.com`)?** Its `hosting_deploy` deploys Git
 > repositories only and cannot read a local `path`. Run this step through the local
 > `hostinger-api-mcp` server instead (see the connect step:
-> `npx --yes --package=@hostinger/mcp@latest hostinger-api-mcp`).
+> `npx --yes --prefix="$HOME" --package=@hostinger/mcp@latest hostinger-api-mcp`).
 
 > **With a shell and the Hostinger CLI installed**, the same deploy is one command, with the build
 > settings passed exactly as the table below says. Run it from the project, since it links the current directory:

package/skills/maintain-wordpress/SKILL.md

@@ -65,7 +65,7 @@ When a site breaks: stop the run, deactivate the plugin updated last with `wordp
 
 - Page cache: `wordpress_litespeed-cache_show-lite-speed-status`; purge after design or content changes.
 - Object cache: `wordpress_object-cache_show-memcached-status`, then `wordpress_object-cache_toggle-memcached` with `enabled: true` — the usual quick speed-up.
-- PHP version: `hosting_php_get` is large (around 25 KB), so read it only when the user asks about PHP. PHP 8.x is markedly faster than 7.x; confirm plugin compatibility before `hosting_php_update-version`.
+- PHP version: `hosting_php_get` is large (around 25 KB), so read it only when the user asks about PHP. PHP 8.x is markedly faster than 7.x; confirm plugin compatibility before switching with `hosting_php_update` (`version`). The switch resets extensions and options to their defaults, so pass the custom ones from `hosting_php_get` in the same call.
 - wp-admin: `wordpress_login_create-links` returns temporary one-click login links. Give them to the user only; never store or reuse them.
 - Hostinger's own plugins update with `wordpress_plugins_update-hostinger` (`slug`).
 

package/skills/troubleshoot-website/SKILL.md

@@ -68,7 +68,7 @@ Batch `hosting_get-deployment` (the latest build with its log, failure analysis
 
 ### PHP
 
-`hosting_php_get` returns every extension and option (around 25 KB), so call it only for PHP problems. `hosting_php_update-version` switches versions. `hosting_php_update-options` silently caps values at the plan maximum (`max` in `hosting_php_get`), so read the applied value back. Agency: `agency-hosting_php_list-options-for-website`, then `agency-hosting_php_replace-website-options` — a full replace, so send every custom option that should stay.
+`hosting_php_get` returns every extension and option (around 25 KB), so call it only for PHP problems. `hosting_php_update` changes the version, extensions and options in one call. Switching the version resets the extensions and options to their defaults, so pass the ones to keep in the same call. Option values are silently capped at the plan maximum (`max` in `hosting_php_get`), so read the applied value back. Agency: `agency-hosting_php_list-options-for-website`, then `agency-hosting_php_replace-website-options` — a full replace, so send every custom option that should stay.
 
 ### Agency Plan sites
 

package/src/core/runtime.js

@@ -304,6 +304,8 @@ class MCPServer {
         return await this.handleHostingWebsitesUpdateSettings(params);
       case 'hosting_cache_clear':
         return await this.handleHostingCacheClear(params);
+      case 'hosting_php_update':
+        return await this.handleHostingPhpUpdate(params);
       case 'hosting_websites_list-domains':
         return await this.handleHostingWebsitesListDomains(params);
       case 'hosting_websites_add-domain':
@@ -1605,6 +1607,100 @@ class MCPServer {
     return { domain, cleared: scope, directory, response };
   }
 
+  // Application order, and how each step maps to its operation.
+  hosting_phpUpdate_steps = [
+    { setting: 'version', run: (target, value) => this.callOperation('hosting_php_update-version', { ...target, version: value }) },
+    { setting: 'resetExtensions', run: (target) => this.callOperation('hosting_php_reset-extensions', target) },
+    { setting: 'extensions', run: (target, value) => this.callOperation('hosting_php_update-extensions', { ...target, ...this.hosting_phpUpdate_extensionLists(value) }) },
+    { setting: 'options', run: (target, value) => this.callOperation('hosting_php_update-options', { ...target, options: value }) },
+  ];
+
+  // The enable and disable lists to send: only the non-empty ones.
+  hosting_phpUpdate_extensionLists(extensions) {
+    const lists = {};
+    for (const key of ['enable', 'disable']) {
+      if (Array.isArray(extensions[key]) && extensions[key].length > 0) {
+        lists[key] = extensions[key];
+      }
+    }
+    return lists;
+  }
+
+  hosting_phpUpdate_validate(params) {
+    // Models send null for fields they leave unset.
+    const given = (name) => params[name] !== undefined && params[name] !== null;
+
+    if (given('version') && (typeof params.version !== 'string' || params.version.trim() === '')) {
+      throw new Error('version must be a non-empty string when provided');
+    }
+    if (given('resetExtensions') && typeof params.resetExtensions !== 'boolean') {
+      throw new Error('resetExtensions must be a boolean when provided');
+    }
+    if (given('extensions')) {
+      const extensions = params.extensions;
+      const list = (value) => value === undefined || value === null || (Array.isArray(value) && value.every((name) => typeof name === 'string' && name !== ''));
+      const valid = typeof extensions === 'object' && !Array.isArray(extensions)
+        && list(extensions.enable) && list(extensions.disable)
+        && Object.keys(this.hosting_phpUpdate_extensionLists(extensions)).length > 0;
+      if (!valid) {
+        throw new Error('extensions must be an object with a non-empty enable or disable list of extension names');
+      }
+    }
+    if (given('options')) {
+      const options = params.options;
+      const valid = typeof options === 'object' && !Array.isArray(options) && Object.keys(options).length > 0
+        && Object.values(options).every(value => typeof value === 'string' || (typeof value === 'number' && Number.isInteger(value)));
+      if (!valid) {
+        throw new Error('options must be a non-empty object of option names to string or integer values');
+      }
+    }
+  }
+
+  async handleHostingPhpUpdate(params) {
+    const { domain: requestedDomain } = params;
+    this.hosting_phpUpdate_validate(params);
+
+    // resetExtensions: false asks for nothing, like null.
+    const requested = this.hosting_phpUpdate_steps.filter(step => step.setting === 'resetExtensions'
+      ? params.resetExtensions === true
+      : params[step.setting] !== undefined && params[step.setting] !== null);
+    if (requested.length === 0) {
+      throw new Error('Pass at least one of version, resetExtensions, extensions, options');
+    }
+    if (!requestedDomain || typeof requestedDomain !== 'string') {
+      throw new Error('domain is required and must be a string');
+    }
+
+    const { username, domain } = await this.findWebsite(requestedDomain);
+    const target = { username, domain };
+
+    const applied = {};
+    let failed = null;
+    const skipped = [];
+    for (const step of requested) {
+      const value = params[step.setting];
+      if (failed) {
+        skipped.push(step.setting);
+        continue;
+      }
+      try {
+        await step.run(target, value);
+        // What was sent: for extensions, only the non-empty lists.
+        applied[step.setting] = step.setting === 'extensions' ? this.hosting_phpUpdate_extensionLists(value) : value;
+      } catch (error) {
+        failed = { setting: step.setting, error: this.formatToolError(error) };
+      }
+    }
+
+    const result = { domain, applied, failed, skipped };
+    // A failed step is a tool error carrying the same JSON, so execute reports it and a
+    // multi-execute batch stops at this step.
+    if (failed) {
+      throw new Error(JSON.stringify(result));
+    }
+    return result;
+  }
+
   // A 404 means the domain is not a website on the account, which fails the whole call; any other
   // failure only fails its own list.
   async hosting_websitesListDomains_section(request, pick) {

package/src/core/runtime.ts

@@ -336,6 +336,8 @@ class MCPServer {
         return await this.handleHostingWebsitesUpdateSettings(params);
       case 'hosting_cache_clear':
         return await this.handleHostingCacheClear(params);
+      case 'hosting_php_update':
+        return await this.handleHostingPhpUpdate(params);
       case 'hosting_websites_list-domains':
         return await this.handleHostingWebsitesListDomains(params);
       case 'hosting_websites_add-domain':
@@ -1643,6 +1645,100 @@ class MCPServer {
     return { domain, cleared: scope, directory, response };
   }
 
+  // Application order, and how each step maps to its operation.
+  private hosting_phpUpdate_steps: Array<{ setting: string; run: (target: { username: string; domain: string }, value: any) => Promise<any> }> = [
+    { setting: 'version', run: (target, value) => this.callOperation('hosting_php_update-version', { ...target, version: value }) },
+    { setting: 'resetExtensions', run: (target) => this.callOperation('hosting_php_reset-extensions', target) },
+    { setting: 'extensions', run: (target, value) => this.callOperation('hosting_php_update-extensions', { ...target, ...this.hosting_phpUpdate_extensionLists(value) }) },
+    { setting: 'options', run: (target, value) => this.callOperation('hosting_php_update-options', { ...target, options: value }) },
+  ];
+
+  // The enable and disable lists to send: only the non-empty ones.
+  private hosting_phpUpdate_extensionLists(extensions: Record<string, any>): Record<string, string[]> {
+    const lists: Record<string, string[]> = {};
+    for (const key of ['enable', 'disable']) {
+      if (Array.isArray(extensions[key]) && extensions[key].length > 0) {
+        lists[key] = extensions[key];
+      }
+    }
+    return lists;
+  }
+
+  private hosting_phpUpdate_validate(params: Record<string, any>): void {
+    // Models send null for fields they leave unset.
+    const given = (name: string) => params[name] !== undefined && params[name] !== null;
+
+    if (given('version') && (typeof params.version !== 'string' || params.version.trim() === '')) {
+      throw new Error('version must be a non-empty string when provided');
+    }
+    if (given('resetExtensions') && typeof params.resetExtensions !== 'boolean') {
+      throw new Error('resetExtensions must be a boolean when provided');
+    }
+    if (given('extensions')) {
+      const extensions = params.extensions;
+      const list = (value: any) => value === undefined || value === null || (Array.isArray(value) && value.every((name: any) => typeof name === 'string' && name !== ''));
+      const valid = typeof extensions === 'object' && !Array.isArray(extensions)
+        && list(extensions.enable) && list(extensions.disable)
+        && Object.keys(this.hosting_phpUpdate_extensionLists(extensions)).length > 0;
+      if (!valid) {
+        throw new Error('extensions must be an object with a non-empty enable or disable list of extension names');
+      }
+    }
+    if (given('options')) {
+      const options = params.options;
+      const valid = typeof options === 'object' && !Array.isArray(options) && Object.keys(options).length > 0
+        && Object.values(options).every(value => typeof value === 'string' || (typeof value === 'number' && Number.isInteger(value)));
+      if (!valid) {
+        throw new Error('options must be a non-empty object of option names to string or integer values');
+      }
+    }
+  }
+
+  private async handleHostingPhpUpdate(params: Record<string, any>): Promise<any> {
+    const { domain: requestedDomain } = params;
+    this.hosting_phpUpdate_validate(params);
+
+    // resetExtensions: false asks for nothing, like null.
+    const requested = this.hosting_phpUpdate_steps.filter(step => step.setting === 'resetExtensions'
+      ? params.resetExtensions === true
+      : params[step.setting] !== undefined && params[step.setting] !== null);
+    if (requested.length === 0) {
+      throw new Error('Pass at least one of version, resetExtensions, extensions, options');
+    }
+    if (!requestedDomain || typeof requestedDomain !== 'string') {
+      throw new Error('domain is required and must be a string');
+    }
+
+    const { username, domain } = await this.findWebsite(requestedDomain);
+    const target = { username, domain };
+
+    const applied: Record<string, any> = {};
+    let failed: { setting: string; error: string } | null = null;
+    const skipped: string[] = [];
+    for (const step of requested) {
+      const value = params[step.setting];
+      if (failed) {
+        skipped.push(step.setting);
+        continue;
+      }
+      try {
+        await step.run(target, value);
+        // What was sent: for extensions, only the non-empty lists.
+        applied[step.setting] = step.setting === 'extensions' ? this.hosting_phpUpdate_extensionLists(value) : value;
+      } catch (error) {
+        failed = { setting: step.setting, error: this.formatToolError(error) };
+      }
+    }
+
+    const result = { domain, applied, failed, skipped };
+    // A failed step is a tool error carrying the same JSON, so execute reports it and a
+    // multi-execute batch stops at this step.
+    if (failed) {
+      throw new Error(JSON.stringify(result));
+    }
+    return result;
+  }
+
   // A 404 means the domain is not a website on the account, which fails the whole call; any other
   // failure only fails its own list.
   private async hosting_websitesListDomains_section(request: Promise<any>, pick: (item: any) => any): Promise<any> {