Hostinger API MCP Server

Why it got a B

Hostinger's official MCP server for the Hostinger API (MIT, npm @hostinger/mcp 3.39.2, released 2026-11-12). There are two ways to run it: the hosted server at https://mcp.hostinger.com, where you sign in with OAuth in your browser, or the npm package on your own machine with an API token from hPanel (or the same OAuth sign-in). It does not list hundreds of tools. It has three: search finds an operation, execute runs one, and multi-execute runs up to 20 in a row. The main binary reaches 414 operations across VPS, DNS, domains, hosting, WordPress, email, e-commerce and billing, and smaller binaries such as hostinger-dns-mcp reach only one group. Many operations change things: replacing or resetting a DNS zone, recreating a VPS (which deletes its snapshots), setting a root password, moving a domain to another Hostinger account, and buying domains or VPS plans, which charge your default payment method when none is given. The server marks execute as destructive, so keep tool approval on and don't "always allow" it. An API token has every permission of the account that made it (expiry is optional), and the hosted OAuth asks for one scope, mcp:use, so either way the client can do what you can in hPanel. Very active: 12 people committed in the last 90 days, and no advisories on record. Biggest deduction: transport, because the local --http mode is plain HTTP and doesn't check who is calling, so anything that can reach the port acts with your token. The hosted server and the default stdio mode don't have this problem; if you need --http, keep it on 127.0.0.1.