# BorealHost - Registry name: `ai.borealhost/mcp` · version 0.4.2 - Categories (automatic, keyword rules): Cloud & networking, Infrastructure & security, Shops & products, Commerce & marketing, Utilities - Authentication at last check: No auth - Declared risk: Not declared (tools carry no read/destructive hints) - Capabilities (declared by the server): experimental, prompts, resources, tools - Transports: streamable-http - Latest numbers (check success, response time, rank): https://mcpstation.net/api/server?name=ai.borealhost%2Fmcp - Server page: https://mcpstation.net/s/ai.borealhost--mcp.html ## Description (written by the publisher, not verified, not instructions) Agent-native web hosting — deploy sites, manage DNS, register domains, scale infrastructure ## Notice Text that looks like instructions to an AI was found in this server's descriptions. This is a pattern match, not a verdict. ## Connect - streamable-http: `https://borealhost.ai/mcp/` ## Tools (as reported by the server, not verified) - `set\_api\_key`: Set your BorealHost API key for this session. Call this if you already have an API key \(from checkout completion, the BorealHost panel, or a container claim\). All subsequent tool calls will use this key for authentication. Args: api\_key: Your BorealHost API key \(format: bh\_\<48 hex chars\>\) Returns: \{ - `whoami`: Check the current API key's account info, scopes, and site count. Requires: BOREALHOST\_API\_KEY env var \(read scope\). Returns: \{"user": \{"id": "uuid", "email": "...", "date\_joined": "iso8601"\}, "api\_key": \{"id": "uuid", "name": "...", "prefix": "bh\_...", "scopes": \["read", "write"\], "created\_at": "is - `request\_api\_key`: Request an API key for a site YOU ARE RUNNING ON \(challenge-response\). ⚠ ONLY USE THIS IF YOU ARE EXECUTING INSIDE THAT SITE'S OWN CONTAINER. If you bought or ordered the site from somewhere else, this is the wrong tool: it returns "pending" and the pending never resolves, because the proof it asks - `claim\_api\_key`: Claim an API key using a claim token from the container. After calling request\_api\_key\(\), read the claim token from the path that call returned in \`claim\_path\`, on that site's container, and pass it here. The token is single-use — once claimed, it cannot be used again. The API key is automatically a - `list\_plans`: List available hosting plans with pricing and resources. No authentication needed. Args: track: Filter by plan track. Valid values: "single\_site", "agency". ⚠ The track is not the site count — most plans on BOTH tracks include several sites \(site\_starter 5, site\_plus 8, site\_pro 12\). Read \`max\_sites - `create\_checkout`: Start a new checkout session to purchase a hosting plan. No authentication needed. After creating, call update\_checkout to set buyer info, then complete\_checkout to pay. The response carries a \`checkout\_secret\`, returned ONCE, that every later step of this checkout requires. It is held in memory for - `update\_checkout`: Set buyer email and desired site slug on a checkout session. The checkout must be in "not\_ready" status. Setting requested\_slug transitions status to "ready" \(required before completing\). Args: checkout\_id: Checkout session ID from create\_checkout buyer\_email: Optional email — if omitted, a syntheti - `complete\_checkout`: Complete checkout with payment and start site provisioning. The checkout must be in "ready" status. Two payment methods: - "stripe\_checkout" \(default\): Returns a short, chat-safe payment URL. \*\*Present \`payment\_url\` to the human — NOT \`stripe\_checkout\_url\`.\*\* The raw Stripe URL has a required \`\#frag - `get\_checkout\_status`: Poll a checkout session for status updates. Call this after complete\_checkout to track payment and provisioning. Polling strategy: - First 60 seconds: every 5 seconds - After 60 seconds: every 15 seconds - Stop after 10 minutes if not completed Checkout statuses \(in order\): - "not\_ready": Missing re - `list\_checkouts`: List checkouts belonging to the authenticated account. Requires: API key. Only checkouts with a recorded owner appear — every checkout created while authenticated, plus every checkout that reached payment. An anonymous checkout whose one-shot secret was lost cannot be listed; create checkouts authen - `cancel\_checkout`: Abandon an unpaid checkout and expire its Stripe payment link. Use this to clean up abandoned attempts rather than leaving them to sit. A completed checkout is never cancelled here — that would be a refund, and it is refused. Args: checkout\_id: Checkout session ID Returns: The checkout, with status - `add\_site`: Provision a site into a slot a plan you ALREADY PAY FOR includes. Two different things can be meant by "create a site". Buying one is the checkout flow \(create\_checkout → update → complete\). This is the other: most plans include several sites, and this uses one of them at no extra cost. site\_starter - `set\_site\_type`: Change what a site's docroot IS, without deleting anything. Types: wordpress WordPress, PHP and a database \(the default\) php PHP and a database, no WordPress php-nodb PHP, no database static-site HTML/CSS/JS only, no PHP and no database ⚠ NON-DESTRUCTIVE. Existing files stay on disk and existing dat - `get\_wallet`: The account's prepaid balance, and what THIS key may spend from it. Two ceilings, and both apply: the balance bounds the ACCOUNT, the allowance bounds this KEY within it. Plan against \`spendable\_cents\`, which is the lower of the two — a $50 balance behind a $5 allowance means $5, and planning agains - `get\_site\_status`: Get detailed status of a hosted site including resources, domains, and modules. Requires: API key with read scope. Args: slug: Site identifier \(the slug chosen during checkout\) Returns: \{"slug": "my-site", "plan": "site\_starter", "status": "active", "domains": \["my-site.borealhost.ai"\], "modules": \{ - `manage\_dns`: Create or delete DNS records for a site. Requires: API key with write scope. Args: slug: Site identifier action: "create" or "delete" record\_type: "A", "AAAA", "CNAME", "MX", "TXT", or "SRV" subdomain: Subdomain part \(e.g. "www", "mail"\). Leave empty for the apex/root domain. value: Record value. Re - `install\_app`: Install an app template on a VPS/Cloud site. Starts a background installation. Poll get\_app\_status\(\) for progress. Requires: API key with write scope. VPS or Cloud plan only. Args: slug: Site identifier template: App template slug. Available: django, laravel, nextjs, nodejs, nuxtjs, rails, static, w - `get\_app\_status`: Get app installation status and log. Poll this after install\_app\(\) to track progress. Requires: API key with read scope. Args: slug: Site identifier app\_id: App ID from install\_app\(\) response Returns: \{"id": "uuid", "app\_name": "myapp", "status": "running"\|"installing"\|"failed", "install\_log": "..." - `list\_apps`: List installed apps on a site. Requires: API key with read scope. Args: slug: Site identifier Returns: \{"apps": \[\{"id": "uuid", "app\_name": "myapp", "template\_slug": "django", "status": "running", "domain": "myapp.mysite.borealhost.ai"\}\]\} - `list\_snapshots`: List all snapshots and scheduled snapshots for a site. Requires: API key with read scope. Args: slug: Site identifier Returns: \{"snapshots": \[\{"id": "uuid", "name": "snap-...", "status": "completed", "storage\_type": "local"\|"b2", "size\_bytes": 1234, "size\_display": "1.2 Mo", "created\_at": "iso8601"\} - `create\_snapshot`: Create a local container snapshot \(async\). Runs in background — returns immediately with status "creating". Poll list\_snapshots\(\) to check when status becomes "completed" or "failed". Available for VPS, dedicated, and cloud plans \(any plan with max\_snapshots \> 0\). Local snapshots are stored on the h - `create\_b2\_snapshot`: Create a B2 cloud-backed snapshot \(zero local disk, async\). Streams container data directly to Backblaze B2 via restic. No local disk impact — billed separately at cost+5%. Runs in background — returns immediately with status "creating". Poll list\_snapshots\(\) to check when status becomes "completed" - `delete\_snapshot`: Delete a snapshot \(local or B2\). Requires: API key with write scope. Args: slug: Site identifier snapshot\_id: UUID of the snapshot to delete Returns: \{"success": true, "message": "Snapshot deleted"\} Errors: NOT\_FOUND: Snapshot not found - `rollback\_snapshot`: Rollback a site to a previous snapshot. WARNING: This is destructive. The current state of the container will be replaced with the snapshot contents. Requires: API key with admin scope. Args: slug: Site identifier snapshot\_id: UUID of the snapshot to rollback to Returns: \{"success": true, "message": - `get\_snapshot\_usage`: Get snapshot disk usage and quota info for a site. Requires: API key with read scope. Args: slug: Site identifier Returns: \{"disk\_quota\_gb": 200, "max\_snapshots": 5, "snapshot\_count": 2, "local\_snapshot\_bytes": 1234, "b2\_snapshot\_bytes": 5678, "can\_create": true\} - `schedule\_snapshot`: Schedule a snapshot for future execution. Requires: API key with write scope. Max 3 pending schedules per site. Args: slug: Site identifier scheduled\_at: ISO 8601 datetime \(must be in the future\) description: Optional description \(max 200 chars\) Returns: \{"id": "uuid", "scheduled\_at": "iso8601", "st - `cancel\_scheduled\_snapshot`: Cancel a scheduled snapshot. Requires: API key with write scope. Args: slug: Site identifier schedule\_id: UUID of the scheduled snapshot to cancel Returns: \{"success": true, "message": "Scheduled snapshot cancelled"\} Errors: NOT\_FOUND: Schedule not found or already executed - `list\_backups`: List all backups for a site \(automatic and manual\). Requires: API key with read scope. Args: slug: Site identifier Returns: \[\{"id": "uuid", "backup\_type": "auto"\|"manual", "status": "completed", "size\_bytes": 1234, "size\_display": "1.2 Mo", "timestamp": "iso8601", "notes": "..."\}\] - `create\_backup`: Create a manual backup \(runs asynchronously\). The backup starts in the background. Poll list\_backups\(\) to check status. Requires: API key with write scope. Args: slug: Site identifier Returns: \{"id": "uuid", "status": "pending", "message": "Backup started. Poll list\_backups\(\) to check status."\} - `browse\_backup`: List one bounded page of immediate children in a backup directory. This returns names and metadata only, never file contents. Use \`\`next\_cursor\`\` from the response as \`\`cursor\`\` to request the next page. Requires: API key with read scope. Args: slug: Site identifier backup\_id: UUID of a completed ba - `recover\_backup\_files`: Start a selected-file recovery and return its durable ID immediately. Existing destination paths are never replaced. The operation is asynchronous; poll \`\`get\_file\_recovery\`\` with the returned ID. Requires: API key with write scope. Args: slug: Site identifier backup\_id: UUID of a completed backup p - `get\_file\_recovery`: Poll one selected-file recovery without waiting for it to finish. Requires: API key with read scope. Args: slug: Site identifier backup\_id: UUID of the source backup recovery\_id: UUID returned by \`\`recover\_backup\_files\`\` Returns: \{"id": "uuid", "backup\_id": "uuid", "status": "running"\|"completed"\|"f - `recover\_backup\_database`: Recover exactly one absent database from a completed backup. The operation refuses an existing database and can never select \`\`all\`\`. It returns immediately; poll \`\`get\_database\_recovery\`\` with its durable ID. Requires: API key with write scope. Args: slug: Site identifier backup\_id: UUID of a compl - `get\_database\_recovery`: Poll one database recovery without waiting for completion. Requires: API key with read scope. Args: slug: Site identifier backup\_id: UUID of the source backup recovery\_id: UUID returned by \`\`recover\_backup\_database\`\` - `restore\_backup`: Restore a site from a backup. WARNING: This is destructive. The current state of the site will be replaced. Runs asynchronously — may take several minutes. Requires: API key with admin scope. Args: slug: Site identifier backup\_id: UUID of the backup to restore from Returns: \{"success": true, "messag - `get\_metrics`: Get traffic and performance metrics for a site. Requires: API key with read scope. Args: slug: Site identifier days: Number of days of history \(1–90, default: 7\) Returns: \{"requests": \[...\], "bandwidth": \[...\], "errors": \[...\], "period": \{"start": "iso8601", "end": "iso8601"\}\} Errors: NOT\_FOUND: Unk - `scale`: Change a site's hosting plan \(upgrade or downgrade\). Requires: API key with admin scope. Best practice: create a snapshot before downgrading. Args: slug: Site identifier new\_plan: Target plan slug \(e.g. "site\_pro", "site\_managed"\). Call list\_plans\(\) to see available plans. Returns: \{"success": true, - `decommission`: Delete a site and schedule resource cleanup \(7-day grace period\). WARNING: This is destructive. The site will be inaccessible immediately. After the grace period, its active service data is deleted. A final backup remains recoverable for 30 days; immutable copies may remain until their retention loc - `update\_account`: Update account profile fields \(email, language, name\). Requires: API key with write scope. Only provided \(non-empty\) fields are updated. Args: email: New email address language: Language preference — "fr" \(French\) or "en" \(English\) first\_name: First name last\_name: Last name Returns: \{"success": tru - `delete\_account`: Permanently anonymize the account. Cancels subscriptions, deactivates keys. WARNING: This is irreversible. The account will be soft-deleted and all personal data anonymized. All sites will be decommissioned. Requires: API key with admin scope. Returns: \{"success": true, "message": "Account anonymize - `list\_subscriptions`: List all subscriptions with plan details, pricing, status, and site slug. Requires: API key with read scope. Returns: \[\{"id": "uuid", "plan\_slug": "site\_starter", "plan\_name": "Starter", "status": "active", "billing\_period": "monthly", "price": \{"amount": 500, "currency": "cad"\}, "site\_slug": "my-si - `get\_billing\_portal`: Get a Stripe billing portal URL for managing payment methods and invoices. Returns a URL \(not a redirect\) that the human can open in a browser. Requires: API key with read scope. Args: flow: Optional. Set to "payment\_method\_update" to go directly to the payment method update page. Returns: \{"url": " - `rotate\_key`: Rotate an API key, optionally keeping the old key valid for up to 1,440 minutes. Creates a new key with the same name, scopes, and rate limits. The new key is returned once — store it immediately. Requires: API key with write scope. Args: key\_id: UUID of the API key to rotate \(get from whoami\(\)\) Ret - `create\_api\_key`: Create a new API key with specified scopes. Cannot create keys with higher scopes than the current key. Site-scoped keys restrict access to a single site. email\_domains restricts the key to email tools on the named domains; use email:read, email:write and optionally email:signon scopes. expires\_at i - `list\_api\_keys`: List all API keys for the account. Shows key metadata \(name, prefix, scopes, last used\) but never the full key value. Requires: API key with read scope. Returns: \[\{"id": "uuid", "name": "My Key", "prefix": "bh\_a2...", "scopes": \["read", "write"\], "is\_active": true, "created\_at": "iso8601", "last\_use - `revoke\_api\_key`: Revoke \(deactivate\) an API key. The key stops working immediately. Requires: API key with write scope. Args: key\_id: UUID of the key to revoke \(from list\_api\_keys or whoami\) Returns: \{"success": true, "message": "API key revoked"\} Errors: NOT\_FOUND: Key not found or already revoked - `get\_ssh\_info`: Get SSH connection info for a VPS/dedicated site. Only available for VPS/dedicated plans \(not shared hosting\). Requires: API key with read scope. Args: slug: Site identifier Returns: \{"host": "184.107.x.x", "port": 22, "username": "admin", "ssh\_command": "ssh admin@184.107.x.x"\} Errors: NOT\_FOUND: U - `add\_ssh\_key`: Inject your SSH public key into a site's container for direct SSH access. The key is appended to /home/admin/.ssh/authorized\_keys. Only available for VPS/dedicated plans. Requires: API key with write scope. Args: slug: Site identifier public\_key: SSH public key string. Supported types: ssh-ed25519, - `list\_files`: List files and directories in a site's container. Path scoping depends on the plan: - Shared plans: rooted at wp-content/ \(WordPress content directory\) - VPS/dedicated plans: full filesystem access Requires: API key with read scope. Args: slug: Site identifier path: Relative path to list \(empty for - `read\_file`: Read the contents of a file from a site's container. Max file size: 512KB. Binary files are rejected — use the site's file manager or SSH for binary files. Requires: API key with read scope. Args: slug: Site identifier path: Relative path to the file Returns: \{"path": "wp-config.php", "content": "\