Hostkey Cloud MCP server

Hostkey MCP Server

MCP server for Hostkey (.com portal, InvAPI invapi.hostkey.com). Runs locally over stdio — Cursor, VS Code, and other MCP clients.

Gives the model access to your Hostkey account: servers, catalog and ordering, power, OS reinstall, network, DNS, snapshots, IPMI/console, ISO, S3, Remote Hands, billing, and API keys.

For the .ru portal use the separate package hostkey-mcp-server-ru.

1. Get an API key

InvAPI → API keys → create a key.

Prefer a dedicated key for MCP. Per-server keys limit access to one server. DNS writes need the pdns/edit permission.

2. Install

Cursor

Click the button, replace YOURAPIKEY with your InvAPI key, then confirm.

Or add to .cursor/mcp.json manually:

{
  "mcpServers": {
    "hostkey-mcp-server": {
      "command": "npx",
      "args": ["-y", "hostkey-mcp-server"],
      "env": {
        "HOSTKEY_API_KEY": "your-api-key"
      }
    }
  }
}

VS Code

.vscode/mcp.json:

{
  "mcp.servers": {
    "hostkey-mcp-server": {
      "command": "npx",
      "args": ["-y", "hostkey-mcp-server"],
      "env": {
        "HOSTKEY_API_KEY": "your-api-key"
      }
    }
  }
}

Optional: HOSTKEYTOKENTTL, HOSTKEYHTTPTIMEOUT, HOSTKEYALLOWDESTRUCTIVE (see .env.example).

From source (Node.js ≥ 20): npm install && npm run build.

3. Confirming dangerous operations

Every write call needs confirm=true. Without it, nothing changes.

Also:

• orderserver defaults to dryrun — a real order only after explicit consent;
• OS reinstall, PXE, and service cancellation require HOSTKEYALLOWDESTRUCTIVE=1;
• passwords and tokens are masked in responses.

Long jobs (deploy, reinstall) return a callback key — poll with check_task.

4. Tools

Groups (full list via tools/list):

Prompts

Or just ask: “list my servers” / “order a VPS in NL”.