MCP.Market

Websupport MCP server

by tydung26·io.github.tydung26/websupport-mcp·v0.1.1·1 stars
No reviews yet

Manage a Websupport account: DNS, FTP, hosting, databases, mailboxes, VPS and invoices.

B83/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B83/100

full report

Adoption
Growing

1 stars39 downloads/wk

Reviews

Write one

Nobody has reviewed Websupport yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Websupport tools (50, 15 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • ws_auth_check

    Verify that the configured Websupport API key and secret authenticate successfully. Returns {verified: true} on success. Use this first when diagnosing 401 errors.

  • ws_db_createwrite action

    Create a database on a hosting service. …

  • ws_db_deletewrite action

    Permanently delete a database and everything stored in it. The data is destroyed immediately and cannot be recovered from this API — restore from your own backup or it is gone. Any application still pointing at this database will start failing.

  • ws_db_get

    Get one database by id, including its name, type and connection details.

  • ws_db_list

    List the databases on a hosting service.

  • ws_db_stats

    Usage statistics for one database. `kind` selects the series: size (storage used) or cpu (query load).

  • ws_db_updatewrite action

    Update a database. Only the supplied fields are sent. …

  • ws_db_users_list

    List the database users on a hosting service.

  • ws_dns_record_createwrite action

    Create a DNS record in a service zone. The API returns 204 with no body, so this tool re-lists the record it just wrote and returns that — `record` is null if the re-list found nothing.

  • ws_dns_record_deletewrite action

    Permanently delete a DNS record by id. The record and its resolution are lost immediately and cannot be recovered — recreate it manually if deleted in error.

  • ws_dns_record_list

    List DNS records in a service zone, with paging and server-side filtering. Returns the API pagination envelope unflattened.

  • ws_dns_record_updatewrite action

    Update a DNS record by id. Only the supplied fields are sent. The API returns 204 with no body.

  • ws_dns_zone_get

    Get the DNS zone attached to a service.

  • ws_domain_assign

    Assign a domain to a hosting service, optionally installing WordPress. Unlike the other v2 mutations this one returns a body rather than 204.

  • ws_dyndns_updatewrite action

    Best-effort Dynamic DNS update via the standard /nic/update endpoint. Returns the raw text response, not JSON. This endpoint authenticates differently from the rest of the API (no date header) and its behaviour with a Standard API key is unverified — prefer ws_dns_record_update for reliable record changes.

  • ws_ftp_account_createwrite action

    Create an FTP account. The API returns 204 with no body, so this tool re-lists by login and returns the created account — without its password, which the API never echoes back.

  • ws_ftp_account_deletewrite action

    Permanently delete an FTP account. Any client or deployment pipeline authenticating with these credentials loses access immediately. The account cannot be restored — it must be recreated with a new password.

  • ws_ftp_account_get

    Get one FTP account by id. The password is never returned.

  • ws_ftp_account_list

    List FTP accounts on a hosting service. Passwords are never returned — the API response schema has no password field.

  • ws_ftp_account_updatewrite action

    Update an FTP account by id. Only the supplied fields are sent. Supplying `password` rotates it. The API returns 204 with no body.

  • ws_hosting_get

    Get one hosting service by id or uuid, including its package, limits and current usage.

  • ws_hosting_list

    List the hosting services on the account.

  • ws_hosting_stats

    Usage statistics for a hosting service. `kind` selects the series: size (disk usage), domain (per-domain traffic), or ftp (FTP activity).

  • ws_hosting_vhost_get

    Get one virtual host by id, including its document root and domain configuration.

  • ws_hosting_vhost_list

    List the virtual hosts (domains) served by a hosting service.

  • ws_invoice_get

    Get one invoice by id, including line items, totals and payment status. Use ws_invoice_pdf for the document itself.

  • ws_invoice_list

    List the account's invoices with their amounts, dates and payment status. Paying an invoice is deliberately out of scope for this server.

  • ws_invoice_pdf

    Fetch an invoice as a PDF. `base64` returns the document encoded for a caller that will decode and save it. `binary` reports the size and type only — raw PDF bytes are never inlined into a tool result, because they would flood the conversation without being usable.

  • ws_mail_stats

    Mail storage statistics for a hosting service. Supply `domain` to scope the figures to one domain; omit it for the whole service.

  • ws_mailbox_createwrite action

    Create a mailbox on a domain. Note the domain-rooted path: the domain id comes from ws_hosting_vhost_list. …

  • ws_mailbox_deletewrite action

    Permanently delete a mailbox and every message stored in it. Mail already delivered is destroyed and cannot be recovered, and messages sent to the address afterwards will bounce.

  • ws_mailbox_get

    Get one mailbox by id, including its address, quota and forwarding configuration.

  • ws_mailbox_list

    List the mailboxes on a hosting service.

  • ws_mailbox_updatewrite action

    Update a mailbox. This endpoint takes POST rather than PUT — a documented v1 quirk, not a mistake. …

  • ws_service_get

    Get one service by id, including its type, status and expiry. Use ws_service_list first to find the id.

  • ws_service_list

    List the account's services (hosting, domains, VPS and so on). Returns the v1 envelope {items, pager}. Service ids from here are the candidates for the v2 tools' `service` argument.

  • ws_service_set_auto_extend

    Turn automatic renewal on or off for a service. Switching it off means the service will expire at the end of its current term unless renewed manually — for a domain or hosting package that eventually means it stops working. Only the autoExtend flag is sent; no other service property is touched.

  • ws_user_get

    Get the account record: id, contact details, billing profiles, market and currency. SENSITIVE — the response includes the billing address, email address, phone number, and a verifyUrl containing a live account-verification key. Do not echo the full response to the user or store it; read the specific field needed.

  • ws_vps_get

    Get one VPS by id or name, including its specification, IP addresses and power state.

  • ws_vps_hard_reboot

    Force a VPS to power-cycle without letting the guest shut down. Equivalent to pulling the power cable: writes still in flight are lost and filesystems or databases can be left corrupted. Use ws_vps_reboot unless the machine is already unresponsive.

  • ws_vps_list

    List the VPS instances on the account.

  • ws_vps_reboot

    Gracefully reboot a VPS. The guest operating system is asked to shut down cleanly first, so running services stop in an orderly way. The machine is unreachable while it restarts.

  • ws_vps_snapshot_createwrite action

    Take a snapshot of a VPS disk, so its current state can be restored later. Snapshots consume storage against the account.

  • ws_vps_snapshot_deletewrite action

    Permanently delete a VPS snapshot. The recovery point is destroyed and the disk state it held can no longer be restored. The running VPS is unaffected.

  • ws_vps_snapshot_list

    List the snapshots taken of a VPS, with their names and creation times.

  • ws_vps_snapshot_restore

    Overwrite the VPS disk with the named snapshot. All data written since that snapshot was taken is permanently lost — databases, uploads, logs and configuration changes alike. There is no undo. Take a fresh snapshot first if the current state matters at all.

  • ws_vps_stats

    Usage statistics for a VPS. `kind` selects the series: cpu (processor load) or traffic (network transfer).

  • ws_vps_vnc

    Get VNC console access details for a VPS. SENSITIVE — the response may carry a one-time console URL or session credential that grants direct machine access. Hand it to the user who asked for it and nothing else: do not log it, do not repeat it in a summary, and treat it as expiring.

  • ws_zone_get

    Get one DNS zone by domain name.

  • ws_zone_list

    List the DNS zones on the account. For the records inside a zone use the v2 tool ws_dns_record_list — v1 record CRUD is deprecated and deliberately not exposed.

Public scan report

scanner v0.1.10 · 2026-10-31 · same rubric, same numbers if you re-run it

no findings
  • Code scan2 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 0 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 83/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Websupport compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
83/100
higher than 65% of 48,255 servers
Tools
50
the typical server has 7
Tools that change things
30%
typical: 0%. Fewer write tools means less an agent can break
GitHub stars
1
more than 65% of 28,688 servers
Downloads a week
39
more than 30% of 12,191 servers with a package

What its tools let an agent do: 35 read · 15 change

Install Websupport in Claude Code, Cursor or VS Code

Runs npx -y websupport-mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add websupport-mcp -- npx -y websupport-mcp
Add to Cursor

What the publisher says

From the Websupport repository's README, as published. We do not edit it. Read it on GitHub

websupport-mcp

An MCP server (TypeScript, ESM, stdio) wrapping the Websupport REST API v1 + v2 — DNS, FTP, hosting, databases, mailboxes, VPS and invoices — exposed as MCP tools with signed HMAC-SHA1 authentication.

Status: early. All 50 tools are implemented and published, but most have been verified only as far as reaching the API — routes, signing and error handling are proven; response shapes largely are not. Read docs/verification-matrix.md before relying on any tool, and see IMPLEMENTATION_PLAN.md for progress.

Risk tiers

Tools are registered in three tiers, and the tier gates registration — a read-only deployment never sees a write tool in tools/list at all, so it costs no client context and offers no affordance.

A tool is destructive when it destroys state you cannot cheaply recreate — not merely because it writes. A graceful VPS reboot is write; a hard power-cycle is destructive, because it can corrupt in-flight writes. Taking a snapshot is write; restoring one is destructive, because it discards everything since.

The two opt-ins are independent: WEBSUPPORTALLOWDESTRUCTIVE=1 alone does not unlock write tools, and vice versa.

The confirm: true argument, not MCP elicitation, is the safety boundary. Protocol negotiation may settle well below the revision that supports elicitation — this server's SDK currently tops out at 2025-11-25 — and a gate that disappears against an older client is not a gate.

Install

Requires Node >= 22. Nothing to install ahead of time — npx fetches the package on first run.

Add this to your MCP client's configuration:

{
  "mcpServers": {
    "websupport": {
      "command": "npx",
      "args": ["-y", "websupport-mcp"],
      "env": {
        "WEBSUPPORT_API_KEY": "…",
        "WEBSUPPORT_API_SECRET": "…"
      }
    }
  }
}

That gives you the 30 read-only tools. Nothing in that configuration can change your account.

To allow changes, add only the opt-ins you need — see Risk tiers above:

"env": {
  "WEBSUPPORT_API_KEY": "…",
  "WEBSUPPORT_API_SECRET": "…",
  "WEBSUPPORT_ALLOW_WRITE": "1",
  "WEBSUPPORT_ALLOW_DESTRUCTIVE": "1"
}

Ready-made configurations for each combination live in examples/mcp-config/. Pin a version with websupport-mcp@0.1.1 in place of websupport-mcp.

Once it is wired up, ask your client to run wsauthcheck. It returns {"verified": true} when the credentials work, which is the quickest way to separate a bad key from anything else.

Docker

A Dockerfile is included, for hosts that run containers rather than npx and for registry build sandboxes:

docker build -t websupport-mcp .
docker run -i --rm -e WEBSUPPORT_API_KEY -e WEBSUPPORT_API_SECRET websupport-mcp

-i is not optional — the transport is stdio. No credentials are baked into the image; pass them per run.

From a local checkout

For development, or to run unreleased changes:

npm install
npm run build

Then point command at node and args at the built entrypoint (/dist/index.js) instead of npx.

Credentials

Generate a Standard API access pair in WebAdmin (Security → API keys). A DynDNS-only pair authenticates against /nic/update and nothing else.

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Websupport: common questions

Is Websupport MCP server safe?
Mostly: it is graded B (83/100). Read the Websupport safety report
How do I install Websupport?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Websupport need an API key?
Yes. The registry entry asks for WEBSUPPORT_API_SECRET.
Is Websupport maintained?
The last commit was 4 days ago (2026-10-31). The latest release is v0.1.1.
How does Websupport compare with other MCP servers?
safety score 83/100 (higher than 65% of 48,255 servers); tools 50 (the typical server has 7); tools that change things 30% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.