MCP.Market

ZynoHosting MCP server

by zyno-io·io.github.zyno-io/zynohosting·v0.4.5
No reviews yet

Manage ZynoHosting sites and create, discover, embed, and configure ZynoForms through local stdio.

B77/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B77/100

full report

Adoption
New

0 stars55 downloads/wk

Reviews

Write one

Nobody has reviewed ZynoHosting yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

ZynoHosting tools (18, 8 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • apply_deploywrite action

    Apply the exact deployment plan returned by plan_deploy.

  • apply_download

    Download and safely extract the exact snapshot authorized by plan_download.

  • create_basic_formwrite action

    Create and immediately publish a one-page form with text, textarea, email, phone, URL, hidden, number, date, select, radio, checkbox, or contact fields. Fields submit by stable key aliases; required defaults to true except for hidden URL-parameter fields. Exact origins or ZynoHosting site references may be allowed for browser JavaScript. When a page already has its own form, read it first and keep

  • delete_filewrite action

    Delete one regular hosted file, optionally guarded by its ETag.

  • describe_form

    Describe a form the way it is authored: its fields in order with their keys, types, labels, and constraints, which of them this tool can edit, and what advanced content — sections, conditions, themes, translations — it preserves but cannot change. Read this before update_form.

  • get_file

    Download one regular hosted file to the MCP process filesystem, optionally restricted by configured local roots.

  • get_form_integration

    Get live field aliases, public endpoints, an iframe, and JSON, URL-encoded, multipart, and HTML examples.

  • get_site

    Get one explicitly intended site by UUID or hostname. Do not use this to pick a likely deployment target; ask the user when the project domain is not explicit.

  • list_files

    List one directory or subtree without following symbolic links.

  • list_forms

    List the tenant’s forms with direct links and ready-to-use iframe snippets.

  • list_sites

    List sites the current credential is authorized to inspect.

  • login
  • plan_deploywrite action

    Build and store an exact deployment plan for the domain the user explicitly chose. Never guess a site from the project or select a similar authorized domain. This does not change the hosted site.

  • plan_download

    Authorize a deployable-only or sensitive full snapshot into a local destination, optionally restricted by configured roots.

  • put_filewrite action

    Create or replace one regular hosted file from the MCP process filesystem, optionally restricted by configured local roots.

  • update_formwrite action

    Change a form’s name, link, heading, submit label, success message, or notification emails, and add, update, move, or remove fields addressed by key. Call describe_form first; it reports what is editable, what is locked, and whether an unpublished draft is blocking the edit. Untouched fields keep their identity, and content this vocabulary cannot express is preserved. Publishes a new version by de

  • update_form_bot_protectionwrite action

    Idempotently set Cap.js protection to an interactive widget, an invisible programmatic solve, or disabled for legacy submissions. A request that already matches skips the update call.

  • update_form_originswrite action

    Idempotently add or remove exact HTTP(S) origins. Site references expand to the site’s primary, alias, and vanity HTTPS hostnames.

Public scan report

scanner v0.1.9 · 2026-09-24 · same rubric, same numbers if you re-run it

no findings
  • Code scan76 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 50 days ago12/15
  • Maintainer identityregistry namespace matches repository owner7/10
Overall 77/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How ZynoHosting compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
77/100
higher than 50% of 48,255 servers
Tools
18
the typical server has 7
Tools that change things
44%
typical: 0%. Fewer write tools means less an agent can break
Downloads a week
55
more than 46% of 12,191 servers with a package

What its tools let an agent do: 9 read · 1 create · 5 change · 1 delete · 2 run or deploy

Install ZynoHosting in Claude Code, Cursor or VS Code

Runs npx -y @zyno-io/zynohosting on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add zynohosting -- npx -y @zyno-io/zynohosting
Add to Cursor

What the publisher says

From the ZynoHosting repository's README, as published. We do not edit it. Read it on GitHub

ZynoHosting CLI and MCP server

@zyno-io/zynohosting is the public command-line and local MCP client for ZynoHosting. It can:

  • list sites authorized for the current tenant credential;
  • inspect, download, upload, and delete individual files;
  • preview and apply complete manifest-driven deployments;
  • download a complete deployable snapshot or, with the extra permission, all user content;
  • discover, create, inspect, edit, embed, and configure published ZynoForms;
  • expose the same operations to agents through a local stdio MCP server.

The package requires Node.js 24.

Full CLI and MCP documentation is available at zyno-io.github.io/zynohosting-cli.

Install

npm install --global @zyno-io/zynohosting
zynohosting --help

It installs two executables:

  • zynohosting — the human and CI command-line interface;
  • zynohosting-mcp — the local stdio MCP server.

You can also run commands without a global install:

npx -y @zyno-io/zynohosting sites list

Authenticate

For an interactive user:

zynohosting login --permission hosting.sitesRead
zynohosting login \
  --name "Claude MCP — work laptop" \
  --permission hosting.sitesRead \
  --permission hosting.deploy \
  --permission forms.create \
  --permission forms.edit \
  --renewable

Browser login creates a tenant-bound scoped CLI token. hosting.sitesRead is requested when no --permission is supplied; repeat the option to request the narrowest complete set for your workflow. Access tokens always expire after 60 minutes. --renewable stores the rotating renewal credential in the operating system credential store and lets long-running CLI/MCP processes refresh automatically. While MCP remains alive, it renews in the background even when no tools are being called; each request also checks freshness as a backstop. The renewal secret is never written to the JSON config file.

Revoke the saved scoped grant and remove its local credentials with zynohosting logout.

For CI or another non-interactive environment, inject a tenant API key:

export ZYNOHOSTING_API_KEY='...'

The CLI also accepts --environment production|alpha|dev and --api-url. Credentials are resolved in this order:

  1. command options;
  2. environment variables;
  3. the saved login file.

Relevant environment variables are:

  • ZYNOHOSTINGAPIKEY
  • ZYNOHOSTINGACCESSTOKEN
  • ZYNOHOSTINGTENANTID
  • ZYNOHOSTINGTOKENEXPIRES_AT
  • ZYNOHOSTINGAPIURL
  • ZYNOSUITEAPI_URL
  • ZYNOAUTHAPI_URL
  • ZYNOHOSTING_ENVIRONMENT
  • ZYNOHOSTING_CONFIG
  • ZYNOHOSTINGLOGINURL

Sites

zynohosting sites list
zynohosting sites get example.com
zynohosting sites get 11111111-1111-4111-8111-111111111111 --json

A site may be addressed by its UUID, primary hostname, vanity hostname, or authorized alias.

Individual files

Remote paths are relative to the site document root. Absolute paths, .., control characters, backslashes, and symbolic-link traversal are rejected.

zynohosting files list example.com
zynohosting files list example.com wp-content/themes --recursive

zynohosting files get example.com index.html --output ./index.html
zynohosting files put example.com ./index.html index.html
zynohosting files rm example.com obsolete.html --yes

Use ETags to prevent overwriting a file that changed since it was inspected:

zynohosting files put example.com ./index.html index.html --etag '"etag-from-list"'
zynohosting files rm example.com obsolete.html --etag '"etag-from-list"' --yes

Use --create to require that an uploaded path does not already exist.

Full deployment

zynohosting deploy example.com ./dist
zynohosting deploy example.com ./dist --dry-run
zynohosting deploy example.com ./dist --yes

Deployment is always planned before it is applied. The client and node agent:

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

ZynoHosting: common questions

Is ZynoHosting MCP server safe?
Mostly: it is graded B (77/100). Read the ZynoHosting safety report
How do I install ZynoHosting?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does ZynoHosting need an API key?
Yes. The registry entry asks for ZYNOHOSTING_API_KEY.
Is ZynoHosting maintained?
The last commit was 92 days ago (2026-08-04). The latest release is v0.4.5.
How does ZynoHosting compare with other MCP servers?
safety score 77/100 (higher than 50% of 48,255 servers); tools 18 (the typical server has 7); tools that change things 44% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.