MCP Server

What hostkey-cloud/mcp-server does

hostkey-cloud/mcp-server gives an MCP-compatible agent access to a Hostkey account through the InvAPI. Its toolset covers infrastructure management and related account functions, including:

• Listing servers, hardware presets, operating systems, and traffic plans
• Reading power state and starting or stopping servers
• Ordering servers and reinstalling operating systems
• Managing PXE workflows, network ports, reverse DNS, DNS zones, and records
• Working with VM snapshots, ISO images, S3 buckets, and objects
• Opening and managing Remote Hands duty-shift requests
• Reading invoices, payments, and billing contacts
• Checking asynchronous tasks and invoking the API through call_api_raw

The server also provides prompts for guided server ordering, OS reinstalls, and troubleshooting. These can be used alongside direct requests such as listing servers or ordering a VPS in the Netherlands.

How it works

The local deployment communicates with an MCP client over standard input and output. It sends requests to the fixed InvAPI endpoint, https://invapi.hostkey.com, using the HOSTKEY_API_KEY environment variable for authentication. A dedicated InvAPI key is recommended, and a key restricted to an individual server can limit the accessible account scope. DNS changes require the pdns/edit permission.

A hosted deployment is available at https://mcp.hostkey.com/mcp. Cloud agents can connect to that URL and pass the InvAPI key as a Bearer token instead of running Node.js or npx locally.

Long-running operations, such as deployments and reinstalls, return a callback key. The check_task tool can poll the operation. Sensitive passwords and tokens are masked in tool responses.

Setup and configuration

Create an API key in InvAPI under API keys before configuring a client. For a local setup, run the package with npx and provide the key in the client’s environment configuration. Cursor and VS Code configurations use the hostkey-mcp-server command with the package name hostkey-mcp-server.

The hosted configuration uses the MCP URL and an Authorization header in this form:

{
  "url": "https://mcp.hostkey.com/mcp",
  "headers": {
    "Authorization": "Bearer your-api-key"
  }
}

Optional settings include HOSTKEY_TOKEN_TTL, HOSTKEY_HTTP_TIMEOUT, and HOSTKEY_ALLOW_DESTRUCTIVE. Building from source requires Node.js 22.18 or newer, followed by npm install and npm run build.

Tools and capabilities

The tools are grouped around the Hostkey account rather than a separate local datastore. Representative names include get_servers, get_server, get_power_status, list_presets, list_os, power_on, power_off, order_server, and reinstall_server.

PXE operations follow a multi-step workflow that can begin with create_reinstall_task and finish with clear_pxe_config. Other groups handle ports, PTR records, DNS zones and records, snapshots, ISOs, S3, Remote Hands requests, invoices, payments, contacts, and API keys. The complete tool inventory can be retrieved through MCP’s tools/list operation.

Limitations and notes

Every write operation requires confirm=true; without that value, the request makes no change. order_server starts in dry-run mode, so a real order requires explicit consent. OS reinstalls, PXE actions, and service cancellations additionally require HOSTKEY_ALLOW_DESTRUCTIVE=1.

API access is limited by the permissions and scope of the supplied InvAPI key. The local server targets the hardcoded InvAPI endpoint, while remote use depends on the hosted MCP endpoint. Operations that run for an extended time must be monitored through their returned callback key.