Loading…
Quebec-based agent-native web hosting for deploying sites, managing DNS, registering domains, and scaling infrastructure.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 7 days ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The BorealHost MCP server exposes 144 tools, focused primarily on network, communication, and filesystem capabilities. Its published description reads: "Quebec-based agent-native web hosting for deploying sites, managing DNS, registering domains, and scaling infrastructure". It communicates over Streamable HTTP using the 2025-06-18 protocol revision, and does not require authorization to connect. MCPGrade currently rates BorealHost F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Hidden instructions in a tool description" and "Cross-tool shadowing". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check BorealHost's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add BorealHost to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://borealhost.ai/mcp/Streamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
Register a new agent account and get an API key. No authentication needed. The returned API key grants read+write access to all BorealHost API endpoints. Store it securely — it cannot be retrieved aga
Set your BorealHost API key for this session. Call this if you already have an API key (from a previous registration, checkout completion, or the BorealHost panel). All subsequent tool calls will use
Check the current API key's account info, scopes, and site count. Requires: BOREALHOST_API_KEY env var (read scope). Returns: {"user": {"id": "uuid", "email": "...", "date_joined": "iso8601"}, "api_ke
Request an API key for a site you are running on (challenge-response). This starts a two-step verification flow: 1. A claim token is written to your container at ~/.borealhost/.claim_token (mode 600,
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: complete_checkout
A tool description contains imperative text aimed at the model (e.g. "ignore previous", "before answering read …").
.ai/pay/<id>/?s=<secret>", "stripe_checkout_url": "https://checkoutRecommendationRemove model-directed instructions from tool descriptions.
tool: set_api_key
A tool description tries to alter the model’s use of another tool.
call this after register() — the key is set automatically. Args: apRecommendationDescriptions must describe only their own tool.
tool: set_api_key
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "api_key"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: request_api_key
A tool description tries to alter the model’s use of another tool.
t file and call claim_api_key(token) within 1 hour This proves you have acceRecommendationDescriptions must describe only their own tool.
tool: claim_api_key
A tool description tries to alter the model’s use of another tool.
After calling request_api_key(), read the claim token from ~/.borealhost/.claRecommendationDescriptions must describe only their own tool.
tool: create_checkout
A tool description tries to alter the model’s use of another tool.
. Call list_plans() to discover all available plan slugs. ReturnRecommendationDescriptions must describe only their own tool.
tool: update_checkout
A tool description tries to alter the model’s use of another tool.
session ID from create_checkout buyer_email: Optional email — if omitted, aRecommendationDescriptions must describe only their own tool.
tool: complete_checkout
A tool description tries to alter the model’s use of another tool.
302. Then poll get_checkout_status() until status becomes "completed". The API kRecommendationDescriptions must describe only their own tool.
tool: get_checkout_status
A tool description tries to alter the model’s use of another tool.
Call this after complete_checkout to track payment and provisioning. Polling strRecommendationDescriptions must describe only their own tool.
tool: manage_dns
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
ite. Requires: API key with write scope. Args: slug: Site identifRecommendationRemove side-channel parameters; constrain tool inputs.
tool: install_app
A tool description tries to alter the model’s use of another tool.
ain override (default: {app_name}.{site_domain}) display_name: HumanRecommendationDescriptions must describe only their own tool.
tool: get_app_status
A tool description tries to alter the model’s use of another tool.
Poll this after install_app() to track progress. Requires: API key with reRecommendationDescriptions must describe only their own tool.
tool: create_snapshot
A tool description tries to alter the model’s use of another tool.
creating". Poll list_snapshots() to check when status becomes "completed" or "RecommendationDescriptions must describe only their own tool.
tool: create_b2_snapshot
A tool description tries to alter the model’s use of another tool.
creating". Poll list_snapshots() to check when status becomes "completed". OnlRecommendationDescriptions must describe only their own tool.
tool: create_backup
A tool description tries to alter the model’s use of another tool.
ackground. Poll list_backups() to check status. Requires: API key with writRecommendationDescriptions must describe only their own tool.
tool: scale
A tool description tries to alter the model’s use of another tool.
Call list_plans() to see available plans. Returns: {"succeRecommendationDescriptions must describe only their own tool.
tool: rotate_key
A tool description tries to alter the model’s use of another tool.
otate (get from whoami()) Returns: {"api_key": "bh_...", "key_id"RecommendationDescriptions must describe only their own tool.
tool: revoke_api_key
A tool description tries to alter the model’s use of another tool.
ist_api_keys or whoami) Returns: {"success": true, "message": "APRecommendationDescriptions must describe only their own tool.
tool: list_files
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
cess Requires: API key with read scope. Args: slug: Site identifiRecommendationRemove side-channel parameters; constrain tool inputs.
tool: write_file
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
e_file Write or overwrite a text file in a site's container. Creates parent directorRecommendationAnnotate destructive tools and require human approval.
tool: upload_file
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
e(). Requires: API key with write scope. Args: slug: Site identifRecommendationRemove side-channel parameters; constrain tool inputs.
tool: upload_file
A tool description tries to alter the model’s use of another tool.
t files, prefer write_file(). Requires: API key with write scope. Args:RecommendationDescriptions must describe only their own tool.
tool: delete_file
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
delete_file Delete a file or directory from a site's container. Directories are deletRecommendationAnnotate destructive tools and require human approval.
tool: create_directory
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
ist. Requires: API key with write scope. Args: slug: Site identifRecommendationRemove side-channel parameters; constrain tool inputs.
tool: delete_cron
A tool description tries to alter the model’s use of another tool.
ne numbers from list_cron(). Requires: API key with write scope. Args:RecommendationDescriptions must describe only their own tool.
tool: execute_query
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
execute_query Execute a SQL query on a site's database. Supports SELECT, INSERT,RecommendationAnnotate destructive tools and require human approval.
tool: execute_query
A database tool exposes a query/sql parameter that is a free-form string with no allow-list or parameterisation constraint — a raw-string injection surface. A tool exposing structured filters or an `enum` of named queries does not fire.
unconstrained query parameter "query"RecommendationExpose parameterised operations instead of a raw query string; never build queries from unvalidated model output.
tool: create_ftp_account
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "password"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: create_alert_rule
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
ite. Requires: API key with write scope. Args: slug: Site identifRecommendationRemove side-channel parameters; constrain tool inputs.
tool: run_malware_scan
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
"/var/www/html/shell.php", "threat": "Php.Malware.Agent"}], "scRecommendationAnnotate destructive tools and require human approval.
tool: register_domain
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
ain. Requires: API key with write scope. Args: domain: Full domaiRecommendationRemove side-channel parameters; constrain tool inputs.
tool: register_domain
A tool description tries to alter the model’s use of another tool.
Register a new domain with WHOIS contact info and StripeRecommendationDescriptions must describe only their own tool.
tool: add_subdomain
A tool description tries to alter the model’s use of another tool.
to a site (see link_domain). Idempotent: if the DNS record already existsRecommendationDescriptions must describe only their own tool.
tool: link_domain
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
ing. Requires: API key with write scope. Args: domain_name: FullRecommendationRemove side-channel parameters; constrain tool inputs.
tool: set_domain_usage
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
sa). Requires: API key with write scope. Args: domain_name: FullRecommendationRemove side-channel parameters; constrain tool inputs.
tool: list_domain_dns
A tool description tries to alter the model’s use of another tool.
t of site-level manage_dns). Use this for domains that may not be linked tRecommendationDescriptions must describe only their own tool.
tool: delete_domain_dns
A tool description tries to alter the model’s use of another tool.
to delete (from list_domain_dns) Returns: {"success": true, "message": "DNRecommendationDescriptions must describe only their own tool.
tool: list_compute_types
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
ts). Requires: API key with read scope. Returns: {"region": "ca-cRecommendationRemove side-channel parameters; constrain tool inputs.
tool: launch_compute_instance
A tool description tries to alter the model’s use of another tool.
ance_type: From list_compute_types, e.g. "lsw.c3.large" image_id: From list_coRecommendationDescriptions must describe only their own tool.
tool: list_compute_instances
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
end. Requires: API key with read scope. Returns: {"instances": [.RecommendationRemove side-channel parameters; constrain tool inputs.
tool: get_compute_instance
A tool description tries to alter the model’s use of another tool.
tance UUID from launch_compute_instance / list Returns: {"id", "state", "public_ipRecommendationDescriptions must describe only their own tool.
tool: stop_compute_instance
A tool description tries to alter the model’s use of another tool.
e stopped. Use terminate_compute_instance to stop the charges permanently. Requires: APIRecommendationDescriptions must describe only their own tool.
tool: terminate_compute_instance
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
ing. Requires: API key with write scope. Returns: Final instanceRecommendationRemove side-channel parameters; constrain tool inputs.
tool: get_compute_volume
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
ost. Requires: API key with read scope. Returns: Volume dict plusRecommendationRemove side-channel parameters; constrain tool inputs.
tool: create_compute_volume
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
rge. Requires: API key with write scope, and an active subscription.RecommendationRemove side-channel parameters; constrain tool inputs.
tool: create_compute_volume
A tool description tries to alter the model’s use of another tool.
ance_type: From list_compute_types, e.g. "lsw.g6.xlarge". CAN cRecommendationDescriptions must describe only their own tool.
tool: detach_compute_volume
A tool description tries to alter the model’s use of another tool.
nd worker. Poll get_compute_volume until state is "detached" (done) or "error" (faRecommendationDescriptions must describe only their own tool.
tool: attach_compute_volume
A tool description tries to alter the model’s use of another tool.
is ready. Poll get_compute_volume and give it a few minutes (measured: ~6 min forRecommendationDescriptions must describe only their own tool.
tool: snapshot_compute_volume
A tool description tries to alter the model’s use of another tool.
shotting"; poll get_compute_volume until it is back to "attached" (done) or "errorRecommendationDescriptions must describe only their own tool.
tool: delete_compute_volume
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
lex. Requires: API key with admin scope. Returns: {"id", "state":RecommendationRemove side-channel parameters; constrain tool inputs.
tool: get_support_ticket
A tool description tries to alter the model’s use of another tool.
icket UUID from list_support_tickets Returns: {"id", "subject", "status", "messRecommendationDescriptions must describe only their own tool.
tool: create_support_ticket
A tool description tries to alter the model’s use of another tool.
y ticket — poll get_support_ticket for updates. Requires: API key with write scopRecommendationDescriptions must describe only their own tool.
tool: add_redirect
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "target_url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: manage_db_user
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "password"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: create_mailbox
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "password"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: reset_mailbox_password
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "new_password"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: create_webhook
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: create_webhook
A tool description tries to alter the model’s use of another tool.
Register a webhook endpoint for platform events. EventsRecommendationDescriptions must describe only their own tool.
tool: delete_webhook
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "endpoint_id"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: test_webhook
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
tus. Requires: API key with write scope. Returns: {"id", "messageRecommendationRemove side-channel parameters; constrain tool inputs.
tool: test_webhook
A tool description tries to alter the model’s use of another tool.
(async). Poll list_webhooks afterwards for last_status. Requires: API keyRecommendationDescriptions must describe only their own tool.
tool: enable_smtp_relay
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
mail-send-only credential on the platform relay and configures SPF/DKIM DRecommendationRemove side-channel parameters; constrain tool inputs.
tool: (server instructions)
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
entication - **API key format:** `bh_<48 hex chars>` — pass as `AuthorRecommendationRemove side-channel parameters; constrain tool inputs.
tool: (server instructions)
A tool description tries to alter the model’s use of another tool.
es, manage DNS, register domains, and scale infrastructure — entirely thRecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: register
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "register"RecommendationScope tools to the minimum needed.
tool: set_api_key
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "set_api_key"RecommendationScope tools to the minimum needed.
tool: whoami
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "whoami"RecommendationScope tools to the minimum needed.
tool: request_api_key
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
e container) 2. Read that file and call claim_api_key(token) within 1 hour ThRecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: claim_api_key
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "claim_api_key"RecommendationScope tools to the minimum needed.
tool: claim_api_key
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
im token string read from the container file Returns: {"api_key": "bh_...", "key_prefixRecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: create_checkout
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "create_checkout"RecommendationScope tools to the minimum needed.
tool: update_checkout
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "update_checkout"RecommendationScope tools to the minimum needed.
tool: get_checkout_status
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "get_checkout_status"RecommendationScope tools to the minimum needed.
tool: manage_dns
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "manage_dns"RecommendationScope tools to the minimum needed.
tool: install_app
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "install_app"RecommendationScope tools to the minimum needed.
tool: create_snapshot
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "create_snapshot"RecommendationScope tools to the minimum needed.
tool: create_b2_snapshot
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "create_b2_snapshot"RecommendationScope tools to the minimum needed.
tool: delete_snapshot
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "delete_snapshot"RecommendationScope tools to the minimum needed.
tool: schedule_snapshot
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "schedule_snapshot"RecommendationScope tools to the minimum needed.
tool: cancel_scheduled_snapshot
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "cancel_scheduled_snapshot"RecommendationScope tools to the minimum needed.
tool: create_backup
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "create_backup"RecommendationScope tools to the minimum needed.
tool: scale
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "scale"RecommendationScope tools to the minimum needed.
tool: decommission
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "decommission"RecommendationScope tools to the minimum needed.
tool: update_account
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "update_account"RecommendationScope tools to the minimum needed.
tool: get_billing_portal
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "get_billing_portal"RecommendationScope tools to the minimum needed.
tool: get_billing_portal
The description pairs a fetch imperative with a hardcoded external URL, letting the server relocate its real instructions off-metadata and mutate them after review. Fires only when a fetch verb and a URL co-occur, so benign documentation links do not.
s: {"url": "https://billing.stripe.com/p/session/..."}RecommendationDo not direct the model to fetch and act on external URLs; treat linked content as untrusted.
tool: rotate_key
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "rotate_key"RecommendationScope tools to the minimum needed.
tool: create_api_key
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "create_api_key"RecommendationScope tools to the minimum needed.
tool: list_api_keys
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "list_api_keys"RecommendationScope tools to the minimum needed.
tool: revoke_api_key
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "revoke_api_key"RecommendationScope tools to the minimum needed.
tool: add_ssh_key
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "add_ssh_key"RecommendationScope tools to the minimum needed.
tool: list_files
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "list_files"RecommendationScope tools to the minimum needed.
tool: list_files
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
list_files List files and directories in a site's container. Path scoping depends onRecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: list_files
A filesystem tool exposes a path parameter that is a free-form string with no pattern/enum/format constraint, so it accepts absolute paths and "../" traversal. A tool that constrains its path (a rooted `pattern` or an `enum`) does not fire.
unconstrained path parameter "path"RecommendationConstrain the path parameter to a rooted allow-list and reject absolute/traversal paths server-side.
tool: read_file
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
read_file Read the contents of a file from a site's container. Max file size: 512KB.RecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: read_file
A filesystem tool exposes a path parameter that is a free-form string with no pattern/enum/format constraint, so it accepts absolute paths and "../" traversal. A tool that constrains its path (a rooted `pattern` or an `enum`) does not fire.
unconstrained path parameter "path"RecommendationConstrain the path parameter to a rooted allow-list and reject absolute/traversal paths server-side.
tool: write_file
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "write_file"RecommendationScope tools to the minimum needed.
tool: write_file
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
write_file Write or overwrite a text file in a site's container. Creates parent directorRecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: write_file
A filesystem tool exposes a path parameter that is a free-form string with no pattern/enum/format constraint, so it accepts absolute paths and "../" traversal. A tool that constrains its path (a rooted `pattern` or an `enum`) does not fire.
unconstrained path parameter "path"RecommendationConstrain the path parameter to a rooted allow-list and reject absolute/traversal paths server-side.
tool: upload_file
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "upload_file"RecommendationScope tools to the minimum needed.
tool: delete_file
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "delete_file"RecommendationScope tools to the minimum needed.
tool: delete_file
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
delete_file Delete a file or directory from a site's container. Directories are deletRecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: delete_file
A filesystem tool exposes a path parameter that is a free-form string with no pattern/enum/format constraint, so it accepts absolute paths and "../" traversal. A tool that constrains its path (a rooted `pattern` or an `enum`) does not fire.
unconstrained path parameter "path"RecommendationConstrain the path parameter to a rooted allow-list and reject absolute/traversal paths server-side.
tool: create_directory
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "create_directory"RecommendationScope tools to the minimum needed.
tool: create_directory
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
reate_directory Create a directory in a site's container. Creates parent directorRecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: create_directory
A filesystem tool exposes a path parameter that is a free-form string with no pattern/enum/format constraint, so it accepts absolute paths and "../" traversal. A tool that constrains its path (a rooted `pattern` or an `enum`) does not fire.
unconstrained path parameter "path"RecommendationConstrain the path parameter to a rooted allow-list and reject absolute/traversal paths server-side.
tool: manage_plugin
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "manage_plugin"RecommendationScope tools to the minimum needed.
tool: manage_theme
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "manage_theme"RecommendationScope tools to the minimum needed.
tool: wp_check_updates
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "wp_check_updates"RecommendationScope tools to the minimum needed.
tool: wp_update_all
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "wp_update_all"RecommendationScope tools to the minimum needed.
tool: add_cron
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "add_cron"RecommendationScope tools to the minimum needed.
tool: delete_cron
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "delete_cron"RecommendationScope tools to the minimum needed.
tool: ssl_renew
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "ssl_renew"RecommendationScope tools to the minimum needed.
tool: switch_php
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "switch_php"RecommendationScope tools to the minimum needed.
tool: cache_flush
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "cache_flush"RecommendationScope tools to the minimum needed.
tool: cache_toggle
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "cache_toggle"RecommendationScope tools to the minimum needed.
tool: optimize_database
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "optimize_database"RecommendationScope tools to the minimum needed.
tool: database_search_replace
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "database_search_replace"RecommendationScope tools to the minimum needed.
tool: execute_query
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "execute_query"RecommendationScope tools to the minimum needed.
tool: cloudflare_set_proxy
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "cloudflare_set_proxy"RecommendationScope tools to the minimum needed.
tool: cloudflare_purge_cache
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "cloudflare_purge_cache"RecommendationScope tools to the minimum needed.
tool: create_ftp_account
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "create_ftp_account"RecommendationScope tools to the minimum needed.
tool: create_ftp_account
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
w itself, which lists every site directory. Returns: {"success": true, "username": "sRecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: create_ftp_account
A filesystem tool exposes a path parameter that is a free-form string with no pattern/enum/format constraint, so it accepts absolute paths and "../" traversal. A tool that constrains its path (a rooted `pattern` or an `enum`) does not fire.
unconstrained path parameter "home_dir"RecommendationConstrain the path parameter to a rooted allow-list and reject absolute/traversal paths server-side.
tool: remove_ftp_account
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "remove_ftp_account"RecommendationScope tools to the minimum needed.
tool: create_alert_rule
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "create_alert_rule"RecommendationScope tools to the minimum needed.
tool: delete_alert_rule
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "delete_alert_rule"RecommendationScope tools to the minimum needed.
tool: run_malware_scan
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "run_malware_scan"RecommendationScope tools to the minimum needed.
tool: add_firewall_rule
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "add_firewall_rule"RecommendationScope tools to the minimum needed.
tool: remove_firewall_rule
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "remove_firewall_rule"RecommendationScope tools to the minimum needed.
tool: register_domain
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "register_domain"RecommendationScope tools to the minimum needed.
tool: register_domain
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
d_include_path: Append the visitor's path to the target (default: True) ca_legal_typeRecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: add_subdomain
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "add_subdomain"RecommendationScope tools to the minimum needed.
tool: link_domain
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "link_domain"RecommendationScope tools to the minimum needed.
tool: set_domain_usage
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "set_domain_usage"RecommendationScope tools to the minimum needed.
tool: set_domain_usage
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
d_include_path: Append the visitor's path to the target (default: True) Returns: {"dRecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: domain_settings
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "domain_settings"RecommendationScope tools to the minimum needed.
tool: add_domain_dns
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "add_domain_dns"RecommendationScope tools to the minimum needed.
tool: delete_domain_dns
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "delete_domain_dns"RecommendationScope tools to the minimum needed.
tool: toggle_module
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "toggle_module"RecommendationScope tools to the minimum needed.
tool: list_compute_types
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "list_compute_types"RecommendationScope tools to the minimum needed.
tool: launch_compute_instance
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "launch_compute_instance"RecommendationScope tools to the minimum needed.
tool: get_compute_instance
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "get_compute_instance"RecommendationScope tools to the minimum needed.
tool: start_compute_instance
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "start_compute_instance"RecommendationScope tools to the minimum needed.
tool: stop_compute_instance
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "stop_compute_instance"RecommendationScope tools to the minimum needed.
tool: reboot_compute_instance
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "reboot_compute_instance"RecommendationScope tools to the minimum needed.
tool: terminate_compute_instance
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "terminate_compute_instance"RecommendationScope tools to the minimum needed.
tool: create_compute_volume
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "create_compute_volume"RecommendationScope tools to the minimum needed.
tool: adopt_compute_instance
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "adopt_compute_instance"RecommendationScope tools to the minimum needed.
tool: detach_compute_volume
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "detach_compute_volume"RecommendationScope tools to the minimum needed.
tool: attach_compute_volume
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "attach_compute_volume"RecommendationScope tools to the minimum needed.
tool: snapshot_compute_volume
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "snapshot_compute_volume"RecommendationScope tools to the minimum needed.
tool: delete_compute_volume
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "delete_compute_volume"RecommendationScope tools to the minimum needed.
tool: container_action
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "container_action"RecommendationScope tools to the minimum needed.
tool: create_support_ticket
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "create_support_ticket"RecommendationScope tools to the minimum needed.
tool: reply_support_ticket
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "reply_support_ticket"RecommendationScope tools to the minimum needed.
tool: set_backup_retention
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "set_backup_retention"RecommendationScope tools to the minimum needed.
tool: delete_backup
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "delete_backup"RecommendationScope tools to the minimum needed.
tool: add_redirect
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "add_redirect"RecommendationScope tools to the minimum needed.
tool: delete_redirect
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "delete_redirect"RecommendationScope tools to the minimum needed.
tool: set_force_https
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "set_force_https"RecommendationScope tools to the minimum needed.
tool: manage_db_user
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "manage_db_user"RecommendationScope tools to the minimum needed.
tool: transfer_out_domain
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "transfer_out_domain"RecommendationScope tools to the minimum needed.
tool: enable_wildcard
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "enable_wildcard"RecommendationScope tools to the minimum needed.
tool: upload_ssl_cert
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "upload_ssl_cert"RecommendationScope tools to the minimum needed.
tool: setup_email
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "setup_email"RecommendationScope tools to the minimum needed.
tool: create_mailbox
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "create_mailbox"RecommendationScope tools to the minimum needed.
tool: delete_mailbox
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "delete_mailbox"RecommendationScope tools to the minimum needed.
tool: reset_mailbox_password
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "reset_mailbox_password"RecommendationScope tools to the minimum needed.
tool: get_webmail_url
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "get_webmail_url"RecommendationScope tools to the minimum needed.
tool: create_webhook
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "create_webhook"RecommendationScope tools to the minimum needed.
tool: delete_webhook
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "delete_webhook"RecommendationScope tools to the minimum needed.
tool: test_webhook
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "test_webhook"RecommendationScope tools to the minimum needed.
tool: enable_smtp_relay
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "enable_smtp_relay"RecommendationScope tools to the minimum needed.
tool: revoke_smtp_relay
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "revoke_smtp_relay"RecommendationScope tools to the minimum needed.
tool: (server instructions)
Role tokens or delimiter abuse steer the model rather than describe the tool.
stent envelope: ```json {"ok": true, "data": {...}, "meta": {"requeRecommendationWrite neutral, descriptive tool metadata.
tool: register_domain
An unusually long description is a common injection-padding tactic.
description length 2588 charsRecommendationKeep descriptions concise.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Claim an API key using a claim token from the container. After calling request_api_key(), read the claim token from ~/.borealhost/.claim_token on your container and pass it here. The token is single-u
List available hosting plans with pricing and resources. No authentication needed. Args: track: Filter by plan track. Valid values: "single_site", "agency". Leave empty to list all tracks. include_dep
Start a new checkout session to purchase a hosting plan. No authentication needed. After creating, call update_checkout to set buyer info, then complete_checkout to pay. Args: sku: Plan SKU in format
Set buyer email and desired site slug on a checkout session. The checkout must be in "not_ready" status. Setting requested_slug transitions status to "ready" (required before completing). Args: checko
Complete checkout with payment and start site provisioning. The checkout must be in "ready" status. Two payment methods: - "stripe_checkout" (default): Returns a short, chat-safe payment URL. **Presen
Poll a checkout session for status updates. Call this after complete_checkout to track payment and provisioning. Polling strategy: - First 60 seconds: every 5 seconds - After 60 seconds: every 15 seco
Get detailed status of a hosted site including resources, domains, and modules. Requires: API key with read scope. Args: slug: Site identifier (the slug chosen during checkout) Returns: {"slug": "my-s
Create or delete DNS records for a site. Requires: API key with write scope. Args: slug: Site identifier action: "create" or "delete" record_type: "A", "AAAA", "CNAME", "MX", "TXT", or "SRV" subdomain
Install an app template on a VPS/Cloud site. Starts a background installation. Poll get_app_status() for progress. Requires: API key with write scope. VPS or Cloud plan only. Args: slug: Site identifi
Get app installation status and log. Poll this after install_app() to track progress. Requires: API key with read scope. Args: slug: Site identifier app_id: App ID from install_app() response Returns:
List installed apps on a site. Requires: API key with read scope. Args: slug: Site identifier Returns: {"apps": [{"id": "uuid", "app_name": "myapp", "template_slug": "django", "status": "running", "do
List all snapshots and scheduled snapshots for a site. Requires: API key with read scope. Args: slug: Site identifier Returns: {"snapshots": [{"id": "uuid", "name": "snap-...", "status": "completed",
Create a local container snapshot (async). Runs in background — returns immediately with status "creating". Poll list_snapshots() to check when status becomes "completed" or "failed". Available for VP
Create a B2 cloud-backed snapshot (zero local disk, async). Streams container data directly to Backblaze B2 via restic. No local disk impact — billed separately at cost+5%. Runs in background — return
Delete a snapshot (local or B2). Requires: API key with write scope. Args: slug: Site identifier snapshot_id: UUID of the snapshot to delete Returns: {"success": true, "message": "Snapshot deleted"} E
Rollback a site to a previous snapshot. WARNING: This is destructive. The current state of the container will be replaced with the snapshot contents. Requires: API key with admin scope. Args: slug: Si
Get snapshot disk usage and quota info for a site. Requires: API key with read scope. Args: slug: Site identifier Returns: {"disk_quota_gb": 200, "max_snapshots": 5, "snapshot_count": 2, "local_snapsh
Schedule a snapshot for future execution. Requires: API key with write scope. Max 3 pending schedules per site. Args: slug: Site identifier scheduled_at: ISO 8601 datetime (must be in the future) desc
Cancel a scheduled snapshot. Requires: API key with write scope. Args: slug: Site identifier schedule_id: UUID of the scheduled snapshot to cancel Returns: {"success": true, "message": "Scheduled snap
List all backups for a site (automatic and manual). Requires: API key with read scope. Args: slug: Site identifier Returns: [{"id": "uuid", "backup_type": "auto"|"manual", "status": "completed", "size
Create a manual backup (runs asynchronously). The backup starts in the background. Poll list_backups() to check status. Requires: API key with write scope. Args: slug: Site identifier Returns: {"id":
Restore a site from a backup. WARNING: This is destructive. The current state of the site will be replaced. Runs asynchronously — may take several minutes. Requires: API key with admin scope. Args: sl
Get traffic and performance metrics for a site. Requires: API key with read scope. Args: slug: Site identifier days: Number of days of history (1–90, default: 7) Returns: {"requests": [...], "bandwidt
Change a site's hosting plan (upgrade or downgrade). Requires: API key with admin scope. Best practice: create a snapshot before downgrading. Args: slug: Site identifier new_plan: Target plan slug (e.
Delete a site and schedule resource cleanup (7-day grace period). WARNING: This is destructive. The site will be inaccessible immediately but data is retained for 7 days before permanent deletion. Bes
Update account profile fields (email, language, name). Requires: API key with write scope. Only provided (non-empty) fields are updated. Args: email: New email address language: Language preference —
Permanently anonymize the account. Cancels subscriptions, deactivates keys. WARNING: This is irreversible. The account will be soft-deleted and all personal data anonymized. All sites will be decommis
List all subscriptions with plan details, pricing, status, and site slug. Requires: API key with read scope. Returns: [{"id": "uuid", "plan_slug": "site_starter", "plan_name": "Starter", "status": "ac
Get a Stripe billing portal URL for managing payment methods and invoices. Returns a URL (not a redirect) that the human can open in a browser. Requires: API key with read scope. Args: flow: Optional.
Atomically rotate an API key. Old key is immediately invalidated. Creates a new key with the same name, scopes, and rate limits. The new key is returned once — store it immediately. Requires: API key
Create a new API key with specified scopes. Cannot create keys with higher scopes than the current key. Site-scoped keys restrict access to a single site. Requires: API key with write scope. Args: nam
List all API keys for the account. Shows key metadata (name, prefix, scopes, last used) but never the full key value. Requires: API key with read scope. Returns: [{"id": "uuid", "name": "My Key", "pre
Revoke (deactivate) an API key. The key stops working immediately. Requires: API key with write scope. Args: key_id: UUID of the key to revoke (from list_api_keys or whoami) Returns: {"success": true,
Get SSH connection info for a VPS/dedicated site. Only available for VPS/dedicated plans (not shared hosting). Requires: API key with read scope. Args: slug: Site identifier Returns: {"host": "184.107
Inject your SSH public key into a site's container for direct SSH access. The key is appended to /home/admin/.ssh/authorized_keys. Only available for VPS/dedicated plans. Requires: API key with write
List files and directories in a site's container. Path scoping depends on the plan: - Shared plans: rooted at wp-content/ (WordPress content directory) - VPS/dedicated plans: full filesystem access Re
Read the contents of a file from a site's container. Max file size: 512KB. Binary files are rejected — use the site's file manager or SSH for binary files. Requires: API key with read scope. Args: slu
Write or overwrite a text file in a site's container. Creates parent directories if they don't exist. Requires: API key with write scope. Args: slug: Site identifier path: Relative path to the file co
Upload a base64-encoded file to a site's container. Use this for binary files (images, archives, fonts, etc.). For text files, prefer write_file(). Requires: API key with write scope. Args: slug: Site
Delete a file or directory from a site's container. Directories are deleted recursively. Protected system paths (e.g. /etc, /usr) cannot be deleted. Requires: API key with write scope. Args: slug: Sit
Create a directory in a site's container. Creates parent directories if they don't exist. Requires: API key with write scope. Args: slug: Site identifier path: Relative path of the directory to create
List installed WordPress plugins with status. Requires: API key with read scope. WordPress sites only. Args: slug: Site identifier Returns: {"plugins": [{"name": "akismet", "status": "active", "versio
List installed WordPress themes with status. Requires: API key with read scope. WordPress sites only. Args: slug: Site identifier Returns: {"themes": [{"name": "twentytwentyfour", "status": "active",
Install, activate, deactivate, or delete a WordPress plugin. Requires: API key with write scope. Args: slug: Site identifier action: "install", "activate", "deactivate", or "delete" plugin: Plugin slu
Install, activate, or delete a WordPress theme. Requires: API key with write scope. Args: slug: Site identifier action: "install", "activate", or "delete" theme: Theme slug (e.g. "twentytwentyfour", "
Check for available WordPress core, plugin, and theme updates. Requires: API key with read scope. Args: slug: Site identifier Returns: {"core": {"current": "6.5", "update": "6.6"}, "plugins": [{"name"
Update WordPress core, all plugins, and all themes. Runs all updates in sequence. May take up to 2 minutes. Requires: API key with write scope. Args: slug: Site identifier Returns: {"core": {...}, "pl
List cron jobs on a site. Requires: API key with read scope. Args: slug: Site identifier Returns: {"jobs": [{"line": 1, "schedule": "*/5 * * * *", "command": "/usr/bin/php /var/www/html/wp-cron.php"},
Add a cron job to a site. Requires: API key with write scope. Args: slug: Site identifier schedule: Cron schedule (e.g. "*/5 * * * *", "0 2 * * *") command: Command to execute Returns: {"added": true,
Delete a cron job by line number. Get line numbers from list_cron(). Requires: API key with write scope. Args: slug: Site identifier line_number: Line number of the cron entry to delete Returns: {"del
Get SSL certificate information for a site. Returns certificate details, expiry date, and issuer. Requires: API key with read scope. Args: slug: Site identifier Returns: {"issuer": "Let's Encrypt", "d
Force SSL certificate renewal via certbot. Requires: API key with write scope. Args: slug: Site identifier Returns: {"renewed": true, "expires_at": "iso8601"}
List available PHP versions and the currently active one. Requires: API key with read scope. Args: slug: Site identifier Returns: {"versions": [{"version": "8.1", "active": false}, {"version": "8.2",
Switch the active PHP version for a site. Requires: API key with write scope. Args: slug: Site identifier version: Target PHP version (e.g. "8.3", "8.2", "8.1") Returns: {"version": "8.3", "result": {
Get cache status (Redis, WP object cache, hit rates). Requires: API key with read scope. Args: slug: Site identifier Returns: {"redis_running": true, "object_cache_enabled": true, "hit_rate": 0.95, "m
Flush all caches (Redis + WP object cache). Requires: API key with write scope. Args: slug: Site identifier Returns: {"flushed": true}
Enable or disable the WordPress object cache. Requires: API key with write scope. Args: slug: Site identifier enable: true to enable, false to disable Returns: {"enabled": true}
Get WordPress database information (size, tables, row counts). Requires: API key with read scope. WordPress sites only. Args: slug: Site identifier Returns: {"database": "wp_mysite", "size_mb": 45.2,
Optimize WordPress database tables (reduces bloat). Requires: API key with write scope. Args: slug: Site identifier Returns: {"optimized": true, "tables_optimized": 12}
Search and replace in WordPress database (e.g. URL migration). Handles serialized data safely. Use dry_run=true first to preview changes. Requires: API key with write scope. Args: slug: Site identifie
List all databases on a site's container. Requires: API key with read scope. Args: slug: Site identifier Returns: {"databases": ["wordpress", "app_db", ...]}
List tables in a database. Requires: API key with read scope. Args: slug: Site identifier database: Database name Returns: {"tables": [{"name": "wp_posts", "rows": 1234, "size_mb": 5.2}, ...]}
Execute a SQL query on a site's database. Supports SELECT, INSERT, UPDATE, DELETE, and DDL statements. Results are limited to 1000 rows for SELECT queries. Requires: API key with write scope. Args: sl
Get detailed system stack information (OS, PHP, DB, web server versions). Requires: API key with read scope. Args: slug: Site identifier Returns: {"os": "Debian 12", "kernel": "6.1.0", "php": "8.3.4",
Get current resource usage (CPU, memory, disk, load average). Requires: API key with read scope. Args: slug: Site identifier Returns: {"cpu_percent": 12.5, "memory_mb": 384, "memory_total_mb": 512, "d
Get Cloudflare proxy (CDN) status for a site. Shows whether traffic is routed through Cloudflare's CDN (orange cloud) or goes direct to origin (grey cloud / DNS-only). Requires: API key with read scop
Enable or disable Cloudflare CDN proxy for a site. When enabled (orange cloud): traffic goes through Cloudflare's CDN, gets caching, DDoS protection, and SSL termination at the edge. When disabled (gr
Purge Cloudflare CDN cache for a site. Without urls: purges all cached content for the site's subdomain. With urls: purges only the specified URLs (max 30 per call). Requires: API key with write scope
List SFTP accounts on a site. Also returns the host and port to connect to. Do not use the site's domain for SFTP: it is Cloudflare-proxied and only carries HTTP(S). Requires: API key with read scope.
Create an SFTP account on a site. The account is chrooted to /var/www and lands in home_dir. Password must be at least 8 characters. Username must be lowercase alphanumeric. Requires: API key with wri
Remove an SFTP account from a site. Requires: API key with write scope. Args: slug: Site identifier username: SFTP username to remove Returns: {"removed": true, "username": "sftpuser"}
List user-configurable alert rules for a site. Requires: API key with read scope. Args: slug: Site identifier Returns: [{"id": "uuid", "metric": "disk", "operator": "gt", "threshold": 90, "severity":
Create an alert rule to monitor CPU, memory, or disk usage. When the metric crosses the threshold, a notification is sent via email and/or webhook. Max 10 rules per site. Requires: API key with write
Delete an alert rule. Requires: API key with write scope. Args: slug: Site identifier rule_id: UUID of the alert rule to delete Returns: {"deleted": true, "id": "uuid"}
Run a ClamAV malware scan on a site's container. Scans the web root (or specified path) for malware, viruses, and trojans. ClamAV is installed automatically if not present. Excludes node_modules, vend
List IP allow/deny firewall rules for a site. Rules are implemented as Nginx allow/deny directives per container. Requires: API key with read scope. Args: slug: Site identifier Returns: {"rules": [{"i
Add an IP firewall rule (allow or deny) and reload Nginx. Supports IPv4, IPv6, and CIDR notation. Max 100 rules per site. If a rule already exists for the IP, the action is updated. Requires: API key
Remove an IP firewall rule and reload Nginx. Requires: API key with write scope. Args: slug: Site identifier ip: IP address or CIDR to remove (must match exactly) Returns: {"removed": true, "ip": "1.2
Retrieve container logs (error, access, or PHP). Requires: API key with read scope. Args: slug: Site identifier log_type: "error" (Nginx/Apache errors), "access" (HTTP request log), or "php" (PHP-FPM
List all domains owned by the authenticated user. Requires: API key with read scope. Returns: [{"domain": "example.com", "status": "active", "expires_at": "iso8601", "auto_renew": true, "linked_site":
Check domain availability and get pricing. Requires: API key with read scope. Args: domain: Full domain name (e.g. "example.com", "mybiz.ca") Returns: {"domain": "example.com", "available": true, "pri
Register a new domain with WHOIS contact info and Stripe billing. The domain cost is charged to the user's active subscription. Free domain if plan includes free_domain_annual + annual billing + first
Get full domain details including DNS and infrastructure status. Requires: API key with read scope. Args: domain_name: Full domain name (e.g. "example.com") Returns: {"domain": "example.com", "status"
List subdomain DNS records for a domain you own. Requires: API key with read scope. Args: domain_name: Registrable domain (e.g. "example.com") Returns: [{"fqdn": "blog.example.com", "subdomain": "blog
Create and route a subdomain of a site-linked domain. Creates the DNS A record (if absent) pointing at the site's server, then configures the nginx vhost and SSL certificate on that server. The domain
Link a domain to a hosted site. Attaches the domain to the specified site and triggers automatic DNS configuration and SSL provisioning. Requires: API key with write scope. Args: domain_name: Full dom
Set what a registered domain points at — a site, someone else's nameservers, our DNS with no site, or a redirect to another URL. Use this to park a domain, hand it to an external host, or forward it.
Update domain settings (auto-renew, WHOIS privacy, registrar lock). Only provided (non-None) fields are updated. Requires: API key with write scope. Args: domain_name: Full domain name (e.g. "example.
List all DNS records for a domain. Returns DNS records at the domain level (independent of site-level manage_dns). Use this for domains that may not be linked to a site. Requires: API key with read sc
Add a DNS record to a domain. Requires: API key with write scope. Args: domain_name: Full domain name (e.g. "example.com") record_type: "A", "AAAA", "CNAME", "MX", "TXT", or "SRV" value: Record value
Delete a DNS record from a domain. Requires: API key with write scope. Args: domain_name: Full domain name (e.g. "example.com") record_id: ID of the DNS record to delete (from list_domain_dns) Returns
List AI modules and their enabled/disabled state for a site. Also returns the list of modules available for the site's plan. Requires: API key with read scope. Args: slug: Site identifier Returns: {"m
Enable or disable an AI module on a site. The module must be in the plan's available module list. Requires: API key with write scope. Args: slug: Site identifier module_name: Module to toggle. Availab
List on-demand compute instance types with hourly CAD prices. On-demand instances are real cloud VMs in Canada (Montreal region), billed per minute (1-hour minimum) post-paid onto your existing Boreal
List OS images available for on-demand compute instances. Requires: API key with read scope. Returns: {"images": [{"id": "UBUNTU_24_04_64BIT", "name": "Ubuntu 24.04 LTS (x86_64)", "family": "linux", "
Launch an on-demand hourly compute instance (Canada, CAD). Billing starts at launch (per minute, 1-hour minimum) and runs until terminate_compute_instance — stopping does NOT stop the charge. Every in
List your on-demand compute instances with month-to-date spend. Requires: API key with read scope. Returns: {"instances": [...], "month_to_date_spend_cad": 12.34, "monthly_spend_cap_cad": 500.0}
Get live details for a compute instance (state, public IP, accrued cost). State is synced from the cloud provider on each call. SSH as root once state is "running" and public_ip is set. Requires: API
Start a stopped compute instance. Requires: API key with write scope.
Stop a compute instance. WARNING: hourly billing continues while stopped. Use terminate_compute_instance to stop the charges permanently. Requires: API key with write scope.
Reboot a running compute instance. Requires: API key with write scope.
Permanently terminate a compute instance — this stops hourly billing. The instance and its disk are destroyed and cannot be recovered. Copy any results off the instance before terminating. Requires: A
List your compute volumes — machines that survive instance termination. A volume is a whole machine (packages, drivers, services, users, data) stored in Canada. Detaching destroys the instance but kee
Get a volume's live state, its instance, and its monthly storage cost. Requires: API key with read scope. Returns: Volume dict plus "monthly_storage_cad". After attach, poll this until instance.state
Create a persistent machine and boot its first instance. Start here, then set the machine up however you like (install packages, drivers, models). Everything you do becomes part of the volume the firs
Turn an instance you are ALREADY running into a persistent volume. Use this when you launched something, set it up, and then decided you want to keep it. Nothing reboots and no data moves — the machin
Queue: snapshot the machine, verify it, then destroy the instance. This is how you stop paying for compute while keeping your work. ASYNCHRONOUS. Returns immediately with state "detaching" — it does N
Restore a detached volume onto a fresh instance — optionally a new type. Pass a different instance_type to move the same machine to different hardware: this is the closest thing to changing instance t
Queue a checkpoint snapshot without detaching — before a risky change. ASYNCHRONOUS. Returns immediately with state "snapshotting"; poll get_compute_volume until it is back to "attached" (done) or "er
Permanently delete a volume and everything stored in it. Irreversible: the instance is released AND the stored data is purged from object storage, so billing genuinely stops. Refuses while an instance
Start, stop, or restart a site's container. Only for plans with a dedicated container (VPS / split-VPS / dedicated). Shared-hosting sites share a container and cannot restart it. The response reports
List the account's support tickets. Requires: API key with read scope. Args: status: Optional filter (e.g. "open", "closed") Returns: [{"id", "subject", "status", "category", "created_at", ...}, ...]
Get a support ticket with its full message thread. Requires: API key with read scope. Args: ticket_id: Ticket UUID from list_support_tickets Returns: {"id", "subject", "status", "messages": [...]}
Open a support ticket with the BorealHost team. Use this to escalate platform-side problems you cannot fix with the available tools (billing issues, infrastructure faults, API bugs). A human answers e
Add a message to an existing support ticket. Requires: API key with write scope. Args: ticket_id: Ticket UUID message: Reply text Returns: {"id", "status", ...}
Get the backup retention policy for a VPS site. Requires: API key with read scope. Returns: {"site", "retention": {"keep_daily", "keep_weekly", "keep_monthly"}}
Set the backup retention policy for a VPS site. Storage is billed on real stored bytes, so deeper history costs the customer, not the platform. Values are clamped to platform bounds; the response repo
Permanently delete a single backup (metadata + stored snapshot). Irreversible. Requires: API key with admin scope. Returns: {"site", "backup_id", "deleted": true}
List HTTP redirect rules for a site. Requires: API key with read scope. Returns: [{"id", "source_path", "target_url", "redirect_type"}, ...]
Add an HTTP redirect rule to a site. Requires: API key with write scope. Args: slug: Site identifier source_path: Path to redirect, must start with "/" (e.g. "/old-page") target_url: Destination URL r
Delete a redirect rule by source path or id. Requires: API key with write scope. Returns: {"site", "deleted": true}
Enable or disable the HTTP→HTTPS redirect for a site. Requires: API key with write scope. Returns: {"site", "force_https": true|false, "message"}
List database users for a site. Requires: API key with read scope. Returns: {"engine", "users": [{"user", "host", ...}, ...]}
Manage a database user on a site. Actions: "create" (user+password), "drop" (user), "set_password" (user+password), "grants" (list a user's grants), "grant" / "revoke" (user+database, optional privile
Prepare a domain to transfer to another registrar. Unlocks the domain and emails the EPP/auth code to the registrant contact on file (BorealHost never sees the code). The domain keeps working here unt
Route *.domain (every subdomain) to the domain's linked site. Creates a wildcard DNS record and issues a wildcard certificate via ACME DNS-01. SLOW — DNS propagation is part of the challenge, expect 2
Install your own SSL certificate for a site's domain. The certificate must be a PEM fullchain (leaf + intermediates) and the key unencrypted PEM. Validated (parse, key match, domain coverage, expiry)
Email addon status and mailboxes for a site. Requires: API key with read scope. Returns: {"configured": bool, "domain", "mailboxes", "mailbox_list": [...]}
Enable business email (hosted mailboxes + webmail) on a domain. Creates the hosted-email domain, sets up outbound authentication (DKIM/SPF), and auto-configures MX/SPF DNS when the zone is hosted by B
Create a mailbox on the site's email domain. Password is generated when omitted and returned ONCE — store it. Each mailbox adds to the subscription's email billing. Requires: API key with write scope.
Delete a mailbox (its mail is destroyed). Requires: API key with write scope. Returns: {"email", "deleted": true}
Reset a mailbox password (generated when omitted, returned ONCE). Requires: API key with write scope. Returns: {"email", "password", "message"}
One-time webmail single-sign-on URL for a mailbox. Requires: API key with write scope. Returns: {"email", "url"}
List webhook endpoints registered on the account. Requires: API key with read scope. Returns: [{"id", "url", "events", "is_active", "last_status", "failure_count"}, ...]
Register a webhook endpoint for platform events. Events (backup failures, security notices, hosting incidents, billing) are POSTed as JSON, signed with X-BH-Signature (HMAC-SHA256 of the raw body). Th
Remove a webhook endpoint. Requires: API key with write scope. Returns: {"id", "deleted": true}
Send a test event to a webhook endpoint (async). Poll list_webhooks afterwards for last_status. Requires: API key with write scope. Returns: {"id", "message"}
List SMTP relay credentials for a site, with domain-auth status. Requires: API key with read scope. Returns: {"relays": [{"relay_id", "domain", "status", "domain_authenticated"}, ...]}
Enable an SMTP relay for a site's outbound transactional mail. Provisions a mail-send-only credential on the platform relay and configures SPF/DKIM DNS when the domain zone is hosted here. The SMTP pa
Revoke an SMTP relay credential (immediate at the relay). Requires: API key with write scope. Returns: {"relay_id", "revoked": true}