# Reported issues for Hostinger Connector

Pod holds 16 of 16 GitHub reports that passed its relevance review. This can include external user reports, maintainer-confirmed bugs, and concrete feature gaps. Treat them as evidence to inspect, not a count of distinct defects.

Back to [Hostinger Connector](/mcp/hostinger-connector).

## Most discussed

### Request for vulnerability report

Hey, I want to report a vulnearbility on this MCP.

Is it possible to open PVR, private vulnerability report, in this repo?
I'd like to report this vuln in a secured way... thanks

[Read the thread](https://github.com/hostinger/api-mcp-server/issues/57) · 2026-08-03 · closed · external user · 4 comments

### Allowlist OAuth redirect URI for Sanaa (sanaabot.com) MCP client

## Request
Please allowlist this OAuth redirect URI for Dynamic Client Registration / authorize:

`https://sanaabot.com/api/mcp/oauth/hostinger/callback`

## Context
Sanaa (https://sanaabot.com) integrates `hostinger-api-mcp` so users can connect Hostinger from our Settings → Integrations UI, buy domains, manage DNS, and deploy static sites built in chat.

DCR against `https://auth.hostinger.com/api/external/v1/oauth-server/register` currently returns `invalid_redirect_uri` for our production…

[Read the thread](https://github.com/hostinger/api-mcp-server/issues/53) · 2026-07-22 · closed · external user · 2 comments

### Invalid tool name breaks MCP clients — `hosting_restartNode.jsApplicationV1` contains a dot

**Package version:** 1.5.1
**Affected files:**
- `src/core/tools/hosting.ts` (line ~1233) / compiled `src/core/tools/hosting.js` (line ~1223)
- `src/core/tools/all.ts` (line ~2721) / compiled `src/core/tools/all.js` (line ~2711)

**Description:**

One tool name generated from the OpenAPI spec contains a literal `.` character:

```
"name": "hosting_restartNode.jsApplicationV1"
```

The MCP spec (and clients like Claude Desktop) require tool names to match `^[a-zA-Z0-9_-]{1,64}$` (no dots,…

[Read the thread](https://github.com/hostinger/api-mcp-server/issues/52) · 2026-07-09 · closed · external user · 2 comments

### Invalid MCP tool name breaks Claude Desktop: hosting_restartNode.jsApplicationV1

The Hostinger hosting MCP server exposes the tool name `hosting_restartNode.jsApplicationV1`.

Claude Desktop rejects this because tool names must match:
^[a-zA-Z0-9_-]{1,64}$

The dot in `Node.js` causes:
FrontendRemoteMcpToolDefinition.name: String should match pattern '^[a-zA-Z0-9_-]{1,64}$'

Local workaround confirmed:
rename `hosting_restartNode.jsApplicationV1` to `hosting_restartNode_jsApplicationV1`.

Environment:
- Windows
- Claude Desktop
- hostinger-api-mcp installed globally
-…

[Read the thread](https://github.com/hostinger/api-mcp-server/issues/51) · 2026-07-09 · closed · external user · 2 comments

### Enable private vulnerability reporting

Hi,

I have a security finding to share privately. Could you enable private vulnerability reporting on this repo?

Thanks

[Read the thread](https://github.com/hostinger/api-mcp-server/issues/50) · 2026-07-09 · closed · external user · 2 comments

### Tool name "hosting_restartNode.jsApplicationV1" violates MCP client name pattern (contains a dot)

The tool `hosting_restartNode.jsApplicationV1` (defined in `src/core/tools/hosting.ts`, reproduced in npm package `hostinger-api-mcp@1.5.1`) contains a literal `.` in its name, inherited from "Node.js" in the source endpoint naming.

Many MCP clients validate tool names against `^[a-zA-Z0-9_-]{1,64}$` (dots not allowed). Claude Desktop, for example, rejects the tool list outright with:
```
tools.494.FrontendRemoteMcpToolDefinition.name: String should match pattern '^[a-zA-Z0-9_-]{1,64}$'
```…

[Read the thread](https://github.com/hostinger/api-mcp-server/issues/49) · 2026-07-08 · closed · external user · 2 comments

### Invalid tool name: hosting_restartNode.jsApplicationV1 contains a dot

## Bug

The tool name `hosting_restartNode.jsApplicationV1` contains a dot (`.`), which is not allowed by the MCP tool name specification. Tool names must match the pattern `^[a-zA-Z0-9_-]{1,64}$`.

This causes Claude Desktop to fail on startup with:

```
tools.214.FrontendRemoteMcpToolDefinition.name: String should match pattern '^[a-zA-Z0-9_-]{1,64}$'
```

## Location

The invalid name appears in:
- `src/core/tools/hosting.ts`
- `src/core/tools/hosting.js`
- `src/core/tools/all.ts`
-…

[Read the thread](https://github.com/hostinger/api-mcp-server/issues/48) · 2026-07-08 · closed · external user · 2 comments

### [BUG] version 1.5.0 breaks Claude Desktop with the FrontendRemoteMcpToolDefinition.name pattern error, and that rolling back to 1.4.0 fixes it.

Error:
tools.181.FrontendRemoteMcpToolDefinition.name: String should match pattern '^[a- hostingerzA-Z0-9_-]{1,64}$'
when using latest tag which is now 1.5

## Steps to Reproduce
Use the Hostinger MCP connector with hostinger-api-mcp@latest  (which is now 1.5)
Start the MCP integration
Observe the validation error
Change the config to hostinger-api-mcp@1.4
The issue disappears
Expected result:
MCP tools should load successfully and tool names should comply with the required naming pattern.…

[Read the thread](https://github.com/hostinger/api-mcp-server/issues/47) · 2026-07-08 · closed · external user · 2 comments

## Most recent

### [BUG] Hostinger Mail MCP server corrupts binary attachment downloads by returning them as text

## Bug Description
The Hostinger Mail MCP server appears to corrupt binary attachment downloads by returning attachment bytes as `text` content.

The REST API endpoint works correctly when called directly with an Agentic Mail API token, but the same endpoint called through the MCP server returns binary attachment bodies inside a text response. This causes binary bytes to be decoded/serialized as text, introducing replacement characters (`�` / `\ufffd`) and making the original files impossible…

[Read the thread](https://github.com/hostinger/api-mcp-server/issues/60) · 2026-08-21 · open · external user · 0 comments

### Allowlist OAuth redirect URI for n8n Cloud MCP client

## Request
Please allowlist dynamic callback patterns for n8n Cloud instances on the Hostinger OAuth authorization server.

## Details
- **Platform**: n8n Cloud
- **Redirect URI Pattern**: `https://*.app.n8n.cloud/rest/oauth2-credential/callback`
- **Use Case**: Enabling low-code AI agents in n8n Cloud to natively discover and call Hostinger MCP tools without 403/400 authorization errors.

[Read the thread](https://github.com/hostinger/api-mcp-server/issues/59) · 2026-08-13 · closed · external user · 1 comment

### Allowlist OAuth redirect URI for ClickUp MCP integration

## Request
Please allowlist the official redirect URI for the ClickUp workspace MCP client on `https://mcp.hostinger.com`.

## Details
- **Platform**: ClickUp
- **Redirect URI**: `https://search.clickup-prod.com/connect/mcp`
- **Use Case**: Connecting Hostinger VPS tools and automated management directly inside ClickUp workspaces via remote SSE transport.

https://help.clickup.com/hc/en-us/articles/38503227973655-Connect-an-MCP-server-to-your-Workspace

[Read the thread](https://github.com/hostinger/api-mcp-server/issues/58) · 2026-08-13 · closed · external user · 1 comment

### Tool names containing dots (Node.js) break LLM API compatibility

## Bug

Three tool names contain a literal `.` (dot) character which is rejected by LLM APIs that validate function names against the pattern `^[a-zA-Z][a-zA-Z0-9_-]*$`:

- `hosting_createNode.jsBuildFromArchiveV1`
- `hosting_getNode.jsBuildLogsV1`
- `hosting_listNode.jsBuildsV1`

## Impact

APIs like Kimi (Moonshot) reject the entire tool registration request when any function name contains a dot. This prevents the MCP server from being used with these providers.

## Suggested Fix

Rename the…

[Read the thread](https://github.com/hostinger/api-mcp-server/issues/40) · 2026-06-09 · closed · external user · 2 comments

### hosting_deployStaticWebsite fails with 500 'Archive not found' — archive_path needs public_html/ prefix

## Bug Description

`hosting_deployStaticWebsite` consistently fails at the deploy trigger step with HTTP 500 and `"[Hosting:9999] Archive not found"`, even though the file upload succeeds.

## Root Cause

The `hosting_deployStaticWebsite_triggerDeploy` method sends:
```json
{"archive_path": "filename.zip"}
```

But the Hostinger API now requires the full path relative to the account root:
```json
{"archive_path": "public_html/filename.zip"}
```

## Evidence

The file IS uploaded to…

[Read the thread](https://github.com/hostinger/api-mcp-server/issues/34) · 2026-04-14 · open · external user · 0 comments

### [Bug] hosting_deployWordpressPlugin returns 400 error - API endpoint not found

# Bug Report / Rapport de bug

## English

### Description
The `hosting_deployWordpressPlugin` tool fails with HTTP 400 error when attempting to deploy a WordPress plugin to a shared hosting account. The underlying API endpoint `/file-manager/upload-url` does not appear to exist in the public Hostinger API.

### Environment

| Component | Value |
|-----------|-------|
| Package | `hostinger-api-mcp` |
| Version | `0.1.27` |
| Hosting Plan | Business (shared hosting) |
| Domain | `airdazur.com`…

[Read the thread](https://github.com/hostinger/api-mcp-server/issues/24) · 2026-02-14 · closed · external user · 1 comment

### [BUG] Directory permissions changed to 700 after deploying static website via `hosting_deployStaticWebsite`

## Description

When using the `hosting_deployStaticWebsite` tool to upload and deploy a static website (e.g., a simple `index.html`), the directory permissions on the hosting server are changed, resulting in a **403 Forbidden** error when accessing the site.

## Steps to Reproduce

1. Create a simple static website archive containing `index.html`
2. Use the `hosting_deployStaticWebsite` tool to deploy:
   ```
   hosting_deployStaticWebsite({
     domain: "example.com",
     archivePath:…

[Read the thread](https://github.com/hostinger/api-mcp-server/issues/18) · 2026-01-04 · open · external user · 0 comments

### API_TOKEN environment variable not working as documented

# API_TOKEN environment variable not working as documented

## Description
The MCP server fails to authenticate when using `API_TOKEN` as documented. Only `APITOKEN` (without underscore) works.

## Environment
- hostinger-api-mcp version: 0.1.5
- Node.js version: 22.18.0
- MCP client: opencode

## Steps to Reproduce
1. Configure MCP server with `API_TOKEN` environment variable as shown in README
2. Attempt any API call (e.g., getVirtualMachineListV1)
3. Receive "Unauthenticated" error

##…

[Read the thread](https://github.com/hostinger/api-mcp-server/issues/3) · 2025-08-19 · closed · external user · 1 comment

The remaining reports are on [the project's issue tracker](https://github.com/hostinger/api-mcp-server/issues).