Reported issues for Hostinger Connector

Pod holds 16 of 16 GitHub reports that passed its relevance review. This can include external user reports, maintainer-confirmed bugs, and concrete feature gaps. Treat them as evidence to inspect, not a count of distinct defects.

Back to Hostinger Connector.

Most discussed

Request for vulnerability report

Hey, I want to report a vulnearbility on this MCP.

Is it possible to open PVR, private vulnerability report, in this repo? I'd like to report this vuln in a secured way... thanks

Read the thread · 2026-08-03 · closed · external user · 4 comments

Allowlist OAuth redirect URI for Sanaa (sanaabot.com) MCP client

Request

Please allowlist this OAuth redirect URI for Dynamic Client Registration / authorize:

https://sanaabot.com/api/mcp/oauth/hostinger/callback

Context

Sanaa (https://sanaabot.com) integrates hostinger-api-mcp so users can connect Hostinger from our Settings → Integrations UI, buy domains, manage DNS, and deploy static sites built in chat.

DCR against https://auth.hostinger.com/api/external/v1/oauth-server/register currently returns invalid_redirect_uri for our production…

Read the thread · 2026-07-22 · closed · external user · 2 comments

Invalid tool name breaks MCP clients — hosting_restartNode.jsApplicationV1 contains a dot

Package version: 1.5.1 Affected files:

• src/core/tools/hosting.ts (line ~1233) / compiled src/core/tools/hosting.js (line ~1223)
• src/core/tools/all.ts (line ~2721) / compiled src/core/tools/all.js (line ~2711)

Description:

One tool name generated from the OpenAPI spec contains a literal . character:

"name": "hosting_restartNode.jsApplicationV1"

The MCP spec (and clients like Claude Desktop) require tool names to match ^[a-zA-Z0-9_-]{1,64}$ (no dots,…

Read the thread · 2026-07-09 · closed · external user · 2 comments

Invalid MCP tool name breaks Claude Desktop: hosting_restartNode.jsApplicationV1

The Hostinger hosting MCP server exposes the tool name hosting_restartNode.jsApplicationV1.

Claude Desktop rejects this because tool names must match: ^[a-zA-Z0-9_-]{1,64}$

The dot in Node.js causes: FrontendRemoteMcpToolDefinition.name: String should match pattern '^[a-zA-Z0-9_-]{1,64}$'

Local workaround confirmed: rename hosting_restartNode.jsApplicationV1 to hosting_restartNode_jsApplicationV1.

Environment:

• Windows
• Claude Desktop
• hostinger-api-mcp installed globally -…

Read the thread · 2026-07-09 · closed · external user · 2 comments

Enable private vulnerability reporting

Hi,

I have a security finding to share privately. Could you enable private vulnerability reporting on this repo?

Thanks

Read the thread · 2026-07-09 · closed · external user · 2 comments

Tool name "hosting_restartNode.jsApplicationV1" violates MCP client name pattern (contains a dot)

The tool hosting_restartNode.jsApplicationV1 (defined in src/core/tools/hosting.ts, reproduced in npm package hostinger-api-mcp@1.5.1) contains a literal . in its name, inherited from "Node.js" in the source endpoint naming.

Many MCP clients validate tool names against ^[a-zA-Z0-9_-]{1,64}$ (dots not allowed). Claude Desktop, for example, rejects the tool list outright with:

tools.494.FrontendRemoteMcpToolDefinition.name: String should match pattern '^[a-zA-Z0-9_-]{1,64}$'
```…

[Read the thread](https://github.com/hostinger/api-mcp-server/issues/49) · 2026-07-08 · closed · external user · 2 comments

### Invalid tool name: hosting_restartNode.jsApplicationV1 contains a dot

## Bug

The tool name `hosting_restartNode.jsApplicationV1` contains a dot (`.`), which is not allowed by the MCP tool name specification. Tool names must match the pattern `^[a-zA-Z0-9_-]{1,64}$`.

This causes Claude Desktop to fail on startup with:

tools.214.FrontendRemoteMcpToolDefinition.name: String should match pattern '^[a-zA-Z0-9_-]{1,64}$'

## Location

The invalid name appears in:
- `src/core/tools/hosting.ts`
- `src/core/tools/hosting.js`
- `src/core/tools/all.ts`
-…

[Read the thread](https://github.com/hostinger/api-mcp-server/issues/48) · 2026-07-08 · closed · external user · 2 comments

### [BUG] version 1.5.0 breaks Claude Desktop with the FrontendRemoteMcpToolDefinition.name pattern error, and that rolling back to 1.4.0 fixes it.

Error:
tools.181.FrontendRemoteMcpToolDefinition.name: String should match pattern '^[a- hostingerzA-Z0-9_-]{1,64}$'
when using latest tag which is now 1.5

## Steps to Reproduce
Use the Hostinger MCP connector with hostinger-api-mcp@latest  (which is now 1.5)
Start the MCP integration
Observe the validation error
Change the config to hostinger-api-mcp@1.4
The issue disappears
Expected result:
MCP tools should load successfully and tool names should comply with the required naming pattern.…

[Read the thread](https://github.com/hostinger/api-mcp-server/issues/47) · 2026-07-08 · closed · external user · 2 comments

## Most recent

### [BUG] Hostinger Mail MCP server corrupts binary attachment downloads by returning them as text

## Bug Description
The Hostinger Mail MCP server appears to corrupt binary attachment downloads by returning attachment bytes as `text` content.

The REST API endpoint works correctly when called directly with an Agentic Mail API token, but the same endpoint called through the MCP server returns binary attachment bodies inside a text response. This causes binary bytes to be decoded/serialized as text, introducing replacement characters (`�` / `\ufffd`) and making the original files impossible…

[Read the thread](https://github.com/hostinger/api-mcp-server/issues/60) · 2026-08-21 · open · external user · 0 comments

### Allowlist OAuth redirect URI for n8n Cloud MCP client

## Request
Please allowlist dynamic callback patterns for n8n Cloud instances on the Hostinger OAuth authorization server.

## Details
- **Platform**: n8n Cloud
- **Redirect URI Pattern**: `https://*.app.n8n.cloud/rest/oauth2-credential/callback`
- **Use Case**: Enabling low-code AI agents in n8n Cloud to natively discover and call Hostinger MCP tools without 403/400 authorization errors.

[Read the thread](https://github.com/hostinger/api-mcp-server/issues/59) · 2026-08-13 · closed · external user · 1 comment

### Allowlist OAuth redirect URI for ClickUp MCP integration

## Request
Please allowlist the official redirect URI for the ClickUp workspace MCP client on `https://mcp.hostinger.com`.

## Details
- **Platform**: ClickUp
- **Redirect URI**: `https://search.clickup-prod.com/connect/mcp`
- **Use Case**: Connecting Hostinger VPS tools and automated management directly inside ClickUp workspaces via remote SSE transport.

https://help.clickup.com/hc/en-us/articles/38503227973655-Connect-an-MCP-server-to-your-Workspace

[Read the thread](https://github.com/hostinger/api-mcp-server/issues/58) · 2026-08-13 · closed · external user · 1 comment

### Tool names containing dots (Node.js) break LLM API compatibility

## Bug

Three tool names contain a literal `.` (dot) character which is rejected by LLM APIs that validate function names against the pattern `^[a-zA-Z][a-zA-Z0-9_-]*$`:

- `hosting_createNode.jsBuildFromArchiveV1`
- `hosting_getNode.jsBuildLogsV1`
- `hosting_listNode.jsBuildsV1`

## Impact

APIs like Kimi (Moonshot) reject the entire tool registration request when any function name contains a dot. This prevents the MCP server from being used with these providers.

## Suggested Fix

Rename the…

[Read the thread](https://github.com/hostinger/api-mcp-server/issues/40) · 2026-06-09 · closed · external user · 2 comments

### hosting_deployStaticWebsite fails with 500 'Archive not found' — archive_path needs public_html/ prefix

## Bug Description

`hosting_deployStaticWebsite` consistently fails at the deploy trigger step with HTTP 500 and `"[Hosting:9999] Archive not found"`, even though the file upload succeeds.

## Root Cause

The `hosting_deployStaticWebsite_triggerDeploy` method sends:
```json
{"archive_path": "filename.zip"}

But the Hostinger API now requires the full path relative to the account root:

{"archive_path": "public_html/filename.zip"}

Evidence

The file IS uploaded to…

Read the thread · 2026-04-14 · open · external user · 0 comments

[Bug] hosting_deployWordpressPlugin returns 400 error - API endpoint not found

Bug Report / Rapport de bug

English

Description

The hosting_deployWordpressPlugin tool fails with HTTP 400 error when attempting to deploy a WordPress plugin to a shared hosting account. The underlying API endpoint /file-manager/upload-url does not appear to exist in the public Hostinger API.

Environment

Read the thread · 2026-02-14 · closed · external user · 1 comment

[BUG] Directory permissions changed to 700 after deploying static website via hosting_deployStaticWebsite

Description

When using the hosting_deployStaticWebsite tool to upload and deploy a static website (e.g., a simple index.html), the directory permissions on the hosting server are changed, resulting in a 403 Forbidden error when accessing the site.

Steps to Reproduce

1. Create a simple static website archive containing index.html
2. Use the hosting_deployStaticWebsite tool to deploy:

   hosting_deployStaticWebsite({
     domain: "example.com",
     archivePath:…
   

Read the thread · 2026-01-04 · open · external user · 0 comments

API_TOKEN environment variable not working as documented

API_TOKEN environment variable not working as documented

Description

The MCP server fails to authenticate when using API_TOKEN as documented. Only APITOKEN (without underscore) works.

Environment

• hostinger-api-mcp version: 0.1.5
• Node.js version: 22.18.0
• MCP client: opencode

Steps to Reproduce

1. Configure MCP server with API_TOKEN environment variable as shown in README
2. Attempt any API call (e.g., getVirtualMachineListV1)
3. Receive "Unauthenticated" error

##…

Read the thread · 2025-08-19 · closed · external user · 1 comment

The remaining reports are on the project's issue tracker.