Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, email [email protected] and we’ll put it right.

io.github.hostsmith/mcp-server

NPM · @HOSTSMITH/MCP-SERVER · 2 COMPONENTS · SCANNED AUG 3

Deploy static sites on Hostsmith - give it a file, get a live HTTPS URL. EU/US residency.

+28 this week 69 Trust /100
Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security78
  • No malware found by supply-chain analysis.Pass
  • CVE check failed: a known medium-severity CVE affects @hono/node-server 1.19.17, a direct dependency. A fixed version is available. View diagnostics → Fail
  • No install/post-install scripts declared.Pass
  • Only part of the dependency tree could be resolved (97 of 101), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency97
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Cryptographically verified build provenance (signed, bound to hostsmith/mcp-server). View diagnostics → Pass
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 78 days ago).Pass
  • Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability55
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 4753 tokens (~528/item across 9 items; 9 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
  • Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Unverified: 1 category

A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · @hostsmith/mcp-server

# add to Claude Code
claude mcp add hostsmith-mcp-server -- npx -y @hostsmith/mcp-server
# add to Codex CLI
codex mcp add hostsmith-mcp-server -- npx -y @hostsmith/mcp-server
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "hostsmith-mcp-server": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@hostsmith/mcp-server"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add hostsmith-mcp-server --command npx --arg -y --arg @hostsmith/mcp-server
# ~/.hermes/config.yaml
mcp_servers:
  hostsmith-mcp-server:
    command: "npx"
    args: ["-y", "@hostsmith/mcp-server"]
// mcp.json
{
  "mcpServers": {
    "hostsmith-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@hostsmith/mcp-server"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 3 Aug 26 +49
    • GHSA-frvp-7c67-39w9 affects this package: medium security
    • Known CVEs: unverified → fail security
    • Install scripts: unverified → pass security
    • Provenance: unverified → pass security
    • Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
    • The attested source repository moved: hostsmith/mcp-server security
    • Security disclosure: unverified → fail functional
    • Schema quality: unverified → excellent functional
    • Tool coverage: unverified → 100 functional
    • License: unverified → pass functional
    • Dependency health: unverified → partial functional
    • Maintenance: unverified → pass functional
    • MCP protocol: unverified → pass functional
    • Licence: MIT functional
  • 2 Aug 26 −11
    • Tool coverage: 100 → unverified functional
    • Security disclosure: fail → unverified functional
    • First check of Schema quality: unverified functional
  • 1 Aug 26 +15
    • Malware scan: unverified → pass security
  • 31 Jul 26 −25
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 27 Jul 26 41

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/@hostsmith/[email protected]

Provenance verified

Ecosystem: npm · Outcome: verified

Reason: verified

Source repo:
hostsmith/mcp-server
Certificate issuer:
https://token.actions.githubusercontent.com
Certificate SAN:
https://github.com/hostsmith/mcp-server/.github/workflows/release.yml@refs/heads/main
Rekor log index:
1553444892
Predicate type:
https://slsa.dev/provenance/v1
Subject digest:
sha512:149bf51615f051eeebc314a86bf390e9de8440a1572493a73dcd7cd024325598799f69d37e37b5ea614059194ea826d78a48cf3bb60f7e67435fe4e2e
Discovery method:
attestation_endpoint
Vulnerabilities 1 finding
ID CVE Severity Vector Fix available
GHSA-frvp-7c67-39w9 medium CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N yes
Dependencies 97 packages

97 packages in the resolved dependency tree · 96 deprecated · 29 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 9 exposed · ~3,709 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens
create_site ~492

Create a new Hostsmith site and return its `siteId`, full URL, and configuration. Use when the user wants to publish or host new content and no suitable site already exists. After creation, deploy content with `deploy_files` (small inline text) or `deploy_create_upload` + `deploy_finalize` (binaries / files > ~1 MB, uploaded directly to S3). The site-resolution and confirmation flow is described in the global server instructions; the rules below are specific to this tool's parameters. `domain` MUST be one of the domains returned by `list_domains` for this user - never invent or assume one. The selected domain must be in `active` status; if it isn't, surface the problem to the user instead of attempting creation. `partition` passed to this tool MUST match the partition of the selected domain. Subdomain selection must respect the domain's capabilities from `list_domains`. To serve the bare apex, pass `subdomain: "www"` - only valid when the domain has `enableApexDomain: true` (typically custom domains the user owns). For any other subdomain, the domain must have `enableSubdomains: true`; shared hosting domains (e.g. `*.hostsmith.link`) and most custom domains have `enableApexDomain: false`, so a non-apex subdomain is required there. If the chosen domain doesn't support the kind of site the user asked for (apex vs subdomain), surface the conflict rather than silently picking something else.

NameTypeReqDescription
domainstringyesParent domain for the site, MUST be one returned by `list_domains` for this user. Examples: "us.hostsmith.link", "eu.hostsmith.link", or a custom domain the user owns. Do not invent domains.
partitionstringData partition for the new site. Must match the partition of the selected domain.
subdomainstringSubdomain prefix; auto-generated if omitted. Lowercase alphanumeric with hyphens only - no dots, uppercase, or underscores. Pass `subdomain: "www"` only when the chosen `domain` has `enableApexDomain…

No output schema declared.

No examples provided.

delete_site ~152

Permanently delete a Hostsmith site and all of its deployed files. **Destructive - only call after explicit user confirmation.** The site URL becomes unreachable immediately and the content cannot be recovered. The user must pass `confirm: true` for the deletion to proceed; otherwise the call returns an error explaining the safeguard.

NameTypeReqDescription
confirmbooleanSet to true only after the user has explicitly confirmed they want to permanently delete this site. Required safeguard - never pass true speculatively.
partitionstringData partition the site lives in. Omit to use the user's home partition.
siteIdstringyesThe site ID to delete (from `list_sites` or `get_site`).

No output schema declared.

No examples provided.

deploy_create_upload ~2,041

Start a direct-to-S3 upload for binary or large files. Use this instead of `deploy_files` for binaries (PDF, image, video, zip) or any file > ~1 MB. The MCP server has no access to the user's filesystem and `deploy_files` ships content inline through Lambda (capped at ~6 MB JSON-RPC payloads); this tool returns presigned S3 PUT URLs so the file bytes flow directly from your environment to S3, never through the MCP server. **Bundle into a zip first when:** the upload contains more than 3 files OR any file is larger than ~1 MB. The fileWorker auto-extracts a single-zip upload after promotion, so subdirectories are preserved end-to-end and you avoid one PUT round-trip per file. Skip zipping only for the trivial single-small-file case (e.g. one HTML). Bash bundle-and-deploy template (the agent should adapt fileNames and the cleanup prompt): TMP=$(mktemp -d) zip -r "$TMP/site.zip" index.html styles.css img/ # add every file/dir to deploy SIZE=$(stat -c%s "$TMP/site.zip" 2>/dev/null || stat -f%z "$TMP/site.zip") # 1. call deploy_create_upload with { siteId, files: [{ fileName: "site.zip", fileSize: $SIZE }] } # 2. PUT $TMP/site.zip to the returned URL(s) per the protocol below, capturing ETag # 3. call deploy_finalize with { siteId, versionId, completions: [...] } # 4. ASK THE USER: "Deploy succeeded. Remove temp folder $TMP? [y/N]" # Only run `rm -rf "$TMP"` after explicit confirmation; otherwise leave it for them to inspect. Three-step protocol: 1. Call this tool with `{ siteId, files: [{ fileName, fileSize }] }`. Receive `{ versionId, files: { [fileName]: { uploadId, key, partUploadUrls: [{ part, url }], partSize, expiresAt } } }`. 2. For each file, slice the bytes into chunks of `partSize` and PUT each chunk to its `partUploadUrls[i].url`. **Capture the `ETag` response header from every PUT** - you will need it for finalize. Single-part (small file, one URL): `curl -D - -X PUT --data-binary @file.pdf "$URL"`, then grep th…

NameTypeReqDescription
filesarrayyesFiles to upload. Most user requests are a single file.
partitionstringData partition the site lives in. Omit to use the user's home partition.
siteIdstringyesThe site ID to deploy to (from `list_sites` or `create_site`).

No output schema declared.

No examples provided.

deploy_files ~315

Publish in-memory file contents to a Hostsmith site without writing to disk. Use when you have just generated content (an HTML page, a report, JSON data) and the user wants it live. Returns the deployment version and status; call `get_site` afterwards if you need the public URL to share. The site must already exist - call `create_site` first if you do not have a `siteId`. Deploying to a site that already has content overwrites it - confirm overwrite with the user first. **Anti-pattern:** do not use this tool to ship binaries (images, PDFs, video, fonts, zips) by base64-embedding or data-URI inlining them into HTML/CSS/JSON. Binaries belong on `deploy_create_upload`. If that path is blocked by sandbox/network, escalate to the user (ask them to enable egress, or offer manual upload of the presigned URL) - never reach for this tool as a workaround. Inlining bloats pages, breaks browser caching, and reships the bytes on every deploy.

NameTypeReqDescription
filesarrayyesFiles to deploy. For an HTML site, include an `index.html` as the entry point; otherwise any single file (PDF, image, JSON, etc.) works on its own.
partitionstringData partition the site lives in. Omit to use the user's home partition.
siteIdstringyesThe site ID to deploy to (from `list_sites` or `create_site`).

No output schema declared.

No examples provided.

deploy_finalize ~203

Commit a deploy started with `deploy_create_upload`. Pass the `versionId` from the start response and a `completions` array containing the agent-collected ETags for each multi-part file (single-part uploads - those whose start response had an empty `uploadId` - do not need a completion entry). Returns the live site URL on success. The site must belong to the authenticated user; bearer-token auth is re-validated server-side, so holding presigned URLs alone does not let an unrelated caller finalize.

NameTypeReqDescription
completionsarrayCompletions for multi-part uploads. Omit or pass an empty array if every file was single-part.
partitionstringData partition the site lives in. Omit to use the user's home partition.
siteIdstringyesThe site ID being deployed to (must match the start call).
versionIdstringyesThe `versionId` returned by `deploy_create_upload`.

No output schema declared.

No examples provided.

get_account ~85

Get the user's account: organization details (`orgId`, `orgName`), the calling user's home partition under `user.homePartition`, current subscription plan with its limits (max sites, max domains, storage, bandwidth), and current usage counts. Use to check how much headroom the user has before creating new sites or to confirm plan-tier features. Usage is summed across all partitions.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

get_site ~159

Get full details of a specific Hostsmith site by ID, including its public URL (`https://<subdomain>.<domain>`), current deployment status, and configuration. Use after `list_sites` to inspect a single site, or after `deploy_files` / `deploy_finalize` to confirm the site is live and grab the URL to share with the user. Defaults to the user's home partition; pass `partition` explicitly when the site lives in a different one (visible in `list_sites` output).

NameTypeReqDescription
partitionstringData partition the site lives in (visible in list_sites output). Omit to use the user's home partition.
siteIdstringyesThe site ID returned by `list_sites` or `create_site`.

No output schema declared.

No examples provided.

list_domains ~121

List domains the user can host sites under. Returns shared hosting domains (e.g. `hostsmith.link`, available to everyone) and custom domains owned by the user's organization. Use this to pick a `domain` value before calling `create_site`. By default queries all partitions and merges; pass `partition` or `shared` to narrow.

NameTypeReqDescription
partitionstringFilter by data partition. Omit to query all partitions.
sharedbooleanFilter by domain type: true for shared only, false for custom only. Omit for both.

No output schema declared.

No examples provided.

list_sites ~141

List Hostsmith sites in the user's account. Returns each site's `siteId`, `subdomain`, `domain`, and current status - feed `siteId` into `get_site`, `deploy_files`, `deploy_create_upload`, or `delete_site`. This is the source of truth for "does the user already have a site at FQDN X" - call it before any create/deploy/delete to resolve the user's site reference. By default queries all data partitions and merges the results; pass `partition: "us"` or `"eu"` to limit the query.

NameTypeReqDescription
partitionstringFilter by data partition. Omit to query all partitions.

No output schema declared.

No examples provided.