kapaweb deploy
MCPB · KAPAWEB-CONNECTOR.MCPB
Deploy websites, PHP apps and WordPress to kapaweb hosting (DirectAdmin, Plesk preview) from Claude
Available components
Last scanned (9 hours ago)
Scores higher than 82% of MCPB servers
Category Cloud Infrastructure
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security13
- No malware scan is available for this kind of package: the supply-chain vendors we use do not cover it. This is a permanent gap in our coverage, not a finding about the package.Unverified
- Known CVEs could not be checked: we found no dependency list to check in this bundle: either it runs a compiled binary, whose bundled manifests we do not read, or none of the package.json, requirements.txt, pyproject.toml or uv.lock files it ships for its runtime declares a dependency we can read (a requirements.txt that only points at a setup.py project, a local path, or a nested requirements file we cannot follow counts as none).Unverified
- No install/post-install scripts declared.Pass
- Dependency health could not be checked: we found no dependency list to check in this bundle: either it runs a compiled binary, whose bundled manifests we do not read, or none of the package.json, requirements.txt, pyproject.toml or uv.lock files it ships for its runtime declares a dependency we can read (a requirements.txt that only points at a setup.py project, a local path, or a nested requirements file we cannot follow counts as none).Unverified
Provenance & Transparency32
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- License check failed: the license (UNLICENSED) isn't a recognized OSI-approved license. See how to fix → Fail
- Actively maintained (last published 5 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability67
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 10516 tokens (~175/item across 60 items; 60 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management73
- Stability observed for 22 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 9 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 61 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 70 to 73. That category is still filling its 30-day observation window: 21 days of observed history at the previous scan, 22 at this one. The score rises as the window fills, whether or not the server changes.
- 3 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 63 to 67. That category is still filling its 30-day observation window: 19 days of observed history at the previous scan, 20 at this one. The score rises as the window fills, whether or not the server changes.
- 1 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 57 to 60. That category is still filling its 30-day observation window: 17 days of observed history at the previous scan, 18 at this one. The score rises as the window fills, whether or not the server changes.
- 30 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 50 to 53. That category is still filling its 30-day observation window: 15 days of observed history at the previous scan, 16 at this one. The score rises as the window fills, whether or not the server changes.
- 28 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.
- 25 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 33 to 37. That category is still filling its 30-day observation window: 10 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes.
- 23 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.
- 21 Oct 26 +3
- Schema quality: 158 → 175 ▼ functional
- Stability: unverified → 0.23 ▲ functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed mcpb/https://github.com/kapaweb/kapaweb-deploy/releases/download/v0.8.1/kapaweb-connector.mcpb
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | mcpb |
| Reason | No attestation published |
Background: How many MCP packages publish verified provenance →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
secret_set Store a secret for later (never shown again) ~203
Stores a secret you already have, for example a WordPress Application Password you created through its REST API, in this computer's protected storage, under a short name you choose. Put {{KW_SECRET:<name>}} in a config file written with write_file (outside the web root) to insert it there; the value itself never appears in a tool result or the chat again after this call. For a brand-new database password use db_create instead, which generates one for you. Calling this again with the same name overwrites it.
| Name | Type | Req | Description |
|---|---|---|---|
| account | string | – | Which connected hosting account this is for: its username (or username@panel). Only needed when more than one account is connected; account_info lists them. |
| name | string | yes | Short name to store it under, lowercase letters, digits, underscore, hyphen and dot (max 64), e.g. "example.gr-wp-app". |
| value | string | yes | The secret value to store. |
No output schema declared.
No examples provided.
set_php_version Select the PHP version of a domain ~121
Selects one of the versions returned by php_versions (pass its text, e.g. "PHP 8.3"). Takes effect in about a second. Afterwards verify with php_probe: effective limits and extensions differ per PHP version.
| Name | Type | Req | Description |
|---|---|---|---|
| account | string | – | Which connected hosting account this is for: its username (or username@panel). Only needed when more than one account is connected; account_info lists them. |
| domain | string | yes | The domain or subdomain. |
| version | string | yes | Exactly one of the version names from php_versions. |
No output schema declared.
No examples provided.
ssl_dry_run Why would issuing a certificate fail? ~84
Simulates issuing the certificate and lists what would fail (dnsNamesFailedChallenge = names whose DNS does not point here yet). Changes nothing.
| Name | Type | Req | Description |
|---|---|---|---|
| account | string | – | Which connected hosting account this is for: its username (or username@panel). Only needed when more than one account is connected; account_info lists them. |
| domain | string | yes | The domain. |
No output schema declared.
No examples provided.
ssl_issue Issue the free certificate ~77
Issues the Let's Encrypt certificate for the domain. Run ssl_dry_run first; DNS must point to this server.
| Name | Type | Req | Description |
|---|---|---|---|
| account | string | – | Which connected hosting account this is for: its username (or username@panel). Only needed when more than one account is connected; account_info lists them. |
| domain | string | yes | The domain. |
No output schema declared.
No examples provided.
ssl_status Certificates of a domain ~87
Lists the domain's TLS certificates and the DNS names that still have none. A new domain gets a free Let's Encrypt certificate only after its DNS points to this server.
| Name | Type | Req | Description |
|---|---|---|---|
| account | string | – | Which connected hosting account this is for: its username (or username@panel). Only needed when more than one account is connected; account_info lists them. |
| domain | string | yes | The domain. |
No output schema declared.
No examples provided.
subdomain_create Create a subdomain (e.g. staging) ~112
Creates a subdomain with its own web root (/domains/<sub>.<domain>/public_html) and its own PHP selector. Useful as a staging area before deploying to the real domain.
| Name | Type | Req | Description |
|---|---|---|---|
| account | string | – | Which connected hosting account this is for: its username (or username@panel). Only needed when more than one account is connected; account_info lists them. |
| domain | string | yes | The main domain. |
| subdomain | string | yes | Subdomain label, e.g. "staging". |
No output schema declared.
No examples provided.
subdomain_delete Delete a subdomain and its files ~119
Deletes a subdomain INCLUDING its files, but ONLY a subdomain this connector created (like db_drop), and only with the user's agreement. Any other subdomain must be removed by the user in DirectAdmin.
| Name | Type | Req | Description |
|---|---|---|---|
| account | string | – | Which connected hosting account this is for: its username (or username@panel). Only needed when more than one account is connected; account_info lists them. |
| confirm | boolean | yes | Must be true. |
| domain | string | yes | The main domain. |
| subdomain | string | yes | Subdomain label. |
No output schema declared.
No examples provided.
subdomain_list List subdomains ~64
Lists the subdomains of a domain.
| Name | Type | Req | Description |
|---|---|---|---|
| account | string | – | Which connected hosting account this is for: its username (or username@panel). Only needed when more than one account is connected; account_info lists them. |
| domain | string | yes | The main domain. |
No output schema declared.
No examples provided.
usage Current usage against the limits ~85
Used vs limit for domains, subdomains, databases, inodes, bandwidth, plus database and mailbox size. The disk figure for files can lag behind recent uploads: use disk_usage for a live number.
| Name | Type | Req | Description |
|---|---|---|---|
| account | string | – | Which connected hosting account this is for: its username (or username@panel). Only needed when more than one account is connected; account_info lists them. |
No output schema declared.
No examples provided.
write_file Write a small file ~392
Creates or overwrites a small file. Text by default (up to 1 MB), e.g. .user.ini or an app config: placeholders are filled in by the connector so secrets never pass through the chat: {{KW_DB_PASSWORD:<database>}} inserts the password of a database created with db_create; {{KW_SECRET:<name>}} inserts a secret stored with secret_set (for example a WordPress Application Password); {{KW_RANDOM:<length>}} inserts a fresh random string (for salts, app keys). Writing a web root .htaccess automatically keeps the kapaweb firewall block. Put secrets in files OUTSIDE the web root (e.g. /domains/<domain>/config/...). For one binary file (a photo, a PDF, a favicon, ...) set encoding to "base64" and put its base64 in content, up to 10 MB decoded: it is written byte for byte, with no placeholder substitution (a {{KW_...}} that happens to appear in the decoded bytes is left alone) and no restriction on being inside a web root. For a whole release use deploy, and for a single .htaccess always use text (it needs the placeholder merge, not a byte-for-byte write).
| Name | Type | Req | Description |
|---|---|---|---|
| account | string | – | Which connected hosting account this is for: its username (or username@panel). Only needed when more than one account is connected; account_info lists them. |
| content | string | yes | File content: plain text, or the file's base64 when encoding is "base64" (plain or URL-safe alphabet, with or without padding). |
| encoding | string | – | "text" (default) or "base64" for a binary file (image, PDF, ...). |
| path | string | yes | File path. |
| perm | string | – | Octal permissions, default "0644". Use "0600" for private config. |
No output schema declared.
No examples provided.
How do I install the kapaweb deploy MCP server?
kapaweb deploy ships as an MCPB bundle, a single file you download and open in an MCP host that supports MCPB bundles, such as Claude Desktop. The host reads the launch command from the bundle's own manifest, so there is no command to copy. Before opening it, check the file's SHA-256 matches the one the MCP registry declares for it, ae27edc21d3a5c404b6d0f5888fe45c0df2b55fe38230ace5079a2c7c783b50a; the commands to do that are on this page. If it does not match, do not open it.
mcpb · kapaweb-connector.mcpb
Download bundleCheck the download matches the SHA-256 the MCP registry declares before you open it. If it does not match, do not open the file.
SHA-256
ae27edc21d3a5c404b6d0f5888fe45c0df2b55fe38230ace5079a2c7c783b50a
macOS / Linux
echo "ae27edc21d3a5c404b6d0f5888fe45c0df2b55fe38230ace5079a2c7c783b50a kapaweb-connector.mcpb" | shasum -a 256 -c
Windows (PowerShell)
(Get-FileHash -Algorithm SHA256 .\kapaweb-connector.mcpb).Hash -eq "ae27edc21d3a5c404b6d0f5888fe45c0df2b55fe38230ace5079a2c7c783b50a"
Run it in the folder you saved the bundle to, then open the file with an MCPB-capable host such as Claude Desktop.
What is the kapaweb deploy MCP server?
kapaweb deploy is an MCP server listed in the public MCP registry as io.github.kapaweb/kapaweb-deploy. Deploy websites, PHP apps and WordPress to kapaweb hosting (DirectAdmin, Plesk preview) from Claude. This page covers its MCPB bundle (https://github.com/kapaweb/kapaweb-deploy/releases/download/v0.8.1/kapaweb-connector.mcpb).
Is the kapaweb deploy MCP server safe to use?
kapaweb deploy scores 51 out of 100 on VerifyMCP. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the kapaweb deploy MCP server expose?
kapaweb deploy exposes 60 tools: playbook, connect, disconnect, account_info, usage, and 55 more. Their descriptions and schemas cost roughly 10,044 tokens of context every time the server is loaded.
What licence is the kapaweb deploy MCP server under?
kapaweb deploy declares the UNLICENSED licence, which is not on the OSI-approved list. Read the terms before using it at work, and note this covers the source only, not the cost of any service it calls.