Manual Configuration

Configure Hostinger's MCP server by hand for clients the Connector extension doesn't manage — the hosted remote server, the local npm package, where your API token is written, and how to load a single

Hostinger Connector configures your editor for you. Configure MCP by hand when your client isn't one the extension manages, or when you're running in CI, a container, or a script.

There are two ways to reach the same tools.

Option A: Hosted remote server

Nothing to install and no token to manage — you sign in with OAuth 2.1 in the browser.

{
  "mcpServers": {
    "hostinger": {
      "url": "https://mcp.hostinger.com"
    }
  }
}

This is the better choice for most clients. Use the local server instead if your client can't reach a remote MCP endpoint, or if you need an API token rather than an interactive sign-in.

Option B: Local server

Runs @hostinger/mcp on your machine over standard I/O. Requires Node.js 20 or later.

{
  "mcpServers": {
    "hostinger": {
      "command": "npx",
      "args": ["-y", "@hostinger/mcp"],
      "env": {}
    }
  }
}

Leaving env empty is deliberate. With no token set, the server opens a browser and signs you in the first time your assistant calls a Hostinger tool. To use a token instead, put it in env:

{
  "mcpServers": {
    "hostinger": {
      "command": "npx",
      "args": ["-y", "@hostinger/mcp"],
      "env": {
        "HOSTINGER_API_TOKEN": "YOUR_API_TOKEN"
      }
    }
  }
}

Restart your client after editing its config file.

Where your API token ends up

Worth knowing whichever route you take, because it isn't obvious.

If you connect the Connector extension with an API token, the extension writes that token into the MCP configuration of every editor it manages — the same HOSTINGER_API_TOKEN field shown above. You never paste it into a config file yourself, but it does end up there. The token lives in your editor's encrypted secret storage and in plain text in those config files, because that's how the MCP server receives it at startup.

If you connect with browser sign-in, no token is written anywhere. The configuration contains no credentials at all, and OAuth tokens are kept in a separate credentials file (see below).

Two things follow from that:

• Treat any MCP config file containing HOSTINGER_API_TOKEN as a secret. Don't commit it, and strip the token before pasting the file into an issue or a support chat.

• Hostinger: Disconnect removes those entries along with the stored credentials. Disconnect before uninstalling the extension — uninstalling on its own can leave the token behind in a stale entry.

Tokens carry the permissions of the account that created them and can be set to expire. Generate and revoke them on the API page in hPanel; see Security & Access.

Authentication

The two methods are not equal: an API token always wins. When HOSTINGER_API_TOKEN is set, no OAuth code runs at all.

Without a token, the local server uses OAuth 2.0 with PKCE on the first authenticated tool call. Expired tokens refresh on their own; if a refresh token is revoked, the browser flow relaunches. Credentials are stored outside your client's config:

• macOS / Linux: ~/.config/hostinger-mcp/credentials.json (permissions 0600)

• Windows: %APPDATA%\hostinger-mcp\credentials.json

They're shared across every Hostinger MCP binary, so signing in once covers all of them. Run the flow up front, or clear it:

npx -y @hostinger/mcp --login
npx -y @hostinger/mcp --logout

Browser sign-in doesn't work over HTTP transport. Anything started with --http must set HOSTINGER_API_TOKEN.

Loading one product instead of all 372 tools

The package ships a server per product area as well as the combined one. Pointing your client at a narrower binary gives your assistant a shorter tool list, which keeps it focused and cheaper to run:

Binary	Covers
hostinger-hosting-mcp	Websites, databases, files, cron jobs, PHP, Node.js
hostinger-agency-hosting-mcp	Agency plan websites, orders, and metrics
hostinger-wordpress-mcp	Installations, plugins, themes, caching, maintenance
hostinger-domains-mcp	Availability, registration, transfers, WHOIS, forwarding
hostinger-dns-mcp	Zones, records, snapshots
hostinger-mail-mcp	Mailboxes, aliases, forwarders, autoreplies, webhooks
hostinger-vps-mcp	Virtual machines, firewalls, snapshots, SSH keys, Docker
hostinger-ecommerce-mcp	Stores, products, orders, shipping, payments
hostinger-reach-mcp	Contacts, segments, tags, campaigns, automations
hostinger-horizons-mcp	Horizons websites
hostinger-billing-mcp	Catalog, orders, subscriptions, payment methods

Select one with --package:

{
  "mcpServers": {
    "hostinger-vps": {
      "command": "npx",
      "args": ["-y", "--package=@hostinger/mcp", "hostinger-vps-mcp"],
      "env": {}
    }
  }
}

You can register several at once under different keys.

Environment variables

Variable	Purpose
HOSTINGER_API_TOKEN	API token, sent as a bearer header. When set, OAuth is bypassed entirely.
DEBUG	Enable debug logging (true / false). Defaults to false.
OAUTH_ISSUER	OAuth server base URL. Defaults to https://auth.hostinger.com. Ignored when a token is set.
API_TOKEN	Deprecated alias for HOSTINGER_API_TOKEN. Prefer the prefixed name.

Related

• Installation & Setup — the managed path, for supported editors

• Using the Connector — product groups, prompts, and commands

• Troubleshooting — fixing common issues

• API Reference — the API behind these tools

---

Last updated: September 2, 2026