> For the complete documentation index, see [llms.txt](https://docs.hostinger.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hostinger.com/hostinger-connector/manual-configuration.md).

# Manual Configuration

Configure Hostinger's MCP server by hand for clients the Connector extension doesn't manage — the hosted remote server, the local npm package, where your API token is written, and how to load a single

[Hostinger Connector](/hostinger-connector/overview.md) configures your editor for you. Configure MCP by hand when your client isn't one the extension manages, or when you're running in CI, a container, or a script.

There are two ways to reach the same tools.

## Option A: Hosted remote server

Nothing to install and no token to manage — you sign in with OAuth 2.1 in the browser.

```json
{
  "mcpServers": {
    "hostinger": {
      "url": "https://mcp.hostinger.com"
    }
  }
}
```

This is the better choice for most clients. Use the local server instead if your client can't reach a remote MCP endpoint, or if you need an API token rather than an interactive sign-in.

## Option B: Local server

Runs [`@hostinger/mcp`](https://www.npmjs.com/package/@hostinger/mcp) on your machine over standard I/O. Requires **Node.js 20 or later**.

```json
{
  "mcpServers": {
    "hostinger": {
      "command": "npx",
      "args": ["-y", "@hostinger/mcp"],
      "env": {}
    }
  }
}
```

Leaving `env` empty is deliberate. With no token set, the server opens a browser and signs you in the first time your assistant calls a Hostinger tool. To use a token instead, put it in `env`:

```json
{
  "mcpServers": {
    "hostinger": {
      "command": "npx",
      "args": ["-y", "@hostinger/mcp"],
      "env": {
        "HOSTINGER_API_TOKEN": "YOUR_API_TOKEN"
      }
    }
  }
}
```

Restart your client after editing its config file.

## Where your API token ends up

Worth knowing whichever route you take, because it isn't obvious.

**If you connect the Connector extension with an API token,** the extension writes that token into the MCP configuration of every editor it manages — the same `HOSTINGER_API_TOKEN` field shown above. You never paste it into a config file yourself, but it does end up there. The token lives in your editor's encrypted secret storage *and* in plain text in those config files, because that's how the MCP server receives it at startup.

**If you connect with browser sign-in,** no token is written anywhere. The configuration contains no credentials at all, and OAuth tokens are kept in a separate credentials file (see below).

Two things follow from that:

* Treat any MCP config file containing `HOSTINGER_API_TOKEN` as a secret. Don't commit it, and strip the token before pasting the file into an issue or a support chat.
* **Hostinger: Disconnect** removes those entries along with the stored credentials. Disconnect before uninstalling the extension — uninstalling on its own can leave the token behind in a stale entry.

Tokens carry the permissions of the account that created them and can be set to expire. Generate and revoke them on the [API page in hPanel](https://hpanel.hostinger.com/profile/api); see [Security & Access](/account/security.md).

## Authentication

The two methods are not equal: **an API token always wins**. When `HOSTINGER_API_TOKEN` is set, no OAuth code runs at all.

Without a token, the local server uses OAuth 2.0 with PKCE on the first authenticated tool call. Expired tokens refresh on their own; if a refresh token is revoked, the browser flow relaunches. Credentials are stored outside your client's config:

* **macOS / Linux:** `~/.config/hostinger-mcp/credentials.json` (permissions `0600`)
* **Windows:** `%APPDATA%\hostinger-mcp\credentials.json`

They're shared across every Hostinger MCP binary, so signing in once covers all of them. Run the flow up front, or clear it:

```bash
npx -y @hostinger/mcp --login
npx -y @hostinger/mcp --logout
```

> Browser sign-in doesn't work over HTTP transport. Anything started with `--http` must set `HOSTINGER_API_TOKEN`.

## Loading one product instead of all 372 tools

The package ships a server per product area as well as the combined one. Pointing your client at a narrower binary gives your assistant a shorter tool list, which keeps it focused and cheaper to run:

| Binary                         | Covers                                                   |
| ------------------------------ | -------------------------------------------------------- |
| `hostinger-hosting-mcp`        | Websites, databases, files, cron jobs, PHP, Node.js      |
| `hostinger-agency-hosting-mcp` | Agency plan websites, orders, and metrics                |
| `hostinger-wordpress-mcp`      | Installations, plugins, themes, caching, maintenance     |
| `hostinger-domains-mcp`        | Availability, registration, transfers, WHOIS, forwarding |
| `hostinger-dns-mcp`            | Zones, records, snapshots                                |
| `hostinger-mail-mcp`           | Mailboxes, aliases, forwarders, autoreplies, webhooks    |
| `hostinger-vps-mcp`            | Virtual machines, firewalls, snapshots, SSH keys, Docker |
| `hostinger-ecommerce-mcp`      | Stores, products, orders, shipping, payments             |
| `hostinger-reach-mcp`          | Contacts, segments, tags, campaigns, automations         |
| `hostinger-horizons-mcp`       | Horizons websites                                        |
| `hostinger-billing-mcp`        | Catalog, orders, subscriptions, payment methods          |

Select one with `--package`:

```json
{
  "mcpServers": {
    "hostinger-vps": {
      "command": "npx",
      "args": ["-y", "--package=@hostinger/mcp", "hostinger-vps-mcp"],
      "env": {}
    }
  }
}
```

You can register several at once under different keys.

## Environment variables

| Variable              | Purpose                                                                                       |
| --------------------- | --------------------------------------------------------------------------------------------- |
| `HOSTINGER_API_TOKEN` | API token, sent as a bearer header. When set, OAuth is bypassed entirely.                     |
| `DEBUG`               | Enable debug logging (`true` / `false`). Defaults to `false`.                                 |
| `OAUTH_ISSUER`        | OAuth server base URL. Defaults to `https://auth.hostinger.com`. Ignored when a token is set. |
| `API_TOKEN`           | Deprecated alias for `HOSTINGER_API_TOKEN`. Prefer the prefixed name.                         |

## Related

* [Installation & Setup](/hostinger-connector/installation-and-setup.md) — the managed path, for supported editors
* [Using the Connector](/hostinger-connector/using-the-connector.md) — product groups, prompts, and commands
* [Troubleshooting](/hostinger-connector/troubleshooting.md) — fixing common issues
* [API Reference](/api-reference/overview.md) — the API behind these tools

***

*Last updated: September 2, 2026*