Hostkey MCP Server
MCP server for Hostkey (.com portal, InvAPI invapi.hostkey.com).
Runs locally over stdio — Cursor, VS Code, and other MCP clients.
Hosted remote: https://mcp.hostkey.com/mcp (cloud agents).
Gives the model access to your Hostkey account: servers, catalog and ordering, power, OS reinstall, network, DNS, snapshots, IPMI/console, ISO, S3, Remote Hands, billing, and API keys.
1. Get an API key
InvAPI → API keys → create a key.
Prefer a dedicated key for MCP. Per-server keys limit access to one server.
DNS writes need the pdns/edit permission.
2. Install
Cursor
Click the button, replace YOUR_API_KEY with your InvAPI key, then confirm.
Or add to .cursor/mcp.json manually:
{
"mcpServers": {
"hostkey-mcp-server": {
"command": "npx",
"args": ["-y", "hostkey-mcp-server"],
"env": {
"HOSTKEY_API_KEY": "your-api-key"
}
}
}
}
Remote (cloud agents)
No local Node/npx. Point the client at the hosted endpoint and send your InvAPI key:
{
"mcpServers": {
"hostkey": {
"url": "https://mcp.hostkey.com/mcp",
"headers": {
"Authorization": "Bearer your-api-key"
}
}
}
}
VS Code
.vscode/mcp.json:
{
"servers": {
"hostkey-mcp-server": {
"command": "npx",
"args": ["-y", "hostkey-mcp-server"],
"env": {
"HOSTKEY_API_KEY": "your-api-key"
}
}
}
}
Optional: HOSTKEY_TOKEN_TTL, HOSTKEY_HTTP_TIMEOUT, HOSTKEY_ALLOW_DESTRUCTIVE
(see .env.example).
From source (Node.js ≥ 22.18): npm install && npm run build.
3. Confirming dangerous operations
Every write call needs confirm=true. Without it, nothing changes.
Also:
order_serverdefaults todry_run— a real order only after explicit consent;- OS reinstall, PXE, and service cancellation require
HOSTKEY_ALLOW_DESTRUCTIVE=1; - passwords and tokens are masked in responses.
Long jobs (deploy, reinstall) return a callback key — poll with check_task.
4. Tools
Groups (full list via tools/list):
Prompts
Or just ask: “list my servers” / “order a VPS in NL”.