Kapaweb Deploy

kapaweb deploy

Deploy websites, PHP apps and WordPress to kapaweb hosting (DirectAdmin; Plesk in preview) from a conversation with Claude, without your hosting password ever entering the chat. The plugin bundles the kapaweb connector, a local MCP server that runs on your computer, and a skill that tells Claude how to use it safely.

Requirements

• A hosting account at kapaweb (https://kapaweb.gr) on a DirectAdmin server, or on a Plesk server (Plesk support is a preview).
• Node.js 18.17 or newer on the computer that runs Claude. The connector has no dependencies and nothing to build.
• A Claude surface that starts local MCP servers: Claude Code, or Cowork sessions that run on your computer. Claude chat on the web does not start local servers, so use the Claude Desktop extension from https://kapaweb.gr/deploy-with-ai/ there.

Use it

Ask Claude to deploy a project to kapaweb. The skill makes Claude read the public playbook (https://kapaweb.gr/deploy-with-ai/playbook.md), check that the connector is current, and call connect. connect opens a sign-in page on your own computer (http://127.0.0.1, random port and token): you type your DirectAdmin address, username and password there, never in the chat. The connector exchanges the password for a restricted DirectAdmin login key, forgets the password, and keeps only the key in your computer's protected storage (Windows DPAPI, macOS Keychain, Linux secret-tool). Plesk (preview): Plesk does not let a customer create a limited key, so for a Plesk account the connector keeps your Plesk password itself in the same protected storage and uses it for every request to your own Plesk panel; the sign-in page tells you this before you sign in, disconnect removes it, and Claude never sees it.

Tools: deploy (always makes a backup first), rollback, list_files, read_file, write_file, db_create, db_import, db_export (streamed, any size, saved on your computer), files_archive, files_extract, files_upload, files_download (zip, unzip, upload and download of files of any size; list_files pages through folders of any size), node_* and files_* (Plesk preview: the Node.js extension and the File Manager of a Plesk subscription), php_versions, set_php_version, php_settings, ssl_status, cron_*, subdomain_*, check_url, logs, usage, account_info, playbook, connect, disconnect. Read-only tools are annotated readOnlyHint, destructive ones destructiveHint.

What it runs, stores and sends

• Runs node server/index.js from this plugin, on your computer, over stdio. On macOS it calls security (Keychain), on Linux secret-tool, on Windows PowerShell DPAPI, to store and read its own login key; it opens your browser on the local sign-in page.
• Sends requests only to: your own kapaweb DirectAdmin or Plesk panel (the address you typed; it is checked against kapaweb's own server list before every connection); https://firewall.kapaweb.gr/servers.txt (that list of kapaweb server addresses); https://kapaweb.gr/deploy-with-ai/playbook.md (the playbook); https://kapaweb.gr/downloads/kapaweb-connector.version.json (a version check at most once a day, nothing is sent but the User-Agent kapaweb-connector/<version>; KAPAWEB_CONNECTOR_NO_UPDATE_CHECK=1 turns it off); and, only when you ask for it with check_url, the domains of your own hosting account (plus a short fixed list of sites that kapaweb itself maintains).
• Stores on your computer: the saved connection (panel address, user name, key id; no password), the login key (for a Plesk account: the Plesk password, see above) and generated database passwords in the protected storage, and database exports you ask for in the connector's settings folder. Nothing is sent to kapaweb for analytics, and nothing about you is collected by this plugin.
• Never shows Claude your password (the Plesk password included), the login key or generated database passwords.

Privacy policy

Kapaweb (https://kapaweb.gr, [email protected]) provides this plugin.

• What we collect: nothing. The plugin has no accounts, no analytics and no telemetry on our side.
• What stays on your computer: the address, user name and key id of your hosting panel; a restricted DirectAdmin login key (for a Plesk account instead: your Plesk password, because Plesk gives customers no limited key) and generated database passwords (in your operating system's protected storage); and the database exports you ask for. On DirectAdmin your hosting password is used once, to create the key, and is then forgotten; on Plesk it is kept in the protected storage until you disconnect. All of this stays until you delete it: disconnect, or remove the key in DirectAdmin under Login Keys (for Plesk: also change the Plesk password if the computer is shared or lost). The key expires (30 days by default; you can choose 90 days, a year, or never) and can be revoked at any time.
• Where data goes: to your own hosting panel (the files, databases, settings and logs of your account, as far as you ask Claude to work on them). The requests to kapaweb.gr and firewall.kapaweb.gr listed above carry no personal data except the usual network data (your IP address, the time, the file requested and the User-Agent kapaweb-connector/<version>), which kapaweb's web server records in its normal access log. What the tools return (file listings, logs, command results) is given to Claude, the AI app you use, and is covered by that app's own terms and privacy policy.
• Third parties: we share nothing with anyone. No advertising, no sale of data.
• Retention: local data stays until you remove it (see above); kapaweb's web server logs follow kapaweb's normal log retention.
• Children: this is a business tool and is not intended for people under 18.
• Contact: [email protected].

Notes for reviewers

The directory scan holds this plugin for review because its heuristics see "a credential" near "a remote host". What each finding points at (all checked in the source):

• server/da.js: ssd5.kdns.gr appears only in a code comment (the example shape of a panel address). The panel address the user typed is checked against kapaweb's own server list (verifyPanelHost) and the connection is pinned to the verified IP address before the login key is ever sent.
• server/setup.js: ${h} is a JavaScript template literal in the Origin check of the local sign-in page (http://127.0.0.1:<random port>); it is not a host and no secret is sent to it.
• server/tools.js: kapaweb.gr is a comment and the public playbook URL. That request carries only the header User-Agent: kapaweb-connector (no key, no password).
• server/plesk.js, server/plesk-web.js, server/provision-plesk.js (Plesk preview): they talk only to the Plesk panel the user typed, which is checked against kapaweb's own server list and pinned to the verified IP address first, like the DirectAdmin one; the Plesk password goes only there (a login form post, or a Basic auth header), never to Claude or to any other host.
• server/clients.js: this file builds help text for the user and mentions the path ~/.claude.json inside that text. It reads no file and sends nothing.

The credentials the plugin handles are those of the user's own hosting account. On DirectAdmin: the restricted login key, created from a password typed once on the local sign-in page, which is then forgotten. On Plesk (preview): the Plesk password itself, because Plesk lets a customer create no restricted key; it is typed on the same local page, and the page says so before the user signs in. In both cases the secret is kept in the operating system's protected storage and sent only to that user's own verified kapaweb panel. The plugin does not read any other credential, environment token or file from the user's computer.

License

MIT. See the LICENSE file.