Websupport

Name: Websupport
Author: tydung26

by tydung26version 0.1.1i★ –iRuns on your computer

Registry nameio.github.tydung26/websupport-mcp

Install

Overview

Description from the maker (original English)

Manage a Websupport account: DNS, FTP, hosting, databases, mailboxes, VPS and invoices.

PopNx MCP’s three pillars

These three are never merged into one score: opinions, measurements and popularity are different things.

User voiceiNo reviews yetReviews open together with accounts in a later step
Our basic checksi1 of 1 passedChecked from public information; code not scanned yet
UsageiVery new↓ 39/wk · ★ –

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

Connection: Runs on your computer
Transport: stdio
Category: Developer tools
You need to fill in: WEBSUPPORT_API_KEY, WEBSUPPORT_API_SECRET

Install

Pick the AI app you use, then copy the settings.

Before you install

Basic checks: 1 of 1 passed
Runs on your computer with your user’s permissions (files, network, apps).
You fill in yourself: WEBSUPPORT_API_KEY, WEBSUPPORT_API_SECRET, WEBSUPPORT_API_BASE_URL, WEBSUPPORT_ACCEPT_LANGUAGE, WEBSUPPORT_ALLOW_WRITE, WEBSUPPORT_ALLOW_DESTRUCTIVE

Values marked secret are keys to your account. Never share them or paste them into a chat.

You need

npmNode.js installed (for the npx command)

Which app do you use?

ClaudeClaude CodeCursorVS CodeChatGPT

Pick your app above. We remember it, so next time the button says “Install in …”.

Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json

{
  "mcpServers": {
    "websupport": {
      "command": "npx",
      "args": [
        "-y",
        "websupport-mcp"
      ],
      "env": {
        "WEBSUPPORT_API_KEY": "your-value",
        "WEBSUPPORT_API_SECRET": "your-value",
        "WEBSUPPORT_API_BASE_URL": "your-value",
        "WEBSUPPORT_ACCEPT_LANGUAGE": "your-value",
        "WEBSUPPORT_ALLOW_WRITE": "your-value",
        "WEBSUPPORT_ALLOW_DESTRUCTIVE": "your-value"
      }
    }
  }
}

Run this in your terminal

claude mcp add websupport --env WEBSUPPORT_API_KEY=your-value --env WEBSUPPORT_API_SECRET=your-value --env WEBSUPPORT_API_BASE_URL=your-value --env WEBSUPPORT_ACCEPT_LANGUAGE=your-value --env WEBSUPPORT_ALLOW_WRITE=your-value --env WEBSUPPORT_ALLOW_DESTRUCTIVE=your-value -- npx -y websupport-mcp

Fill in the empty values before running it.

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "websupport": {
      "command": "npx",
      "args": [
        "-y",
        "websupport-mcp"
      ],
      "env": {
        "WEBSUPPORT_API_KEY": "your-value",
        "WEBSUPPORT_API_SECRET": "your-value",
        "WEBSUPPORT_API_BASE_URL": "your-value",
        "WEBSUPPORT_ACCEPT_LANGUAGE": "your-value",
        "WEBSUPPORT_ALLOW_WRITE": "your-value",
        "WEBSUPPORT_ALLOW_DESTRUCTIVE": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "websupport": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "websupport-mcp"
      ],
      "env": {
        "WEBSUPPORT_API_KEY": "your-value",
        "WEBSUPPORT_API_SECRET": "your-value",
        "WEBSUPPORT_API_BASE_URL": "your-value",
        "WEBSUPPORT_ACCEPT_LANGUAGE": "your-value",
        "WEBSUPPORT_ALLOW_WRITE": "your-value",
        "WEBSUPPORT_ALLOW_DESTRUCTIVE": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

This one runs on your computer, and ChatGPT can only connect to servers on the internet. Pick another app.

Your choice stays on this device in a cookie; no account needed.

Values you fill in

WEBSUPPORT_API_KEY required env
API key identifier from WebAdmin (Security -> API keys). Generate a Standard pair; a DynDNS pair authenticates against one endpoint only.
WEBSUPPORT_API_SECRET secret required env
API secret paired with the key. Used only to sign requests; it is never transmitted.
WEBSUPPORT_API_BASE_URL env
Market selection. Defaults to https://rest.websupport.sk. Also live: rest.websupport.cz, rest.websupport.hu, rest.websupport.se.
WEBSUPPORT_ACCEPT_LANGUAGE env
Language for API responses.
WEBSUPPORT_ALLOW_WRITE env
Set to 1 to register the 13 write tools. Omit for a read-only deployment, where they never appear in tools/list at all.
WEBSUPPORT_ALLOW_DESTRUCTIVE env
Set to 1 to register the 7 destructive tools, each of which also requires confirm: true on every call. Independent of WEBSUPPORT_ALLOW_WRITE.

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

Runs on your computer; the tool list appears in your AI app after you install it.

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 9, 2026

✓ Pass
Maker matches the repo
The registry name was verified with the GitHub account tydung26, which owns the repo
… Not checked yet
Still maintained
We have not read this repo from GitHub yet
… Not checked yet
Has a licence
We have not read this repo from GitHub yet
– Not applicable
Endpoint responds
This one runs on your computer; there is no internet endpoint
– Not applicable
Sign-in with OAuth
Runs on your computer and uses local settings instead
… Not checked yet
No hidden instructions in tool descriptions
Runs on your computer; we can only read tool lists from internet endpoints

Compared with others in Developer toolsi

More stars than 0% of the other 5574 servers in this category
Published to the registry more recently than 33% of the other 5574 servers in this category
Basic checks equal to or better than 100% of the other 5574 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Common questions

Is Websupport safe?

It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.

What keys or codes does it need?

You need to fill in: WEBSUPPORT_API_KEY, WEBSUPPORT_API_SECRET

Does it run on my computer or in the cloud?

It runs on your computer. Your AI app starts it when needed, and data does not pass through the maker’s servers (unless it calls an online service itself).

Is it still maintained?

The GitHub repo last changed –, and the latest version (0.1.1) reached the registry 3 months ago.

Which apps can use it?

Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. You also need Node.js on your computer.

What can I use instead?

In the same category: GitHub, Desktop Commander, Cloudflare MCP

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:↓ Downloads per weeki★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

GitHub

GitHub’s official server lets AI read and manage code, issues and pull requests in your account. Use GitHub’s hosted version or run it locally with Docker.

by githubWidely used★ 34.2KUpdated 6 days ago

Computer or cloud

Install

Desktop Commander

MCP server for terminal commands, file operations, and process management

by wonderwhy-erWidely used↓ 709.6K/wk★ 10.2KUpdated 18 days ago

Runs on your computer

Install

Cloudflare MCP

Cloudflare MCP servers

by cloudflareWidely used★ 4.4KUpdated 14 months ago

Runs in the cloud✓ mcp.cloudflare.com

Install

README from the maker

Open the README

Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.

websupport-mcp

An MCP server (TypeScript, ESM, stdio) wrapping the Websupport REST API v1 + v2 — DNS, FTP, hosting, databases, mailboxes, VPS and invoices — exposed as MCP tools with signed HMAC-SHA1 authentication.

Status: early. All 50 tools are implemented and published, but most have been verified only as far as reaching the API — routes, signing and error handling are proven; response shapes largely are not. Read docs/verification-matrix.md before relying on any tool, and see IMPLEMENTATION_PLAN.md for progress.

Risk tiers

Tools are registered in three tiers, and the tier gates registration — a read-only deployment never sees a write tool in tools/list at all, so it costs no client context and offers no affordance.

Tier	Opt-in	Extra per-call gate	Currently
`read`	always on	—	30 tools
`write`	`WEBSUPPORT_ALLOW_WRITE=1`	—	13 tools
`destructive`	`WEBSUPPORT_ALLOW_DESTRUCTIVE=1`	`confirm: true` argument	7 tools

A tool is destructive when it destroys state you cannot cheaply recreate — not merely because it writes. A graceful VPS reboot is write; a hard power-cycle is destructive, because it can corrupt in-flight writes. Taking a snapshot is write; restoring one is destructive, because it discards everything since.

The two opt-ins are independent: WEBSUPPORT_ALLOW_DESTRUCTIVE=1 alone does not unlock write tools, and vice versa.

The confirm: true argument, not MCP elicitation, is the safety boundary. Protocol negotiation may settle well below the revision that supports elicitation — this server's SDK currently tops out at 2025-11-25 — and a gate that disappears against an older client is not a gate.

Install

Requires Node >= 22. Nothing to install ahead of time — npx fetches the package on first run.

Add this to your MCP client's configuration:

"mcpServers": { "websupport": { "command": "npx", "args": ["-y", "websupport-mcp"], "env": { "WEBSUPPORT_API_KEY": "…", "WEBSUPPORT_API_SECRET": "…" } } } }

That gives you the 30 read-only tools. Nothing in that configuration can change your account.

To allow changes, add only the opt-ins you need — see Risk tiers above:

"env": {

"WEBSUPPORT_API_KEY": "…", "WEBSUPPORT_API_SECRET": "…", "WEBSUPPORT_ALLOW_WRITE": "1", "WEBSUPPORT_ALLOW_DESTRUCTIVE": "1" }

Ready-made configurations for each combination live in examples/mcp-config/. Pin a version with websupport-mcp@0.1.1 in place of websupport-mcp.

Once it is wired up, ask your client to run ws_auth_check. It returns {"verified": true} when the credentials work, which is the quickest way to separate a bad key from anything else.

Docker

A Dockerfile is included, for hosts that run containers rather than npx and for registry build sandboxes:

docker build -t websupport-mcp .

docker run -i --rm -e WEBSUPPORT_API_KEY -e WEBSUPPORT_API_SECRET websupport-mcp

-i is not optional — the transport is stdio. No credentials are baked into the image; pass them per run.

From a local checkout

For development, or to run unreleased changes:

npm install

npm run build

Then point command at node and args at the built entrypoint ( /dist/index.js) instead of npx.

Credentials

Generate a Standard API access pair in WebAdmin (Security → API keys). A DynDNS-only pair authenticates against /nic/update and nothing else.

Variable	Required	Default	Notes
`WEBSUPPORT_API_KEY`	yes	—	The pair's identifier.
`WEBSUPPORT_API_SECRET`	yes	—	The pair's secret. Used for HMAC-SHA1 signing; never logged, never returned in an error.
`WEBSUPPORT_API_BASE_URL`	no	`https://rest.websupport.sk`	Market selection — see below.
`WEBSUPPORT_ACCEPT_LANGUAGE`	no	`en_us`	One of `en_us`, `sk`, `cs_cz`, `hu`.
`WEBSUPPORT_ALLOW_WRITE`	no	off	Set to `1` to register write tools.
`WEBSUPPORT_ALLOW_DESTRUCTIVE`	no	off	Set to `1` to register destructive tools.

Copy .env.example for local development. .env is gitignored.

Missing credentials do not stop the server. It starts, registers its tools and answers tools/list unauthenticated — which is what registry build sandboxes, MCP Inspector and client config probes do before anyone holds a key — and the first tool call then fails with a message naming the variable that is absent.

Markets

Websupport is a regional team.blue/Loopia brand, so the API host selects the market. The same application serves every host — GET /v2/docs/openapi.json is byte-identical across all of them — so switching markets is configuration, never a code change.

Market	`WEBSUPPORT_API_BASE_URL`
Slovakia (default)	`https://rest.websupport.sk`
Czechia	`https://rest.websupport.cz`
Hungary	`https://rest.websupport.hu`
Sweden	`https://rest.websupport.se`

An unrecognised host warns to stderr and is used anyway, so a newly added market works without waiting for a release.

Documentation

Document	What it holds
`docs/tools.md`	Every tool: tier, method + path, confirm requirement. Generated from the registry — never hand-edited.
`docs/verification-matrix.md`	What has actually been proven about each tool, and what has not. Read this before trusting any tool in production.
`docs/system-architecture.md`	The request path, the signing contract and its three counter-intuitive rules, and how the tier model works.
`docs/codebase-summary.md`	Module map — what lives where and why.
`examples/mcp-config/`	Ready-to-edit client configurations for each tier combination.

Scope

Order creation and invoice/order payment endpoints are deliberately out of scope and are asserted absent by test. v1 DNS-record CRUD and v1 FTP-account CRUD are deprecated upstream and are not exposed — the v2 tools cover both.

Development

npm test              # offline suite

npm run test:network # live, unauthenticated probes (market hosts + OpenAPI drift) npm run typecheck npm run lint npm run build

Network suites are separated deliberately: a Websupport outage must not fail the build.

Toolchain

Node >= 22, to run or to build. Node 20 reached end of life on 2026-04-30 and is not supported. CI covers the two live LTS lines, 22 and 24, and builds and smoke-tests the bundle on each.

Building also needs npm >= 11: npm 10 cannot resolve the bundler's dependency tree and fails with an unhelpful Cannot read properties of null (reading 'edgesOut'). If you hit that, upgrade npm rather than debugging the repository.

Security

The credentials this server holds grant full control of a Websupport account — there is no read-only API pair. SECURITY.md covers how they are handled, which tools return sensitive data, and how to report a vulnerability privately.

Contributing

See CONTRIBUTING.md. Note two boundaries enforced by test rather than review: no order or payment endpoints, and every destructive tool must declare confirm: true.

Licence

MIT — see LICENSE.

Websupport

Overview

PopNx MCP’s three pillars

What you can do with it

Install

Before you install

Values you fill in

What it can do

Basic checksi

Maker matches the repo

Still maintained

Has a licence

Endpoint responds

Sign-in with OAuth

No hidden instructions in tool descriptions

Compared with others in Developer toolsi

Common questions

Alternatives

GitHub

Desktop Commander

Cloudflare MCP

README from the maker

websupport-mcp

Risk tiers

Install

Docker

From a local checkout

Credentials

Markets

Documentation

Scope

Development

Toolchain

Security

Contributing

Licence