MCP Server (AI Integration)

The MCP Server extension connects external AI tools — Claude, ChatGPT, Cursor, VS Code, and any other client speaking the open Model Context Protocol (MCP) — directly to your panel. It's installed as an opt-in extension via the marketplace; the panel core is untouched unless it's enabled.

Security model in one sentence

The tool set is mostly read-only, with a handful of safe write actions — and contains no delete operation whatsoever. That's not a configuration option, it's simply not implemented: even a badly instructed AI assistant cannot remove a site, database, DNS zone, cron job or extension via MCP.

Installation & enabling

1. Enable the extension (marketplace) — starts the extension process as its own Unix socket service (/run/enconf/ext-mcp-server.sock), with no direct access to the panel database.
2. Package permission — in the package, the admin sets Allow MCP access (perm_mcp_server) to control whether a customer can use the extension. Disabled by default.

Connecting

The MCP Server page (sidebar) shows a connection guide with a sample config for the given client. The extension authenticates via the panel's existing API key — the client sends it as an X-API-Key header, and the same permission check applies as for any normal API request. There is no separate service token and no additional trust boundary.

Tools (currently: 24, version 1.2.0)

Area	Tools	Kind
Sites & servers	list_sites, get_site, get_site_status, get_site_logs, list_servers	read
Databases	list_databases, create_database, list_database_users, create_database_user	read + safe create
DNS & SSL	list_dns_zones, list_dns_records, create_dns_record, list_domains, enable_ssl	read + safe create
Cron jobs	list_cronjobs, create_cronjob	read + safe create
Firewall	list_firewall_rules	read-only (see below)
Backup	list_backup_schedules, list_backup_jobs	read
FTP & mail	list_ftp_accounts, list_mailboxes	read
Subdomains	list_subdomains	read
Platform	list_extensions, list_packages	read

create_dns_record hardcodes changetype=REPLACE server-side, so a DNS-create tool can never be repurposed into a delete tool.

Why firewall rules are read-only

The underlying panel endpoint forwards a largely-unvalidated raw body directly to nftables. A malformed rule from an AI client could lock out SSH or the panel itself — that doesn't fit the extension's "safe, non-destructive" promise. Firewall rules can only be viewed via MCP, never changed.

FTP accounts and mailboxes never return passwords — neither is stored server-side in reversible form (or at all, for FTP).

Audit log

Every tools/call is logged (extension → POST /api/v1/audit-logs/mcp → the existing audit log infrastructure). Admins can see recent calls right on the MCP Server page.

Not yet included

• OAuth + PKCE — the current version deliberately uses the existing API key mechanism instead of a dedicated OAuth flow.
• Deployments — would require a cross-extension proxy to the Git Deploy extension.
• Daemons/queues — has no equivalent in enconf's PHP-hosting model.
• Firewall write access — see the security note above.