MCP serverai.borealhost/mcp

Add a cron job to a site. Requires: API key with write scope. Args: slug: Site identifier schedule: Cron schedule (e.g. "*/5 * * * *", "0 2 * * *") command: Command t

Add a DNS record to a domain. Requires: API key with write scope. Args: domain_name: Full domain name (e.g. "example.com") record_type: "A", "AAAA", "CNAME", "MX", "TXT",

Add an IP firewall rule (allow or deny) and reload Nginx. Supports IPv4, IPv6, and CIDR notation. Max 100 rules per site. If a rule already exists for the IP, the action is update

Add an alias on the same domain, preserving existing aliases.

Publish a container port on the node's public IP (TCP or UDP). This is how inbound UDP reaches a container. There is no other way: the container's own address is private, and the

Add an HTTP redirect rule to a site. Requires: API key with write scope. Args: slug: Site identifier source_path: Path to redirect, must start with "/" (e.g. "/old-page")

Provision a site into a slot a plan you ALREADY PAY FOR includes. Two different things can be meant by "create a site". Buying one is the checkout flow (create_checkout → update →

Inject your SSH public key into a site's container for direct SSH access. The key is appended to /home/admin/.ssh/authorized_keys. Only available for VPS/dedicated plans. Require

Create and route a subdomain of a site-linked domain. Creates the DNS A record (if absent) pointing at the site's server, then configures the nginx vhost and SSL certificate on th

Turn an instance you are ALREADY running into a persistent volume. Use this when you launched something, set it up, and then decided you want to keep it. Nothing reboots and no da

Restore a detached volume onto a fresh instance — optionally a new type. Pass a different instance_type to move the same machine to different hardware: this is the closest thing t

List one bounded page of immediate children in a backup directory. This returns names and metadata only, never file contents. Use ``next_cursor`` from the response as ``cursor`` t

Flush all caches (Redis + WP object cache). Requires: API key with write scope. Args: slug: Site identifier Returns: {"flushed": true}

Get cache status (Redis, WP object cache, hit rates). Requires: API key with read scope. Args: slug: Site identifier Returns: {"redis_running": true, "object_cache_enabl

Enable or disable the WordPress object cache. Requires: API key with write scope. Args: slug: Site identifier enable: true to enable, false to disable Returns: {"ena

Abandon an unpaid checkout and expire its Stripe payment link. Use this to clean up abandoned attempts rather than leaving them to sit. A completed checkout is never cancelled her

Cancel a scheduled snapshot. Requires: API key with write scope. Args: slug: Site identifier schedule_id: UUID of the scheduled snapshot to cancel Returns: {"success

Claim an API key using a claim token from the container. After calling request_api_key(), read the claim token from the path that call returned in `claim_path`, on that site's con

Clear forwarding; when Sieve exists, requires explicit clear_all_filters=true.

Get Cloudflare proxy (CDN) status for a site. Shows whether traffic is routed through Cloudflare's CDN (orange cloud) or goes direct to origin (grey cloud / DNS-only). Requires:

Purge Cloudflare CDN cache for a site. Without urls: purges all cached content for the site's subdomain. With urls: purges only the specified URLs (max 30 per call). Requires: AP

Enable or disable Cloudflare CDN proxy for a site. When enabled (orange cloud): traffic goes through Cloudflare's CDN, gets caching, DDoS protection, and SSL termination at the ed

Complete checkout with payment and start site provisioning. The checkout must be in "ready" status. Two payment methods: - "stripe_checkout" (default): Returns a short, chat-safe

Configure OpenSRS DKIM and merge email DNS, preserving other senders and subdomains.

Start, stop, or restart a site's container. Only for plans with a dedicated container (VPS / split-VPS / dedicated). Shared-hosting sites share a container and cannot restart it.

Create an alert rule to monitor CPU, memory, or disk usage. When the metric crosses the threshold, a notification is sent via email and/or webhook. Max 10 rules per site. Require

Create a new API key with specified scopes. Cannot create keys with higher scopes than the current key. Site-scoped keys restrict access to a single site. email_domains restricts

Create a B2 cloud-backed snapshot (zero local disk, async). Streams container data directly to Backblaze B2 via restic. No local disk impact — billed separately at cost+5%. Runs i

Create a manual backup (runs asynchronously). The backup starts in the background. Poll list_backups() to check status. Requires: API key with write scope. Args: slug: Site

Start a new checkout session to purchase a hosting plan. No authentication needed. After creating, call update_checkout to set buyer info, then complete_checkout to pay. The resp

Create a persistent machine and boot its first instance. Start here, then set the machine up however you like (install packages, drivers, models). Everything you do becomes part o

Create a directory in a site's container. Creates parent directories if they don't exist. Requires: API key with write scope. Args: slug: Site identifier path: Relative

Create a domain-addressed billable mailbox. Password returned once; retries omit it.

Create an SFTP account on a site. The account is chrooted to /var/www and lands in home_dir. Password must be at least 8 characters. Username must be lowercase alphanumeric. Requ

Create a mailbox on the site's email domain. Password is generated when omitted and returned ONCE — store it. Each mailbox adds to the subscription's email billing. Requires: API

Issue a temporary mail-services token with no OMA access. Requires email:signon. Use 60, 120, ... 1440 minutes. OpenSRS rejects fractional hours; no rounding up.

Create a local container snapshot (async). Runs in background — returns immediately with status "creating". Poll list_snapshots() to check when status becomes "completed" or "fail

Open a support ticket with the BorealHost team. Use this to escalate platform-side problems you cannot fix with the available tools (billing issues, infrastructure faults, API bug

Register a webhook endpoint for platform events. Events (backup failures, security notices, hosting incidents, billing) are POSTed as JSON, signed with X-BH-Signature (HMAC-SHA256

Search and replace in WordPress database (e.g. URL migration). Handles serialized data safely. Use dry_run=true first to preview changes. Requires: API key with write scope. Arg

Delete a site and schedule resource cleanup (7-day grace period). WARNING: This is destructive. The site will be inaccessible immediately. After the grace period, its active servi

Permanently anonymize the account. Cancels subscriptions, deactivates keys. WARNING: This is irreversible. The account will be soft-deleted and all personal data anonymized. All s

Delete an alert rule. Requires: API key with write scope. Args: slug: Site identifier rule_id: UUID of the alert rule to delete Returns: {"deleted": true, "id": "uui

Permanently delete a single backup (metadata + stored snapshot). Irreversible. Requires: API key with admin scope. Returns: {"site", "backup_id", "deleted": true}

Permanently delete a volume and everything stored in it. Irreversible: the instance is released AND the stored data is purged from object storage, so billing genuinely stops. Refu

Delete a cron job by line number. Get line numbers from list_cron(). Requires: API key with write scope. Args: slug: Site identifier line_number: Line number of the cron

Delete a DNS record from a domain. Requires: API key with write scope. Args: domain_name: Full domain name (e.g. "example.com") record_id: ID of the DNS record to delete

Soft-delete a mailbox. confirm must equal email. Provider recovery window: 30 days.

Delete a file or directory from a site's container. Directories are deleted recursively. Protected system paths (e.g. /etc, /usr) cannot be deleted. Requires: API key with write

Delete a mailbox (its mail is destroyed). Requires: API key with write scope. Returns: {"email", "deleted": true}

Delete a redirect rule by source path or id. Requires: API key with write scope. Returns: {"site", "deleted": true}

Delete a snapshot (local or B2). Requires: API key with write scope. Args: slug: Site identifier snapshot_id: UUID of the snapshot to delete Returns: {"success": tru

Remove a subdomain: its DNS record, nginx vhost and certificate. The inverse of add_subdomain. Removes the DNS record AND the server-side vhost and cert, so the name stops resolvi

Remove a webhook endpoint. Requires: API key with write scope. Returns: {"id", "deleted": true}

Queue: snapshot the machine, verify it, then destroy the instance. This is how you stop paying for compute while keeping your work. ASYNCHRONOUS. Returns immediately with state "

Disable an empty email domain; refuses active or recoverable accounts.

Get full domain details including DNS and infrastructure status. Requires: API key with read scope. Args: domain_name: Full domain name (e.g. "example.com") Returns: {"d

Update domain settings (auto-renew, WHOIS privacy, registrar lock). Only provided (non-None) fields are updated. Requires: API key with write scope. Args: domain_name: Full

Enable an independent email domain; preserve all other email domains. Requires a verified owned domain and email:write scope. site_slug selects billing when ambiguous. Defaults re

Enable an SMTP relay for a site's outbound transactional mail. Provisions a mail-send-only credential on the platform relay and configures SPF/DKIM DNS when the domain zone is hos

Route *.domain (every subdomain) to the domain's linked site. Creates a wildcard DNS record and issues a wildcard certificate via ACME DNS-01. SLOW — DNS propagation is part of th

Run ONE bounded read against a site's database. One statement, beginning with SELECT, SHOW, DESCRIBE or EXPLAIN, with no second statement and no data-modifying clause anywhere in

Look up mailbox/alias/forward/free in an authorized email domain.

Get app installation status and log. Poll this after install_app() to track progress. Requires: API key with read scope. Args: slug: Site identifier app_id: App ID from

Get the backup retention policy for a VPS site. Requires: API key with read scope. Returns: {"site", "retention": {"keep_daily", "keep_weekly", "keep_monthly"}}

Get a Stripe billing portal URL for managing payment methods and invoices. Returns a URL (not a redirect) that the human can open in a browser. Requires: API key with read scope.

Poll a checkout session for status updates. Call this after complete_checkout to track payment and provisioning. Polling strategy: - First 60 seconds: every 5 seconds - After 60

Get live details for a compute instance (state, public IP, accrued cost). State is synced from the cloud provider on each call. SSH as root once state is "running" and public_ip i

Get a volume's live state, its instance, and its monthly storage cost. Requires: API key with read scope. Returns: Volume dict plus "monthly_storage_cad". After attach, poll

Get WordPress database information (size, tables, row counts). Requires: API key with read scope. WordPress sites only. Args: slug: Site identifier Returns: {"database":

Poll one database recovery without waiting for completion. Requires: API key with read scope. Args: slug: Site identifier backup_id: UUID of the source backup recover

Read effective OpenSRS limits, counts, connections and public DNS health.

Email addon status and mailboxes for a site. Requires: API key with read scope. Returns: {"configured": bool, "domain", "mailboxes", "mailbox_list": [...]}

Issue a one-use BorealHost link expiring in 60 seconds. Redemption mints provider SSO. Requires email:signon.

Poll one selected-file recovery without waiting for it to finish. Requires: API key with read scope. Args: slug: Site identifier backup_id: UUID of the source backup

Retrieve container logs (error, access, or PHP). Requires: API key with read scope. Args: slug: Site identifier log_type: "error" (Nginx/Apache errors), "access" (HTTP re

Inspect usage, services, aliases count, forwarding/Sieve, autoresponder and label.

Get traffic and performance metrics for a site. Requires: API key with read scope. Args: slug: Site identifier days: Number of days of history (1–90, default: 7) Returns

Get current resource usage (CPU, memory, disk, load average). Requires: API key with read scope. Args: slug: Site identifier Returns: {"cpu_percent": 12.5, "memory_mb":

Read the custom nginx config for a domain on the BorealHost host proxy. Your site sits behind a BorealHost reverse proxy that terminates TLS and forwards to your container. This r

Get detailed status of a hosted site including resources, domains, and modules. Requires: API key with read scope. Args: slug: Site identifier (the slug chosen during checkou

List SMTP relay credentials for a site, with domain-auth status. Requires: API key with read scope. Returns: {"relays": [{"relay_id", "domain", "status", "do

Get snapshot disk usage and quota info for a site. Requires: API key with read scope. Args: slug: Site identifier Returns: {"disk_quota_gb": 200, "max_snapshots": 5, "sn

Get SSH connection info for a VPS/dedicated site. Only available for VPS/dedicated plans (not shared hosting). Requires: API key with read scope. Args: slug: Site identifier

Get detailed system stack information (OS, PHP, DB, web server versions). Requires: API key with read scope. Args: slug: Site identifier Returns: {"os": "Debian 12", "ke

Get a support ticket with its full message thread. Requires: API key with read scope. Args: ticket_id: Ticket UUID from list_support_tickets Returns: {"id", "subject", "

The account's prepaid balance, and what THIS key may spend from it. Two ceilings, and both apply: the balance bounds the ACCOUNT, the allowance bounds this KEY within it. Plan aga

One-time webmail single-sign-on URL for a mailbox. Requires: API key with write scope. Returns: {"email", "url"}

Install an app template on a VPS/Cloud site. Starts a background installation. Poll get_app_status() for progress. Requires: API key with write scope. VPS or Cloud plan only. Ar

Launch an on-demand hourly compute instance (Canada, CAD). Billing starts at launch (per minute, 1-hour minimum) and runs until terminate_compute_instance — stopping does NOT stop

Link a domain to a hosted site. Attaches the domain to the specified site and triggers automatic DNS configuration and SSL provisioning. WARNING: Regenerates this site's nginx vh

List user-configurable alert rules for a site. Requires: API key with read scope. Args: slug: Site identifier Returns: [{"id": "uuid", "metric": "disk", "operator": "gt"

List all API keys for the account. Shows key metadata (name, prefix, scopes, last used) but never the full key value. Requires: API key with read scope. Returns: [{"id": "uu

List installed apps on a site. Requires: API key with read scope. Args: slug: Site identifier Returns: {"apps": [{"id": "uuid", "app_name": "myapp", "template_slug": "dj

List all backups for a site (automatic and manual). Requires: API key with read scope. Args: slug: Site identifier Returns: [{"id": "uuid", "backup_type": "auto"|"manual

List checkouts belonging to the authenticated account. Requires: API key. Only checkouts with a recorded owner appear — every checkout created while authenticated, plus every chec

List OS images available for on-demand compute instances. Requires: API key with read scope. Returns: {"images": [{"id": "UBUNTU_24_04_64BIT", "name": "Ubuntu 24.04 LTS (x86_

List your on-demand compute instances with month-to-date spend. Requires: API key with read scope. Returns: {"instances": [...], "month_to_date_spend_cad": 12.34, "month

List on-demand compute instance types with hourly CAD prices. On-demand instances are real cloud VMs in Canada (Montreal region), billed per minute (1-hour minimum) post-paid onto

List your compute volumes — machines that survive instance termination. A volume is a whole machine (packages, drivers, services, users, data) stored in Canada. Detaching destroys

List cron jobs on a site. Requires: API key with read scope. Args: slug: Site identifier Returns: {"jobs": [{"line": 1, "schedule": "*/5 * * * *", "command": "/usr/

List all databases on a site's container. Requires: API key with read scope. Args: slug: Site identifier Returns: {"databases": ["wordpress", "app_db", ...]}

List database users for a site. Requires: API key with read scope. Returns: {"engine", "users": [{"user", "host", ...}, ...]}

List all DNS records for a domain. Returns DNS records at the domain level (independent of site-level manage_dns). Use this for domains that may not be linked to a site. Requires

List all domains owned by the authenticated user. Requires: API key with read scope. Returns: [{"domain": "example.com", "status": "active", "expires_at": "iso8601", "a

List email API mutation/credential issuance attempts, actor, reason and outcome.

List email domains visible to this key, with cluster connection settings.

List files and directories in a site's container. Path scoping depends on the plan: - Shared plans: rooted at wp-content/ (WordPress content directory) - VPS/dedicated plans: full

List IP allow/deny firewall rules for a site. Rules are implemented as Nginx allow/deny directives per container. Requires: API key with read scope. Args: slug: Site identif

List SFTP accounts on a site. Also returns the host and port to connect to. Do not use the site's domain for SFTP: it is Cloudflare-proxied and only carries HTTP(S). Requires: AP

List a mailbox's aliases with pagination.

Page through a domain's mailboxes, optionally filtering by organisation label.

List AI modules and their enabled/disabled state for a site. Also returns the list of modules available for the site's plan. Requires: API key with read scope. Args: slug: S

List available PHP versions and the currently active one. Requires: API key with read scope. Args: slug: Site identifier Returns: {"versions": [{"version": "8.1", "activ

List available hosting plans with pricing and resources. No authentication needed. Args: track: Filter by plan track. Valid values: "single_site", "agency". ⚠ The tra

List installed WordPress plugins with status. Requires: API key with read scope. WordPress sites only. Args: slug: Site identifier Returns: {"plugins": [{"name": "akisme

List ports published from this site's container to the public internet. These are iptables DNAT rules on the node, NOT the IP allow/deny rules that add_firewall_rule manages — tho

List HTTP redirect rules for a site. Requires: API key with read scope. Returns: [{"id", "source_path", "target_url", "redirect_type"}, ...]

List all snapshots and scheduled snapshots for a site. Requires: API key with read scope. Args: slug: Site identifier Returns: {"snapshots": [{"id": "uuid", "name": "sna

List subdomain DNS records for a domain you own. Requires: API key with read scope. Args: domain_name: Registrable domain (e.g. "example.com") Returns: [{"fqdn": "blog.e

List all subscriptions with plan details, pricing, status, and site slug. Requires: API key with read scope. Returns: [{"id": "uuid", "plan_slug": "site_starter", "plan_name"

List the account's support tickets. Requires: API key with read scope. Args: status: Optional filter (e.g. "open", "closed") Returns: [{"id", "subject", "status", "categ

List tables in a database. Requires: API key with read scope. Args: slug: Site identifier database: Database name Returns: {"tables": [{"name": "wp_posts", "rows": 1

List installed WordPress themes with status. Requires: API key with read scope. WordPress sites only. Args: slug: Site identifier Returns: {"themes": [{"name": "twentytw

List webhook endpoints registered on the account. Requires: API key with read scope. Returns: [{"id", "url", "events", "is_active", "last_status", "failure_count"}, ...

Terminate established IMAP and POP sessions through OpenSRS logout_user.

Manage a database user on a site. Actions: "create" (user+password), "drop" (user), "set_password" (user+password), "grants" (list a user's grants), "grant" / "revoke" (user+datab

Create or delete DNS records for a site. Requires: API key with write scope. Args: slug: Site identifier action: "create" or "delete" record_type: "A", "AAAA", "CNAME

Install, activate, deactivate, or delete a WordPress plugin. Requires: API key with write scope. Args: slug: Site identifier action: "install", "activate", "deactivate",

Install, activate, or delete a WordPress theme. Requires: API key with write scope. Args: slug: Site identifier action: "install", "activate", or "delete" theme: Them

Optimize WordPress database tables (reduces bloat). Requires: API key with write scope. Args: slug: Site identifier Returns: {"optimized": true, "tables_optimized": 12}

Read the contents of a file from a site's container. Max file size: 512KB. Binary files are rejected — use the site's file manager or SSH for binary files. Requires: API key with

Reboot a running compute instance. Requires: API key with write scope.

Recover exactly one absent database from a completed backup. The operation refuses an existing database and can never select ``all``. It returns immediately; poll ``get_database_r

Start a selected-file recovery and return its durable ID immediately. Existing destination paths are never replaced. The operation is asynchronous; poll ``get_file_recovery`` with

Register a new domain with WHOIS contact info and Stripe billing. First request a quote (quote_only=True), present registration_cad, privacy_cad, total_cad, term and privacy choic

Remove an IP firewall rule and reload Nginx. Requires: API key with write scope. Args: slug: Site identifier ip: IP address or CIDR to remove (must match exactly) Return

Remove an SFTP account from a site. Requires: API key with write scope. Args: slug: Site identifier username: SFTP username to remove Returns: {"removed": true, "use

Remove one alias, preserving the mailbox and other aliases.

Stop publishing a port, by the rule id from list_port_forwards. Requires: API key with write scope. Args: slug: Site identifier forward_id: Rule id (uuid) from list_port_

Add a message to an existing support ticket. Requires: API key with write scope. Args: ticket_id: Ticket UUID message: Reply text Returns: {"id", "status", ...}

Request an API key for a site YOU ARE RUNNING ON (challenge-response). ⚠ ONLY USE THIS IF YOU ARE EXECUTING INSIDE THAT SITE'S OWN CONTAINER. If you bought or ordered the site fro

Request OpenSRS verification email to its existing owner contact. Requires a write-scope API key and an owned registered/transferred domain. Call only when the customer requests a

Reset password and terminate IMAP/POP sessions. Requires email:signon.

Reset a mailbox password (generated when omitted, returned ONCE). Requires: API key with write scope. Returns: {"email", "password", "message"}

Restore a site from a backup. WARNING: This is destructive. The current state of the site will be replaced. Runs asynchronously — may take several minutes. Requires: API key with

Restore a uniquely identifiable soft-deleted mailbox under its original address.

Revoke (deactivate) an API key. The key stops working immediately. Requires: API key with write scope. Args: key_id: UUID of the key to revoke (from list_api_keys or whoami)

Revoke an SMTP relay credential (immediate at the relay). Requires: API key with write scope. Returns: {"relay_id", "revoked": true}

Rollback a site to a previous snapshot. WARNING: This is destructive. The current state of the container will be replaced with the snapshot contents. Requires: API key with admin

Rotate the current email-only key with overlap, preserving scope and expiry.

Rotate an API key, optionally keeping the old key valid for up to 1,440 minutes. Creates a new key with the same name, scopes, and rate limits. The new key is returned once — stor

Run a ClamAV malware scan on a site's container. Scans the web root (or specified path) for malware, viruses, and trojans. ClamAV is installed automatically if not present. Exclud

Change a site's hosting plan (upgrade or downgrade). Requires: API key with admin scope. Best practice: create a snapshot before downgrading. Args: slug: Site identifier

Schedule a snapshot for future execution. Requires: API key with write scope. Max 3 pending schedules per site. Args: slug: Site identifier scheduled_at: ISO 8601 datetim

Check domain availability and get pricing. Requires: API key with read scope. Args: domain: Full domain name (e.g. "example.com", "mybiz.ca") Returns: {"domain": "exampl

Set your BorealHost API key for this session. Call this if you already have an API key (from checkout completion, the BorealHost panel, or a container claim). All subsequent tool

Set the backup retention policy for a VPS site. Storage is billed on real stored bytes, so deeper history costs the customer, not the platform. Values are clamped to platform boun

Set what a registered domain points at — a site, someone else's nameservers, our DNS with no site, or a redirect to another URL. Use this to park a domain, hand it to an external

Enable or disable the HTTP→HTTPS redirect for a site. Requires: API key with write scope. Returns: {"site", "force_https": true|false, "message"}

Replace the complete alias list idempotently (maximum 2,000).

Set custom nginx config on the BorealHost host proxy — WebSocket, timeouts, headers. Use this when configuring your container's own nginx is not enough because something in front

Change what a site's docroot IS, without deleting anything. Types: wordpress WordPress, PHP and a database (the default) php PHP and a database, no WordPress php

Enable business email (hosted mailboxes + webmail) on a domain. Creates the hosted-email domain, sets up outbound authentication (DKIM/SPF), and auto-configures MX/SPF DNS when th

Queue a checkpoint snapshot without detaching — before a risky change. ASYNCHRONOUS. Returns immediately with state "snapshotting"; poll get_compute_volume until it is back to "at

Get SSL certificate information for a site. Returns certificate details, expiry date, and issuer. Requires: API key with read scope. Args: slug: Site identifier Returns:

Force SSL certificate renewal via certbot. Requires: API key with write scope. Args: slug: Site identifier Returns: {"renewed": true, "expires_at": "iso8601"}

Start a stopped compute instance. Requires: API key with write scope.

Stop a compute instance. WARNING: hourly billing continues while stopped. Use terminate_compute_instance to stop the charges permanently. Requires: API key with write scope.

Switch the active PHP version for a site. Requires: API key with write scope. Args: slug: Site identifier version: Target PHP version (e.g. "8.3", "8.2", "8.1") Returns:

Permanently terminate a compute instance — this stops hourly billing. The instance and its disk are destroyed and cannot be recovered. Copy any results off the instance before ter

Send a test event to a webhook endpoint (async). Poll list_webhooks afterwards for last_status. Requires: API key with write scope. Returns: {"id", "message"}

Enable or disable an AI module on a site. The module must be in the plan's available module list. Requires: API key with write scope. Args: slug: Site identifier module_

Prepare a domain to transfer to another registrar. Unlocks the domain and emails the EPP/auth code to the registrant contact on file (BorealHost never sees the code). The domain k

Update account profile fields (email, language, name). Requires: API key with write scope. Only provided (non-empty) fields are updated. Args: email: New email address la

Set buyer email and desired site slug on a checkout session. The checkout must be in "not_ready" status. Setting requested_slug transitions status to "ready" (required before comp

Set mailbox_limit, alias_limit, quota_gb, smtp_sent_limit, services or language.

Set display_name, quota_gb, smtp_sent_limit, label, services or suspended. Suspension disables client access and outbound SMTP while preserving receipt.

Upload a base64-encoded file to a site's container. Use this for binary files (images, archives, fonts, etc.). For text files, prefer write_file(). Requires: API key with write s

Install your own SSL certificate for a site's domain. The certificate must be a PEM fullchain (leaf + intermediates) and the key unencrypted PEM. Validated (parse, key match, doma

Check the current API key's account info, scopes, and site count. Requires: BOREALHOST_API_KEY env var (read scope). Returns: {"user": {"id": "uuid", "email": "...", "date_jo

Check for available WordPress core, plugin, and theme updates. Requires: API key with read scope. Args: slug: Site identifier Returns: {"core": {"current": "6.5", "updat

Update WordPress core, all plugins, and all themes. Runs all updates in sequence. May take up to 2 minutes. Requires: API key with write scope. Args: slug: Site identifier

Write or overwrite a text file in a site's container. Creates parent directories if they don't exist. Requires: API key with write scope. Args: slug: Site identifier pat