{
  "markdown": "# Panelica MCP Server\n\n> Talk to your [Panelica](https://panelica.com) hosting panel in plain English.\n> Provision a domain, issue an SSL certificate, create a database, or restart a\n> service through Claude Desktop, Cursor, ChatGPT, or any other\n> [Model Context Protocol](https://modelcontextprotocol.io) client.\n\n[![npm](https://img.shields.io/npm/v/panelica-mcp?color=CB3837&logo=npm)](https://www.npmjs.com/package/panelica-mcp)\n[![Tools](https://img.shields.io/badge/tools-404-blue)](tools/tools.json)\n[![Scopes](https://img.shields.io/badge/permission%20scopes-50-8A2BE2)](#permission-scopes)\n[![Docker](https://img.shields.io/badge/ghcr.io-panelica%2Fpanelica--mcp-2496ED?logo=docker&logoColor=white)](https://github.com/Panelica/panelica-mcp/pkgs/container/panelica-mcp)\n[![Zero drift](https://img.shields.io/badge/catalogue-auto--generated%20weekly-brightgreen)](#keeping-the-tool-catalogue-current)\n[![License](https://img.shields.io/badge/license-MIT-green)](LICENSE)\n\n404 tools cover the entire External API surface — accounts, domains, DNS,\nSSL, email, MySQL, FTP, security, backups, server resources, and more.\n\n---\n\n## Table of Contents\n\n- [How it works](#how-it-works)\n- [Requirements](#requirements)\n- [Install](#install)\n  - [Option A — npm (recommended)](#option-a--npm-recommended)\n  - [Option B — Docker](#option-b--docker)\n  - [Option C — Build from source](#option-c--build-from-source)\n- [Configuration](#configuration)\n  - [1. Open the External API port](#1-open-the-external-api-port)\n  - [2. Generate an API key in the panel](#2-generate-an-api-key-in-the-panel)\n  - [3. Verify the credentials with curl](#3-verify-the-credentials-with-curl)\n- [Wire it into your MCP client](#wire-it-into-your-mcp-client)\n  - [Claude Code (one command)](#claude-code-one-command)\n  - [Claude Desktop](#claude-desktop)\n  - [Cursor](#cursor)\n  - [OpenAI Codex CLI](#openai-codex-cli)\n  - [Continue.dev, Cline, Zed](#continuedev-cline-zed)\n  - [Generic stdio client](#generic-stdio-client)\n- [Tool catalogue](#tool-catalogue)\n- [Example sessions](#example-sessions)\n- [Permission scopes](#permission-scopes)\n- [Security model](#security-model)\n- [Troubleshooting](#troubleshooting)\n- [Development](#development)\n- [Versioning & support](#versioning--support)\n- [License](#license)\n\n---\n\n## How it works\n\n```\n+----------------+         stdio JSON-RPC          +-------------------+\n|  MCP client    |  <----------------------------> |  panelica-mcp     |\n|  (Claude, ...) |                                 |  (this package)   |\n+----------------+                                 +---------+---------+\n                                                             |\n                                          HTTPS + HMAC-SHA256|\n                                            X-API-Key        |\n                                            X-Timestamp      |\n                                            X-Signature      |\n                                                             v\n                              +------------------------------+------------------------------+\n                              |  https://<panel-host>:8443/api/external/v1/...               |\n                              |  nginx reverse proxy on the panel host                       |\n                              |  (TLS termination + path rewrite: /api/external/X -> /X)     |\n                              +------------------------------+------------------------------+\n                                                             |\n                                       127.0.0.1:3002 plain  |\n                                                             v\n                                            +----------------+-----------------+\n                                            |  external-server (HMAC verify)   |\n                                            +----------------+-----------------+\n                                                             |\n                                                             v\n                                            +----------------+-----------------+\n                                            |  Panelica panel + Linux services |\n                                            +----------------------------------+\n```\n\n`panelica-mcp` is a thin, stateless adapter:\n\n1. The MCP client launches the binary over stdio.\n2. The client asks for the tool list — the server reads `tools/tools.json`\n   (404 entries, auto-generated from the panel's live API spec) and returns it.\n3. When the client calls a tool, the server builds the corresponding HTTP\n   request, signs it with HMAC-SHA256 using your local `PANELICA_API_SECRET`,\n   and forwards it to the panel.\n4. The HTTP response is returned to the client as the tool result.\n\nNo data is cached, no telemetry is emitted, and the secret never leaves the\nmachine running the MCP server.\n\n## Requirements\n\n- A running Panelica panel (version 1.0.193 or newer recommended; the External\n  API surface is stable from 1.0.180+).\n- HTTPS access to the panel UI on port 8443 from the machine that will run\n  `panelica-mcp`. This is the same port you already use in the browser — no\n  extra firewall change is required.\n- One of the following runtimes on that machine:\n  - **Node.js ≥ 20** for the npm install path\n  - **Docker** for the container path\n\nYou do **not** need to install anything on the panel host itself, and you do\n**not** need to open the internal port 3002 to the public internet.\n\n## Install\n\nPick whichever fits your MCP client setup. All three produce the same stdio\nbinary; pick by which sandbox model you prefer.\n\n### Option A — npm (recommended)\n\n```bash\nnpm install -g panelica-mcp\n```\n\nor run without installing (the MCP client launches `npx` for you):\n\n```bash\nnpx -y panelica-mcp\n```\n\nThe `-y` flag accepts npm's \"install on first run\" prompt non-interactively,\nwhich is what MCP clients need.\n\n### Option B — Docker\n\nA pre-built image is published to GitHub Container Registry on every release:\n\n```bash\ndocker pull ghcr.io/panelica/panelica-mcp:latest\n```\n\nRun it from an MCP client config:\n\n```json\n{\n  \"command\": \"docker\",\n  \"args\": [\n    \"run\", \"--rm\", \"-i\",\n    \"-e\", \"PANELICA_BASE_URL\",\n    \"-e\", \"PANELICA_API_KEY\",\n    \"-e\", \"PANELICA_API_SECRET\",\n    \"ghcr.io/panelica/panelica-mcp:latest\"\n  ],\n  \"env\": {\n    \"PANELICA_BASE_URL\": \"https://your-panel-host:8443/api/external\",\n    \"PANELICA_API_KEY\":  \"pk_...\",\n    \"PANELICA_API_SECRET\": \"sk_...\"\n  }\n}\n```\n\n`-i` keeps stdin attached so the MCP client can talk to the container.\n`--rm` removes the container when the client disconnects.\n\n### Option C — Build from source\n\n```bash\ngit clone https://github.com/Panelica/panelica-mcp.git\ncd panelica-mcp\nnpm install\nnpm run build\nnode dist/index.js          # speaks MCP over stdio\n```\n\nTo regenerate `tools/tools.json` from your panel's live API spec:\n\n```bash\nPANELICA_SPEC_URL=\"https://your-panel:8443/api/external/v1/api-spec\" npm run rebuild-tools\n```\n\n## Configuration\n\nYou need three values: a reachable base URL, an API key, and an API secret.\n\n### 1. Pick the right base URL\n\nPanelica's `external-server` process listens on `127.0.0.1:3002`, and the\npanel's nginx on **8443** reverse-proxies `/api/external/...` to it. Nginx\nstrips the `/api/external` prefix before forwarding, so the path the HMAC\nsignature is computed over and the path the backend sees both end up as\n`/v1/...` — signatures match end-to-end without any extra knobs.\n\nThe right `PANELICA_BASE_URL` depends on where you run `panelica-mcp`:\n\n| Scenario | Recommended `PANELICA_BASE_URL` |\n|---|---|\n| MCP client on your laptop, panel on a remote server | `https://<panel-host>:8443/api/external` |\n| MCP client and panel on the **same** machine | `http://127.0.0.1:3002` |\n\nYou should **not** open port 3002 to the public internet. The default install\nbinds it on all interfaces but expects it to be either firewalled or only\nreached through the 8443 reverse proxy.\n\nSanity-check the proxy from your machine:\n\n```bash\ncurl -sk https://<panel-host>:8443/api/external/health\n# {\"status\":\"ok\"} or similar\n```\n\nIf you get a TLS error, that is the panel's self-signed certificate — install\na real cert on the panel (panel UI → Settings → SSL) rather than disabling\nverification client-side.\n\n### 2. Generate an API key in the panel\n\n1. Sign in to the panel as **root** or any account with permission to manage\n   API keys.\n2. Navigate to **Settings → API Keys → Generate API Key**.\n3. Pick the scopes you want the MCP server to have. For a read-only assistant,\n   `*:read` is enough. For full automation, grant `*:write` too. Every tool's\n   `description` in this server lists the scopes it requires.\n4. Copy both **key** (looks like `pk_...`) and **secret** (looks like `sk_...`).\n   The secret is shown **only once**; store it in a password manager.\n\n### 3. Verify the credentials with curl\n\nBefore you wire the MCP client up, prove the credentials work end-to-end:\n\n```bash\nexport PANELICA_BASE_URL=https://your-panel-host:8443/api/external\nexport PANELICA_API_KEY=pk_xxxxxxxx\nexport PANELICA_API_SECRET=sk_xxxxxxxx\n\nTS=$(date +%s)\n# Signature is over METHOD + PATH + TIMESTAMP + BODY. The path is the\n# backend-visible path (/v1/...) — NOT the /api/external/ prefix that nginx\n# strips before forwarding. panelica-mcp does this automatically.\nSIG=$(printf \"GET/v1/api-keys${TS}\" \\\n  | openssl dgst -sha256 -hmac \"$PANELICA_API_SECRET\" -hex | awk '{print $2}')\n\ncurl -sk \"$PANELICA_BASE_URL/v1/api-keys\" \\\n  -H \"X-API-Key:   $PANELICA_API_KEY\" \\\n  -H \"X-Timestamp: $TS\" \\\n  -H \"X-Signature: $SIG\"\n```\n\nYou should get back JSON listing your API keys. Common 401 responses:\n\n| `error.code` | Likely cause |\n|---|---|\n| `MISSING_API_KEY` / `MISSING_TIMESTAMP` / `MISSING_SIGNATURE` | Header is empty — re-check the curl flags |\n| `INVALID_KEY_FORMAT` | The `PANELICA_API_KEY` value is malformed |\n| `INVALID_TIMESTAMP` | Local clock drifted more than 5 minutes — sync NTP |\n| `INVALID_SIGNATURE` | Wrong secret, **or** the path you signed includes `/api/external/` (it must not — nginx strips it before the backend sees it) |\n\n## Wire it into your MCP client\n\n### Claude Code (one command)\n\n```bash\nclaude mcp add panelica \\\n  -e PANELICA_BASE_URL=https://your-panel:8443/api/external \\\n  -e PANELICA_API_KEY=pk_... \\\n  -e PANELICA_API_SECRET=sk_... \\\n  -- npx -y panelica-mcp\n```\n\nThat's it — ask Claude Code to \"list my domains\" or \"create a database for\nexample.com\" and it will drive the panel through the scoped API key.\n\n### Claude Desktop\n\nEdit your Claude Desktop config:\n\n- **macOS:** `~/Library/Application Support/Claude/claude_desktop_config.json`\n- **Windows:** `%APPDATA%\\Claude\\claude_desktop_config.json`\n- **Linux (Claude Desktop beta):** `~/.config/Claude/claude_desktop_config.json`\n\n```json\n{\n  \"mcpServers\": {\n    \"panelica\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"panelica-mcp\"],\n      \"env\": {\n        \"PANELICA_BASE_URL\":   \"https://your-panel-host:8443/api/external\",\n        \"PANELICA_API_KEY\":    \"pk_...\",\n        \"PANELICA_API_SECRET\": \"sk_...\"\n      }\n    }\n  }\n}\n```\n\nSave, fully quit Claude Desktop (not just close the window — *Quit*), and\nre-open it. A new chat will show `panelica` as a connected MCP server with\n\"404 tools available\".\n\n### Cursor\n\nIn **Settings → MCP → Add new server**:\n\n```json\n{\n  \"panelica\": {\n    \"command\": \"npx\",\n    \"args\": [\"-y\", \"panelica-mcp\"],\n    \"env\": {\n      \"PANELICA_BASE_URL\":   \"https://your-panel-host:8443/api/external\",\n      \"PANELICA_API_KEY\":    \"pk_...\",\n      \"PANELICA_API_SECRET\": \"sk_...\"\n    }\n  }\n}\n```\n\n### OpenAI Codex CLI\n\nAdd to `~/.codex/config.toml`:\n\n```toml\n[mcp_servers.panelica]\ncommand = \"npx\"\nargs = [\"-y\", \"panelica-mcp\"]\n\n[mcp_servers.panelica.env]\nPANELICA_BASE_URL = \"https://your-panel:8443/api/external\"\nPANELICA_API_KEY = \"pk_...\"\nPANELICA_API_SECRET = \"sk_...\"\n```\n\n### Continue.dev, Cline, Zed\n\nAny MCP-aware editor that accepts a stdio command works the same way — give it\n`npx -y panelica-mcp` (or the absolute path to the built `dist/index.js`) and\nthe three environment variables.\n\n### Generic stdio client\n\n```bash\nPANELICA_BASE_URL=https://your-panel-host:8443/api/external \\\nPANELICA_API_KEY=pk_... \\\nPANELICA_API_SECRET=sk_... \\\npanelica-mcp\n```\n\nThe process speaks MCP JSON-RPC over stdin/stdout. Send an `initialize`\nrequest first, then `tools/list`, then `tools/call`.\n\n## Tool catalogue\n\n**404 tools** are auto-generated from the panel's live `/v1/api-spec`, so they never\ndrift from the API. Each tool carries MCP safety annotations\n(![read-only](https://img.shields.io/badge/-read--only-brightgreen) 181 ·\n![mutating](https://img.shields.io/badge/-mutating-orange) 177 ·\n![destructive](https://img.shields.io/badge/-destructive-red) 46)\nthat capable clients use to auto-approve reads and warn before destructive calls.\n\n| Category | Tools |\n|----------|------:|\n| Git | 43 |\n| Domains | 32 |\n| Logs | 26 |\n| File Manager | 23 |\n| Laravel Apps | 21 |\n| Python Apps | 19 |\n| Node.js Apps | 18 |\n| Accounts | 16 |\n| CloudFlare | 12 |\n| Docker | 12 |\n| IP Addresses | 9 |\n| Cron Jobs | 8 |\n| Email | 8 |\n| FTP | 8 |\n| Security | 8 |\n| Databases | 7 |\n| Spam | 7 |\n| SSH Users | 7 |\n| WordPress | 7 |\n| API Keys | 6 |\n| License | 6 |\n| MySQL Users | 6 |\n| Server | 6 |\n| Webhooks | 6 |\n| Backups | 5 |\n| DNS | 5 |\n| Migrations | 5 |\n| Plans | 5 |\n| Snapshots | 5 |\n| 2FA | 4 |\n| Antivirus | 4 |\n| Backup Schedules | 4 |\n| Mailing Lists | 4 |\n| SSL | 4 |\n| Bandwidth | 3 |\n| Config Locks | 3 |\n| Core | 3 |\n| Remote MySQL | 3 |\n| Sessions | 3 |\n| Subdomains | 3 |\n| Terminal | 3 |\n| Audit | 2 |\n| Metrics | 2 |\n| Notifications | 2 |\n| Panel Settings | 2 |\n| Resource Quota | 2 |\n| SMTP Relay | 2 |\n| System Cron | 2 |\n| Mail Queue | 1 |\n| PHP | 1 |\n| Redirects | 1 |\n\nFull machine-readable list: [`tools/tools.json`](tools/tools.json).\n\n## Example sessions\n\nAfter wiring the server up, try these in your MCP client:\n\n**Domain provisioning.**\n> *\"Create a new account for `alice@example.com` on the `starter` plan, then\n> add the domain `alice-shop.com` to it and issue a Let's Encrypt\n> certificate.\"*\n\nThe assistant will pick up `panelica_accounts_post_v1_accounts`,\n`panelica_domains_post_v1_domains`, and `panelica_ssl_post_v1_ssl_...` from\nthe catalogue, fill in the parameters from the conversation, and call them in\nsequence. You can watch the calls happen in the client's tool log.\n\n**Diagnostic.**\n> *\"Show me the last 24 hours of bandwidth usage for `alice-shop.com` and tell\n> me whether it is on track to exceed the plan quota this month.\"*\n\n**Bulk cleanup.**\n> *\"List every domain whose SSL certificate expires in the next 14 days and\n> renew them all.\"*\n\n**DNS migration.**\n> *\"For the zone `alice-shop.com`, list the current A and CNAME records, then\n> add `www` as a CNAME to `alice-shop.com` and an A record for `mail`\n> pointing to `203.0.113.10`.\"*\n\nThe assistant will only invoke tools whose scopes are granted to your API\nkey, so a read-only key safely answers \"list\" questions but refuses\n\"create / delete\".\n\n## Permission scopes\n\nAPI keys are scoped — grant an AI assistant exactly the access it needs, nothing\nmore. **No scope is preselected** when creating a key in the panel, and the\ncreate dialog has live search over all 50 scopes.\n![read](https://img.shields.io/badge/-read-brightgreen) view/list only · ![write](https://img.shields.io/badge/-write-orange) create/update · ![delete](https://img.shields.io/badge/-delete-red) remove · ![special](https://img.shields.io/badge/-special-blue) special access.\nEvery family also accepts its wildcard (`domains:*`) and `*:*` grants everything.\n\n| Area | Scopes |\n|------|--------|\n| Accounts | `accounts:read` ![read](https://img.shields.io/badge/-read-brightgreen) · `accounts:write` ![write](https://img.shields.io/badge/-write-orange) · `accounts:delete` ![delete](https://img.shields.io/badge/-delete-red) |\n| Domains & subdomains | `domains:read` ![read](https://img.shields.io/badge/-read-brightgreen) · `domains:write` ![write](https://img.shields.io/badge/-write-orange) · `domains:delete` ![delete](https://img.shields.io/badge/-delete-red) |\n| Databases | `databases:read` ![read](https://img.shields.io/badge/-read-brightgreen) · `databases:write` ![write](https://img.shields.io/badge/-write-orange) · `databases:delete` ![delete](https://img.shields.io/badge/-delete-red) |\n| DNS | `dns:read` ![read](https://img.shields.io/badge/-read-brightgreen) · `dns:write` ![write](https://img.shields.io/badge/-write-orange) · `dns:delete` ![delete](https://img.shields.io/badge/-delete-red) |\n| Email | `email:read` ![read](https://img.shields.io/badge/-read-brightgreen) · `email:write` ![write](https://img.shields.io/badge/-write-orange) · `email:delete` ![delete](https://img.shields.io/badge/-delete-red) |\n| FTP | `ftp:read` ![read](https://img.shields.io/badge/-read-brightgreen) · `ftp:write` ![write](https://img.shields.io/badge/-write-orange) · `ftp:delete` ![delete](https://img.shields.io/badge/-delete-red) |\n| SSL | `ssl:read` ![read](https://img.shields.io/badge/-read-brightgreen) · `ssl:write` ![write](https://img.shields.io/badge/-write-orange) |\n| Backups & snapshots | `backups:read` ![read](https://img.shields.io/badge/-read-brightgreen) · `backups:write` ![write](https://img.shields.io/badge/-write-orange) · `backups:restore` ![special](https://img.shields.io/badge/-special-blue) |\n| File Manager | `files:read` ![read](https://img.shields.io/badge/-read-brightgreen) · `files:write` ![write](https://img.shields.io/badge/-write-orange) · `files:delete` ![delete](https://img.shields.io/badge/-delete-red) |\n| CloudFlare | `cloudflare:read` ![read](https://img.shields.io/badge/-read-brightgreen) · `cloudflare:write` ![write](https://img.shields.io/badge/-write-orange) · `cloudflare:delete` ![delete](https://img.shields.io/badge/-delete-red) |\n| Docker & app templates | `docker:read` ![read](https://img.shields.io/badge/-read-brightgreen) · `docker:write` ![write](https://img.shields.io/badge/-write-orange) · `docker:delete` ![delete](https://img.shields.io/badge/-delete-red) |\n| App hosting (Laravel / Node.js / Python) | `apps:read` ![read](https://img.shields.io/badge/-read-brightgreen) · `apps:write` ![write](https://img.shields.io/badge/-write-orange) · `apps:delete` ![delete](https://img.shields.io/badge/-delete-red) |\n| Git & Deploy | `git:read` ![read](https://img.shields.io/badge/-read-brightgreen) · `git:write` ![write](https://img.shields.io/badge/-write-orange) · `git:delete` ![delete](https://img.shields.io/badge/-delete-red) |\n| Logs & audit | `logs:read` ![read](https://img.shields.io/badge/-read-brightgreen) · `logs:write` ![write](https://img.shields.io/badge/-write-orange) |\n| Security (antivirus, firewall, IP blocks) | `security:read` ![read](https://img.shields.io/badge/-read-brightgreen) · `security:write` ![write](https://img.shields.io/badge/-write-orange) · `security:delete` ![delete](https://img.shields.io/badge/-delete-red) |\n| Server & infrastructure | `server:read` ![read](https://img.shields.io/badge/-read-brightgreen) · `server:write` ![write](https://img.shields.io/badge/-write-orange) |\n| Service control | `services:restart` ![special](https://img.shields.io/badge/-special-blue) · `services:start` ![special](https://img.shields.io/badge/-special-blue) · `services:stop` ![special](https://img.shields.io/badge/-special-blue) |\n| Plans | `plans:read` ![read](https://img.shields.io/badge/-read-brightgreen) · `plans:write` ![write](https://img.shields.io/badge/-write-orange) |\n| Webhooks | `webhooks:read` ![read](https://img.shields.io/badge/-read-brightgreen) · `webhooks:write` ![write](https://img.shields.io/badge/-write-orange) · `webhooks:delete` ![delete](https://img.shields.io/badge/-delete-red) |\n| Bandwidth | `bandwidth:read` ![read](https://img.shields.io/badge/-read-brightgreen) |\n| License | `license:read` ![read](https://img.shields.io/badge/-read-brightgreen) |\n| Migrations (panel-to-panel) | `migrations:read` ![read](https://img.shields.io/badge/-read-brightgreen) |\n| Terminal | `terminal:access` ![special](https://img.shields.io/badge/-special-blue) |\n| Full access | `*:*` ![special](https://img.shields.io/badge/-special-blue) |\n\nMutating service control deliberately requires its own action scopes (or\n`server:write`) — a metrics-only `server:read` key can **not** stop MySQL.\n\n## Security model\n\n- **HMAC-SHA256 request signing.** Every request is signed over\n  `METHOD + PATH + QUERY + TIMESTAMP + BODY` with your API secret. The panel\n  rejects requests whose timestamp drifts more than 5 minutes from server\n  clock, so replays are not possible.\n- **Secrets stay local.** The API secret is read from the process environment\n  and used only to compute the signature. It is never logged, sent to any\n  third party, or written to disk.\n- **Scope-restricted keys.** Generate one API key per use case. Grant only\n  the scopes that use case needs — e.g. `domains:read` for a read-only\n  assistant, `*:write` only for full automation.\n- **Audit trail.** Every request hits the panel's normal audit logging and\n  RBAC. Actions taken via MCP are indistinguishable from any other\n  authenticated API call and can be traced to the API key that performed\n  them.\n- **No data harvesting.** This server emits no telemetry, writes no cache,\n  and contacts no third party.\n- **Container hardening.** The Docker image runs as a non-root user and\n  exposes no ports — it speaks only stdio.\n\n## Troubleshooting\n\n| Symptom | Likely cause | Fix |\n|---------|--------------|-----|\n| Client reports \"0 tools available\" | Server crashed at startup — usually a missing env var | Run `panelica-mcp` once from a shell with the three env vars set; read stderr |\n| `401 MISSING_API_KEY` | `PANELICA_API_KEY` not set or wrong header passthrough | Re-check the MCP client config; restart the client after editing |\n| `401 INVALID_SIGNATURE` | Wrong `PANELICA_API_SECRET`, or clock drift > 5 min | `chronyc tracking` (or `timedatectl status`) on both the MCP host and panel host |\n| `401 INVALID_TIMESTAMP` | Local clock drift > 5 min | Sync NTP on the MCP host |\n| Connect timeout on `BASE_URL` | Wrong host/port — typically `:8443/api/external` was missed off the URL | Verify with `curl -sk $PANELICA_BASE_URL/health` — should return `{\"status\":\"ok\"}` |\n| `403 FORBIDDEN` on a tool | API key lacks the required scope | Regenerate the key in the panel with the scope listed in the tool's description |\n| Tool description says \"Schema not statically extractable\" | The endpoint uses dynamic request bodies | Pass a free-form `body` object; the panel will validate and tell you the missing fields with a 400 response |\n| TLS verification fails | Panel is using its self-signed cert | If the MCP host trusts that CA, this works out of the box. If not, deploy a real cert on the panel (panel UI → Settings → SSL) — do not disable TLS verification client-side |\n\nIf you are still stuck, open an issue at\n[github.com/Panelica/panelica-mcp/issues](https://github.com/Panelica/panelica-mcp/issues)\nwith the (redacted) stderr output.\n\n## Development\n\n```bash\ngit clone https://github.com/Panelica/panelica-mcp.git\ncd panelica-mcp\nnpm install\nnpm run build\nnode dist/index.js\n```\n\nProject layout:\n\n```\n.\n├── src/index.ts          # MCP server (stdio transport, HMAC client)\n├── tools/\n│   ├── build-tools.mjs   # Generates tools.json from the API spec\n│   ├── api-spec.json     # Committed snapshot of the live /v1/api-spec\n│   └── tools.json        # 404 tool definitions, auto-generated (committed)\n├── .github/workflows/\n│   └── refresh-tools.yml # Weekly CI: regenerate from the live API, commit if changed\n├── Dockerfile\n├── smithery.yaml         # Smithery deployment manifest\n├── .env.example\n└── README.md\n```\n\n### Keeping the tool catalogue current\n\nThe catalogue never drifts from the API by hand. The backend serves an\nalways-current `/v1/api-spec` (built from its route registry), and the tools are\nregenerated from it:\n\n```bash\n# Rebuild from the committed snapshot (offline):\nnpm run rebuild-tools\n\n# Pull the live spec, refresh the snapshot, and rebuild:\nPANELICA_SPEC_URL=\"https://your-panel:8443/api/external/v1/api-spec\" npm run rebuild-tools\n```\n\nCI (`refresh-tools.yml`) runs this weekly against the panel named in the\n`PANELICA_SPEC_URL` repository variable and commits any changes, so a new API\nendpoint becomes an MCP tool automatically. Each tool is tagged with safety\nannotations (`readOnlyHint` for `GET`, `destructiveHint` for `DELETE`) that\ncapable MCP clients use to auto-approve reads and warn before destructive calls.\n\nA separate, internal dataset of every panel endpoint (1,263 total) exists for\ntraining purposes — only the **404 documented External API endpoints** are\nexposed through this package. Internal panel endpoints, recorded DEV data,\nand training jsonl files are not part of the public repository.\n\n## Versioning & support\n\n- This package follows the Panelica panel's External API. Tool signatures\n  change only when the panel itself ships a backward-incompatible API change,\n  and the package's major version is bumped to match.\n- New endpoints become available the next time we regenerate\n  `tools/tools.json` and publish a release.\n- Panel issues (the API itself, not this client): the Panelica forum at\n  [forum.panelica.com](https://forum.panelica.com).\n- Client / packaging issues:\n  [github.com/Panelica/panelica-mcp/issues](https://github.com/Panelica/panelica-mcp/issues).\n\n## License\n\nMIT. See [LICENSE](LICENSE).\n\n## Links\n\n- Panel website: <https://panelica.com>\n- Live demo: <https://demo.panelica.com>\n- Documentation: <https://panelica.com/docs>\n- Forum & support: <https://forum.panelica.com>\n- Public installer: <https://latest.panelica.com/install.sh>\n",
  "bytes": 25788,
  "sha": "a2e02658d70385fc724d2398d78a6760c522f3156ee97b1b0ef83707c0dab7ce",
  "repo_slug": "panelica/panelica-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_panelica_panelica_mcp_aa09b608/readme"
}