hosting.com runs an MCP server, so an AI assistant such as Claude or ChatGPT can work with your account directly. Once connected, you can ask it to check what is due, look up a domain’s nameservers, read a PHP error log, or create a mailbox, and it will make the calls itself.
A connected assistant can spend money and delete things. It has the same reach over your account that you do, which includes paying an invoice, deleting a website, deleting a database or a mailbox, and changing nameservers, which can take a site offline.Connect it to accounts you are comfortable with it changing, read what it proposes before you approve it, and disconnect it when you are done. See reviewing and revoking access below. What you need
- A hosting.com account, and your normal login for it
- An AI assistant that supports MCP connectors, such as Claude or ChatGPT
- The server address:
https://api.hosting.com/mcp
There is nothing to install, no API key to generate beforehand, and no setting to switch on in the Hosting Panel first.
Connecting
The exact wording differs between assistants and changes fairly often, but the shape is the same everywhere.
- In your assistant, find where custom connectors or MCP servers are added. In Claude this is under Settings, then Connectors.
- Add a new custom connector and give it the server URL
https://api.hosting.com/mcp.
- Your browser opens a hosting.com sign-in page. Sign in as you normally would, including your second factor if you have one.
- Review what the connection is asking for, and approve it.
- You are returned to your assistant, and the connection is live.
You are signing in at hosting.com, not handing your password to the assistant. The sign-in happens in your own browser on our page, and the assistant receives only a token. It never sees your password, and the token can be revoked without changing it.
A good first thing to ask is something read-only, such as “what services do I have and when do they renew?” It confirms the connection works before anything is at stake.
What it can do once connected
Everything in the API is available to the assistant as a tool. In practice that covers:
Two limits worth knowing
It can only ever reach your own account. The token is tied to the account you signed in as, and no call can touch another one.
Deletions have to name what they are deleting. Any call that removes something has to repeat the exact domain or address back, which means an assistant cannot delete the wrong mailbox through a mistyped parameter. It is a real guard rail, though it is not a substitute for reading what it proposes.
Reviewing and revoking access
A connection stays live until you end it. There are two ways to do that.
Disconnect it in the assistant. Removing the connector at that end stops it being used.
Revoke the session at our end. Your account keeps a list of the sessions signed in to it, and any one of them can be revoked. This is the one to use if you no longer have the assistant to hand, or if you are not certain what is connected.
Revoke the session if a device with the assistant on it is lost or stolen, if you are handing a machine to someone else, or if you simply want to be sure nothing is still connected. Revoking does not affect your password or your other sign-ins.
If something is not working
Related articles
.jpg?fit=max&auto=format&n=E2LlsT5gBITvo732&q=85&s=ec11e1673894bdf46663a5d73602eb87){kind=logo}