MCP and AI agents

Three ways to use AI with HiPanel

The AI assistant in the panel · available now, with your first 1 million tokens free.
Your own AI agent through the REST API · available now with a scoped API token.
MCP server · coming soon; MCP-capable agents connect straight to HiPanel.

The AI assistant in the panel

Open the AI assistant in the panel and ask in plain language. The assistant calls read tools to get real data from your servers and sites, then answers or proposes an action.

Read tools run right away and change nothing on your servers.
Write and dangerous tools show a confirmation card with the exact parameters, and only run when you approve.
Root and database passwords are entered by you on the confirmation card or only shown to you; the model never sees them.
The assistant uses your permissions in the team; every action is a logged task.

Use AI agents through the REST API

Any agent that can make HTTP calls can drive HiPanel: Claude Code, Cursor or an agent you wrote yourself. Here's how:

Create a separate API token for the agent with only the scopes it needs. An agent that only analyzes gets read scopes.
Point the agent at the OpenAPI spec at https://hipanel.cloud/api/v1/openapi.json so it knows every endpoint and schema.
Keep the token in an environment variable, never in a prompt or a committed file.

Claude Code

export HIPANEL_TOKEN=tc_live_xxxxxxxxxxxxxxxx   # token with read:servers read:sites read:monitoring
claude "Read https://hipanel.cloud/api/v1/openapi.json. Using curl with the header
'Authorization: Bearer $HIPANEL_TOKEN', list my servers and tell me which one
had the highest CPU over the last 24 hours and why."

Write calls through the API run immediately when the token allows them, with no confirmation card like in the panel. Have the agent ask you before calling write endpoints, or only give it a read-only token.

MCP server

Coming soon HiPanel will offer an MCP server over Streamable HTTP, sharing its tool list with the AI assistant in the panel. Planned configuration:

Claude Code

claude mcp add --transport http hipanel https://hipanel.cloud/api/mcp \
  --header "Authorization: Bearer tc_live_xxxxxxxxxxxxxxxx"

Cursor, Claude Desktop

{
  "mcpServers": {
    "hipanel": {
      "url": "https://hipanel.cloud/api/mcp",
      "headers": { "Authorization": "Bearer tc_live_xxxxxxxxxxxxxxxx" }
    }
  }
}

Authenticate with an API token; the token's scopes decide which tools are listed. OAuth sign-in comes later.
Dangerous tools (deleting servers, sites, databases…) are hidden unless the URL has ?allow_destructive=1 and the token has the matching write scope.
Tools that take or return passwords are not available over MCP, because there is no confirmation card to keep secrets away from the model.
Every call through MCP is logged with MCP as its source.

Tool list

The AI assistant in the panel and the MCP server share this list. New tools added to the assistant automatically appear over MCP.

Tools	Kind	What it does
`list_servers · get_server`	Read	View servers, specs and status
`get_server_metrics`	Read	CPU, memory and disk metrics over a time range
`list_sites · get_site`	Read	View sites, domains, SSL and PHP versions
`list_databases · list_firewall_rules · list_cron_jobs`	Read	View databases, firewall rules and cron jobs
`list_tasks · get_task · wait_for_task`	Read	View tasks, read logs, wait for a task to finish
`create_server · create_site`	Write	Create servers and sites (including WordPress)
`issue_ssl · change_php_version · site_action`	Write	Issue SSL, switch PHP, enable/disable sites, purge caches
`create_database · create_firewall_rule · create_cron_job`	Write	Create databases, firewall rules and cron jobs
`retry_task`	Write	Retry a failed task
`reboot_server · reprovision_server · run_command`	Dangerous	Reboot or reinstall servers, run shell commands
`delete_server · delete_site · delete_database`	Dangerous	Delete servers, sites and databases

Using agents safely

One token per agent, clearly named so it's easy to revoke.
Only grant the scopes it needs; a token never exceeds your role.
Start with a read-only token for analysis, and only grant write scopes once you trust how the agent works.
Revoke tokens under Settings → API tokens as soon as you stop using them.