MCP server
The panel includes an MCP server: a standard endpoint through which an AI tool you already use operates your hosting account. AI clients use the Model Context Protocol to find and call external capabilities; once connected, a model can work with your account instead of only being told about it.
The idea is the same as the built-in AI Assistant, with the parts in different places:
| AI Assistant | MCP server | |
|---|---|---|
| The model | Supplied by your provider. | Your own. |
| The client | The panel. | Your own AI tool. |
| The operations | The same, with the same validation. | The same, with the same validation. |
The server is at https://<your panel>/mcp. The panel's Integrations page
shows it under Integrations → Model Context Protocol (MCP) Server.
Connect a client
There's no token to create and nothing to paste. Point the client at the URL:
claude mcp add --transport http elpan https://panel.example.com/mcp
The first connection opens a browser consent screen: sign in as the account holder and approve the scopes the client asks for. The client then holds its own short-lived credentials, rotated automatically. The panel page has instructions for the popular clients, including the few that need a small OAuth helper.
It belongs to the panel and authenticates you, the account holder. It has no connection to the identity provider you can run for your domain users, and an MCP client works on an account without one.
Access uses OAuth, not a key, so you revoke it by disconnecting the app under Integrations → OAuth → Connected apps, not on the API Keys page. The two credential systems are separate by design.
What a connected client can do
Each tool is named resource_verb: database_list, appserver_create,
dns_rrset_replace, file_write. Together they cover what the panel
itself manages:
| Area | Covers |
|---|---|
| Applications and services | Databases and database servers, app servers, containers and pods, websites and the mounts that route to them, services on your domains, and TLS certificates. |
| Files | Read, write, list, copy, move, archive, extract, and the trash. This is what lets a client edit your site's code the way it edits a local project. |
| Domain accounts, forwarders, groups and mailing lists, send-only accounts, app passwords, rejection rules, and the traffic, access, and failure logs. | |
| DNS | List, view, replace, and delete record sets; export a zone. |
| The account itself | Shares, processes and signals, resource usage, identity-provider clients, and the global search behind the panel's Ctrl+K box. |
Read-only tools are marked as such in the protocol, so a well-behaved client can tell "look at this" from "change this" and ask you at the right moment.
Most tools take a human-readable name as well as an id: wherever a UUID
works, so does [email protected] or example.com, so a model needn't
look up an identifier first.
The live API reference on the panel page comes from the server itself. The groups above are a summary.
Limiting what it can do
Two things limit a connected client: the scopes you approved at consent, and the confirmation policy the client applies before it writes.
A scope has the form resource:access, e.g. database:readonly,
file:readwrite, dns:readwrite, plus two umbrella scopes,
all:readonly and all:readwrite. Write access includes read access.
A client that only answers questions about your setup doesn't need write
scopes. A connection with all:readwrite can do anything you can.
Beyond scopes, the confinement is the same as everywhere in the panel: the server acts as your account, can't reach another account, and records each call in your audit trail.
Dynamic registration
Some tools register themselves with dynamic client registration instead of using a client you create first. That works here. Dynamic registration describes the guardrails.
That page is mostly about an MCP server you host behind your own identity provider, a different arrangement from this one.
MCP or the API?
| Use | When |
|---|---|
| MCP server | An AI decides what to call. Authentication is OAuth, and the server describes each tool to the model so it can choose. |
| REST API | Your code decides what to call. Authentication is an API key you create and revoke yourself. What a cron job or deploy script needs. |
The operations underneath are the same; only the authentication and the shape differ.