Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/ringo380/claude-cpanel-mcp/setupgit clone --depth 1 https://github.com/ringo380/claude-cpanel-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/ringo380/claude-cpanel-mcp/setup)<a href="https://agentmods.dev/commands/ringo380/claude-cpanel-mcp/setup"><img src="https://agentmods.dev/badge/commands/ringo380/claude-cpanel-mcp/setup.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00033 | $0.00981 |
| Opus 5 | $0.00016 | $0.00491 |
| Sonnet 5 | $0.00007 | $0.00196 |
| Haiku 4.5 | $0.00003 | $0.00098 |
Grade A, and why
setup scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 65 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/cpanel-mcp:setup
Drive a state-machine flow that takes the user from "plugin enabled" to "issuing cPanel API calls" entirely in chat. The MCP tools handle persistence; this command orchestrates the conversation.
cPanel does NOT support OAuth. Authentication is via an API token the user creates inside the cPanel UI and pastes back here.
Step 1 - Diagnose current state
Call auth_status. Branch on the result:
- Already configured: ask via
AskUserQuestionwhether they want to (a) add a new profile (multi-account setup), (b) rotate the token on the active profile (auth_rotate_token), or (c) abort. If (a), proceed to Step 2 with a fresh profile name. If (b), skip to Step 4 withauth_rotate_tokeninstead ofsetup. - Not configured: proceed to Step 2 with profile name
"default".
Step 2 - Collect host + user
Use AskUserQuestion, one field at a time:
- cPanel hostname - what they put in the browser to reach cPanel. Examples:
web2.siteocity.com,cpanel.theirdomain.com, or the server's raw IP. Strip anyhttps://or trailing port for them. - cPanel username - their login name.
- (If adding a profile) profile name - short kebab-case label like
siteocityorclient-acme. 1-64 chars of[a-zA-Z0-9_.-].
Step 3 - Surface the token-creation URL
Call auth_open_token_page(host=<host>). Relay the URL and the numbered steps it returns to the user.
If they report "Manage API Tokens" is missing from cPanel, the hosting provider has it disabled. Stop here and tell them to file a support ticket.
Ask them to paste the token back in chat. Treat the pasted value as opaque - never log or echo it back in full.
Step 4 - Dry-run validate
Call auth_test(host=<host>, user=<user>, api_key=<token>). This does NOT write to disk.
Branch on result:
- OK: proceed to Step 5.
CPHULK_LOCKOUT: stop. Tell the user their IP is blocked, instruct them to file a hosting-provider ticket, and offer to retry once unblocked. Suggest trying the server's raw IP instead of hostname (cPHulk is often hostname-keyed). Do NOT retry automatically - repeated attempts extend the lockout.AUTH_FAILED: ask whether the token is fresh (cPanel sometimes shows the token only once and pasting can lose characters). Loop back to Step 3 with a regenerated token.NETWORK_ERROR: confirm host and port (default 2083); ask whether the host uses a self-signed cert (offerinsecure_tls=true).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 65 lines · 33 tokens per session scan A c862ed2f1ccd
setup is a command published in the GitHub repository ringo380/claude-cpanel-mcp (1 stars, last pushed 1mo ago), licensed MIT. It adds 33 tokens to every session and 981 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
init
Install the formatters this repository needs, with every command visible before it runs.
brand-generate
Generate an on-brand document from a saved Brand Profile.
genshijin-compress
Markdown・テキストファイルを原始人形式へ安全圧縮.
save
Save this conversation as a new or existing reusable context.
wp-polylang
Translate an existing WordPress site into a second language using Polylang.
standup
Show a daily standup summary with completed, in-progress, and blocked tasks across all active epics.