Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/hostinger/api-mcp-servernpx agentmods add skills/hostinger/api-mcp-server/webappWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hostinger/api-mcp-server/webapp)<a href="https://agentmods.dev/skills/hostinger/api-mcp-server/webapp"><img src="https://agentmods.dev/badge/skills/hostinger/api-mcp-server/webapp/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/hostinger/api-mcp-server/webapp"><img src="https://agentmods.dev/badge/skills/hostinger/api-mcp-server/webapp.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00069 | $0.02484 |
| Opus 5.5 | $0.00028 | $0.00994 |
| Sonnet 5.5 | $0.00014 | $0.00497 |
| Haiku 4.5 | $0.00007 | $0.00248 |
Grade A, and why
headless-step-provision-webapp scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 159 lines — stays where its author put it; the contents beside it link to each section on GitHub.
headless-step-provision-webapp
Provision a bare Node.js app host for <domain> and prove it is ready. This is the backend for
any webapp, SPA or app that brings its own code (and, if it needs one, its own database) — there is
no CMS and no store engine here. The site is an empty website: just the hosting slot that the
frontend step builds into and the deploy step ships to as a Node.js application. Out: site.json.
Not WordPress, not Ecommerce. Never provision
headless_wordpress/headless_ecommercefor a webapp, and never install WordPress at/cms. A webapp owns its own routes, data and rendering.
All website/database operations below go through the Hostinger connector (execute).
Fire vs join (background provision). Steps 1–2 up to
hosting_websites_start-setupare the fire half: once the setup is queued, recordprovision.in_progressand return to do prepare work (see the router../SKILL.md). The readiness poll at the end of Step 2, plus Steps 3–5, are the join half — run them when an instance-barrier step needs the backend (or immediately, if the agent can't interleave). An already-completedsite detected in Step 1 means provision is done: recordprovision.completedand adopt it.
Step 1 — Detect before you create (never provision twice)
hosting_websites_list { "domain": "<domain>" }— substring filter, so exact-match the row'sdomain. If a row exists, noteusername,order_id,website_type.hosting_websites_list-setups { "domain": "<domain>" }— exact-match the row:completed→ already provisioned → skip to Step 3 (adopt it).running→ skip to Step 2 (poll).failed→ tell the user and point them at hPanel; do not call start-setup again on your own.
- If the site exists but is a different kind (
website_typeisheadless, or a WordPress/store site), stop and tell the user — this domain already hosts something else.
Step 2 — Create (only when nothing exists)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago Changed · +2 lines 1b4639929e9d
- 6d ago Changed · +1 lines 9b7aa3f3643b
- 7d ago Changed · +1 lines f93a16580c8a
- 10d ago First seen · 155 lines · 69 tokens per session scan A 79989e076068
headless-step-provision-webapp is a skill published in the GitHub repository hostinger/api-mcp-server (165 stars, last pushed today), licensed MIT. It adds 69 tokens to every session and 2,484 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-20.
Other skills, from other repositories
adapter-aws-lambda
Deploy tRPC on AWS Lambda with awsLambdaRequestHandler() from @trpc/server/adapters/aws-lambda for API Gateway v1 (REST, APIGatewayProxyEvent) and v2 (HTTP, APIGatewayProxyEventV2), and Lambda Function URLs. Enable response streaming with awsLambdaStreamingRequestHandler() wrapped in awslambda.streamifyResponse().…
adapter-fetch
Deploy tRPC on WinterCG-compliant edge runtimes with fetchRequestHandler() from @trpc/server/adapters/fetch. Supports Cloudflare Workers, Deno Deploy, Vercel Edge Runtime, Astro, Remix, SolidStart. FetchCreateContextFnOptions provides req (Request) and resHeaders (Headers) for context creation. The endpoint option…
mirrord-temporal
Helps DevOps engineers configure mirrord Operator's Temporal task queue splitting feature end-to-end. Generates the MirrordSplitConfig and MirrordPropertyList Kubernetes CRD YAMLs, the matching mirrord.json splitqueues section with messagefilter and jqfilter, and Helm value guidance. Use this skill whenever the user…
devops/deploy-railway
A deployment guide for running backend services and managed databases on Railway with its command-line tool. It covers common languages, Docker applications, and PostgreSQL, MySQL, Redis, and MongoDB services.
Contract Testing with Pact
Consumer-driven contract testing skill using Pact, covering consumer tests, provider verification, Pact Broker integration, and CI/CD workflows.
API Rate Limiting Testing
Testing API rate limiting implementations including throttling behavior, burst handling, rate limit headers, and distributed rate limiting patterns.