# RiLiGar Hoster — MCP Server

Static sites and SPAs: one project is one subdomain.

Endpoint: `https://hoster.worker.myinfrastructure.click/mcp`
Protocol: MCP revision 2026-07-28, Streamable HTTP, stateless. `POST` only —
`GET` and `DELETE` answer 405.

## Authentication — OAuth 2.1, and nothing else

```
Authorization: Bearer <OAuth access token>
```

The token is issued by RiLiGar Auth and identifies a PERSON. Your client
discovers the authorization server on its own: call the endpoint without a
credential, read the 401, follow the challenge.

```
WWW-Authenticate: Bearer
  resource_metadata="https://hoster.worker.myinfrastructure.click/.well-known/oauth-protected-resource",
  scope="auth:read auth:write"
```

**API keys do not authenticate here.** RiLiGar Hoster's key is the credential of the
REST API; sending it to this endpoint returns 401. MCP is for people, the REST
API is for machines — and the token, unlike a key, says which person and with
which consent.

### The audience is what isolates one server from another

The token's `aud` must be `https://hoster.worker.myinfrastructure.click/mcp`.
A token issued for another RiLiGar MCP is refused here even carrying the same
scope names (RFC 8707). It is the audience, not the scope name, that separates
one service from the next.

### Connecting

```bash
claude mcp add --transport http hoster https://hoster.worker.myinfrastructure.click/mcp
```

No key in the command, and no secret in a config file: you approve in the
browser and the client stores the token.

## Tools — 14 in total

The catalogue is filtered by the token's scopes: a tool outside them is not
registered, so it does not appear in `tools/list` and calling it by name fails.

The owner always comes from the credential, never from a tool argument — that is the defence against prompt injection.

### Read — scope `auth:read`

- `hoster_check_name`
- `hoster_deploy_status`
- `hoster_get_project`
- `hoster_list_deployments`
- `hoster_list_projects`

### Write — scope `auth:write`

- `hoster_audit_project`
- `hoster_check_domain`
- `hoster_delete_project`
- `hoster_deploy_ticket`
- `hoster_purge_cache`
- `hoster_rollback`
- `hoster_set_cache`
- `hoster_set_domain`
- `hoster_set_variables`

Publishing does not send bytes through the agent: `hoster_deploy_ticket` returns a terminal command, and the CLI uploads the files.

## Errors

A business error is a RESULT, not a transport failure: HTTP 200 with
`isError: true` and a readable reason. The agent needs the refusal as an
answer it can act on.

Transport and authentication failures do use HTTP status:

| Status | Meaning |
|---|---|
| 401 | No credential, an invalid token, or an API key sent instead of a token |
| 403 | Identity known, scope missing |
| 404 | Unknown method |
| 405 | `GET` or `DELETE` — this revision has no session |

## Also see

- `https://myinfrastructure.click/products/hoster/llms.txt` — the REST API, where the API key belongs
- `https://myinfrastructure.click/products/auth/llms-mcp.txt` — Auth as the authorization server