Connecting an AI assistant to adminbolt is the easy part. The interesting question is what you actually do once it is connected. adminbolt ships an MCP server at https://ai-hub.adminbolt.com/mcp, and any MCP-capable client (Claude, Cursor, or VS Code) can drive your hosting in plain language: provision accounts, manage mailboxes and databases, suspend a late payer, check whether the server can take 50 more sites this week.
This post is the workflow companion to the setup guide. If you have not connected yet, start with How to Connect adminbolt MCP to Claude, Cursor, and VS Code, then come back here for what to do with it. Everything below maps to the real tools the MCP server exposes, grouped by the two roles most operators connect with: admin and reseller.
One endpoint, scoped to your role
The same chat box does very different things depending on which key it authenticates with. That is the most important thing to understand before you start typing.
- Admin sees the full surface: roughly 43 tools spanning hosting accounts, domains and subdomains, email, databases and database users, FTP, hosting plans, resellers, and server health and metrics.
- Reseller gets a focused surface: about 12 tools centered on hosting accounts and plans, implicitly scoped so you only ever see and act on your own clients. There is no
reseller_idto pass when creating an account; new accounts attach to your reseller automatically.
This per-role scoping is the same permission model that runs the rest of the panel, applied to the assistant. Each key stays inside its own lane: a reseller works within its own portfolio of accounts and plans, while account-level resources like email and databases stay with the account owner. That isolation is a security feature, and it makes the assistant safe to hand to staff and clients because each one can only act within their own scope.
What the assistant can actually touch
Before the workflows, a quick map of what the assistant can reach. The surface is broad, and it covers the actions operators run most often.
What the MCP covers today:
- Accounts: list, inspect, create, update holder details, change password, suspend, unsuspend, export, delete. Admin can also pull per-account usage details (disk, bandwidth).
- Domains and subdomains (admin): add a domain, subdomain, or parked domain, set PHP version and PHP-FPM per domain, change document root, delete.
- Email, databases, database users, FTP (admin): create and delete mailboxes, databases, database users with privilege assignment, and FTP accounts.
- SSL (admin): toggle automatic Let's Encrypt SSL per account.
- Plans: list, create, rename, delete (admin and reseller).
- Resellers (admin): create, update, delete.
- Server health and metrics (admin): health check, service status, admin statistics, live CPU/RAM/disk, historical metrics, and system info.
That is enough to run provisioning, lifecycle, and day-to-day operations straight from a chat window, which is exactly what the workflows below do.
Admin workflows
Connected as admin, the assistant is closest to a junior operator who never gets tired of repetitive provisioning. A few workflows that pay off immediately.
Onboard a customer end to end
"Set up hosting for acme.com on the Business plan, add an [email protected] mailbox, and create a database with a user for their app."
One sentence, one chain: get_hosting-plans to resolve the plan, post_hosting-accounts to create it, then post_hosting-account_email-accounts, post_hosting-account_databases, post_hosting-account_database-users, and post_hosting-account_database-users_assign to wire up mail and the database. What used to be six screens is one prompt and a confirmation.
Provision a WordPress stack
"Create a database, a DB user with full privileges, and an FTP account so the dev can upload WordPress to example.com."
One prompt sets up everything a WordPress install needs: post_hosting-account_databases, then post_hosting-account_database-users with privileges set to ALL via post_hosting-account_database-users_assign, then post_hosting-account_ftp-accounts scoped to the right path. The dev gets a database, a fully privileged user, and FTP access in one go, ready to drop WordPress in and run the installer.
Spin up a subdomain on a specific PHP version
"Add blog.example.com as a subdomain and run it on PHP 8.4 with PHP-FPM."
post_hosting-account_domains with domain_type=subdomain, then put_hosting-account_domains to set php_version and enable PHP-FPM. Useful when a single site needs a different runtime from the rest of the account.
Suspend a non-paying customer, reinstate later
"Suspend latepayer.com until they pay, then turn it back on."
post_hosting-accounts_suspend takes the sites offline immediately; post_hosting-accounts_unsuspend brings them back. Treat suspend with the same care as a delete: it is service-affecting the moment it runs.
Capacity check before a sales push
"Can the server handle 50 new accounts this week?"
This is where read-only tools shine. get_health, get_services, get_metrics_stats, get_metrics_history, and get_admin_statistics give the assistant enough to summarize current load, headroom, and trend in a sentence instead of you opening five dashboards.
Usage audit across the fleet
"Which accounts are close to their disk or bandwidth limits?"
get_hosting-accounts to enumerate, then get_hosting-accounts_usage-details per account. A good example of a loop you want to run thoughtfully (see the guardrails below) rather than firing blindly across hundreds of accounts.
Offboard cleanly, and respond to incidents
"oldclient.com cancelled, take a backup then delete the account."
post_hosting-accounts_export produces a backup artifact first (it is a non-destructive action), then delete_hosting-accounts removes the account. For a suspected compromise: post_hosting-accounts_change-password, then list and remove the leaked FTP user with get_hosting-account_ftp-accounts and delete_hosting-account_ftp-accounts, and issue a fresh one. Credential rotation in one conversation.
Reseller workflows
The reseller surface is smaller on purpose, and that is a feature. You provision and lifecycle-manage accounts and plans; anything inside an account (mail, databases, FTP, domains, SSL) belongs to the account owner's panel. The workflows are tight and high-frequency.
See your whole portfolio
"Show me all my hosting accounts."
get_reseller_hosting-accounts. The fastest possible status check, scoped automatically to your clients only.
Onboard a new client
"Create hosting for clientx.com on my Pro plan."
get_reseller_hosting-plans to find the plan, then post_reseller_hosting-accounts. No reseller_id needed, the account attaches to you automatically.
Suspend an overdue client, reinstate on payment
"Suspend clientx.com until they pay, then turn it back on."
post_reseller_hosting-accounts_suspend, later post_reseller_hosting-accounts_unsuspend. Same service-affecting caution as the admin version.
Manage your plan catalogue
"Add a Business 2026 plan, rename Starter to Starter Plus, and retire the legacy Basic 2019 plan."
post_reseller_hosting-plans, put_reseller_hosting-plans, and delete_reseller_hosting-plans. One note on the last one: deleting a plan that still has accounts on it orphans them, so migrate accounts off first.
Rotate a password or update contact details
"Reset the login password for clientx.com and update their company name and phone."
post_reseller_hosting-accounts_change-password and put_reseller_hosting-accounts. The reseller profile update covers the holder's name, company, and phone.
Guardrails worth setting up first
Driving hosting in natural language is powerful, which means a few habits matter more here than they would in a click-through panel. This is the part most teams skip and later wish they had not.
- Add an approval step for destructive actions. Treat
delete_*, suspend, and password resets as high-impact: have the assistant state the exact target and wait for an explicit yes before it runs. A human-in-the-loop confirmation keeps the convenience of natural language while keeping you in control of anything irreversible. The in-panel AI Assistant and WhatsApp control build this kind of confirmation in, and it is a good pattern to mirror in your own MCP prompts. - IDs are global once resolved. Listing tools require an account ID, but once you hold a resource ID, a delete or update acts on that resource directly. Pass the wrong number and you act on the wrong account. Always resolve IDs with a list or get call first, and have the assistant echo back what it is about to touch.
- Secrets travel in cleartext. Passwords and FTP credentials are passed as plain strings in the call. Avoid logging conversation chains that include them, and rotate anything that leaks.
- The read-only surface is safe to explore. Every
get_*tool is non-destructive: listings, account details, usage, health, and metrics. This is the right place to get comfortable. Build dashboards, run audits, and let staff learn the assistant's behavior against read-only tools before handing them write access. - Mind bulk loops and rate limits. No rate limits are declared in the tool schemas, but that is not a promise there are none. Throttle loops like the fleet-wide usage audit and check the adminbolt API docs for server-side limits rather than assuming unlimited throughput.
Why this fits how adminbolt is built
None of this is bolted on. adminbolt was designed API-first, with agent access as a first-class capability rather than an afterthought, which is exactly why the MCP server maps so cleanly onto real operations. The same foundation powers the Client REST API shipped in 1.0.4 and the API-first architecture underneath the whole panel. MCP is just the most natural way to reach it: you describe the outcome, the assistant calls the right tools. For the broader automation picture, see Best Hosting Panel for API Automation.
Get started
Spin up a panel with a 30-day free trial at adminbolt.com, connect your assistant to https://ai-hub.adminbolt.com/mcp following the setup guide, and start with the read-only workflows above before you move on to provisioning. Full documentation is at docs.adminbolt.com, and the community on Discord and the forum is the fastest way to get help.
A client-scoped walkthrough, covering what an end customer can do for their own single account over MCP, is coming next.