ZynoHosting CLI and MCP server

@zyno-io/zynohosting is the public command-line and local MCP client for ZynoHosting. It can:

• list sites authorized for the current tenant credential;
• inspect, download, upload, and delete individual files;
• preview and apply complete manifest-driven deployments;
• download a complete deployable snapshot or, with the extra permission, all user content;
• discover, create, embed, and configure published ZynoForms;
• expose the same operations to agents through a local stdio MCP server.

The package requires Node.js 24.

Full CLI and MCP documentation is available at zyno-io.github.io/zynohosting-cli.

Install

npm install --global @zyno-io/zynohosting
zynohosting --help

It installs two executables:

• zynohosting — the human and CI command-line interface;
• zynohosting-mcp — the local stdio MCP server.

You can also run commands without a global install:

npx -y @zyno-io/zynohosting sites list

Authenticate

For an interactive user:

zynohosting login --permission hosting.sitesRead
zynohosting login \
  --name "Claude MCP — work laptop" \
  --permission hosting.sitesRead \
  --permission hosting.deploy \
  --permission forms.create \
  --permission forms.edit \
  --renewable

Browser login creates a tenant-bound scoped CLI token. hosting.sitesRead is requested when no --permission is supplied; repeat the option to request the narrowest complete set for your workflow. Access tokens always expire after 60 minutes. --renewable stores the rotating renewal credential in the operating system credential store and lets long-running CLI/MCP processes refresh automatically. While MCP remains alive, it renews in the background even when no tools are being called; each request also checks freshness as a backstop. The renewal secret is never written to the JSON config file.

Revoke the saved scoped grant and remove its local credentials with zynohosting logout.

For CI or another non-interactive environment, inject a tenant API key:

export ZYNO_HOSTING_API_KEY='...'

The CLI also accepts --environment production|alpha|dev and --api-url. Credentials are resolved in this order:

1. command options;
2. environment variables;
3. the saved login file.

Relevant environment variables are:

• ZYNO_HOSTING_API_KEY
• ZYNO_HOSTING_ACCESS_TOKEN
• ZYNO_HOSTING_TENANT_ID
• ZYNO_HOSTING_TOKEN_EXPIRES_AT
• ZYNO_HOSTING_API_URL
• ZYNO_SUITE_API_URL
• ZYNO_AUTH_API_URL
• ZYNO_HOSTING_ENVIRONMENT
• ZYNO_HOSTING_CONFIG
• ZYNO_HOSTING_LOGIN_URL

Sites

zynohosting sites list
zynohosting sites get example.com
zynohosting sites get 11111111-1111-4111-8111-111111111111 --json

A site may be addressed by its UUID, primary hostname, vanity hostname, or authorized alias.

Individual files

Remote paths are relative to the site document root. Absolute paths, .., control characters, backslashes, and symbolic-link traversal are rejected.

zynohosting files list example.com
zynohosting files list example.com wp-content/themes --recursive

zynohosting files get example.com index.html --output ./index.html
zynohosting files put example.com ./index.html index.html
zynohosting files rm example.com obsolete.html --yes

Use ETags to prevent overwriting a file that changed since it was inspected:

zynohosting files put example.com ./index.html index.html --etag '"etag-from-list"'
zynohosting files rm example.com obsolete.html --etag '"etag-from-list"' --yes

Use --create to require that an uploaded path does not already exist.

Full deployment

zynohosting deploy example.com ./dist
zynohosting deploy example.com ./dist --dry-run
zynohosting deploy example.com ./dist --yes

Deployment is always planned before it is applied. The client and node agent:

1. agree on protocol limits and mandatory ignores;
2. inventory local and remote content; 3

... View full README on GitHub