impreza-mcp
MCP server for Impreza Host: deploy custom apps to managed VPSes from your AI editor.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
imprezahost
Source: Glama · also listed on github_repo_search
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
impreza_list_serversimpreza_list_appsimpreza_list_deploymentsimpreza_deploy_customimpreza_uninstall_deploymentimpreza_get_logsimpreza_restart_deploymentRestart a deployment's docker-compose stack (non-destructive). The container is stopped + started; data volumes preserved. Status flips to `installing` briefly then back to `running`. Works for both catalog and custom deployments.
impreza_redeploy_deploymentRebuild a CUSTOM deployment in place from its current source — re-pull the image, re-clone the watched git ref at its new HEAD, or rebuild — and swap the container with near-zero downtime. Reuses the same deployment, so the domain, host port, and URL never change. This is the in-place way to ship a …
impreza_change_domainRe-route a RUNNING deployment to a new clearnet hostname without touching its container or data. The agent regenerates its Caddy fragment + reloads zero-downtime; Let's Encrypt issues a fresh cert on the first hit. Use to migrate from an auto-subdomain to a custom domain, or vice-versa, or just to r…
impreza_add_onionAdd a Tor v3 hidden service (.onion mirror) to a deployment that's currently running clearnet-only. The agent provisions Tor + publishes the hidden service alongside the existing clearnet route. Useful when the customer realized post-install that they wanted Tor exposure. The .onion address is persi…
impreza_git_webhook_statusCheck whether a custom deployment is wired up for git-push auto-deploy. Returns the git url, branch, the mode (github one-click | manual generic | none), whether the webhook is active, and the payload URL the provider posts to. Use before calling `impreza_git_webhook_connect` to confirm the deployme…
impreza_git_webhook_connectWire up auto-deploy: connect a push webhook so every push to the deployment's tracked branch triggers a redeploy. Works with ANY provider against one per-deployment secret. Two modes: (1) GitHub one-click — pass `github_pat` (a Fine-grained PAT with `Repository → Webhooks: read and write`, generate …
impreza_git_webhook_disconnectStop auto-deploying from git. Always clears the Impreza-side webhook state (further pushes are rejected — the token/signature no longer matches). For a GitHub one-click hook, supply `github_pat` to also DELETE the webhook from the repo cleanly; for a manual/generic hook (GitLab, Bitbucket, Gitea, se…
impreza_deploy_catalog_appInstall an app from the Impreza catalog (Vaultwarden, n8n, Nextcloud, etc.) on a target VPS. Use `impreza_list_apps` to discover available names. Pair with `impreza_list_servers` to find the right `agent_id`. Variables specific to the app (e.g. `signups_allowed` for Vaultwarden) go in `vars`. For no…
impreza_account_infoimpreza_list_servicesimpreza_topupimpreza_topup_statusimpreza_topup_paymentimpreza_domain_checkCheck domain availability + price before registering. Pass one domain or several comma-separated. Read-only.
impreza_domain_detailsimpreza_list_dnsList the DNS records (host, type, value, TTL, priority) for a domain on Impreza-managed DNS. Read-only.
impreza_add_dns_recordimpreza_update_dns_recordimpreza_delete_dns_recordDelete a DNS record from an Impreza-managed domain. Identify it by `type` + `host` + `value`.
impreza_set_nameserversimpreza_vps_statusimpreza_vps_powerimpreza_vps_list_backupsList the available backups for a Proxmox VPS (id, timestamp, size). Read-only.
impreza_vps_create_backupTrigger an on-demand backup of a Proxmox VPS. Poll `impreza_vps_list_backups` for completion.
impreza_vps_list_templatesimpreza_vps_reinstallimpreza_list_productsimpreza_order_vpsimpreza_domain_pricingimpreza_register_domainimpreza_list_invoicesimpreza_pay_invoiceimpreza_list_dedicatedimpreza_dedicated_infoimpreza_dedicated_statusimpreza_dedicated_ipsimpreza_dedicated_bandwidthimpreza_dedicated_powerimpreza_dedicated_set_rdnsimpreza_upgrade_serviceimpreza_titan_detailsimpreza_titan_dnsimpreza_titan_webmailimpreza_google_detailsimpreza_google_dnsimpreza_google_setup_adminimpreza_vps_list_snapshotsimpreza_vps_create_snapshotimpreza_vps_rollback_snapshotimpreza_vps_delete_snapshotimpreza_vps_restore_backupimpreza_vps_delete_backupimpreza_vps_list_backup_schedulesimpreza_cloud_rdnsimpreza_cloud_set_rdnsimpreza_cloud_delete_rdnsDisclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
node-tar: Decompression/parse DoS via unlimited input
When Vitest UI server is listening, arbitrary file can be read and executed
node-tar: Negative tar entry size causes infinite loop in archive replace
node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection
node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)
Tool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
62/62 tools missing one or more hints — impreza_list_servers (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); impreza_list_apps (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); impreza_list_deployments (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +59 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Tool test coverage
Only 3/62 tools referenced in tests (5%)
Write tests that reference each tool by name so every tool has at least one test.
Production dependencies are patched
1 critical, 2 high severity in production deps — tar@7.5.15 (critical), tar@7.5.15 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Dev dependencies
1 critical/high in dev-only deps (does not ship to users)
Upgrade dev dependencies when convenient.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/imprezahost/impreza-mcp)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check