Cloudways just handed AI agents access to nearly everything a hosting account touches, malware scans, staging environments, billing, team permissions, background jobs, and as a result, the update raises a question worth sitting with: how much control should a chatbot actually have over your infrastructure?
This week, the company’s Model Context Protocol server jumped to version 1.2.112, nearly doubling its tool count to 244, with 112 of those arriving fresh. The MCP server is the piece of software that lets AI tools like Claude, Cursor, or Windsurf act directly on hosting accounts. With the update in place, an agent can now restart a service, deploy code, run a security scan, or send a client invoice straight from a chat window, no dashboard needed.
Cloudways is not alone here. Its parent company, DigitalOcean, shipped its own MCP server back in August 2025, and community-built versions already wrap other hosting panels, including one for cPanel that exposes 164 tools of its own.
What actually matters here, though, isn’t the tool count. It’s what Cloudways changed underneath it. Instead of issuing one API key with blanket access to everything, the company now offers three permission tiers: read-only for monitoring, limited scope for specific tasks, and full access for total control. “Instead of one key with blanket access, you generate a token scoped to exactly what you want,” the company said.
That distinction matters more than it might sound, especially because the security research on this category of tool is genuinely unsettling. The firm BlueRock scanned more than 10,000 public MCP servers and found 9.2% carrying critical vulnerabilities, with 43% vulnerable to command injection, meaning an outsider could potentially run their own commands on the server.
In one proof-of-concept attack against Microsoft’s own MarkItDown MCP server, for example, BlueRock researchers used a separate flaw to pull AWS access keys directly out of a cloud instance’s metadata, keys that, depending on their permissions, could open a door into the wider AWS account.
Against that backdrop, scoped tokens aren’t a nice-to-have, they’re the difference between an agent that can fix one thing and an agent that becomes a single point of failure across every client site an agency manages. Ultimately, for anyone handing an AI agent the keys to a hosting account, the real question isn’t whether it’s convenient. It’s how narrowly that key gets cut.
