Administer Everlock from your AI assistant

Everlock's admin console now speaks MCP. The new backend-admin-mcp outlet exposes every admin command — around a hundred of them — as Model Context Protocol tools over streamable HTTP, so an AI assistant like Claude can create users, wire up mail domains, manage certificates, inspect jobs, and flip backends on and off through the same engine the SSH console uses.

One engine, three outlets

The admin commands live in a library, everlock-admin-core, with a typed input for every command. The SSH console parses those inputs from a command line; the MCP outlet projects each one into a tool with a real JSON schema — names, types, and descriptions derived from the same source, with drift tests enforcing that the two surfaces never diverge. Results come back as structured JSON, not scraped terminal text.

Authorization is unchanged: the same per-resource ACLs as the SSH console, behind a system-admin entry gate. An assistant can do exactly what the operator whose key it holds can do, and nothing else.

API keys, shown once, hashed forever

MCP authenticates with the new Everlock API keys: Authorization: Bearer evapi_<key_id>.<secret>. Keys are minted with /users apikey create, displayed exactly once, and stored as an Argon2id hash only. First-boot bootstrap prints one next to the generated admin password, so a fresh instance is fully administrable over MCP without ever opening the SSH console.

Public over HTTPS, LAN over mDNS

The outlet is pinned to a vhost (/server settings set admin.mcp.vhost mcp.example.org) and served at /mcp. Public hosts answer over HTTPS exclusively — ACME issues the certificate like for any other vhost. Local hosts (.local names, localhost, private addresses) are also served over plain HTTP, so a LAN instance works with an mDNS-announced mcp.local name and zero certificate setup — a deliberate trade-off for trusted home networks, spelled out in the admin documentation.

Add the URL and the key to your assistant's MCP configuration, and your server answers to plain language.