HHostSSH

Add-ons

The extra capabilities that ship inside HostSSH — email sending, DNS tools & integrity, webhooks, scraping, browser automation, and the AI copilot / MCP.

Add-ons

Beyond deploy-and-protect, HostSSH bundles several product capabilities you'd otherwise stitch together from separate SaaS vendors. Each is built in, tenant-scoped, and controlled from the dashboard. Most need a small amount of configuration (a sending domain, an API key) before they go live.

Email

Send transactional and alert email from your own domain without a third-party ESP.

  • What it is: a native email engine — sending domains with verification and health checks, API keys, a send API, a durable queue, and a delivery-event log — surfaced on the Email page.
  • Set up: add a sending domain, publish the DNS records it gives you (SPF/DKIM/DMARC), verify, then send. Configure the platform sender with HOSTSSH_PLATFORM_EMAIL_FROM and either an SMTP URL (HOSTSSH_SMTP_URL) or the agent MTA sidecar.
  • Used by: monitor alerts, license-expiry notices, and billing dunning route through this engine, so your alerts and system mail come from you.

DNS tools & integrity

Look up, monitor, and score the DNS health of any domain.

  • DNS SuperTool: on-demand lookups (A/AAAA/MX/TXT/CNAME/NS, propagation, blacklist checks).
  • Integrity score: a health score for a domain's DNS and mail authentication (SPF/DKIM/DMARC), so you can catch a misconfiguration before it costs you deliverability.
  • Continuous monitors: turn any lookup into a monitor (including MTA blacklist watch) that alerts on drift.
  • Cutover helper: when you connect a Cloudflare token, DNS changes for a migration become a dashboard action (see Domains & TLS).

Webhooks

Deliver outbound webhooks reliably.

  • What it is: a durable webhook delivery system — register endpoints, sign payloads (Stripe-style HMAC), retry with a circuit breaker, and see delivery history.
  • Use it for: notifying your own systems (or customers') when events happen in your apps, without building the retry/back-off/signing machinery yourself.
  • API: manage endpoints via POST /api/v1/webhooks/endpoints and drive delivery via /api/v1/webhooks/run.

Scraping

Fetch and extract structured data from the web, safely.

  • What it is: a fetch + extraction engine with SSRF protection (private-range blocking, host pinning) and structured extractors (CSS/regex/JSON-LD).
  • Safety: requests are guarded against pointing back at your own private network; this is the same isBlockedHost guard the attack-surface scanner uses.

Browser automation

Render and interact with real pages when a plain fetch isn't enough.

  • What it is: a Playwright-backed browser worker exposing an observe → plan → act agent and a rendered-DOM scraper (for JS-heavy sites the plain scraper can't read).
  • Set up: the browser worker is gated behind its own service (services/browser-worker) and a token (HOSTSSH_BROWSER_WORKER_URL / HOSTSSH_BROWSER_WORKER_TOKEN).
  • Monitors: a browser monitor type can assert a real page renders and behaves, not just that it returns 200.
  • Deploy smoke tests: the same worker powers the optional browser smoke gate on a deploy — catching "up but blank/JS-crashed."

Attack-surface self-scan

Know what your own boxes expose.

  • What it is: an owner-gated active-recon scan — a common-port sweep, exposed-file probe, certificate-transparency subdomain discovery, and tech fingerprinting — behind a DNS-TXT ownership gate so you can only scan domains you control.
  • Safety: the port sweep pins the resolved public IP and shares the SSRF block-list, so it can't be turned against internal targets.

AI copilot & MCP

Drive and diagnose the whole fleet with an AI agent.

  • Copilot: a RAG assistant grounded in live fleet state. It diagnoses (read-only), and — with your confirmation on each action — can act: redeploy, cancel a job, harden a box, cut over a domain, restore a snapshot, or provision. Every action is RBAC-gated and audited. Activate it by setting ANTHROPIC_API_KEY (it falls back to read-only diagnosis without one).
  • MCP: the same platform actions are exposed over the Model Context Protocol so any MCP host (Claude, etc.) can operate HostSSH as a tool. On a box, hostssh mcp runs the stdio server; the hosted MCP app exposes fleet-wide tools over HTTP-bearer.

Billing & provisioning (platform operators)

If you run HostSSH as a business (reselling capacity), two more surfaces matter:

  • Billing: Stripe checkout + webhooks map plan tiers to license entitlements, with dunning on failed payments. Configure STRIPE_* secrets.
  • Provisioning: spin up new VPSes through a provider driver (Hostinger first) from the dashboard. Paid execution requires a verified encrypted provider Connection, an explicit live opt-in, a server-side monthly ceiling, complete catalog mappings, and a dedicated worker secret. A machine is not labelled ready until provider, boot, agent, backup, and restore-drill evidence are recorded.

These are documented for developers in docs/dev/ and for the business model in docs/BUSINESS-MODEL.md.

Turning things on

Most add-ons are dark until configured — that's deliberate, so nothing sends email or makes outbound calls until you say so. The pattern is always: set the credential/env → verify in the dashboard → use it. If an add-on page says "not configured," it's telling you the truth, not hiding a secret.