Connect Claude Code to your panel — Docs

With this set up, Claude Code can look at your panel while you work in a terminal: "which of my accounts is closest to its disk limit?", "show the DNS records for example.com". It reads only what your token allows. Anything that deletes or interrupts becomes a request that waits for you to press Approve in the panel. The assistant never approves its own request.

This is the second way to use AI with Nimbopanel. The first, a chat panel inside the panel itself, is described in AI assistant. You do not need that one to use this.

Before you start

Your panel's address, for example https://panel.yourdomain.com. Use the panel's own address, not an IP.
Claude Code installed on your computer (the claude command works in a terminal).
An account on the panel: administrator, reseller, customer or team user.

1. The administrator switches the connection on (once)

Open System → Security → AI assistant connection (MCP), tick Allow AI assistants to connect, choose which kinds of people may connect one, and press Save. The card shows the address assistants use: /mcp on your panel's address.

A new install has this off. Until it is on, /mcp answers 404 and nothing below works.

2. Make a token only for the assistant

Sign in to the panel and open API tokens: for administrators and resellers under Security, for customers under Advanced. Open Connect an AI assistant (Claude and others).

Give it a name you will recognise, such as Claude Code on my laptop.
For each part of the panel choose No access, Read or Read and change. Start with Read: the assistant can look at everything you tick and change nothing.
Leave Stops working after (days) at 90, or set your own number.
Press Create assistant token.

The panel now shows the token once. Copy it before you leave the page.

3. Paste one command

The panel prints the command with your address and the token already in it. Copy it and run it in a terminal. It looks like this:

claude mcp add --transport http nimbopanel https://panel.yourdomain.com/mcp --header "Authorization: Bearer <token>"

What it says: add an MCP server called nimbopanel, reached over HTTP at the panel's /mcp address, and send your token in the Authorization header on every call.

Where Claude Code keeps it. By default the server is saved for the current project only, in ~/.claude.json on your computer, not in the project folder. Add --scope user to use it in every project. Do not add --scope project with a real token: that writes the token into .mcp.json, a file meant to be committed and shared. If a team shares the connection, put a reference in .mcp.json and let each person keep their own token in an environment variable:

{
  "mcpServers": {
    "nimbopanel": {
      "type": "http",
      "url": "https://panel.yourdomain.com/mcp",
      "headers": { "Authorization": "Bearer ${NIMBOPANEL_TOKEN}" }
    }
  }
}

Each person should make their own token, so a request shows who asked and one token can be revoked on its own.

4. Check that it works

claude mcp list

nimbopanel should show as connected. Inside Claude Code you can also type /mcp. Then ask in plain words:

"List my hosting accounts and tell me which one uses the most disk."
"Show the DNS records for example.com."
"Which of my databases are the biggest?"
Administrators: "Are all services running?", "Is the mail queue growing?"

The assistant can look at accounts and their usage, domains, DNS records, email accounts (never passwords), databases, backups, server load and services, the mail queue, resellers and support tickets, within the parts your token names and your own role.

When you ask for a change

With Read and change, an ordinary new address (A or AAAA) or text (TXT) record on a new, everyday name is added at once.
Everything else waits for you: deleting a record, suspending or bringing back an account, mail records, the domain itself, CNAME, SRV and CAA records, wildcards, and names that mail programs look up. It becomes a request.

Open API tokens → Assistant requests. Each request says in plain words what will happen. Press Approve…, then Yes, do it now. A request expires after 30 minutes. Read the request, not the assistant's message: the request is written by the panel and says exactly what will be done.

Because an assistant asked for the change, the panel first asks you to confirm it is you with your password (and your verification code if you use two-step sign-in); after that it does not ask again for a few minutes.

If it does not work

You see	It means	What to do
`404 Not found` from `/mcp`, or a page saying no website is configured for the address	The connection is switched off, or you used an address that is not your panel's own (an IP, or another domain)	Step 1; use the panel's own address, ending in `/mcp`
`403 forbidden_host`	The address reaches the panel but is not one it recognises as its own	Use the panel's own address, for example `https://panel.yourdomain.com`
`401 Login required`	The token is missing, mistyped, expired or revoked	Make a new token and run the command again
`403 mcp_scope_required`	This is an ordinary API token, not one for assistants	Make a token under Connect an AI assistant
`403 mcp_off_for_role`	Your kind of account may not connect an assistant	Ask the administrator (step 1)
`429 rate_limited`	Too many calls in a short time	Wait a minute
A part of the panel is missing	Its area is set to No access	Make a new token with that area on Read

claude mcp list showing a failure usually means the URL is missing /mcp, or the header is not exactly Authorization: Bearer <token>.

Taking it away

claude mcp remove nimbopanel

removes it from your computer. To stop the token working everywhere, delete it under API tokens; any request it left open is cancelled. The administrator can switch the whole connection off in step 1, and /mcp answers 404 again.

Good habits

Prefer Read. Use Read and change only for the areas that need it.
One token per computer or person, with a name that says whose it is.
Keep the 90-day default, or shorter for a shared machine.
Never paste a token into a chat, a ticket or a file you commit.

Not supported yet: clients that can only connect with an OAuth sign-in. This endpoint takes a token in the header.