feat: ship the web hosting skills and catch up with hostinger-api-mcp 2.5.0

[ArnasDon]

Summary

Brings the plugin up to hostinger-api-mcp 2.5.0, so Cursor users get the web hosting skills in the / menu and every operation the plugin names actually exists. Since 2.1.0 (2026-09-28) every operation has been renamed after the CLI commands, and since 2.0.0 each server exposes only search / execute / multi-execute. Every name in the current plugin, such as hosting_listWebsitesV1 and DNS_updateDNSRecordsV1, is gone.

• Skills: the five hand-written skills are replaced by the seven that hostinger/api-mcp-server publishes. They are troubleshoot-website, connect-domain, deploy-to-hosting, maintain-wordpress, audit-hosting, migrate-to-hosting and hostinger-headless.
  • The new scripts/sync-skills.mjs copies them from a published package version or from a local skills directory. It leaves out the cold-start entry/ bootstrap and names each folder after the skill.
  • A new advisory skills-drift CI job, alongside catalog-drift, flags when skills/ falls behind @latest.
• Servers: mcp.json now registers hostinger-agency-hosting-mcp. Without it, every Agency Plan step in the skills failed. USER_AGENT and plugin.json are bumped to 0.3.0.
• Rules:
  • prefer-mcp-tools explains the three-tool server model and the current prefixes (wordpress_, agency-hosting_, dns_, vps_).
  • confirm-destructive-actions keys confirmation off the destructive hint that search returns, plus a short list of the highest-risk operations under their current names.
  • nodejs-deployments is removed; deploy-to-hosting covers it with the current app_type list.
  • The claim that Node.js environment variables can't be set through the API is dropped, because hosting_nodejs_replace-environment-variables does exactly that.
• Agent and command: hostinger-deployment-reviewer and /hostinger-status now use current names. The status command also covers Agency Plan sites.
• check-tool-names.mjs: refreshed against the 2.5.0 catalog of 403 operations. Inside the synced skills/, it checks only operation-prefixed names, because those files are verified upstream and mention many request fields. The hand-written files keep the strict check that rejects any unknown name.
• README and CHANGELOG are updated. The README now steers installs to the marketplace, because a GitHub-URL install can stay on the commit it was installed from.

Reaching users needs one more step: Cursor reviews each marketplace update by hand before it goes out.

Test plan

• node scripts/validate-template.mjs: passes
• node scripts/check-tool-names.mjs: 139 distinct operations referenced, all present in 2.5.0; all 9 servers map to real groups
• Every JSON file parses; shellcheck passes on the hook
• node scripts/sync-skills.mjs on the committed tree produces no changes
• Install the branch locally (~/.cursor/plugins/local), then confirm the seven skills appear under / and an Agency Plan call goes through hostinger-agency-hosting