Everything you can do in the client portal, you can do over our HTTP API — buy a server, control power, reinstall, resize, snapshot, back up, restore, manage firewall rules and SSH keys, read metrics, and pay invoices. We also ship an official MCP server on top of that API, so a customer's AI agent can operate their VPS as an extension of itself — not by copy-pasting commands, but by calling tools directly. The full, always-current API reference lives at /user-api/docs/.

Get an operate-scoped key

An operate key lets an agent (or a script) run your servers: read everything, provision, and manage — but it cannot spend money. Two ways to get one, no website required for either:

• Frontend-free, in one API call — this also creates your account if you don't have one yet:

  curl -s -X POST https://blesta.sovereignhybridcompute.com/user-api/v2/register \
    -H "Content-Type: application/json" \
    -d '{"email":"you@example.com","password":"a-strong-random-password","first_name":"Your","last_name":"Name","country":"US","tos_accepted":true,"scope":"operate"}'

  The response carries a secret key with an shc_live_ prefix. Keep it; you send it as a bearer token on every later call. Review the Terms of Service before you set tos_accepted — that field is your agreement to them.
• From the portal: mint a scoped, revocable key on your API Keys page. Pick the operate scope and an expiry. You can revoke any key the instant you don't trust it.

No key — operate, read, or full — can read or change your account credentials.

Connect the MCP server

Our MCP server exposes the same API as Model Context Protocol tools. Point any MCP client that speaks Streamable HTTP at our endpoint and authenticate with your operate key as a bearer token:

• Endpoint: https://mcp.sovereignhybridcompute.com/
• Auth: the header Authorization: Bearer shc_live_... (your operate key)
• Transport: Streamable HTTP
• Tools: 118, wrapping the customer API one-to-one

We run the server — there is nothing to install. This is the canonical, official MCP for SHC. (Our API docs page may still show an older in-Blesta endpoint at /user-api/mcp; that path is legacy — use mcp.sovereignhybridcompute.com.)

Safe by default

The safety model is enforced by the API itself, not by good intentions:

• An operate key cannot spend. Ask it to buy or upgrade a server, top up credit, or move money, and the API refuses with a clear scope error — it tells your agent that an operate-scoped key cannot do that. Spending is never one wrong tool call away.
• Spending and destructive actions need your explicit approval. Every money or destructive operation is gated: the server hands back a single-use confirm token, your agent surfaces the action to you, and only your go-ahead — re-calling with that token — lets it proceed. The human stays in the loop where it matters.
• Bitcoin only. When you do pay, you pay an invoice in Bitcoin from your own wallet, through our self-hosted BTCPay. See Paying with Bitcoin. There is no card on file for anything to charge.

The skill-pack

If you want your agent to be a competent operator out of the box — with the right discipline and ready-made workflows — point it at our skill-pack at /agent-skills/. It carries the operator rules (never spend without your yes, address servers by service ID, treat a billed service as not yet booted until it reports ready) and end-to-end workflows. Start with get-access: it gets the key and sets everything else up.

Privacy by design

The API tells you what you own and how it's doing — not which physical machine in which rack your server landed on. That placement is ours to manage and not yours to worry about. You address everything by service ID; we handle the rest. This matches how we run everything else: we have no interest in your data.

Start here

• API reference: /user-api/docs/ — rendered straight from the live API spec, so it never drifts.
• Skill-pack: /agent-skills/ — operator discipline plus ready workflows; begin with get-access.
• MCP endpoint: https://mcp.sovereignhybridcompute.com/ — bearer your operate key.
• Latest changes: API v2.4.0: what's new.