Hypamoon

com.hypamoonPublished by hypamoon.comOfficial publisherv1.0.1Updated Oct 30, 2026

Where AI lives: sites, apps, data, domains, email, payments and a phone line, live from your chat.

VerifiedStreamable HTTPWeb executableCloud & Infrastructure Communication & Collaboration Business & Commerce

Server details

Identifier: com.hypamoon/hypamoon
Transport: Streamable HTTP
Runtime: Web executable
Trust: Verified
Published: Oct 16, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified that this server's namespace belongs to hypamoon.com, which also runs its endpoint. That identifies the publisher; it does not make the server's tools safe.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/com.hypamoon%2Fhypamoon.svg)](https://sourceweft.com/mcp/com.hypamoon%2Fhypamoon?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

Hypamoon is a hosted MCP server that lets a chat publish websites and apps, collect forms, take payments, send email and SMS, manage domains and run a phone…

What you can do: Publish and manage sites and apps, including sign-in, roles, per-user data, file uploads, domains and media
Read and write form entries, bookings, orders and other collections
Set up checkout payments into your own Mollie account and manage domain purchases
Read and send email and SMS, and read calls and transcripts
Claim phone numbers, set who they ring, and configure a voice assistant and site chat
Send events to your own systems via webhooks
When to use it: Use it when you want a chat to take a site, form, payment flow or phone line from draft to something actually running for a business, rather than leaving it as text in the conversation. Start in a test project, where nothing costs money and calls are simulated, before switching to live.
Requirements: A remote endpoint at api.hypamoon.com over streamable HTTP; nothing to install. Sign-in is by OAuth from Claude, Claude Code, ChatGPT or Cursor, where you choose the project and scopes; scripts and CI can use an API key sent as an Authorization Bearer header. A Hypamoon account and project are needed, and a Mollie account for payments.

Before you install

It can publish public sites, send email and SMS, place outbound calls and move money, so grant only the scopes a task needs and limit connections to specific sites. Irreversible actions such as deleting a site, releasing a number, changing live DNS or going live are confirmed in the portal with a passkey, and payment setup and refunds happen only in the portal. Keep API keys out of the chat and browser code. Test mode keeps everything simulated.

Installation

In SourceWeft

Open Hypamoon in the dashboard and add it to a workspace.
Connect the required credentials. They are stored privately and never shown on public pages.
Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/com.hypamoon%2Fhypamoon/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config. The client completes OAuth sign-in on first connect.

{
  "mcpServers": {
    "hypamoon": {
      "type": "http",
      "url": "https://api.hypamoon.com/api/v1/mcp"
    }
  }
}

README

Hypamoon MCP server

Where AI lives. Everything between AI and the workfloor.

Most people can already get a chat to write a website, a booking form or a small app. Then it stops. The page sits in the chat, nobody can visit it, the form sends nowhere, and there is no way to take a payment or answer the phone. That gap between what AI writes and what actually runs in a business is what Hypamoon fills.

Connect Hypamoon to Claude, ChatGPT or Cursor and ask for it in plain words. Your chat builds it, Hypamoon runs it.

This repository holds the public listing of the Hypamoon MCP server: this README, the server.json we publish to the MCP Registry, and how to report a security issue. The server itself is hosted by us. There is nothing to install.

What your chat can do with it

Put a site or app live. A real address on hypamoon.app or your own domain. Apps can have sign-in, roles, private data per user and file uploads.
Collect forms. Contact forms, bookings and orders land in your project, and your chat can read them back.
Take payments. A checkout on your own site, paid into your own Mollie account. You are the seller and the money goes straight to you. Hypamoon never holds it.
Send email. From your own domain, to people who already know you, like someone who filled in your form.
Domains. Find a new domain or connect the one you have. Your existing mailbox keeps working.
A phone number that answers. Calls can ring your own phones first, and a voice assistant picks up when nobody does. Also SMS, and a chat on your site.

The full list of tools, with what each one does, is in the docs: https://hypamoon.com/docs/mcp

Connect

The MCP URL:

Start with your test project. In test mode nothing costs money, numbers are test numbers and calls are simulated. Switch to your live project when it works.

Claude (claude.ai and Claude Desktop)

Customize, Connectors, Add custom connector. Name it Hypamoon, paste the MCP URL and leave the OAuth fields empty. Choose Connect and sign in.

Claude Code

Then type /mcp, pick hypamoon and choose Authenticate. Your browser opens and you sign in.

ChatGPT

Plugins, Add, Add custom MCP server. Name it Hypamoon, paste the MCP URL, choose OAuth and leave the client fields empty. Connect and sign in. In a work account an admin may have to allow custom MCP servers first.

Cursor

In ~/.cursor/mcp.json (all projects) or .cursor/mcp.json (one project):

Cursor opens the Hypamoon sign-in in your browser. Prefer a key? See below.

Step by step for every app: https://hypamoon.com/connect

Signing in

OAuth (the chat apps). You paste the URL, the app sends you to a Hypamoon consent screen, and there you choose which project the app may use and what it may do. You can see every connected app in the portal, with when it was last used, and revoke it there. It stops working right away.

API key (scripts, CI, your own app). Create a key in the portal and send it as Authorization: Bearer hm_test_... or hm_live_.... We only store a hash of it. Keep it out of the chat and out of browser code.

What it may do. Every tool needs a scope, and a key or connection only sees the tools its scopes allow. In plain words:

Scope	What it allows
`project:read`	See the project, its balance and its agents. Always on.
`project:write`	Change company details and manage agents.
`sites:read` / `sites:write`	See or publish sites and apps, and manage domains and media.
`data:read` / `data:write`	Read or write form entries, orders and other collections.
`numbers:read` / `numbers:write`	See numbers, or claim one and set who it rings.
`assistant:write`	Set up the voice assistant.
`calls:read` / `calls:write`	Read calls and transcripts, or let the assistant call someone.
`messages:read` / `messages:write`	Read or send SMS and email.
`chat:read` / `chat:write`	Read or run the chat on your site.
`webhooks:write`	Send events to your own systems.

An owner can also limit a key or a connection to a few sites and apps. More: https://hypamoon.com/docs/authentication

Safeguards

We would rather say no than let something go wrong in a customer's name. This is what is in place today.

Test and live. A test key or test project keeps everything simulated: no money moves, no real calls, test payments only.
You confirm what cannot be undone. When a chat connected with OAuth asks for something you cannot take back, like deleting a site, releasing a number, changing DNS on a live domain, changing who is in the team or moving to live, the tool does not do it. It answers with a link to the portal. You read what will happen in plain words and confirm with your passkey. Cancel changes nothing.
Four eyes, if you want them. An owner can turn on four-eyes approval. A live deploy or a deleted site then waits for a second owner or builder. Nobody approves their own change, not even one made by their own agent.
No money from the chat. Connecting your payment account and agreeing to our fee only happen in the portal, by the owner. In Claude, Claude Code and ChatGPT a refund or a domain purchase never happens from the chat itself. You check the amount and click in the portal, or nothing happens.
Passwords stay out of the chat. When your chat needs a key for another service, it asks you to paste it in the portal, not in the conversation.
Calls with manners. Before every live call your chat tells you who it will call and why, and waits for your yes. The voice assistant always says it is a digital assistant and asks if it is a good time; that cannot be switched off. Sales calls only go out when the person's consent is recorded, and only within calling hours. Outbound calls need a verified account.
Checks on every site. Fake login pages, card fields and forms that send data elsewhere do not go live. Public sites are checked daily against lists of known phishing and malware.
Rate limits. Every key and every connected app has a rate limit.

Security and abuse

Found a vulnerability? Email [email protected]. Please read https://hypamoon.com/security first; our contact details are also in https://hypamoon.com/.well-known/security.txt. See SECURITY.md.

Seen a site, number or message on Hypamoon that looks like phishing, fraud or spam? Report it at https://hypamoon.com/abuse or email [email protected].

Who we are

Hypamoon is run by Hypamoon B.V., Rotterdam, the Netherlands.

The text in this repository is ours. You are welcome to link to it and quote from it, but please do not republish it as your own.

Source: README.md at commit 72a8eff

Tools

This server asks you to sign in, so SourceWeft could not read its tools without an account and has not indexed them. What a connected account sees can depend on that account and its permissions.

Version history

v1.0.1LatestOct 23, 2026
v1.0.0Oct 16, 2026

Score

75% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

Reached in the last 30 daysRequired25 pts
Auth declaredRequired10 pts
Tools listed15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
License10 pts
Declare a license in the repository or the registry entry.