Mint a new site key. The old key stops naming the site at once, so the loader on the site has to be replaced with result.loader, and the site returns to pending until the new loader is seen (a disabled site stays disabled; the hit history stays). For a key that leaked or was lost; every call is another key.

Contract:

• MCP tool rotate_website_site_key, registry package mcp.signals/website_sites, mount signals.website.
• Operation action, response envelope action.
• Flags: dangerous: the MCP layer gates it behind a preview/commit token, and the effect cannot be undone through this API.