Connect your AI agent to DeployCloud

What needs attention across your apps, the apps you can reach, your plan and the activity log.

• What needs attentiondiagnoseReads

  One report of everything that needs attention across the apps this account can reach, or in one app: apps down or crashing, failed or stuck deploys, 5xx spikes, alerts firing, domains not verified, HTTPS certificates broken or expiring, volumes and databases near full, backups missing or failing, crons failing, configuration changed but not yet deployed. Most urgent first; each finding lists the calls that look into it or fix it, limited to what the caller's role allows. For a health check, or when something seems wrong.

• List appslist_appsReads

  Every app you can reach — your own and the ones shared with you — with the status of its latest production deployment, replica count, live URL, repo, branch, group, tags and YOUR role on it (owner, admin, member, developer, viewer).

• Get an appget_appReads

  One app in detail: repo, branch, scale, URL, verified domains, its live release (commit, processes), build & run settings (port, health path, root dir, memory/CPU caps), plan limits, previews, maintenance, site-password state, alert thresholds, autoscaling, notification webhook (set/unset), backup schedule, your role and the exact permissions it gives you, and env var KEYS when you may read them (values never leave the platform).

• Account, plan and usageget_accountReads

  The account you are signed in as: email, plan and what it allows (apps, replicas, memory/CPU, add-ons, volumes, domains, collaborators, backups, alerts, autoscaling, log drains), how much is in use, subscription state, security (2FA, passkeys) and the plan catalogue with prices.

• Activity logget_activityReads

  The audit trail: who did what to which app, newest first — deploys, settings, env changes (keys only), domains, backups, collaborators. For questions like "what changed before this broke?". Covers the apps the account can see and what it did itself.

Deployments, logs, metrics, alerts, env keys, domains, add-ons, volumes, backups, crons, previews and who has access.

• List deploymentslist_deploymentsReads

  The 20 most recent deployments of an app (id, status, trigger, commit sha, timestamps, health status). Rows with previewBranch are branch previews, not production.

• Get a deploymentget_deploymentReads

  One deployment: its status (queued, building, deploying, then "running" on success or "failed"), trigger, commit and timestamps, the end of its build + release log with credentials masked and, for a failed one, a plain-words diagnosis. For following a deploy until it settles, or finding out why one failed.

• Runtime logsget_logsReads

  The runtime (container) logs of the app's live production release, credentials masked. Limit to the last N lines with `tail` (default 200, max 2000).

• Metricsget_metricsReads

  CPU / memory / replica samples, uptime, and HTTP traffic (requests, 2xx–5xx counts, 5xx rate, p50/p95 latency) for an app over a window (default 1 h, max 48 h).

• Alert historylist_alertsReads

  Recent alert history for an app (down / high CPU / high memory / error rate; firing and recovered).

• Environment variable keyslist_envReads

  Environment variable KEYS of an app with their scope (all / production / preview) and whether they reach the build. Values are write-only and never returned.

• List domainslist_domainsReads

  An app's custom domains: verification state, the DNS TXT record that proves ownership, and how its HTTPS certificate is obtained.

• List add-onslist_addonsReads

  The add-ons (databases, caches, object storage…) provisioned for an app. Their credentials live in the app env and are never returned.

• List volumeslist_volumesReads

  An app's persistent volumes (name, mount path, size). These are the only paths whose contents survive a deploy.

• List backupslist_backupsReads

  An app's backups: every add-on dump and volume archive (file, kind — 'vol:<name>' for a volume —, size, when) plus the schedule, retention and what the schedule skips. For checking that a recent backup exists before a risky change, and for the exact file names that restoring or deleting one takes.

• List cron jobslist_cronsReads

  An app's scheduled jobs: id, schedule (UTC), command, whether paused, last run, exit code and the tail of its last output (credentials masked).

• List branch previewslist_previewsReads

  Branch previews of an app: whether auto-deploys are on, whether preview URLs are password-protected, and every running preview (branch, status, URL).

• List log drainslist_log_drainsReads

  Where an app's runtime logs are forwarded (kind and host — never the full endpoint, which carries an ingest token).

• Site password stateget_site_passwordReads

  Whether an app's production site is behind a password page, plus its message and public paths. The password itself is never returned — only whether one is set.

• GitHub webhookget_github_webhookReads

  The push-to-deploy webhook for an app's GitHub repo: payload URL, content type, events and branch. The HMAC secret is never returned, only whether one is set.

• List collaboratorslist_collaboratorsReads

  Who can reach an app (with slug): owner, collaborators with their role, and pending invitations if you manage collaborators. Without slug: your account team — people with a role on EVERY app of your account — and the accounts you belong to.

Deploy, roll back, restart, scale and autoscale, run one-off commands, and branch previews.

• Deploydeploy_appChanges

  Queues a build and release of the app's tracked git branch and returns the new deployment id; the deploy runs asynchronously. While one is already queued, the same one is returned. Apps created from uploaded code deploy only from an uploaded archive.

• Roll backrollback_appAsks first

  Re-deploy a previous release by reusing its image (no rebuild), replacing what is live now. Omit deploymentId for the release just before the current one. Without confirm it previews what would be replaced.

• Restartrestart_appChanges

  Zero-downtime restart: fresh containers from the current release image, health-checked, then the old ones reaped. No rebuild — but runtime env, domains and volumes are re-read, so it applies those changes. Fails if there is no live release.

• Scalescale_appChanges

  Set the web replica count (1 or more; the plan caps it, as the app's limits show). Reuses the current image and rolls out with health checks. Replicas are included in the plan price: scaling never changes the bill.

• Autoscalingset_autoscaleChanges

  Let the platform adjust replicas to keep mean CPU per replica near a target (between min and max), or turn it off with off: true. Enabling needs a plan with autoscaling.

• Run a commandrun_commandAsks first

  Run a one-off command SYNCHRONOUSLY in the app's live release environment (current image, decrypted env vars, the app's volumes and network) — migrations, maintenance scripts, inspection. It can change production data, so without confirm it only previews. Blocks up to 10 minutes; returns the exit code and the last 30,000 characters of output with the app's credentials masked. No TTY/stdin.

• Deploy a branch previewdeploy_previewChanges

  Deploy one git branch as a preview at its own URL (1 replica, empty volumes). Branch previews must be enabled on the app. A preview inherits env vars scoped "all" — including add-on credentials, so by default it talks to the live database.

• Tear down a previewdestroy_previewChanges

  Tear one branch preview down (containers, image, its empty volumes). The branch itself is untouched; a new push redeploys it while previews are on.

Build & run settings, env vars, maintenance and password pages, alerts, log drains, domains, add-ons, volumes, crons, groups and tags.

• Build & run settingsupdate_app_settingsChanges

  Change how an app is built and run: port, health-check path, build root (monorepos), tracked branch, repository URL, memory cap (MB) and CPU cap (cores) within the plan, and health-gated routing. Only what is passed changes. Applies on the next deploy, or on a restart without a rebuild. The app's name is not one of these settings.

• Rename an apprename_appAsks first

  Change an app's slug — its name AND its <slug>.<apps-domain> address. The old address stops answering at once; anything linking to it (webhooks, bookmarks, other apps) breaks. Custom domains are unaffected. Without confirm it previews.

• Set an env varset_envAsks first

  Set an environment variable, encrypted at rest; values are never readable again. Overwriting a key that already has a value in that scope destroys the old value, so that case previews first and needs confirm. Applies on the next deploy, or on the next restart when the value is not needed at build time.

• Remove an env varunset_envAsks first

  Remove an environment variable (every scope of that key). Its value is gone for good — values cannot be read back — so this previews without confirm. Applies on the next deploy.

• Import a .env fileimport_envAsks first

  Set many env vars at once from .env content (KEY=value lines; comments, `export` and quotes handled). Existing keys in that scope are overwritten, so it previews first (keys only, and which would be overwritten). In the local server, `path` reads a .env file from disk, so the values reach the platform without passing through the conversation. Returns the keys written, never values.

• Maintenance modeset_maintenanceAsks first

  Route the app to a 503 maintenance page (on) or back to itself (off). The app keeps running — only routing changes, no rebuild. Turning it ON takes the site off the internet, so that previews first.

• Put the site behind a passwordset_site_passwordChanges

  Put an app's production site behind a password page until it launches; omit password to re-enable with the saved one. message is shown above the field; bypass lists paths that stay public (e.g. a payment webhook). Switching on takes one no-rebuild release (~1 min); a new password signs every visitor out. The password is never echoed back.

• Make the site publicdisable_site_passwordAsks first

  Take the password page off an app's production site: it becomes public to everyone, search engines included, and a site that was not meant to be public yet cannot be un-seen. The saved password is kept for turning it back on. Previews without confirm.

• Branch previews settingsset_previewsAsks first

  Branch previews: turn auto-deploys of pushed branches on or off (off tears down every running preview), set or clear ("") a password on preview URLs (user "preview"), and set or clear ("") the GitHub token previews use to post commit statuses and PR comments. Secrets are never echoed.

• Alert thresholdsset_alertsChanges

  Set the thresholds that fire the notification webhook: CPU percent (100 = one core), memory percent of the limit, and 5xx error-rate percent. This replaces all three: pass null or leave one out to turn it off. Needs a plan with alerts.

• Deploy & alert notificationsset_notificationsChanges

  Set ("" or null clears) the Slack-compatible webhook URL that deploys and alerts are announced to, and/or send a test message to it (test: true). The URL is a credential and is never returned — only whether one is set and its host.

• Add a log drainadd_log_drainAsks first

  Forward an app's runtime logs — everything it prints, secrets it logs included — to an outside destination: kind 'http' POSTs JSON batches to a URL; 'syslog' sends RFC3164 over UDP to host:port. Previews the destination first. Needs a plan with log drains.

• Remove a log drainremove_log_drainChanges

  Stop forwarding an app's runtime logs to one log drain, by its id.

• Add a custom domainadd_domainChanges

  Claim a custom domain for an app and get the DNS TXT record that proves ownership; it is routed once the record is verified and the app deployed. A wildcard ("*.example.com") routes every single-label subdomain to the app — how a multi-tenant app serves a hostname per tenant; it is proved on its base zone and needs the platform DNS-01 resolver.

• Verify a domainverify_domainChanges

  Check a pending domain's DNS TXT record. Once verified, it is routed on the next deploy or restart.

• Remove a custom domainremove_domainAsks first

  Detach a custom domain from an app: visitors to it stop reaching the app on the next deploy, and a new claim must be verified again. Previews without confirm.

• Add an add-onadd_addonChanges

  Provision a backing service and inject its credentials into the app's env (never shown): postgres → DATABASE_URL, mysql → MYSQL_URL, redis → REDIS_URL, minio → S3_ENDPOINT/S3_ACCESS_KEY/S3_SECRET_KEY, and so on. memcached has no credential and is protected only by the app's private network. Included in the flat plan price, which caps how many an app may have. Applies on the next deploy.

• Destroy an add-onremove_addonAsks first

  DESTRUCTIVE. Destroy an add-on and its data volume IMMEDIATELY and irreversibly — the database/cache/bucket is gone the moment this returns. Without confirm it previews; it proceeds with confirm: true AND confirm_name set to the add-on type.

• Add a volumeadd_volumeChanges

  Mount a persistent volume into the app's containers at an absolute path, so what it writes there survives deploys — a SQLite file, uploads, a cache. Everything outside a volume is wiped on every release. Applies on the next deploy. Every web replica shares the one volume.

• Delete a volumeremove_volumeAsks first

  DESTRUCTIVE. Detach a persistent volume AND delete its data, backups included. Irreversible. Without confirm it previews; to proceed pass confirm: true AND confirm_name set to the volume name.

• Copy files into a volumepush_volumeAsks firstLocal server

  LOCAL server only. Copy a local directory (or a .tar/.tgz) INTO one of the app's volumes, unpacked at its mount path; files with the same names are overwritten. Previews without confirm.

• Add a cron jobadd_cronAsks first

  Schedule a command in the app's release image, with every env var and the app's volumes — it runs unattended within minutes, so it previews first. 5-field cron, UTC.

• Pause or resume a cron jobset_cron_enabledChanges

  Pause (enabled: false) or resume (true) one of an app's scheduled jobs, by id, without deleting it.

• Delete a cron jobremove_cronChanges

  Delete one of an app's scheduled jobs for good, by id; pausing is the way to keep it.

• File an app in a groupset_app_groupChanges

  Put an app in a group (the dashboard lists the fleet by group), or out of every group with group: null. Case-snaps to an existing group.

• Tag an appset_app_tagsChanges

  Replace an app's tags (cross-cutting labels the dashboard filters by). [] clears them.

• Rename or dissolve a grouprename_groupChanges

  Rename a group on every app carrying it (that you may change), or with to: null take every such app out of it. The apps themselves are untouched.

• Public showcase listingset_showcaseAsks first

  List the app in (on: true) or remove it from the PUBLIC /showcase directory, which publishes its address, status, homepage screenshot and the owner's GitHub handle. Owner only. Listing previews first.

• Refresh the thumbnailrefresh_screenshotChanges

  Ask for a fresh screenshot of the app's homepage (the dashboard tile); recaptured within ~30 s.

Connect or disconnect a git repository and wire push-to-deploy on GitHub.

• Connect a repositoryconnect_repoAsks first

  Point an EXISTING app at a git repository: from now on every deploy clones it rather than using uploaded archives. Works on an app created by upload. A private repo needs the platform to be able to clone it (an SSH deploy key on the box and the git@host:owner/repo.git URL form). It decides what code runs with the production data, so it previews first.

• Disconnect the repositorydisconnect_repoChanges

  Stop cloning a repository: the app goes back to deploying uploaded archives, and its next deploy needs one.

• Wire push-to-deploy on GitHubinstall_github_webhookChanges

  Create (or repair) the push webhook on the app's github.com repository, server-side, so pushes to the tracked branch deploy — the HMAC secret never leaves the platform. Uses the app's own GitHub token (the one its previews use) or, when the caller is the owner, the owner's linked GitHub account; it needs admin access to the repository.

Back up now, schedule backups, restore one or delete one.

• Back up nowrun_backupChanges

  Take a backup NOW and wait for it, returning the file name. For a way back before a migration, a restore, or anything else that cannot be undone. Defaults to the Postgres add-on.

• Restore a backuprestore_backupAsks first

  DESTRUCTIVE. Replace current data with a backup: a dump drops and rebuilds the add-on's schema; a volume archive replaces every file in that volume, with the app stopped meanwhile. Everything written since that backup is lost. Without confirm it previews; it proceeds with confirm: true AND confirm_name set to the backup file name.

• Delete a backupdelete_backupAsks first

  DESTRUCTIVE. Delete one backup file, on the platform and off-site. Without confirm it previews; it proceeds with confirm: true AND confirm_name set to the file name.

• Backup scheduleset_backup_scheduleChanges

  Schedule (or turn off with "") automatic backups of the app's add-ons and volumes: a 5-field cron in UTC ('0 4 * * *' = daily 04:00), how many to keep, and which series to skip. An app with a database and no schedule is one bad deploy from losing it.

• Import a Postgres dumpimport_databaseAsks firstLocal server

  LOCAL server only. DESTRUCTIVE. Load a local pg_dump (plain SQL or .gz) into the app's Postgres add-on, REPLACING its database (it is kept as a backup first). Without confirm it previews; it proceeds with confirm: true AND confirm_name set to the app slug.

Invite collaborators, change their role or remove them, and leave a team.

• Invite a collaboratorinvite_collaboratorAsks first

  Email an invitation (with slug: to one app; without: to the account team, i.e. every app the account owns). Access starts only when they accept it, signed in with that address — an invitation asks a person, it never enrols one. Roles: admin (everything but deleting), member (operate incl. secrets/shell/restores), developer (deploy, previews, logs, shell, crons), viewer (read-only, free and unlimited). extraPermissions adds single permissions on top. Nobody can grant more than they hold. Previews first; it sends with confirm: true AND confirm_name set to the email address.

• Change a collaborator's roleupdate_collaboratorAsks first

  Change someone's role and extra permissions — on one app (slug) or on the account team (no slug), by member id. Takes effect immediately, so it previews who and what first.

• Remove a collaboratorremove_collaboratorAsks first

  Remove someone's access (memberId) or revoke a pending invitation (inviteId) — on one app (slug) or on the account team (no slug). Their access ends immediately; inviting them again restores it. Previews who first.

• Leave someone's teamleave_teamAsks first

  Leave an account team this account was invited to (owner = that account's email): access to all of its apps ends until invited again. Previews without confirm.

Create an app from git or uploaded code, deploy code from your computer, delete an app.

• Create an appcreate_appChanges

  Create a new app (it counts against the plan's app limit). source 'git' (default) clones repoUrl. 'upload' and 'static' need NO repository — they are for code that exists only on a computer and arrives afterwards as an archive from the local MCP server or `deploycloud upload`: 'upload' builds with its own Dockerfile/Nixpacks; 'static' serves a pre-built site as-is.

• Deploy local codeupload_bundleChangesLocal server

  LOCAL server only. Deploy code straight from this machine — no git remote, no credentials on the server. `path` is a directory (tarred, excluding node_modules/.git/.env/build output and nested git worktrees) or an existing .tgz/.zip. A directory in a git repo stamps the deployment with its HEAD sha (plus '-dirty' for uncommitted changes). The app must have been created with source 'upload' or 'static'. Returns the deployment id, plus `warnings` when something was left out or the bundle is unusually big; the deploy runs asynchronously.

• Delete an appdelete_appAsks first

  DESTRUCTIVE. Permanently delete an app with its add-ons, their data, its volumes and its backups. Owner only. Without confirm it previews exactly what would be lost; it proceeds with confirm: true AND confirm_name set to the app slug.

A Stripe link to change plan, which you open and pay yourself — the agent never pays.

• Change planchange_planAsks first

  Get the link that moves the account to a paid plan (Stripe Checkout, or the Billing Portal when a subscription exists), or with portal: true the Billing Portal itself (change or cancel, invoices, card). LINK ONLY: nothing is charged by this tool and no money moves through this connector — the person opens the link and completes the payment in a browser. A plan link previews first; it is returned with confirm: true AND confirm_amount set to the plan's monthly price in USD.

Anything else the REST API does: reads run at once, changes preview first.

• Read from the DeployCloud APIapi_getReads

  Read any endpoint of the DeployCloud REST API v1 with GET, as the signed-in account, for data no purpose-built tool returns (e.g. /apps/<slug>/notify, /groups). The API is documented at https://deploycloud.app/docs#api (a private instance serves the same page at its own /docs#api). path is relative to /api/v1, e.g. '/apps/blog/metrics'. Refused: sign-in, tokens and OAuth; operator-only routes; billing (no money moves through this connector); backup downloads; and the destructive calls that have a purpose-built tool with its own confirmation (deleting an app, a volume, an add-on or a backup, restores, commands, rollbacks, imports, uploads, leaving a team). Credentials in the answer are masked.

• Create through the DeployCloud APIapi_createAsks first

  Send a POST to an endpoint of the DeployCloud REST API v1, as the signed-in account, for an action no purpose-built tool covers. The API is documented at https://deploycloud.app/docs#api. path is relative to /api/v1. It previews the request first and sends it with confirm: true. Refused: sign-in, tokens and OAuth; operator-only routes; billing (no money moves through this connector); backup downloads; and the destructive calls that have a purpose-built tool with its own confirmation (deleting an app, a volume, an add-on or a backup, restores, commands, rollbacks, imports, uploads, leaving a team). Credentials in the answer are masked.

• Update through the DeployCloud APIapi_updateAsks first

  Send a PUT (replace) or PATCH (change some fields) to an endpoint of the DeployCloud REST API v1, as the signed-in account, for a change no purpose-built tool covers. The API is documented at https://deploycloud.app/docs#api. path is relative to /api/v1. It previews the request first and sends it with confirm: true. Refused: sign-in, tokens and OAuth; operator-only routes; billing (no money moves through this connector); backup downloads; and the destructive calls that have a purpose-built tool with its own confirmation (deleting an app, a volume, an add-on or a backup, restores, commands, rollbacks, imports, uploads, leaving a team). Credentials in the answer are masked.

• Delete through the DeployCloud APIapi_deleteAsks first

  Send a DELETE to an endpoint of the DeployCloud REST API v1, as the signed-in account, for a removal no purpose-built tool covers. The API is documented at https://deploycloud.app/docs#api. path is relative to /api/v1. It previews the request first and sends it with confirm: true. Refused: sign-in, tokens and OAuth; operator-only routes; billing (no money moves through this connector); backup downloads; and the destructive calls that have a purpose-built tool with its own confirmation (deleting an app, a volume, an add-on or a backup, restores, commands, rollbacks, imports, uploads, leaving a team). Credentials in the answer are masked.

For the people who run a DeployCloud instance: the hostnames the platform itself answers on.

• Platform domains (operator)list_platform_domainsReadsOperators

  PLATFORM OPERATOR only (others get a 403). The custom hostnames that serve the platform's own dashboard and API, with any redirect each one has (e.g. www → apex).

• Add a platform domain (operator)add_platform_domainChangesOperators

  PLATFORM OPERATOR only. Serve the platform's dashboard and API on another hostname, or with redirectTo make that hostname answer 301 to another one (e.g. www → apex). Applies live.

• Repoint a platform domain (operator)set_platform_domain_redirectChangesOperators

  PLATFORM OPERATOR only. Change where a platform hostname redirects (301), or with redirectTo: null make it serve the dashboard itself. Applies live.

• Remove a platform domain (operator)remove_platform_domainAsks firstOperators

  PLATFORM OPERATOR only. Detach a hostname from the platform: whoever reaches the dashboard or API through it loses it — removing the one in use cuts off the dashboard. Applies live. Without confirm it previews; it proceeds with confirm: true AND confirm_name set to the hostname.