Set up MCP

Set up Coolify MCP by enabling the instance endpoint, confirming team access, creating a token, and adding the endpoint to your AI client.

Before you begin

Use Coolify Cloud or a self-hosted Coolify instance with a public HTTPS URL.
On self-hosted Coolify, enable API access in Settings > Configuration > Advanced.
Choose the team whose resources the client must access.
Create an API token with the smallest required permissions. See API tokens.

Protect the token

An MCP client can use every operation allowed by its token. Store the token in the client's secret configuration, never commit it, and revoke it if exposed.

Example values

Use your own instance URL and token when following this guide:

Example data

Coolify URL: https://coolify.shadowarcanist.com
MCP endpoint: https://coolify.shadowarcanist.com/mcp
API token: 67|abcthisisa123dummytoken

Coolify Cloud already has instance MCP enabled. Skip the Dashboard and API tabs, then continue to Create an MCP token. Team access remains enabled by default, but check team settings if a client receives 403.

Coolify Advanced settings with MCP server enabled

Open Settings in the sidebar.
Select Configuration.
Open Advanced.
In API and MCP, set MCP server to Enabled.

MCP must also be enabled in the current team's settings. Open team settings and set MCP server to Enabled for this team.

Create an MCP token

Create a token from Keys & Tokens > API Tokens while the required team is active.

Coolify displays the complete token only once. Copy it into the client's secret configuration before leaving the API Tokens page.

Use read for inventory and inspection.
Add read:sensitive only for supported sensitive data or log summaries.
Add deploy for deploy, start, stop, restart, or cancel operations.
Do not use root for normal MCP clients.

MCP endpoint URL:

https://coolify.shadowarcanist.com/mcp

Connect a client

Configure the client with:

URL: https://coolify.shadowarcanist.com/mcp
Transport: Streamable HTTP
Authorization: Bearer 67|abcthisisa123dummytoken

Follow a client guide:

Verify access

Ask the client to call get_current_team or get_infrastructure_overview. The response should contain the team and resources associated with the token.