MCP security
MCP gives an AI client access to Coolify data and, when permitted, lifecycle operations. Treat the token as a password.
Use least privilege
| Need | Permission |
|---|---|
| Inspect resources | read |
| Read supported sensitive data or log summaries | read:sensitive |
| Deploy, start, stop, restart, cancel, or roll back | deploy |
Create, update, or delete resources (create_* and manage_* tools) | write |
| Change the instance MCP setting with the API | write or root token of the root team |
Only team admins and owners can use tokens with read:sensitive, write, deploy, or root. Destructive actions need confirm=true. Configure your client to ask you before it calls them.
Do not use a root token for normal MCP access.
Team scope
A token belongs to one team. MCP cannot use that token to read another team's resources. Team admins and owners can disable MCP for their team without disabling the instance endpoint.
Protect client configuration
- Store tokens in the client's secret storage.
- Do not commit MCP configuration containing a token.
- Do not paste tokens into prompts or chat transcripts.
- Restrict access to the machine and user account running the client.
- Revoke the token immediately if exposed.
MCP responses never return private keys, S3 secrets, tokens, passwords, or webhook URLs. Environment values are returned only by get_env_values (read:sensitive, team admin or owner), and never for values marked as shown once. Log and deployment summaries can still contain operational data; redaction is best effort.
Approve changes deliberately
Management tools can delete resources and backup files, overwrite configuration, stop workloads, or purchase cloud servers. Review the target and effects before allowing a client to submit confirm=true for an action that requires confirmation. A confirmation flag does not grant missing token permissions.
Granting write also allows changes to environment variables, scheduled commands, proxy settings, and notification configuration. Use a read-only token when the client only needs to inspect resources.
On self-hosted instances, MCP uses its own enable switch and the Allowed IPs allowlist. Disabling REST API access does not disable MCP; disable MCP server or revoke the token to remove MCP access.