MCP: let your AI agent deploy (safely)
How Aloof's remote MCP server works, what an agent can and can't do, and how to keep a human in the loop for destructive actions.
Aloof ships a Model Context Protocol server at https://mcp.aloof.si/mcp. Any MCP client that supports remote servers with OAuth (Claude, ChatGPT connectors, Cursor and others) can connect. You can also run it locally over stdio.
Authentication
The remote server implements OAuth 2.1 with PKCE and dynamic client registration. The client discovers the authorization server, you log in to Aloof in the browser, and the client receives a scoped token you can revoke from the dashboard. Headless setups can send an API key as a Bearer token instead.
What the agent can do
34 tools cover the platform: deploy_app, deploy_with_config (an aloof.toml as JSON), get_status, app_status, get_logs, scale_app, set_env, set_autoscale, domains, volumes, managed Postgres, releases and rollback, snapshots and off-site restores, private registry and git credentials, deploy tokens and audited exec.
# you: "Deploy github.com/acme/api on Aloof with 512 MB, scale to zero, and tell me the URL." # the agent: list_plans → deploy_app(name="api", git_url=..., plan="shared-1x-512mb") → set_autoscale(min=0) → app_status → https://api.aloof.si/
Keeping it safe
- Least privilege: give CI and agents a deploy token scoped to one app (
aloof tokens create -a api --expiry 30d). It can't touch billing, auth or other apps. - Everything is audited: exec commands, console input, restores, token creation and secret changes are written to the audit log with the token or key that did them.
- Destructive tools say so: restore and destroy tool descriptions tell the model to confirm with the user first. Keep your client's "approve tool calls" setting on for these.
- Secrets stay secret: env values are write-only through the API. An agent can set a secret but never read it back.
For agents that prefer REST
/llms.txt is a compact, accurate description of the API, and the OpenAPI spec is at /api/docs. Agents with shell access can also just use the single-file CLI.