MCP server
https://mcp.cmdz.com/v1 speaks Streamable HTTP, protocol version 2025-06-18, and exposes the entire platform as 47 tools. The same API, the same rights and the same limit as the portal — because the limit is what makes handing over the keys reasonable.
Why this is different
Every serious platform in this category now has an MCP server, and we are not going to pretend otherwise — Railway's is genuinely good, Heroku's Postgres tooling is richer than ours on day one, and Cloudflare exposes more API surface than anyone. What almost none of them do is give an agent write access to the whole product and a mechanism that makes that safe.
That mechanism is the limit. The limit is not the brake on the agent — the limit is what makes the agent possible. An agent with a credit card behind it is a liability. An agent with a ceiling is a colleague.
The second half is the envelope: every single response carries your limit status, your remaining headroom and the agent's own daily budget. Not only on the cost tools — on all 47. An agent that does something a hundred times in a row must see the brake a hundred times, not once at the beginning.
{
"ok": true,
"data": { … },
"spend_cap": {
"used": "412.55", "cap": "500.00",
"remaining": "87.45",
"used_percent": 82.5, "state": "warning"
},
"budget": {
"actions_today": 63, "actions_max": 400,
"deploys_today": 4, "deploys_max": 10
},
"next_steps": ["Follow with cmdz_wait_for_operation."],
"request_id": "req_01J9F2K8QW3ZP6M1"
}Scope
You pick a profile when you authorise an agent, with a passkey, in your own browser. The agent never sees your credentials and never chooses its own scopes.
Look, change nothing. Safe to give to any agent.
Every list and get tool, plus diagnose, usage, forecast and cost explanation. env:read is included because an agent that has to understand your app needs to know that a DATABASE_URL exists — it never sees the value.
Everything needed to go from nothing to live. Cannot permanently delete anything.
Create a project, deploy it, scale it, attach a database, connect a domain, read the logs, diagnose it. All three *:delete scopes are absent, and that is the point of this profile.
Everything, with confirmation on anything destructive.
All 47 tools. Every destructive tool still requires an explicit confirmation token that the agent cannot mint itself, and the five permanent blocks below still apply.
The catalogue — 47 tools in 11 groups
What no profile ever grants
These five are blocked at the API, not in the client. There is no scope that enables them, no profile that contains them, and no tool that offers them.
Connect
Authorisation is OAuth 2.1 with PKCE: the client opens your browser, you log in with a passkey, you choose the organisation and the profile, and you confirm. The token is bound to the MCP server, not to the REST API, so a leaked agent token cannot be replayed against the API directly.
claude mcp add --transport http cmdz https://mcp.cmdz.com/v1{
"mcpServers": {
"cmdz": {
"url": "https://mcp.cmdz.com/v1"
}
}
}{
"mcpServers": {
"cmdz": {
"url": "https://mcp.cmdz.com/v1"
}
}
}[mcp_servers.cmdz]
url = "https://mcp.cmdz.com/v1"Safety
Not a system prompt asking it nicely. Five mechanisms, all enforced server-side, all of which work regardless of what the agent believes it has been told.
The same ceiling as everywhere else. An agent cannot raise it, and a reservation that would cross it simply fails. The most an agent can cost you is the number you already agreed to.
Every agent token has a maximum number of actions and deploys per day, visible in every response. A deploy loop hits that wall long before it hits your wallet.
Destructive operations require a confirmation token that the agent cannot mint itself. It has to come back to you, in your interface, before anything is deleted.
One button revokes every agent token in the organisation. It takes effect within five seconds, and it is deliberately the most prominent control on the agents screen.
Everything an agent did is in the timeline next to what people did, in the brand's agent colour, with the tool name and the request id. Anything an agent changed can be undone from that list.
Log output, environment variable names, repository content and error text that an agent reads are wrapped and marked as untrusted, so a prompt injection in a log line is data rather than an instruction.
The error message
An error that says 403 Forbidden tells an agent nothing it can use, so it retries, and then it retries again. Our errors say what went wrong, whether retrying could ever help, and what the next useful step is.
That is not a nicety. An agent that gets a useful refusal stops; an agent that gets an opaque one loops, and a loop is the failure mode that costs money on every other platform. Here it would hit the daily budget and then the limit — but we would rather it simply did not happen.
{
"ok": false,
"error": {
"code": "cap_exceeded",
"message": "This would reserve 1 240 credits
but only 612 remain under the limit.",
"retryable": false,
"next_steps": [
"Ask the person to raise the limit —
you cannot do this yourself.",
"Or choose a smaller instance size."
]
}
}Questions
Up to your limit, yes — that is the point of giving it access. Above your limit, no, and there is no path to it: raising the ceiling is one of five operations with no scope, no profile and no tool behind it.
Press the emergency stop; every agent token in the organisation is dead within five seconds. Then read the agent timeline, which lists every action with its tool name and request id, and undo what needs undoing. A compromised agent could not have changed your payment details or added a member, because those are permanently blocked.
Anything that speaks Model Context Protocol over Streamable HTTP — Claude Code, Claude Desktop, Cursor and Codex are the ones we test on every release. Older clients that only speak stdio can use mcp-remote as a bridge.
Deliberately none. One tool is one API endpoint, and the only code per tool is the function that shapes the response. There is no services directory and no domain directory in that codebase, and there never will be — what is not there cannot contain a second version of the truth. CI fails if a tool points at an endpoint that is not in the OpenAPI spec.
Yes. cmdz <command> --json returns exactly the same JSON as the identically named MCP tool, so an agent without MCP support can still drive the platform through the CLI. The REST API at https://api.cmdz.com/v1 is the same surface again.
No. The MCP server and all 47 tools are included on every plan, including the free one. It is not an add-on and it is not a tier.
One command connects Claude Code. Choose the read profile if you want to watch it work before you let it build.
claude mcp add --transport http cmdz https://mcp.cmdz.com/v1