<!-- cmdz — MCP server. Source: https://www.cmdz.com/mcp -->
# MCP server
> 47 tools over Model Context Protocol: create projects, deploy, scale, attach databases, connect domains, read logs, diagnose and explain costs. Five operations are permanently blocked for agents, including raising your limit.

https://mcp.cmdz.com/v1 speaks Streamable HTTP, protocol version 2025-06-18, and exposes the entire platform as 47 tools. The same API, the same rights and the same limit as the portal — because the limit is what makes handing over the keys reasonable.

https://mcp.cmdz.com/v1 · protocol 2025-06-18 · OAuth 2.1 + PKCE · 47 tools

## Most hosting MCP servers let an agent look. Ours lets it build.

Every serious platform in this category now has an MCP server, and we are not going to pretend otherwise — Railway's is genuinely good, Heroku's Postgres tooling is richer than ours on day one, and Cloudflare exposes more API surface than anyone. What almost none of them do is give an agent write access to the whole product *and* a mechanism that makes that safe.

That mechanism is the limit. **The limit is not the brake on the agent — the limit is what makes the agent possible.** An agent with a credit card behind it is a liability. An agent with a ceiling is a colleague.

The second half is the envelope: every single response carries your limit status, your remaining headroom and the agent's own daily budget. Not only on the cost tools — on all 47. An agent that does something a hundred times in a row must see the brake a hundred times, not once at the beginning.

```
{
  "ok": true,
  "data": { … },
  "spend_cap": {
    "used": "412.55", "cap": "500.00",
    "remaining": "87.45",
    "used_percent": 82.5, "state": "warning"
  },
  "budget": {
    "actions_today": 63, "actions_max": 400,
    "deploys_today": 4,  "deploys_max": 10
  },
  "next_steps": ["Follow with cmdz_wait_for_operation."],
  "request_id": "req_01J9F2K8QW3ZP6M1"
}
```

[How the ceiling works](/hard-limit)

## Three profiles, and five things none of them grant

You pick a profile when you authorise an agent, with a passkey, in your own browser. The agent never sees your credentials and never chooses its own scopes.

| Profile | Tools | Scopes | What it is for |
|---|---|---|---|
| read | 22 of 47 | 10 | Look, change nothing. Safe to give to any agent. |
| build | 41 of 47 | 16 | Everything needed to go from nothing to live. Cannot permanently delete anything. |
| full | 47 of 47 | 19 | Everything, with confirmation on anything destructive. |

### The tool catalogue

**Organisation** — cmdz_whoami, cmdz_list_organisations

**Projects** — cmdz_list_projects, cmdz_get_project, cmdz_create_project, cmdz_rename_project, cmdz_delete_project

**Apps** — cmdz_list_apps, cmdz_get_app, cmdz_scale_app, cmdz_pause_app, cmdz_resume_app, cmdz_restart_app

**Deployments** — cmdz_deploy, cmdz_list_deployments, cmdz_get_deployment, cmdz_cancel_deployment, cmdz_rollback, cmdz_promote_preview

**Services** — cmdz_list_service_types, cmdz_create_service, cmdz_connect_service, cmdz_quote_service, cmdz_delete_service, cmdz_run_sql

**Backups** — cmdz_list_backups, cmdz_create_backup, cmdz_restore_backup

**Domains & DNS** — cmdz_list_domains, cmdz_add_domain, cmdz_search_domain, cmdz_buy_domain, cmdz_check_domain_status, cmdz_get_dns_instructions

**Environment** — cmdz_list_env, cmdz_set_env, cmdz_delete_env

**Observability** — cmdz_get_runtime_logs, cmdz_get_build_logs, cmdz_get_metrics, cmdz_diagnose_app

**Cost & limit** — cmdz_get_usage, cmdz_get_spend_cap, cmdz_forecast_spend, cmdz_explain_cost

**Operations** — cmdz_get_operation, cmdz_wait_for_operation

### What no profile ever grants

- Raise your spending limit
- Change your payment details or VAT profile
- Dissolve the organisation
- Transfer ownership
- Manage members

## One command, or six lines of config

Authorisation is OAuth 2.1 with PKCE: the client opens your browser, you log in with a passkey, you choose the organisation and the profile, and you confirm. The token is bound to the MCP server, not to the REST API, so a leaked agent token cannot be replayed against the API directly.

### Claude Code

```bash
claude mcp add --transport http cmdz https://mcp.cmdz.com/v1
```

### Claude Desktop

```json
{
  "mcpServers": {
    "cmdz": {
      "url": "https://mcp.cmdz.com/v1"
    }
  }
}
```

### Cursor

```json
{
  "mcpServers": {
    "cmdz": {
      "url": "https://mcp.cmdz.com/v1"
    }
  }
}
```

### Codex

```toml
[mcp_servers.cmdz]
url = "https://mcp.cmdz.com/v1"
```

## What stops an agent going wrong

Not a system prompt asking it nicely. Five mechanisms, all enforced server-side, all of which work regardless of what the agent believes it has been told.

### The spending limit

The same ceiling as everywhere else. An agent cannot raise it, and a reservation that would cross it simply fails. The most an agent can cost you is the number you already agreed to.

### A daily action budget

Every agent token has a maximum number of actions and deploys per day, visible in every response. A deploy loop hits that wall long before it hits your wallet.

### Confirmation tokens

Destructive operations require a confirmation token that the agent cannot mint itself. It has to come back to you, in your interface, before anything is deleted.

### The emergency stop

One button revokes every agent token in the organisation. It takes effect within five seconds, and it is deliberately the most prominent control on the agents screen.

### A separate audit trail

Everything an agent did is in the timeline next to what people did, in the brand's agent colour, with the tool name and the request id. Anything an agent changed can be undone from that list.

### Untrusted content is marked

Log output, environment variable names, repository content and error text that an agent reads are wrapped and marked as untrusted, so a prompt injection in a log line is data rather than an instruction.

## Written for the thing that has to act on it.

An error that says `403 Forbidden` tells an agent nothing it can use, so it retries, and then it retries again. Our errors say what went wrong, whether retrying could ever help, and what the next useful step is.

That is not a nicety. An agent that gets a useful refusal stops; an agent that gets an opaque one loops, and a loop is the failure mode that costs money on every other platform. Here it would hit the daily budget and then the limit — but we would rather it simply did not happen.

```
{
  "ok": false,
  "error": {
    "code": "cap_exceeded",
    "message": "This would reserve 1 240 credits
      but only 612 remain under the limit.",
    "retryable": false,
    "next_steps": [
      "Ask the person to raise the limit —
       you cannot do this yourself.",
      "Or choose a smaller instance size."
    ]
  }
}
```

[The full error table](https://docs.cmdz.com/mcp/errors)

## About handing an agent the keys

### Can an agent spend my money?

Up to your limit, yes — that is the point of giving it access. Above your limit, no, and there is no path to it: raising the ceiling is one of five operations with no scope, no profile and no tool behind it.

### What if my agent is compromised?

Press the emergency stop; every agent token in the organisation is dead within five seconds. Then read the agent timeline, which lists every action with its tool name and request id, and undo what needs undoing. A compromised agent could not have changed your payment details or added a member, because those are permanently blocked.

### Which clients work?

Anything that speaks Model Context Protocol over Streamable HTTP — Claude Code, Claude Desktop, Cursor and Codex are the ones we test on every release. Older clients that only speak stdio can use mcp-remote as a bridge.

### Does the MCP server contain any logic of its own?

Deliberately none. One tool is one API endpoint, and the only code per tool is the function that shapes the response. There is no services directory and no domain directory in that codebase, and there never will be — what is not there cannot contain a second version of the truth. CI fails if a tool points at an endpoint that is not in the OpenAPI spec.

### Can I use it without MCP?

Yes. `cmdz <command> --json` returns exactly the same JSON as the identically named MCP tool, so an agent without MCP support can still drive the platform through the CLI. The REST API at https://api.cmdz.com/v1 is the same surface again.

### Does it cost anything?

No. The MCP server and all 47 tools are included on every plan, including the free one. It is not an add-on and it is not a tier.

## Point your agent at it.

One command connects Claude Code. Choose the read profile if you want to watch it work before you let it build.

- [Create account](https://app.cmdz.com/signup)
- [Read the MCP reference](https://docs.cmdz.com/mcp)

claude mcp add --transport http cmdz https://mcp.cmdz.com/v1