Deploy with an AI agent
A coding agent can carry a change from source code to a verified deployment through the official Tokay MCP or the Tokay API. The credential and memberships define its access, Secret values are write only, and destructive actions still wait for your approval.
Last updated
AI agent? Start with llms.txt.
Deployment state tells the agent what to do next
Tokay exposes what your agent should do next instead of requiring them to infer progress from logs. They submit code, wait for analysis, create the detected Services, resolve named blockers, start the deployment, and poll until the result is running and up to date.
Readiness distinguishes work that is still in progress from a decision that needs action. Diagnoses provide a category, a safe explanation, and a suggested next step when analysis, build, deployment, or runtime behavior fails.
See For AI agents for the deploy loop and the machine readable protocol.
Credentials can be narrower than the person using the dashboard
An API token carries explicit grants and can act only within the identity's live memberships. For durable team owned automation, give your agent a Bot with separate Project and repository memberships instead of inheriting your access. The agent still acts as you or the Bot.
Revoking a membership narrows related tokens on the next request. See Permissions for how membership and token grants intersect.
Agents can inspect Config without reading Secrets
Project Config is visible to an agent whose credential can read source or write Config. This helps with ordinary settings such as API base URLs, modes, and feature flags.
An agent may store a Secret you supply but cannot retrieve the stored value through the API. New values default to Secret unless you explicitly choose Config. This lets the agent complete setup without exposing credentials to its context or logs. See Config, secrets, and environment variables.
Health checks and migration approval protect production
A new web version receives traffic only after health checks pass. Failed versions do not replace the working one. Deleted Projects, code, Services, and databases are recoverable for 30 days.
Database migrations rehearse against a copy first. Under Normal release safety, risky or uncertain changes pause for human confirmation rather than becoming an automatic agent decision. See Database migrations.
Every API action is attributed to the identity and credential that performed it.
Connect through MCP or the API
Use https://mcp.tokay.io/mcp when the client supports remote MCP and browser OAuth. It provides the source, deploy, diagnosis, usage, review, and byte transfer workflows without asking the model to assemble low level calls.
Use the API when the client needs full GraphQL or REST fidelity. API and MCP OAuth tokens have separate audiences and cannot be exchanged.
The orientation for agents is For AI agents. The exact GraphQL queries, mutations, action values, polling rules, and recovery branches are published at https://app.tokay.io/llms.txt.