Tokay MCP

Connect your AI agent to Tokay so they can upload code, deploy apps, recover failures, inspect usage, and keep working on the same repository later.

Last updated August 15, 2026

AI agent? Start with llms.txt.

Connect

Add this remote Streamable HTTP endpoint to your MCP client.

https://mcp.tokay.io/mcp

Connecting opens a browser for OAuth approval. You do not paste an API token into the client. Every connection is listed separately under Connected apps and can be disconnected without affecting another installation.

VS Code can use this workspace or user configuration.

{
  "servers": {
    "tokay": {
      "type": "http",
      "url": "https://mcp.tokay.io/mcp"
    }
  }
}

What your agent can do

• Deploy an app from a small inline project or a large repository archive.
• Return later, find the exact repository snapshot, search it, read files, make a conflict safe change, and deploy again.
• Follow Tokay's authoritative deployment readiness instead of guessing from time or logs.
• Resolve configuration, database, source, and release blockers through named tools.
• Diagnose a failed build or deployment with bounded evidence and logs.
• Report current VM capacity and the share used by a Project, Service, or managed database.
• Create workspaces, choose Plans, and manage funding when the connection has that permission.
• Run a bounded read only query against a managed database when the connection has that permission.
• Use the rest of the public GraphQL surface through a read tool and a fail closed routine mutation tool.

MCP is the workflow surface

MCP carries decisions, metadata, bounded source text, and structured results. It does not carry repository archives, database dumps, or service file bytes through the model context.

Large bytes use short lived capability URLs. Your agent asks Tokay for an upload or download URL, transfers the bytes over ordinary HTTP without an OAuth bearer, then continues the workflow with the returned handle. This keeps a large repository faithful without turning it into thousands of tool arguments.

Clients that need arbitrary GraphQL or REST calls can authorize the separate https://api.tokay.io resource and use the public API directly. Tokay MCP tokens are accepted only at https://mcp.tokay.io/mcp.

Tokay MCP and an MCP hosted on Tokay

See Deploy an MCP server when the product you are hosting is itself an MCP server.

Permissions

The first connection requests the bundle below. It covers everything from uploading source to recovering a failed deploy.

Logs can contain application data or personal information. Tokay includes PROJECT_LOGS because deployment and recovery are one workflow. Diagnosis returns state and explanation first and includes bounded log bodies only when requested.

Database queries, exports, service file writes, access policy changes, workspace funding, permanent deletion, and other elevated actions stay outside this initial bundle. Workspace creation and Plan or funding changes require WORKSPACE_MANAGE_BILLING. When your agent needs an elevated action, Tokay returns the exact missing PermissionActionType. A new OAuth approval creates another independent connection with the requested union of actions.

Core workflow tools

Platform, safety, and byte tools

mutate_platform_graphql accepts only routine operations. Credential changes and SSH registration use dedicated reviewed tools.

renamePlatformCredential is a routine metadata mutation. An MCP root may rename a direct leaf it can manage through mutate_platform_graphql. The mutation cannot change verifier material, grants, owner, lineage, or expiry.

Credential creation requires explicit CREDENTIAL_CREATE_API, CREDENTIAL_CREATE_MCP, or CREDENTIAL_CREATE_GIT. The Git action covers HTTPS and SSH. A credential created for the same Person or Bot is narrower and cannot create another credential. API and MCP leaves default to one hour, cannot exceed 24 hours, and cannot outlive a finite root. Git HTTPS and SSH leaves have optional expiry and no 24 hour cap. An omitted expiry is previewed as “expires with the issuing token” and resolves to the root expiry when it is finite. register_ssh_key accepts only a public key and returns no secret. Provisioning an independent Bot credential requires authority to manage the Bot and acknowledgement that the new credential survives this connection. The preview and receipt name those consequences before execution.

Rotation preserves the authority of the presented MCP root that was not created through OAuth and atomically revokes that root plus its direct leaves. The replacement JWT appears once. A lost committed response is not retryable or recoverable. Roots created through OAuth must disconnect and complete OAuth again.

Credential revocation previews Self or Lineage scope and every affected credential. It also shows one review set of independent credentials created across the lineage boundary. Revoking one requires explicit selection and current authority. A selected API or MCP root brings its direct leaves.

Reviews and retry safety

Reviewed actions use two calls. The first call returns the exact impact and a ten minute receipt. Repeating the exact request with that receipt consumes it once. A changed request, changed target state, different OAuth connection, expired receipt, or replay fails.

Funding review binds the exact Plan, payer and Free entitlement effect, capacity or restart consequence, and availability change. An agent explicitly granted WORKSPACE_MANAGE_BILLING may evaluate the first response and make the second call autonomously. Funding does not grant workspace membership. Owners may attach their own account, while a current payer may end only their own funding even after losing membership.

Repository writes and deploys use caller stable idempotency keys where a lost response could duplicate durable work. Retrying the same source or readiness target returns the same repository, commit, or rollout. A diagnosed failed rollout becomes a new retry target and receives exactly one successor rollout under the same workflow key. Reusing the key for different input fails. Root rotation is the deliberate exception: the predecessor dies at commit and a lost successor response has no recovery path.

Unknown readiness actions and blocker kinds stop safely. Your agent must never invent the safety assertion required to recover a maintenance hold.

Privacy and retention

• Tokay validates the connection's live root credential for every MCP request.
• Disconnecting the connection blocks the next tool call and any unused capability URL or queued source side effect.
• Secret values are accepted only by write only tools and are never returned.
• Tokay does not log OAuth bearers, source contents, database query text or results, application log bodies, release commands, capability tokens, or credentials shown once.
• Operational logs may record the tool name, principal and target IDs, support reference, result size, status, and duration.
• Platform OAuth connections stay active until disconnected or revoked. Capability URLs and review receipts expire quickly and are single use.

Read the privacy policy and security model. Email hello@tokay.io for support.

Troubleshooting