Let your AI agent deploy with limited permissions
Let your AI agent handle routine deployment work without sharing your login or giving them authority over everything you own. Connect them through Tokay MCP, approve only the work they need, and keep destructive decisions with you.
Last updated
AI agent? Start with llms.txt.
Approve only the work you want them to do
Connecting Tokay MCP opens a browser where you see the requested access before your agent receives a credential. For normal interactive work, approve the connection as yourself. Your agent receives no login, and every request stays within your memberships and the capabilities you approved.
Choose an authorized Bot during approval when the work should stay within narrower Project or repository access. Tokay records who approved the connection, which Bot your agent uses, and the exact credential behind every action.
Keep stored secrets out of their reach
Your agent can set credentials needed by an application without retrieving those values later. Secrets are write only through the API and are delivered only to running Services.
Limit the cost of a bad action
A failed deploy does not replace the healthy version because new releases receive traffic only after passing health checks. Deleted Projects, code, Services, and databases remain recoverable for 30 days.
Database migrations run against a copy of production data first. Under Normal release safety, risky or uncertain changes pause for your confirmation, and your agent cannot waive that gate.
Disconnect one client without breaking everything
You can disconnect one client without affecting another. Tokay revokes that connection and any narrower credentials it issued.
A Bot credential you provisioned separately keeps working. If you are responding to a compromise, Tokay shows those Bot credentials so you can decide whether to revoke them too.
Choose how your agent works
Use Tokay MCP for guided deployment and recovery workflows. Use the API when your agent needs direct GraphQL or REST access. The API exposes every dashboard workflow, and each response names the next valid action. Failures explain what went wrong and what to do next. Retrying after a lost response does not duplicate work.
MCP and API credentials work only at their own destination and cannot be replayed at the other one.
Point your agent to app.tokay.io/llms.txt for the protocol. See deploy with an AI agent for the full workflow.
Deploy your first app on Tokay's permanent free plan without a credit card.