What is coolify-mcp?

Coolify MCP Server is an npm-published Model Context Protocol server that puts a running Coolify v4 platform under controlled command of an AI assistant. Its 46 action-based tools handle troubleshooting (diagnosing one app or one server, scanning the whole estate for problems, reading container output), deploys that wait for a final status and can be rolled back, start/stop/restart control, creating or deleting applications, databases across eight engines, services, projects and environments, and routine configuration work covering environment variables, volumes, cron jobs, backups, tags, SSH keys and cloud credentials. Wide-blast operations such as applying one key to many apps, redeploying a project or halting every app are gated: the assistant must get an explicit yes from the operator first, and the question names how much is affected. Secret values are withheld by default, list results come back as compact summaries to protect the context window, and a bundled offline index of the Coolify documentation is searchable. Three guided workflows appear as prompts, two read-only resources can be attached by a client, and a doctor command checks configuration, reachability, token abilities and supported version range in a single run. Setup options are npx as a local stdio process, a drag-and-drop extension file for Claude Desktop, or building the repository's Dockerfile into a container deployed alongside the Coolify it manages, where remote clients sign in over OAuth 2.1. Adding a COOLIFY_INSTANCES JSON array points one server at several Coolify installs, and MCP_READONLY exposes the read tools only. The code is MIT licensed, is verified against Coolify v4.0 up to v4.3, and the project states it collects no usage data and runs no hosted service of its own.

Should you self-host coolify-mcp?

coolify-mcp scores 51/100 on selfhost.directory (how scoring works) and ranks #14 of 27 in Server Management. It has 617 GitHub stars.

It shipped 22 stable releases in the past year. The latest, v3.9.0, came out on 2 October 2026. New versions land roughly every 2 days.

Setup is easy: most people get it running in one sitting. It is MIT-licensed and written mostly in Typescript.

Its closest alternative on selfhost.directory is Termix (76/100, 15 704 stars). It scores higher overall, so compare the two before you pick. See coolify-mcp vs Termix side by side.

Features

Bulk estate operations
Configuration Management
Deployment control and rollbackImage rollback needs Coolify 4.3 and the image still present on the server.
Diagnostics and log reading
Doctor diagnostic command
Documentation Search
Guided workflow prompts
Human confirmation for destructive operations
MCP resources
MCP tool surface for infrastructure management
Multi-instance fleet mode
Read-Only Mode
Remote HTTP transport
Resource create and delete
Secret masking

How to configure coolify-mcp

CF_ACCESS_CLIENT_IDunsetCloudflare Access service token id (pair required)
Cloudflare Access service token id (pair required)
CF_ACCESS_CLIENT_SECRETunsetCloudflare Access service token secret (pair req.)
Cloudflare Access service token secret (pair req.)
COOLIFY_ACCESS_TOKEN
COOLIFY_BASE_URL
COOLIFY_INSTANCESunsetJSON array of extra instances (fleet mode)
JSON array of extra instances (fleet mode)
COOLIFY_MCP_AUDITon in HTTP mode`off` disables the audit log
`off` disables the audit log
COOLIFY_UI_URLCOOLIFY_BASE_URLDashboard address for `coolify_url` links, when the API URL is internal
Dashboard address for `coolify_url` links, when the API URL is internal
doctorCLI subcommand that verifies config, reachability, token abilities and Coolify version range; takes --json for scripts.
CLI subcommand that verifies config, reachability, token abilities and Coolify version range; takes --json for scripts.
--headerRepeatable CLI arg adding an extra header (e.g. for a generic auth proxy) to every request to Coolify.
Repeatable CLI arg adding an extra header (e.g. for a generic auth proxy) to every request to Coolify.
MCP_ACCESS_TOKEN_TTL3600Access token lifetime, seconds
Access token lifetime, seconds
MCP_ALLOW_INSECURE_HTTPunsetLocal development only: allow a non-https public URL
Local development only: allow a non-https public URL
MCP_CLIENT_IP_HEADERX-Forwarded-ForHeader your proxy sets to the caller's IP, e.g. `cf-connecting-ip`
Header your proxy sets to the caller's IP, e.g. `cf-connecting-ip`
MCP_HOSTall interfacesListen address; `127.0.0.1` keeps it on loopback
Listen address; `127.0.0.1` keeps it on loopback
MCP_OAUTH_STATE_FILE/data/oauth-state.jsonOAuth state persistence; set it outside a container
OAuth state persistence; set it outside a container
MCP_PORT8080Listen port
Listen port
MCP_PUBLIC_URL
MCP_READONLYfalseRegister only read-only tools
Register only read-only tools
MCP_REDIRECT_HOSTSunset (any host)Comma-separated hosts clients may redirect to; hardening
Comma-separated hosts clients may redirect to; hardening
MCP_REFRESH_TOKEN_TTL28800Refresh token lifetime, seconds
Refresh token lifetime, seconds
MCP_REQUEST_STATE_KEYgenerated at startupHMAC key for confirmation state (>=32 bytes)
HMAC key for confirmation state (>=32 bytes)
MCP_TRANSPORT