RailPush MCP Server for DevOps Agents

RailPush hosts an MCP (Model Context Protocol) server at mcp.railpush.com that lets AI agents -- Claude, ChatGPT, Cursor, and any MCP-compatible client -- fully manage your infrastructure through natural language. No local installs needed. Create services, trigger deploys, manage databases, configure env vars, and more without leaving your AI conversation.

AI-native infrastructure

With 235 tools covering every platform capability, agents can deploy apps, debug failures, scale services, and manage databases -- all autonomously. Tools update instantly -- no client-side upgrades needed.

AI agents can create accounts and get API keys without any human interaction. The agent signs up, gets an API key, and starts deploying immediately. A human only needs to open a link once to add a payment method for paid plans.

GitHub token signup

Best when the agent already has a GitHub PAT and wants a new RailPush account plus API key in one request.

Agent signup with GitHub token
# Your agent calls this -- no auth required
curl -X POST https://railpush.com/api/v1/auth/agent-signup/github \
  -H "Content-Type: application/json" \
  -d '{"github_token": "ghp_your_github_pat"}'

# Response:
# {
#   "status": "ok",
#   "user_id": "abc-123",
#   "email": "you@example.com",
#   "api_key": "rp_abc123...",
#   "workspace_id": "ws-456",
#   "billing_url": "https://checkout.stripe.com/...",
#   "billing_note": "Have your human open this URL to add a payment method."
# }

Email/password signup

Use this if the agent is creating credentials directly instead of linking a GitHub identity.

Agent signup with email
curl -X POST https://railpush.com/api/v1/auth/agent-signup \
  -H "Content-Type: application/json" \
  -d '{"email": "you@example.com", "password": "securepass123", "name": "My App"}'

Agent login for an existing account

Re-issue an API key for an account that already exists, without opening the dashboard first.

Agent login (existing account)
# With GitHub token:
curl -X POST https://railpush.com/api/v1/auth/agent-login/github \
  -H "Content-Type: application/json" \
  -d '{"github_token": "ghp_your_github_pat"}'

# With email/password:
curl -X POST https://railpush.com/api/v1/auth/agent-login \
  -H "Content-Type: application/json" \
  -d '{"email": "you@example.com", "password": "securepass123"}'

Or use the MCP tools directly: create_account and agent_login.

1. Create an API Key

Already have an account? Go to Settings -> API Keys in the dashboard (or use the API) to create a scoped API key. The raw key is shown only once -- copy it immediately.

terminal
# Or via the API:
curl -X POST https://apps.railpush.com/api/v1/auth/api-keys \
  -H "Authorization: Bearer YOUR_JWT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name": "mcp-server", "scopes": ["read", "write", "deploy"], "allowed_cidrs": ["203.0.113.10/32"], "expires_at": "2026-12-31T23:59:59Z"}'

# Response: {"id": "...", "key": "abc123...", "name": "mcp-server", "scopes": ["read", "write", "deploy"], "allowed_cidrs": ["203.0.113.10/32"]}

# Update IP allowlist later:
curl -X PATCH https://apps.railpush.com/api/v1/auth/api-keys/KEY_ID/allowlist \
  -H "Authorization: Bearer YOUR_JWT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"allowed_cidrs": ["203.0.113.0/24", "2001:db8::/64"]}'

Available scopes: read, write, deploy, support, ops, billing, admin, or * for full access.

2. Connect RailPush MCP to Your LLM

Claude, Cursor, and other MCP clients do not automatically know that RailPush lives at https://mcp.railpush.com/mcp. You need to connect the hosted RailPush MCP server once, then you can ask your LLM to deploy apps in normal language.

Do this in order

Create or copy a RailPush API key from Settings -> API Keys.
Add the hosted RailPush MCP server to your LLM using the exact URL and bearer token header below.
Restart or reconnect the client.
Test the connection by asking: List my RailPush services and their status.

If your LLM cannot list your RailPush services yet, it is not connected to the RailPush MCP server yet.

Use these exact values:

Server name: railpush
Primary MCP URL: https://mcp.railpush.com/mcp
Fallback SSE URL: https://mcp.railpush.com/sse
Auth header: Authorization: Bearer YOUR_API_KEY

What this step actually does:

You are connecting your LLM to the hosted RailPush MCP server. You are not pointing Claude at your GitHub repo, and you are not using your dashboard password here. Once this is connected, Claude can discover RailPush tools and use them on your behalf.

Hosted MCP -- Recommended

Connect directly to https://mcp.railpush.com/mcp. No setup, always up to date. Supports Streamable HTTP and legacy SSE transports.

Claude Desktop

claude_desktop_config.json
{
  "mcpServers": {
    "railpush": {
      "url": "https://mcp.railpush.com/mcp",
      "headers": {
        "Authorization": "Bearer your-api-key"
      }
    }
  }
}

Claude Code (CLI)

terminal
claude mcp add railpush \
  --url https://mcp.railpush.com/mcp \
  --header "Authorization: Bearer your-api-key"

Cursor

.cursor/mcp.json
{
  "mcpServers": {
    "railpush": {
      "url": "https://mcp.railpush.com/mcp",
      "headers": {
        "Authorization": "Bearer your-api-key"
      }
    }
  }
}

Any MCP Client (SSE fallback)

For clients that only support legacy SSE transport:

mcp_config.json
{
  "mcpServers": {
    "railpush": {
      "url": "https://mcp.railpush.com/sse",
      "headers": {
        "Authorization": "Bearer your-api-key"
      }
    }
  }
}

3. What to Ask Claude After Connecting

Once Claude can list your RailPush services, the connection is working. From that point on, use plain English. You should not need to mention tool names, MCP internals, or fields like repo_url.

Good prompt: deploy a repo

prompt.txt
Use RailPush to deploy my app from https://github.com/me/my-app.
Detect the framework, create the right service, deploy it, and give me the live URL.

Good prompt: deploy with Postgres

prompt.txt
Use RailPush to deploy my app from https://github.com/me/my-app.
It needs a Postgres database. Create the database, wire the env vars, deploy it, and give me the app URL.

Good prompt: multi-service repo

prompt.txt
Use RailPush to deploy this repo: https://github.com/me/my-project.
It contains a frontend, an API, and a worker. Create the right services for each part, deploy everything, and give me the resulting URLs.

If Claude says it cannot access RailPush

Go back to step 2 and check the MCP URL, bearer token header, and whether the client was restarted. Claude will not know about RailPush until the RailPush MCP server is connected successfully.

Alternative: Self-hosted MCP (local stdio)

If you prefer to run the MCP server locally (air-gapped environments, custom modifications):

terminal
git clone https://github.com/Railpush/RAILPUSH.git
cd RAILPUSH/mcp
npm install && npm run build

claude_desktop_config.json
{
  "mcpServers": {
    "railpush": {
      "command": "node",
      "args": ["/path/to/RAILPUSH/mcp/build/index.js"],
      "env": {
        "RAILPUSH_API_KEY": "your-api-key"
      }
    }
  }
}

Environment Variables (local mode only)

Variable	Required	Description
`RAILPUSH_API_KEY`	Yes	API key for authentication
`RAILPUSH_API_URL`	No	API base URL (default: https://apps.railpush.com)

Available Tools

The MCP server exposes 235 tools organized by category. Agents discover these automatically.

Category	Tools
Auth	whoami, get_rate_limit
Services	list (with server-side filters + limit/cursor pagination), get, create, clone, update, exec command (sync in-container), get/set retention policy, get/set mTLS policy, get/set ingress access control + list policy-change log, delete (token-confirmed soft delete), restore, restart, suspend, resume, search/filter
Bulk Operations	bulk update services, bulk deploy, bulk restart, bulk set env vars, bulk update databases, plus bulk suspend/resume helpers
Deploys	trigger, list (status/branch/since/until + limit/cursor pagination), get, wait_for_deploy, rollback, queue position + estimated wait
Env Vars	list (limit/cursor pagination), set (bulk replace), upsert (additive), get/set/enable/disable GitHub Actions deploy gate, set workflow allowlist
Disks	list service disks, set/replace disk attachment, delete disk attachment
Custom Domains	list (limit/cursor pagination), add, delete
Databases	list (plan/status/version/name/query filters + limit/cursor pagination), create, get (redacted), reveal credentials, rotate password, query_database (read-only by default, optional write mode), get/set retention policy, get recovery window, update, delete (token-confirmed soft delete with optional linked-service confirmation), restore (soft-delete + backup_id + point-in-time modes), clone (latest backup/backup_id/target_time with optional sanitize rules), get clone status, list restore jobs, backup, list backups (limit/cursor pagination), replicas, create replica, promote replica, enable HA
Key-Value (Redis)	list (plan/status/name/query filters + limit/cursor pagination), create, get (redacted), reveal credentials, update, delete (token-confirmed soft delete), restore
MySQL	list, create, get, reveal credentials, update, delete (soft-delete with 72h recovery), restore
MongoDB	list, create, get, reveal credentials, update, delete (soft-delete with 72h recovery), restore
Meilisearch	list, create, get, reveal API key, update, delete (soft-delete with 72h recovery), restore
Object Storage (MinIO)	list, create, get, reveal access/secret keys, update, delete (soft-delete with 72h recovery), restore
Logs	get runtime/deploy logs with text search, regex, since/until, level, structured field filter; list/create/delete/test log drains + stats; list/create/update/delete log alerts
Terminal & Filesystem	exec_command, create_shell_session, shell_exec, close_shell_session, list_directory, read_file, search_files
AI Fix	get deploy diagnosis, start fix session (hint + preview mode), get fix status
One-Off Jobs	run, list (limit/cursor pagination), get
Autoscaling	get policy, set policy
Blueprints	list, create, get, update (move to folder), sync, delete
Env Groups	list, create, get, update, delete, list vars, set vars, link, unlink, list linked services (optional usage detail)
Metrics	get current resource usage and Prometheus-backed usage history (CPU/memory/network time-series)
Projects	list, create, get, update (name + move to folder), delete
Environments	list, create, update, delete
Workspaces	list members, invite/update/remove members, list audit logs (limit/cursor), get/set retention policy, get/set compliance policy (phase 1), generate compliance report (soc2/hipaa/gdpr)
Project Folders	list, create, update, delete
Search	search_workspace_resources (services/databases/key-value in one query)
Relationships	get_workspace_topology, get_service_dependencies, get_database_connected_services, get_database_impact
Preview Environments	list, create, update, delete
Support Tickets	list/filter, create (category/component/tags), get, update tags, reply
Ops Tickets	list/search (status/category/priority/component/tags/date/sort), get (with internal notes), single update, bulk update, reply as ops
Billing	get overview
Registered Domains	list, register, get, delete
DNS Records	list, create, update, delete
Workspace Members	list, invite, update role, remove
Retention Policies	get/set service retention, get/set database retention, get/set workspace retention
Audit Logs	list events (limit/cursor pagination)
GitHub	list repos, list branches, list workflows, list service workflows, webhook status/repair, issue short-lived service runner tokens
Event Webhooks	get/set/test service deploy event webhooks
Templates	list, get details, deploy stack

Example Conversations

Once configured, you can interact with your infrastructure naturally:

examples
You: "Deploy my-api service from the staging branch"
Agent: [calls trigger_deploy with branch="staging"] Deploy triggered.

You: "What's failing on the flightatom service?"
Agent: [calls get_service, get_logs] The service is in deploy_failed state.
       The logs show a missing RESEND_API_KEY environment variable...

You: "Create a new Postgres database called analytics-db on the L size"
Agent: [calls create_database] Created database analytics-db.
       Connection URL: postgresql://analytics-db:pass@...

You: "Set the DATABASE_URL env var on my-api to that connection string and redeploy"
Agent: [calls set_env_vars, trigger_deploy] Done. Deploy is building now.

You: "Scale the web service to 3 instances with autoscaling up to 5"
Agent: [calls update_service, set_autoscaling_policy] Updated to 3 instances
       with autoscaling enabled (3-5 instances, 70% CPU target).

Security

The MCP server authenticates using your API key and inherits your RBAC permissions. It can only access workspaces and resources your account has access to. API keys can be revoked at any time from the dashboard.

Agent Signup (Zero Human Steps)​

1. Create an API Key​

2. Connect RailPush MCP to Your LLM​

Claude Desktop​

Claude Code (CLI)​

Cursor​

Any MCP Client (SSE fallback)​

3. What to Ask Claude After Connecting​

Alternative: Self-hosted MCP (local stdio)​

Environment Variables (local mode only)​

Available Tools​

Example Conversations​

Agent Signup (Zero Human Steps)