Enables deploying from a deployment’s connected GitHub branch, building and putting the branch’s current contents live as a push would.
Provides tools for reading SQLite database details within an environment, including database configuration, collections, records, and available restore snapshots/backups.
This server does not currently have a deployable release on Glama. Follow the repository's setup instructions to install and configure it for your MCP client, including any required credentials and local dependencies.
@mdrnio/mcp-server connects an AI assistant to MDRN: your workspaces, projects and products,
deployments and their builds, logs, the SQLite and Postgres databases, stored files (Objects),
sent mail and sign-in (Auth), and the changes you allow it: put a build back live, set a variable,
turn a product on or off, store or delete a file, send a test email, set who must sign in, and
manage the databases. To deploy, the assistant uses the MDRN CLI (npx @mdrnio/cli deploy); the
server's instructions tell it so. Nothing it offers deletes a deployment, a product or a domain;
the tools that can take something away are annotated destructive and ask the person first.
The same tools are served two ways:
Hosted (streamable HTTP, MCP protocol 2025-06-18) at https://mcp.mdrn.io/mcp
(development stage: https://development.mcp.mdrn.io/mcp). You sign in with MDRN (OAuth 2.1),
pick one workspace and answer two questions: what it can do (Read, or Read and write, the
default; or per product) and where (Sandbox, ticked at first, and Production). An environment
left unticked is out of its reach, to read as to write.
Local (stdio): npx -y @mdrnio/mcp-server, signed in as you are on this machine (below).
The local server needs Node.js 20 or later; npx -y @mdrnio/mcp-server fetches it on first use
and runs it, so there is nothing else to install. Sign in once with mdrn login
(npm install -g @mdrnio/cli), or set MDRN_API_TOKEN to a management token (a workspace Admin
creates one in the console under Workspace, Tokens).
With mdrn login, the server uses the CLI profile (MDRN_PROFILE, or default) and its
origin: the sign-in's access token, refreshed by the CLI's own code when it is about to expire
or once after MDRN refuses it, so mdrn logout ends this server's access too.
MDRN_API_TOKEN wins when set, with optional MDRN_API_ORIGIN (default
https://api.mdrn.io; https only, except a development server on localhost).
Claude Desktop (claude_desktop_config.json, Settings, Developer, Edit Config):
{
"mcpServers": {
"mdrn": {
"command": "npx",
"args": ["-y", "@mdrnio/mcp-server"]
}
}
}Cursor (.cursor/mcp.json in the project, or ~/.cursor/mcp.json for every project):
{
"mcpServers": {
"mdrn": {
"command": "npx",
"args": ["-y", "@mdrnio/mcp-server"]
}
}
}Claude Code: claude mcp add mdrn -- npx -y @mdrnio/mcp-server.
To use a management token instead of the sign-in, add "env": { "MDRN_API_TOKEN": "mdrn_mgmt_..." }
to the entry (Claude Code: claude mcp add mdrn -e MDRN_API_TOKEN=mdrn_mgmt_... -- npx -y @mdrnio/mcp-server).
On Windows, a client that starts the command itself (not through a shell) needs npx run
through cmd:
{
"mcpServers": {
"mdrn": {
"command": "cmd",
"args": ["/c", "npx", "-y", "@mdrnio/mcp-server"]
}
}
}Related MCP server: Octopus Deploy Official MCP Server
Claude.ai (and Claude Desktop): Settings, Connectors, Add custom connector, URL
https://mcp.mdrn.io/mcp. Claude opens MDRN's sign-in, then the approval page ("Claude
wants to connect to MDRN"): pick the workspace, what it can do and where.
ChatGPT: Settings, Connectors (developer mode), Create, URL https://mcp.mdrn.io/mcp,
authentication OAuth; the same sign-in and consent follow.
Claude Code: claude mcp add --transport http mdrn https://mcp.mdrn.io/mcp, then /mcp
to sign in.
A connection is listed in the console under Workspace, Tokens, Connected apps, where Revoke ends it at once: the next tool call answers 401 and the client asks you to sign in again.
Tool | Arguments | Does |
| optional | List the workspaces you can reach, with your role in each. |
|
| List the projects of a workspace. |
|
| Change. Create a project in a workspace, with its sandbox and production environments and every product on. |
|
| Show which products a project has on (sqlite, postgres, objects, mail, logs, auth) and each one's state in sandbox and production. |
|
| Change. Turn a product back on for a project, in sandbox and production at once (each keeps its own data). |
|
| Change. Turn a product off for a project, in sandbox and production at once. |
|
| Check a change that takes a while (a product turned on or off): its state is accepted or running until it is succeeded or failed. |
|
| Read the workspace's plan, whether it is in build mode, its credit and invoices. |
|
| Read what the workspace used this period (or periodId), per meter. |
|
| List the deployments of a project environment: each serves one app at its own address (hostname). |
|
| Change. Create an empty deployment in a project environment. |
|
| List a deployment's builds, newest first: its history. |
|
| Read one build: its steps, state and artifact. |
|
| Read a build's output, while it runs or after. |
|
| Follow a build being put live (the rolloutId a build or mdrn_roll_back answers): accepted, publishing or verifying until it is ready or failed. |
|
| Change. Build and put live what a deployment's connected GitHub branch holds now, as a push would. |
|
| Change. Deploy one of MDRN's example apps into a deployment, built as an upload. |
|
| Change. Put an earlier build of a deployment back live, by its artifactId from mdrn_list_builds. |
|
| List a deployment's environment variables: name, whether it is secret, whether its builds get it too, and when it was last set. A plain variable's value comes with it; a secret's value never does. |
|
| Change. Set an environment variable on a deployment. |
|
| Change. Remove an environment variable from a deployment; the serving build is put live again without it. |
|
| Change. Delete a deployment's build cache: its next build downloads and compiles everything again. Refused while a build of the deployment is running. |
|
| List an environment's custom domains with their DNS records and state. A host's |
|
| List the environment's own domains (such as example.com) and what answers under each: the hosts serving a deployment or the downloads, and the mail senders, each with its state. Mail that cannot be read leaves the domains answered, with |
|
| Change. Choose the address an environment's mail leaves from on one of its mail domains, such as orders@example.com (noreply@ until chosen). |
|
| Get a link that opens a deployment's app at its own address, signed in as the person. |
|
| Search an environment's application logs (requests, console lines, errors), newest first. |
|
| Read everything one request logged, across the environment's deployments, by its trace id (a search result's traceId); from and to are Unix milliseconds, the last hour when left out. |
|
| Read one environment's SQLite or Postgres database: state, created (false for a Postgres database not made yet), revision, restore window and history, and the Postgres connection string's role and host (the host only for an Admin or Developer; never its password). |
|
| List the database's collections (what the app stores through the SDK's records API) by name, each with its record count up to 1000. |
|
| List one page of a collection's records, by id, each with its data and version. |
|
| Read one record of a collection, with its data and version. |
|
| List the snapshots the SQLite database can be restored to (taken before every restore and deletion, kept 7 days). |
|
| Check a database restore or deletion: accepted or running until it is succeeded or failed. |
|
| Change, can take something away. Set how far back Postgres can be restored: 0 turns it off, or 1, 7 or 30 days. |
|
| Change, can take something away. Run one SQL statement on the environment's SQLite or Postgres database, in its dialect, and answer the rows. |
|
| Change, can take something away. Change the Postgres connection string: on turns it on and rotate makes a new one (both answer it once), off stops it for good, stop_previous stops the string a rotation replaced. |
|
| Change, can take something away. Restore the environment's SQLite or Postgres database to an earlier state: timestamp (an ISO 8601 moment in the restore window) or, for SQLite, backupId (from mdrn_list_database_backups). |
|
| List an environment's stored files (Objects), newest first: id, filename, size, content type and state. |
|
| Get a download link for one stored file. |
|
| Change. Store a file in an environment's Objects: text, or base64 for anything else, at most 4 MiB. |
|
| Change, can take something away. Delete a stored file. |
|
| List the emails an environment's app sent, newest first: id, status (queued, sending, accepted, delivered, bounced, complained, failed), recipient, subject and when. |
|
| Read one sent email whole: status, why it failed or bounced, its timeline, and the body while it is still kept. |
|
| Change. Send one plain test email through the environment's Mail, as the app would, to see that mail works. It counts like any email the app sends: metered, and toward the hourly, daily and build-mode limits. |
|
| Read who must sign in to each deployment of an environment (signIn: everyone must sign in except on its publicPaths, the app decides, or off), the account page your users manage themselves on, and the sign-in session limits. |
|
| Change. Set who must sign in to one deployment: everyone (everyone must sign in, except on publicPaths such as / or /blog/*), app_decides (the app asks MDRN who is signed in and decides), or off. |
|
| List the app's users (the people who signed in to it), newest first: id, email, name, whether disabled, when created and last signed in. |
|
| Export the app's users a page at a time in id order, with every sign-in method and the subject ID its provider knows each by, to move them to another system. |
|
| Read an MDRN API page no other tool covers, by its path: the workspaces, projects, usage, an operation, the products, billing, the deployments, domains, a rollout or a request's logs. |
environmentId is sandbox or production; product is sqlite, postgres, objects, mail,
logs or auth; database is sqlite or postgres; deploymentId is a deployment from
mdrn_list_deployments. Products belong to the project: a new project starts with every product
on, the product tools take no environmentId (one given is refused), and a change applies in
Sandbox and Production at once. Tool schemas reject unknown arguments. Every change sends an
Idempotency-Key: the idempotencyKey you pass (repeat it to retry safely), or a fresh one per
call. Changes are annotated readOnlyHint: false, destructiveHint: false, except five that can
take something away (destructiveHint: true): mdrn_delete_object and
mdrn_set_database_restore_history (idempotentHint: true), and mdrn_run_sql,
mdrn_database_connection and mdrn_restore_database (idempotentHint: false); reads are
readOnlyHint: true. mdrn_restore_database also needs confirmOverwrite: true.
What a connection may do. The hosted server checks each tool against what the person allowed
when connecting (Platform's token-info): a tool needing more answers insufficient_scope without
calling MDRN, and any change in Production (or to a product, which changes both environments) also
needs production:write, which the approval page gives only when Production is ticked under
Where. A connection reaches only the environments ticked there (sandbox:access,
production:access): a tool naming another answers insufficient_scope too, and Platform refuses
it either way. A local server signed in with
mdrn login acts with the person's full access, as their role allows.
Databases. SQLite and Postgres are two products, each with its own database in every
environment. The database tools name the one they work on with database. Records are read, never
written: the app's backend writes them. mdrn_run_sql refuses any statement naming MDRN's own
tables (_mdrn_*, and the provider's _cf_*) and leaves them out of a listing. The connection
string is in the answer of on and rotate only. A Postgres database is made the first time
something uses it; while it is being made the call answers 503 DATABASE_STARTING, and the same
call a few seconds later goes through.
Objects, Mail and Auth. mdrn_upload_object stores up to 4 MiB given as text or base64 (the
CLI's mdrn objects upload takes larger files); its parts go to their own short-lived links,
never with the bearer. mdrn_send_test_email sends one plain message through the app's own Mail.
mdrn_set_mail_address chooses the part before the @ that a mail domain's mail leaves from
(noreply until chosen); the domain must already send mail, and needs mail:write.
mdrn_set_sign_in turns sign-in on at a deployment's address and saves who must sign in
(everyone except on publicPaths, app_decides, or off) under If-Match, so a change made
meanwhile in the console is kept.
The answers of the main flows carry nextSteps: each a step saying what to do, with the tool
to call and the arguments known so far, or a url to open. A refused call ends with Next:
lines: the docs for its error code and, when it comes with going live, the console's go-live
screen; the assistant tells the person rather than working around it.
API requests have a 10-second deadline and reject redirects. Login, checkout, arbitrary URLs and
private routes are excluded, and mdrn_read_api reads only its allowlist. The bearer is redacted from
output, but authorized API data is returned to the client; grant the least scopes required.
The local server sends the sign-in's access token (or the management token) to the API and
nothing else; when the API answers 401 to a sign-in's token, the token is refreshed once and the
call sent again only if the refresh gave a new one. A sign-in that has ended answers each tool
call with what to do (mdrn login); a server started before mdrn login picks the sign-in up on
its next call.
The hosted server is stateless (one JSON answer per POST, no SSE stream or session; GET and
DELETE answer 405) and holds no credential. A request without a bearer answers 401 with
WWW-Authenticate: Bearer resource_metadata="https://mcp.mdrn.io/.well-known/oauth-protected-resource/mcp";
that metadata (RFC 9728) names MDRN's API (https://api.mdrn.io) as the authorization server.
Every request's token is checked with Platform first: one unknown, expired, revoked or issued for
another resource answers 401 invalid_token. A tool needing a scope the connection was not
granted answers a tool error insufficient_scope without calling MDRN. The checked token is then
sent to MDRN's API, which enforces its workspace, role and scopes on every call; it was issued by
that same API for this server, so nothing is exchanged. A browser page of another origin is
refused (403).
Source: src/server.js (the tools, shared), src/stdio.js (the package's mdrn-mcp command,
which reads the CLI profile through @mdrnio/cli/config), src/worker.js (released as the mcp
Worker of each stage, wrangler.<stage>.jsonc; not part of the npm package).
Guide: https://mdrn.io/docs/mcp/
This repository is a mirror: the code is published here from MDRN's main repository on every release, where it is tested together with the console, the API and the SDKs. Issues are welcome here. Pull requests are reviewed here and merged in the main repository, from where the next release brings them back.
This server cannot be deployed
Read-only AI coding tools for change verification, release readiness, capacity, and guidance.
Give your AI agents trusted access to the full Postman platform.
Read-only AI access to HAVN properties, leads, tasks, files, media, and analytics.
Governed memory and workspace for any AI: tasks, calendar, mail and pages, with per-action consent.
