Trigger a new deployment for an application (by UUID or tag). Optionally force-rebuild or deploy a pull-request preview. FENCED: requires --allow-destructive and confirm:true (code/credential write).

List active deployments (no args) or the deployment history for a specific application (app_uuid). Supports pagination with skip/take.

Cancel an in-progress deployment by its deployment UUID (fenced). Requires --allow-destructive and confirm:true.

Trigger a deployment and block until it reaches a terminal state (finished/failed/cancelled/skipped). Emits MCP progress notifications while polling. Returns per-resource final statuses and a logs tail on failure. FENCED: requires --allow-destructive and confirm:true (code/credential write).

List all Coolify resources (applications, databases, services) across all projects. Optionally filter by type.

Get full details of a specific Coolify resource by type and UUID.

Create a new Coolify resource. kind discriminates: application (with source sub-discriminator), database (with engine), or service (with service_type XOR docker_compose_raw base64). FENCED: requires --allow-destructive and confirm:true (code/credential write).

Update configuration fields of an existing Coolify resource. FENCED: requires --allow-destructive and confirm:true (fields can rewrite deploy/start commands — a code-execution write). Pass the fields to change in fields (or fields_json); they are sent verbatim as the PATCH body. Applications commonly accept: name, description, domains (comma-separated URL list — NOT fqdn; dockercompose apps must use docker_compose_domains [{name, domain}] instead of domains), git_branch, build_pack, install_command, build_command, start_command, ports_exposes, base_directory, publish_directory, docker_registry_image_name, docker_registry_image_tag, pre_deployment_command, post_deployment_command, health_check_* settings, custom_docker_run_options, watch_paths. instant_deploy: true additionally queues an immediate redeploy after saving. Services accept only: name, description, instant_deploy, docker_compose_raw, connect_to_docker_network, urls [{name, url}], force_domain_override, is_container_label_escape_enabled.

Start, stop (fenced), or restart (fenced) a Coolify resource. stop and restart are destructive — they require --allow-destructive and confirm:true. For applications, start/restart return a deployment_uuid that can be used to track progress.

Delete a Coolify resource permanently. Requires confirm:true and --allow-destructive flag.

List, create, update, or delete persistent volume storage for an application, database, or service. For create/update, pass the storage fields in fields (create requires type and mount_path; also name, host_path, content, is_directory, fs_path).

List, create, update, or delete database backup schedules and executions. Only applicable to databases. For create/update, pass the schedule fields in fields (create requires frequency, a cron expression; also enabled, save_s3, s3_storage_uuid, databases_to_backup, dump_all, backup_now, database_backup_retention_*, timeout).

List, create (fenced), update (fenced), delete (fenced), or view executions of scheduled tasks on an application or service. create and update are code-execution writes — they require --allow-destructive and confirm:true.

Manage environment variables for a Coolify resource (application, database, or service). action=list returns all vars with a redaction_hint when any value appears empty or masked. action=set upserts one var ({ key, value }) or many ({ vars: [{key,value},...] }) via bulk API. action=delete (fenced) removes a single var by its env_uuid (UUID returned from list); requires --allow-destructive and confirm:true.

Fetch a log snapshot for a Coolify resource. • application: uses GET /applications/{uuid}/logs?lines= (REST API). • database / service: requires --enable-host-ops; the docker logs fallback is wired in Task 31.

Query Coolify servers. Actions: list (summary fields by default; include:true for full), get, validate, resources, domains.

Create, update, or delete (fenced) a Coolify server.

Provision a new server on Hetzner Cloud via Coolify (destructive — creates billable infrastructure). Requires --allow-destructive flag and confirm:true.

Browse Hetzner Cloud resource catalog exposed by Coolify. Use before provision_hetzner to pick a server type and location.

Manage Coolify SSH private keys (security keys). Actions: list, get, create (fenced), update (fenced), delete (fenced). create and update are credential writes — they require --allow-destructive and confirm:true. Note: update uses a collection-level PATCH — uuid is passed in the body.

Manage Coolify projects and their environments. Actions: list, get, create, update, delete (fenced), list_environments, create_environment, get_environment, delete_environment (fenced).

List the Coolify instances this server is configured to drive (names, base URLs, default, and per-instance host-ops/destructive flags). Never returns tokens or other secrets. Pass an instance name as the 'instance' arg to any other tool to route to it.