Returns identity and build information for this server (name, version, build commit, runtime, capability counts)

Manage projects. list: all (includes nested environments with applications, composes, databases). get: projectId (same nested detail). create: name. update: projectId+fields. remove: projectId. duplicate: sourceEnvironmentId+name.

Manage applications. create: name+environmentId. get: applicationId (returns metadata + masked env summary — never values). update: applicationId+fields (supports sourceType, repository, owner, branch, customGitUrl, customGitBranch, githubId, dockerImage, networkIds, detachDokployNetwork, etc.). move: applicationId+targetEnvironmentId. deploy: applicationId, redeploy? (note: first deploy on new services may fail — retry immediately). start/stop/delete/markRunning/refreshToken/cleanQueues/killBuild/cancelDeployment: applicationId. reload: applicationId+appName. saveEnvironment: applicationId+env (KEY=VALUE pairs, full replace). setEnvVars: applicationId + set? (KEY=VALUE pairs to upsert) + unset? (KEY names to remove) — read-modify-write inside the server; result is a masked confirmation with changed key names only. getEnvKeys: applicationId — returns just the KEY names (no values). getEnvValuesUnsafe: applicationId — UNSAFE escape hatch that returns full KEY=VALUE pairs (use only when you need actual values; output goes to the tool transcript and any retained logs). saveBuildType: applicationId+buildType. traefikConfig: applicationId, traefikConfig? (omit to read). readMonitoring: appName. readLogs: applicationId, tail? (default 100), since? ('all' or duration like '1h'), search? (substring filter). search: any of q|name|appName|description|repository|owner|dockerImage|projectId|environmentId + limit/offset. deployNginxQuickstart: environmentId, serverId? — creates and deploys a "Hello World" nginx demo app on a generated traefik.me domain (Dokploy's onboarding smoke test). Note: the API's search index is narrower than the project tree — it can return fewer results than dokploy_project/dokploy_overview list, so use it to find a known service, not to inventory.

Manage Docker Compose services. create: name+environmentId. get: composeId (metadata + masked env summary — never values). update: composeId+fields (supports sourceType, composeFile for raw/inline, git source fields, autoDeploy, createEnvFile, serviceNetworks). delete/start/stop/getDefaultCommand: composeId. deploy: composeId, redeploy?, freshVolumes? (DESTRUCTIVE: runs docker compose down --volumes first, deleting the service's volume data; docker-compose type only, ignored for stack) (note: first deploy on new services may fail — retry immediately). move: composeId+targetEnvironmentId. loadServices: composeId (must deploy first). loadMounts: composeId+serviceName. saveEnvironment: composeId+env (full replace), createEnvFile? (also write a .env file next to the compose file). setEnvVars: composeId + set?/unset? (merge inside the server, masked confirmation only). getEnvKeys: composeId — KEY names only. getEnvValuesUnsafe: composeId — UNSAFE escape hatch that returns full KEY=VALUE pairs (output goes to the tool transcript). cancelDeployment/cleanQueues/killBuild/refreshToken: composeId. readLogs: composeId+containerId, tail?, since?, search?. search (as action): q|name|appName|description|projectId|environmentId + limit/offset. Note: the API's search index is narrower than the project tree — it can return fewer results than dokploy_project/dokploy_overview list, so use it to find a known service, not to inventory.

Manage deployments. list: applicationId|composeId|serverId|type+id. queueList: no params (currently-queued deployments). killProcess: deploymentId (kill an in-flight build). readLogs: deploymentId, tail?. remove: deploymentId (drops the record). Database deployments are listed via the resource itself, not here.

Docker daemon management: containers, files inside them, events, health, and disk usage. Containers: getContainers (list all, serverId?), restartContainer/startContainer/stopContainer/killContainer/removeContainer (containerId, serverId?), getConfig (containerId, serverId?), findContainers (appName+method, serverId?). Method semantics: match → fuzzy name match (optional appType: stack|docker-compose). label → REQUIRES type: standalone|swarm. stack → docker stack lookup. service → swarm service lookup. Container files (containerId+path, serverId?): listContainerFiles, readContainerFile (output truncated at 100k chars), writeContainerFile (+content — writes into the RUNNING container; the change is lost on redeploy unless the path is a mount), deleteContainerFile. Observability: getEvents (minutes? 1-1440, default 15), getServerHealth (sinceHours? 1-168). Disk: getDiskUsage (docker system df — containers, volumes, images and build cache), getBuildCache, pruneBuildCache (same effect as dokploy_settings clean cleanType=dockerBuilder).

Docker volume management and volume file access. Every action accepts an optional serverId. getVolumes: list volumes. getVolumesSize: per-volume disk usage. getVolumeConfig: volumeName — raw Docker inspect for one volume. removeVolume: volumeName — destroys the volume and its data; take a dokploy_volume_backup first. Files (volumeName + path, writeVolumeFile also content): listVolumeFiles, readVolumeFile (truncated at 100k chars), writeVolumeFile, deleteVolumeFile. Unlike writes into a running container (dokploy_docker writeContainerFile), volume writes survive redeploys. For scheduled backups of these volumes see dokploy_volume_backup.

Docker image inventory. getImages: list images, serverId?. getImageConfig: imageRef ('nginx:latest' or an image ID), serverId?. removeImage: requires ALL THREE of repository, tag and id — read them off getImages — plus force? and serverId?. For overall disk usage and build cache see dokploy_docker getDiskUsage / getBuildCache / pruneBuildCache.

Docker network management. list: serverId? (networks Dokploy knows about). get/inspect/remove/recreate/resync: networkId — inspect returns the raw Docker inspect payload, recreate drops and re-adds the network so attached services are briefly disconnected, resync re-reads the network from Docker and refreshes Dokploy's stored record without touching the network itself. create: name (+ driver bridge|overlay, internal, attachable, enableIPv4, enableIPv6, mtu 68-65535, ipam, serverId). networksToSync: serverId? — networks that exist on the Docker host but are not yet tracked by Dokploy. import: names (one or more names from networksToSync), serverId?. Attach networks to workloads with dokploy_application update networkIds, or dokploy_compose update serviceNetworks.

Read-only fleet-wide rollups that span every project, for orientation before drilling into a specific resource. No parameters. services: every application, compose service and database with its status. backups: every configured backup and its schedule. domains: every domain and what it points at. Use these first when asked a 'what is running / what is exposed / what is backed up' question, then use dokploy_application, dokploy_domain or dokploy_backup for detail and for changes.

DNS provider configuration and DNS record management. Providers: list, get (dnsProviderId), create (name+config), update (dnsProviderId+name+config — the API REPLACES the provider, so both must be sent even when changing one), remove (dnsProviderId), testConnection (dnsProviderId for a saved provider, or config to check credentials before saving). config is discriminated on providerType: cloudflare{apiToken}, route53{accessKeyId,secretAccessKey}, porkbun{apiKey,secretApiKey}, infomaniak{apiToken} or ovh{applicationKey,applicationSecret,consumerKey,endpoint?}. Records: listZones (dnsProviderId), listRecords (dnsProviderId+zoneId), createRecord/updateRecord (dnsProviderId+zoneId+type+recordName+content, ttl?, proxied?, plus recordId for update), deleteRecord (dnsProviderId+zoneId+recordId). Record type: A, AAAA, CNAME, MX, TXT, NS, SRV, CAA or PTR. proxied only takes effect on Cloudflare. Provider credentials are never echoed back in tool output; provider reads return id, name and providerType only.

External secret-manager (vault) configuration. list, get (vaultProviderId), create (name+config+assignments), update (vaultProviderId+name+config+assignments — the API REPLACES the provider, so all four must be sent even when changing one; run get first), remove (vaultProviderId), testConnection (vaultProviderId for a saved provider, or config to check credentials before saving), listSecretNames (vaultProviderId+projectId, environmentId?). config is discriminated on providerType: hashicorp | infisical | aws | aws-parameter-store | doppler | azure | scaleway | phase. Note infisical.projectId and scaleway.projectId are that provider's own project, NOT the Dokploy projectId used in assignments. assignments is [{projectId, environmentIds?}] naming the Dokploy projects the vault serves. listSecretNames returns names only — Dokploy exposes no API to read a secret's value — and provider credentials are never echoed back in tool output.

Manage domains. create: host+applicationId|composeId(+serviceName for compose). list: applicationId|composeId. get: domainId. update: domainId+host (include composeId+serviceName for compose domains). delete: domainId. toggleEnable: domainId — flips the enable flag blind; prefer update with enabled:true|false when you need a known end state. generate: appName. canGenerateTraefikMe: serverId?. validate: domain, serverId? (checks DNS against that server's IPs; omit for the Dokploy host).

Manage URL redirect rules on an application (Traefik regex/replacement). create: regex+replacement+permanent+applicationId. update: redirectId+regex+replacement+permanent. remove: redirectId. get: redirectId. A redeploy of the application is required for changes to take effect.

Manage servers. list/count/publicIp: no params. get: serverId. create: name+ipAddress+port+username+sshKeyId+serverType. update: serverId+fields. remove: serverId. getMetrics: url+token. getServices: serverId — the applications, compose services and databases deployed on that server, with their projects (check before removing a server).

System settings. health: check status. version: get version. ip: get IP. clean: cleanType (all|images|volumes|stoppedContainers|dockerBuilder|dockerPrune|monitoring|deploymentQueue|sshPrivateKey), serverId? (only honored for docker-related clean types). reload: reloadTarget (server|traefik), serverId? (traefik only).

Manage databases (postgres/mysql/mariadb/mongo/redis/libsql). create: dbType+name+environmentId+databasePassword. Per-engine extras — postgres/mysql/mariadb: REQUIRE databaseName+databaseUser; mysql/mariadb also accept databaseRootPassword. mongo: REQUIRES databaseUser (databaseName not used). redis: only databasePassword (no databaseName/User). libsql: REQUIRES appName+dockerImage+sqldNode (primary|replica); accepts sqldPrimaryUrl+enableNamespaces. get: dbType+databaseId (returns metadata + masked env summary — never values). update: dbType+databaseId+fields. move: dbType+databaseId+targetEnvironmentId. start/stop/deploy/rebuild/remove: dbType+databaseId. reload: dbType+databaseId+appName. changeStatus: dbType+databaseId+applicationStatus (idle|running|done|error). saveEnvironment: dbType+databaseId+env (full replace). setEnvVars: dbType+databaseId + set?/unset? (merge inside the server, masked confirmation only). getEnvKeys: dbType+databaseId — KEY names only. getEnvValuesUnsafe: dbType+databaseId — UNSAFE escape hatch that returns full KEY=VALUE pairs. saveExternalPort: dbType+databaseId+externalPort (libsql also accepts externalGRPCPort/externalAdminPort). search: dbType + q|name|appName|description|projectId|environmentId + limit/offset — searches within the given dbType (not supported for libsql). Note: the API's search index is narrower than the project tree — it can return fewer results than dokploy_project/dokploy_overview list, so use it to find a known service, not to inventory.

Manage backups. create: schedule+prefix+destinationId+database+databaseType. Provide ONE service id matching databaseType: postgres→postgresId, mysql→mysqlId, mariadb→mariadbId, mongo→mongoId, libsql→libsqlId, web-server→(no id). For backups of a db running inside a compose stack: pass composeId+serviceName (and set databaseType to the engine, e.g. postgres). Optional on create/update: includeEncryptionKey to store the database encryption key with the backup. get: backupId. update: backupId+fields. remove: backupId. listFiles: destinationId. manualBackup: backupId+backupType (postgres|mysql|mariadb|mongo|libsql for db backups; compose for whole-stack; webServer for the dokploy server itself).

Manage scheduled volume-level backups (rclone-based). Distinct from dokploy_backup, which does DB-native dumps. create: name+volumeName+prefix+cronExpression+destinationId (+serviceType and matching *Id, +appName, +turnOff to stop service during backup, +keepLatestCount, +enabled). update: volumeBackupId + all fields. remove/get: volumeBackupId. list: id (parent service id) + volumeBackupType (application|postgres|mysql|mariadb|mongo|redis|compose|libsql). runManually: volumeBackupId (trigger immediately).

Manage preview deployments (per-PR / per-branch deploys off a parent application). list: applicationId. get: previewDeploymentId. remove: previewDeploymentId. redeploy: previewDeploymentId (+title?, +description? for the deploy record).

Manage cron schedules that run commands against applications, compose services, or servers. create: name+cronExpression+command (+ scheduleType and matching applicationId/composeId/serverId; shellType=bash|sh; script for multi-line; timezone). update: scheduleId + all fields. remove/get: scheduleId. list: id (parent id — applicationId|composeId|serverId|'dokploy-server') + scheduleType. runManually: scheduleId. scheduleType: application|compose|server|dokploy-server.

Read the Dokploy audit log with filters. Only action is 'list'. Filters (all optional): userId, userEmail, resourceName, auditAction (create|update|delete|deploy|cancel|redeploy|login|logout), resourceType (project|service|environment|deployment|user|customRole|domain|certificate|registry|server|sshKey|gitProvider|notification|settings|session), from/to (ISO timestamps), limit (default 50, max 500), offset. Note: the wire-level query parameter is called action; the MCP arg is auditAction to avoid clashing with the tool's action discriminator.

Manage project environments. create: projectId+name. get: environmentId. list: projectId. update: environmentId+fields. remove: environmentId. duplicate: environmentId+name.

Manage ports, auth, certs. createPort: applicationId+publishedPort+targetPort. deletePort: portId. createAuth: applicationId+username+password. deleteAuth: securityId. listCerts: all. getCert: certificateId. createCert: name+certificateData+privateKey. removeCert: certificateId.

Manage mounts (volumes, bind mounts, files) attached to services. Mount changes require a redeploy of the parent service to take effect. create: type+mountPath+serviceId+serviceType (+volumeName for volume, +hostPath for bind, +filePath+content for file). update: mountId (+any field). remove: mountId. get: mountId. listByServiceId: serviceType+serviceId. allNamedByApplicationId: applicationId (named volumes only). serviceType: application|postgres|mysql|mariadb|mongo|redis|compose|libsql.

Manage SSH keys. create: name+privateKey+publicKey, description?. list: no params. get: sshKeyId. update: sshKeyId, name?, description?, lastUsedAt?. remove: sshKeyId. generate: type (rsa or ed25519). Note: organizationId is resolved automatically from the API key.

Manage container registries for pulling private images. list. get: registryId. create: registryName+username+password+registryUrl (registryType defaults to 'cloud'). update: registryId+fields. remove: registryId. test: registryName+username+password+registryUrl (without persisting). testById: registryId, serverId?.

Manage S3-compatible backup destinations. list. get: destinationId. create: name+accessKey+bucket+region+endpoint+secretAccessKey, provider?, additionalFlags? (rclone flags). update: destinationId+fields. remove: destinationId. test: same fields as create (without persisting).