# Connect Coolify to Prodpeek

Profile: `coolify/read-only` · connection kind: `http` · tier 1
Credential: Coolify API token
Suggested URL: `https://coolify.example.com/mcp`

Inventory, status and logs from a Coolify instance. Coolify's own token abilities do the enforcing, which is what makes this the cleanest Tier 1.

## What you must not do

You cannot create this credential on the user's behalf — it needs their login and,
usually, an approval step. Walk them through it and verify the result. Never ask
them to paste the credential into the chat; it goes straight into Prodpeek's
console, which encrypts it at rest. Requires the user's Coolify login. Ask them to confirm read-sensitive is OFF — it is the single field that decides whether this is Tier 1.

## Grant exactly these permissions

- `Ability: read` — Everything this profile allows. Nothing else is needed.

## Refuse these, and say why if the user asks for them

- `Ability: write` — The profile denies every write tool; the token should not be able to either.
- `Ability: deploy` — Triggers deployments. Denied in the profile for the same reason.
- `Ability: root` — Full control of the instance.
- `read-sensitive` — The one that is easy to tick by accident and quietly demotes the whole profile. With it OFF, Coolify's own api.sensitive filter strips environment values and secrets from every response — so the tools that would leak them cannot, regardless of what Prodpeek allows.

## Verify before the credential is used

- The token row lists 'read' only, and read-sensitive is off.
- In Prodpeek, Test connection shows the write tools under 'denied by policy'.

## Then, in Prodpeek

1. Services → Add a service → choose the profile `coolify/read-only`.
2. Connection kind `http`, URL `https://coolify.example.com/mcp`.
3. Paste the credential. It is encrypted in the store and never shown again.
4. Run **Test connection**. It lists every tool the upstream advertises and how the
   profile classifies each one. Anything under "not in the policy" is denied by
   default — report that list rather than assuming it is fine.

## Full human walkthrough

## Why this one is the clean example

Coolify tokens carry granular abilities — read, write, deploy, root — plus a
separate `read-sensitive` flag. A token created with read only, and read-sensitive
off, *physically cannot* write and cannot return environment values. Prodpeek's
allowlist and the credential refuse the same things independently, without either
knowing about the other. That is what Tier 1 means here.

## Steps

1. In Coolify: **Keys & Tokens → API tokens → Create new token**.
2. Name it `prodpeek`.
3. Tick **read**. Leave write, deploy and root unticked.
4. Leave **read-sensitive off**. This is the field that matters most.
5. Copy the token — Coolify shows it once.
6. Enable the MCP endpoint if you have not: **Settings → Advanced → MCP**. The URL
   is your instance plus `/mcp`.
7. In Prodpeek: **Services → Add a service → Coolify**, paste the token, then
   **Test connection**.

## What Test connection should show

Your Coolify version decides the tool names, and they have moved between releases.
Anything advertised that the profile does not name lands in **not in the policy**
and is denied by default. That is safe, but it also means a read you wanted might be
missing — send the list along and the profile can be corrected.