Connect a service

Every service, and exactly how to give it a key that cannot do more than it should.

Each guide creates a credential whose own permissions already match the read-only policy Prodpeek enforces — so two independent things refuse a write, not one. Where a vendor's permissions are too coarse for that, the guide says so rather than rounding up.

Confluence Read pages and search spaces — runbooks, architecture notes, the context that explains why production looks the way it does. Tier 2 Atlassian API token ~3 min Coolify Inventory, status and logs from a Coolify instance. Coolify's own token abilities do the enforcing, which is what makes this the cleanest Tier 1. Tier 1 Coolify API token ~2 min DigitalOcean Droplets, App Platform, databases, networking and DOKS. One connection per product area — DigitalOcean serves each from its own MCP endpoint. Tier 2 DigitalOcean API token ~3 min GitHub Read code, history and diffs from selected repositories. One connection per repository, each with a token that can reach only that repository. Tier 1 Fine-grained personal access token ~5 min GitHub — triage Issues and pull requests, without the code. The narrower of the two GitHub profiles — pick this one when the agent triages rather than reads source. Tier 1 Fine-grained personal access token ~4 min Grafana Dashboards, alerts and Loki queries. Honest Tier 2 — Grafana's own roles are coarse, so the gateway allowlist is doing more of the work here than elsewhere. Tier 2 Grafana service account token ~3 min PostgreSQL Query a Postgres server directly — named diagnostics plus a free SELECT that is only enabled when the role is not a superuser. Tier 2 The role's password ~3 min SSH host A fixed menu of diagnostic commands on a Linux host. Not a shell — the adapter has no free-form command tool and never will. Tier 2 Private key PEM (or a password) ~5 min

Missing one? A service needs a reviewed profile before it can have a guide — that is the order on purpose. Open an issue.