Services → Coolify

Connect Coolify

Inventory, status and logs from a Coolify instance. Coolify's own token abilities do the enforcing, which is what makes this the cleanest Tier 1.

Tier 1 Coolify API token ~2 min profile coolify/read-only

Setting this up with your own agent? Give it these instructions.

Why this one is the clean example

Coolify tokens carry granular abilities — read, write, deploy, root — plus a

separate read-sensitive flag. A token created with read only, and read-sensitive

off, *physically cannot* write and cannot return environment values. Prodpeek's

allowlist and the credential refuse the same things independently, without either

knowing about the other. That is what Tier 1 means here.

Steps

  1. In Coolify: Keys & Tokens → API tokens → Create new token.
  2. Name it prodpeek.
  3. Tick read. Leave write, deploy and root unticked.
  4. Leave read-sensitive off. This is the field that matters most.
  5. Copy the token — Coolify shows it once.
  6. Enable the MCP endpoint if you have not: Settings → Advanced → MCP. The URL is your instance plus /mcp.
  7. In Prodpeek: Services → Add a service → Coolify, paste the token, then Test connection.

What Test connection should show

Your Coolify version decides the tool names, and they have moved between releases.

Anything advertised that the profile does not name lands in not in the policy

and is denied by default. That is safe, but it also means a read you wanted might be

missing — send the list along and the profile can be corrected.

Screenshots

Keys & Tokens → API tokens → Create new token. Screenshot pending — the steps above stand on their own.
Keys & Tokens → API tokens → Create new token.
Only "read" ticked, and read-sensitive left off. Screenshot pending — the steps above stand on their own.
Only "read" ticked, and read-sensitive left off.