Deploy from your AI tool

Connect your AI coding tool to Dockhold and let it deploy and manage your apps for you.

Dockhold runs a remote MCP server, the open protocol AI tools use to call out to other services. Connect your tool once with a token, and it can list your apps, read their status and logs, deploy a repo, restart an app, and set variables, all as you, limited to your own account. No copy-pasting config back and forth; the tool does it directly.

1. Create an API token

In the dashboard, go to Settings → API tokens and create one. Pick the access it needs:

• Read-only: list apps, read status and logs. Good for “what’s broken?” without risk.
• Read & deploy: also deploy, restart, and set variables.

Below that is a separate Also allow writing secretscheckbox. It isn’t a third level: check it on top of either choice above to let the token also store and remove app secrets. Leave it unchecked unless your tool needs to set something like an API key, since a secrets-enabled token can write to every app on your account, not only the one you’re working on.

Copy the token when it’s shown. It starts with dh_mcp_ and is shown once. You can set an optional expiry and restrict it to specific IPs.

2. Add Dockhold to your tool

Point your tool’s MCP configuration at the Dockhold server and pass your token as a bearer header:

{
  "mcpServers": {
    "dockhold": {
      "url": "https://api.dockhold.eu/mcp",
      "headers": { "Authorization": "Bearer dh_mcp_live_…" }
    }
  }
}

The exact place this goes depends on the tool. Claude Desktop and Cursor both take an MCP server URL plus headers; drop the dockholdblock into their MCP settings and restart the tool. Replacedh_mcp_live_… with the token you copied.

3. Ask it to do something

Once connected, your tool can run these on your account:

• list_apps: your apps, with status and URLs.
• get_app_status: one app’s deploy status, URL, and last error.
• get_app_logs: recent runtime logs, for debugging a deploy.
• list_github_repos: the repos you’ve connected, so it can deploy a private one.
• deploy_app: deploy a new app from a public or private GitHub repo.
• redeploy_app: restart an app.
• set_app_variable: set a configuration variable.
• get_resource_usage: your memory, database, and storage pools, and how much is free.
• resize_app: give an app more memory when it runs out.
• resize_database / resize_database_storage: grow a managed database’s memory or disk.
• set_app_storage / remove_app_storage: give an app storage that survives restarts, or erase it.
• set_app_secret / unset_app_secret / list_app_secrets: store, remove, or list the names of an app’s secrets. Only on a token with “Also allow writing secrets” turned on.

So “deploy github.com/me/my-app to Dockhold and tell me when it’s live” is a single instruction. The tool calls deploy_app, then polls get_app_status until the URL is up. Deploying a private repo is the same instruction: it calls list_github_reposto find the repo, then deploy_app. And if an app runs out of memory, “give it more memory” calls get_resource_usage to check your pool, then resize_app.

“Make this app keep its SQLite file” works the same way: the tool callsset_app_storage and then writes the app againstDATA_DIR. Ask it to readapp storage first, because storage changes how the app deploys and rules out running several copies of it.remove_app_storage erases the files for good, so it asks you to confirm before it runs.

“Set my Stripe key on this app” is where a secrets-enabled token earns its keep: the tool calls set_app_secret instead ofset_app_variable. The value is encrypted at rest and can never be read back through any tool afterward, only in the dashboard while you’re signed in. Two things to know before you turn on “Also allow writing secrets.” That token can write secrets to every app on your account, not only the one you’re asking about. And any value you hand your AI tool has already passed through that tool’s own context on its way to Dockhold, so point it at a local .env file instead of typing a real key into the chat, and rotate the key afterward if you did type it in. unset_app_secret detaches a secret from one app without deleting it from your account, so anything else still using it keeps working.

What it can’t do

A token only ever does what you could do in the dashboard, on your own apps, within your plan. It can’t reach anyone else’s apps, can’t change billing or delete your account, and a read-only token can’t deploy. Plain config still goes through set_app_variable, which refuses anything that looks like a key or password and points you atset_app_secret instead; secrets stay readable only from theSecrets page in the dashboard, never through the MCP connection. Lost a token or done with it? Revoke it on the same settings page and it stops working immediately.

The one rule that still matters

Whether you deploy by hand or through your AI tool, the app itself has to listen on 0.0.0.0:$PORT. That’s the whole contract. Everything else Dockhold handles.

Create a token →