# Connect with kraftify mcp

`kraftify mcp` speaks the Model Context Protocol over stdio, so Claude Code, OpenCode and Cursor can provision a Postgres or a game server as a tool call. The agent calls the same API the [CLI](/docs/install-cli) does, with your existing login.

## Install it in one command

```
npx add-mcp https://mcp.kraftify.net/mcp
```

That writes the entry into your agent config for you. The manual forms are below if you would rather edit the file yourself.

```
kraftify mcp
```

## Register it with an agent

The block below is the shape for Claude Code; the others take the same command.

```
claude mcp add kraftify -- kraftify mcp
```

```
"mcpServers": { "kraftify": { "command": "kraftify", "args": ["mcp"] } }
```

## Tools it exposes

Read and write are separate tools rather than one tool with a mode, because an agent given a single `deploy` with a `dry_run` flag will eventually call it for real. Every tool also carries the protocol's `readOnlyHint`, `destructiveHint` and `idempotentHint`, so your client knows what to confirm before it runs.

| Tool | Does | Cost |
| --- | --- | --- |
| `kraftify_regions` | List regions and whether each is live | read |
| `kraftify_kinds` | List target kinds with sizes and published monthly rates | read |
| `kraftify_ceiling` | Read the spend ceiling, what is committed, and what is left | read |
| `kraftify_targets` | List targets with kind, state and connection | read |
| `kraftify_logs` | Read console output as a stream held open over the socket | read |
| `kraftify_create_target` | Create a target, refused if it would cross the ceiling | spends money |
| `kraftify_set_env` | Record that a value is set. The value is never stored or returned | write |
| `kraftify_start` | Start a stopped target | spends money |
| `kraftify_stop` | Stop a running target | write |
| `kraftify_delete_target` | Delete a target and its env values, after a safety snapshot | spends money |

## Start read-only

Start in read-only mode. Judge what the agent can see, then open only the tool families you actually need.

```
kraftify mcp --read-only
```

This exposes the five read-only tools and refuses the rest. It is the mode to spend a week in before you let anything write.

## The spend ceiling

`kraftify_ceiling` returns your monthly cap, what is already committed, and what is left. `kraftify_create_target` is refused if the new target would cross the cap.

> A refused create is not queued and not billed. Every provider in this category publishes a spend threshold; the ceiling is the one that actually stops the thing, and nothing in this product, including the agent, can raise it.

## Env values

`kraftify_set_env` records that a value is set. It never receives the value and never returns one. This is the half of "the agent sets up your database" that most implementations skip, and skipping it leaves the user with a box and a manual task. See [What we store](/docs/data).

## Log output is not stored

`kraftify_logs` is a stream held open over the socket and dropped when the client goes away. Nothing is written to disk, which is why it cannot be replayed later. See [What we store](/docs/data).

## What an agent may not do

- Write to a console. Reading is exposed, writing is not, because an agent that can type into your target can do anything your account can.
- Change the spend ceiling. That is one of the few controls reserved to a person.
- Read an env value. It was never sent, so there is nothing to return.
- Create tokens. `tokens:write` exists for a script, not for an agent holding a deploy tool.