# DenkOps

> Deploy APIs, MCP servers and scheduled jobs on managed EU hosting. Sign in with Google or GitHub.

- name: com.denkops/denkops
- version: 1.0.0
- connection class: R0 (autonomous)
- trust: 96/100
- quality: 88/100 (new)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/com.denkops%2Fdenkops
- tools: https://api.protogrid.dev/v1/servers/com.denkops%2Fdenkops/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "denkops": {
      "type": "http",
      "url": "https://denkops.com/mcp"
    }
  }
}
```


## Trust

- hygiene: 100
- liveness: 100
- freshness: 100
- provenance: 85
- drivers: +repository +dns-namespace +website +reachable +uptime-100% +updated-5d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 88/100 (new)

### protocol: 88 (weight 25)

- pass `protocol.modern`: supports 2026-07-28 (server/discover)
- pass `protocol.stateless`: answers without a session
- pass `protocol.transport`: streamable HTTP
- warn `protocol.list_ttl`: tools/list declares ttlMs 0, so clients re-fetch it on every use

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 88 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 62 of 62 tools declare readOnlyHint or destructiveHint
- pass `tools.directory_hints`: every tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
- warn `tools.token_cost`: about 8,440 tokens to load every tool
- warn `tools.api_dump`: 62 tools, 77% named like REST operations: looks like an API mapped one endpoint per tool
- pass `tools.hidden_text`: no hidden text in tool names, descriptions, schemas or annotations

### stability: n/a (weight 15)

- n/a `stability.changes`, `stability.rug_pull`, `stability.new_links`: tool history recorded for 4 of the 7 days needed

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 62, about 8,440 tokens to load them all
- tool set hash: 29eeaee9d8e2f6565497ba3d6a7cf59c
- badge: [![protogrid quality](https://protogrid.dev/badge/com.denkops/denkops.svg)](https://protogrid.dev/servers/com.denkops/denkops)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

_No tool definition changes recorded._

## Remotes

- https://denkops.com/mcp (streamable-http, auth none, reachable true, uptime30d 1)

## Packages

_none_

## Tools (62)

- `add_connector_account`: Create an email/password account for a connector project. A strong password is generated and shown only once; pass it to the person securely. Password sign-in must be enabled for it to work. Workspace owners only.
- `add_domain`: Attach a custom domain to a DenkOps project. Returns the DNS TXT record (and CNAME target) to set at the DNS provider; the domain starts routing once its TXT record is verified.
- `cancel_invite`: Cancel a pending workspace invite. Workspace owners only.
- `create_alert_rule`: Create an alert rule for an event (crash, killed, rate_limit, deploy_failed) on one project or all, optionally posting to an https webhook (e.g. Slack). Workspace owners only.
- `create_connection`: Mint a new scoped, revocable DenkOps connection token for a CLI, CI job or agent (e.g. GitHub Actions deploys). The token is returned exactly once and cannot be retrieved again. Workspace owners only.
- `create_workspace`: Create a new workspace owned by the signed-in person. This connection keeps acting in its current workspace; reconnect to use the new one.
- `delete_alert_rule`: Delete an alert rule. Workspace owners only.
- `delete_project`: PERMANENTLY delete a DenkOps deployment and ALL its data (containers, images, volume and records). Cannot be undone. Only deletes when `confirm` equals the project's exact slug; without it nothing is deleted and the confirmation requirement is returned.
- `deploy`: Deploy a project to DenkOps by sending its files, and get the live URL back. Include every source file (and denkops.json if the project has one; without it a new project is created, named from `name`, package.json or pyproject.toml). Pass project_id to ship a new version of an existing project. Secrets do not belong in files: .env files are rejected (set environment variables separately). Limits: 500 files, 5 MB.
- `get_audit_log`: Show the workspace's recent audit log: who did what, when. Workspace owners only.
- `get_billing_link`: Get a one-click Stripe link for this workspace: subscribe (optionally with extra slots), add slots to an existing subscription, or fix a failed payment. Nothing is charged until the user confirms on Stripe. Workspace owners only; other members are told which owner to ask.
- `get_connection_activity`: Show recent actions performed with one connection token. Workspace owners only.
- `get_connector_access`: Show who may connect to a connector project (public, an email allowlist, or workspace members) and which sign-in methods are allowed. Workspace owners only.
- `get_connector_branding`: Show the brand colours and icon used on a connector project's hosted sign-in and consent pages.
- `get_container_logs`: Read recent container logs for a DenkOps project, e.g. to debug a failing deploy. Optional `since` (15m, 2h, 3d or an ISO timestamp) and `level` (a token matched in the log line, e.g. error) filter the persisted log store.
- `get_denkops_guide`: Explains how to structure, configure (denkops.json) and deploy a DenkOps project: bun-Hono or python-FastAPI APIs and MCP servers built with defineMcp.
- `get_egress_policy`: Read a project's outbound-network (egress) allow-list policy: enabled, allowed hosts and recently blocked hosts.
- `get_member_access`: List the per-project role overrides of one workspace member. Workspace owners only.
- `get_metrics`: Get a DenkOps project's request metrics (latency percentiles, error rate), latest resource sample and rejected-request count over the last 24h.
- `get_plan`: Show the workspace's plan: slots used and still free, subscription status and renewal date, and prices. Use it when a new project might not fit or the user asks about their plan or slots.
- `get_project_access`: Show each member's workspace role and effective role on one project (none = the project is hidden from them). Workspace owners only.
- `get_public_paths`: List a DenkOps project's public (unauthenticated) paths, plus the routes DenkOps has observed the app serve.
- `get_status`: Get a DenkOps project's status and active version by project_id.
- `get_trace`: Get the spans of a single DenkOps request trace by project_id and trace_id.
- `get_workspace_overview`: One overview of the workspace: slot usage and every project with status, active version and latest memory/CPU use.
- `invite_member`: Invite someone to the workspace by email address (or GitHub username) with a role. No email is sent: the result contains a short text with the sign-in link to pass on. They join when they sign in with that email (Google, or their primary GitHub email); an existing DenkOps user with that email is added right away. Workspace owners only.
- `list_alert_events`: Show recent alert events (crashes, kills, rate limits, failed deploys). Workspace owners only.
- `list_alert_rules`: List the workspace's alert rules (crash, killed, rate_limit, deploy_failed) and where they notify. Workspace owners only.
- `list_connections`: List the workspace's DenkOps connection tokens (scoped, revocable agent/CLI credentials): label, agent type, scopes and status. Workspace owners only.
- `list_connector_accounts`: List the email/password accounts that can sign in to a connector project. Workspace owners only.
- `list_crons`: List a project's managed scheduled (cron) jobs with next and last run and status.
- `list_deployments`: List a project's deployed versions (newest first) with status and when; the active version is marked. Useful before rolling back.
- `list_domains`: List a DenkOps project's custom domains and whether each is verified.
- `list_env`: List a DenkOps project's environment variable KEYS (values are write-only and never shown), and whether changes are pending a redeploy.
- `list_members`: List the workspace's members with their roles, and pending invites. Workspace owners only.
- `list_projects`: List the DenkOps projects in the signed-in workspace with their status and URL.
- `list_traces`: List recent request traces for a DenkOps project (name, status, duration, span count).
- `list_workspaces`: List the workspaces of the signed-in account with roles, and which one this connection acts in.
- `redeploy`: Re-run the current version of a DenkOps project to apply staged env or path changes or restart the app. Reuses the last upload; no code is sent.
- `regenerate_connection`: Issue a new token for a connection and revoke the old one (e.g. after a leak). The new token is shown only once. Not for the connection this chat uses. Workspace owners only.
- `remove_connector_account`: Delete an email/password account from a connector project. Workspace owners only.
- `remove_domain`: Detach a custom domain from a DenkOps project.
- `remove_member`: Remove a member from the workspace; their access (including chat connections) ends immediately. The last owner can't be removed. Workspace owners only.
- `reset_connector_account_password`: Generate a new password for a connector project's email/password account; the old one stops working. Shown only once. Workspace owners only.
- `revoke_connection`: Immediately revoke a DenkOps connection token by its connection_id. Workspace owners only.
- `rollback`: Roll a DenkOps project back to a previous healthy version (omit version for the previous one).
- `run_cron`: Trigger a managed scheduled job immediately (recorded as a manual run).
- `set_connector_access`: Change who may connect to a connector project: public on/off, the email allowlist (replaces it), allowed sign-in providers (github, google, microsoft; null = all) and email/password accounts on/off. Omitted fields stay. Workspace owners only.
- `set_connector_branding`: Brand a connector project's hosted sign-in and consent pages: accent colour (buttons/links), background colour (hex like #2563eb; null resets to the DenkOps default) and/or an icon (PNG, JPEG or WebP as base64, max 2 MB). Omitted fields stay unchanged; text colour is chosen automatically for contrast. A `branding` block in denkops.json overrides these values on the next deploy. Workspace owners only; the connector must be enabled.
- `set_cron_enabled`: Pause (enabled=false) or resume (enabled=true) a project's scheduled job.
- `set_egress_policy`: Set a project's egress allow-list. enabled=true is default-deny: only listed hosts (exact or *.domain) may be reached. Allow-list edits apply live; enabling or disabling applies on the next deploy.
- `set_env`: Set or overwrite a DenkOps project's environment variable (for secrets such as API keys). Values are write-only. The change is staged and takes effect on the next deploy or redeploy. Reserved keys (DENKOPS_*) are rejected.
- `set_member_role`: Change a workspace member's role (owner, member or viewer). The last owner can't be demoted. Workspace owners only.
- `set_project_access`: Set a member's role on one project: none (hidden), viewer, member or owner — or inherit to fall back to their workspace role. Workspace owners only.
- `set_public_paths`: Replace a DenkOps project's list of public (unauthenticated) paths. The change is staged and takes effect on the next deploy or redeploy.
- `start_project`: Start a stopped DenkOps deployment again (reactivates its active version).
- `stop_project`: Stop a DenkOps deployment: its containers stop and it goes offline. Reversible by starting the project again.
- `unset_env`: Delete a DenkOps project's environment variable. Takes effect on the next deploy or redeploy.
- `update_alert_rule`: Turn an alert rule on/off or change its webhook (null removes it). Workspace owners only.
- `update_connection_scopes`: Change what a connection token may do: env / public paths / egress access (none, read, write), whether it may create projects, and which projects it may touch (null = all). Not for the connection this chat uses. Workspace owners only.
- `verify_domain`: Check a DenkOps custom domain's DNS TXT record and activate routing when it is present. Reports not-verified if the record isn't visible yet.
- `whoami`: Show which DenkOps account and workspace this connection acts as.