Coolify

Inventory, status and logs from a Coolify instance. Coolify's own token abilities do the enforcing, which is what makes this the cleanest Tier 1.

Policy	coolify/read-only
Connection kind	http
Upstream looks like	https://app.coolify.io/mcp
Credential	Coolify API token
Tier	1 — the credential refuses writes on its own, and Prodpeek refuses them again
Time to set up	about 2 minutes

Grant exactly these

Ability: read

Everything this profile allows. Nothing else is needed.

Do not grant these

Each of these would undo the point of the rest

Ability: write

The profile denies every write tool; the token should not be able to either.

Ability: deploy

Triggers deployments. Denied in the profile for the same reason.

Ability: root

Full control of the instance.

read-sensitive

The one that is easy to tick by accident and quietly demotes the whole profile. With it OFF, Coolify's own api.sensitive filter strips environment values and secrets from every response — so the tools that would leak them cannot, regardless of what Prodpeek allows.

Why this one is the clean example

Coolify tokens carry granular abilities — read, write, deploy, root — plus a separate read-sensitive flag. A token created with read only, and read-sensitive off, physically cannot write and cannot return environment values. Prodpeek's allowlist and the credential refuse the same things independently, without either knowing about the other. That is what Tier 1 means here.

Steps

1. In Coolify: Keys & Tokens → API tokens → Create new token.
2. Name it prodpeek.
3. Tick read. Leave write, deploy and root unticked.
4. Leave read-sensitive off. This is the field that matters most.
5. Copy the token — Coolify shows it once.
6. Enable the MCP endpoint if you have not: Settings → Advanced → MCP. The URL is your instance plus /mcp.
7. In Prodpeek: Services → Add a service → Coolify, paste the token, then Test connection.

What Test connection should show

Your Coolify version decides the tool names, and they have moved between releases. Anything advertised that the profile does not name lands in not in the policy and is denied by default. That is safe, but it also means a read you wanted might be missing — send the list along and the profile can be corrected.

Check you got it right

• [ ] The token row lists 'read' only, and read-sensitive is off.
• [ ] In Prodpeek, Test connection shows the write tools under 'denied by policy'.

If an agent is reading this

Requires the user's Coolify login. Ask them to confirm read-sensitive is OFF — it is the single field that decides whether this is Tier 1.

Then add it to Prodpeek

Console: Services → Add a service, pick coolify/read-only, paste the credential. Or from an agent, add_service with no credential and hand over the drop link.

Then press Test connection and read all three lists.