How do AI agents use DeployHQ through Open Connector?

Your user connects DeployHQ once with one of its cataloged authentication methods. Open Connector stores the credential in an encrypted vault and exposes DeployHQ tools to your agent over MCP or a typed API, with credentials injected server-side on each call.

Is this a DeployHQ MCP server?

Yes. Open Connector can serve DeployHQ as a named MCP server with a scoped allowlist and a per-user connection URL, so any MCP client can call DeployHQ actions with credentials injected server-side.

Where do DeployHQ credentials live?

In your own infrastructure. Open Connector keeps credentials in its own vault and injects them at call time, so they never leave your environment.

DeployHQ integration

DeployHQ integration for AI agents.

DeployHQ integration for AI agents with secure authentication and server-side credential injection. Open Connector runs the OAuth, seals the token in an encrypted vault, and serves DeployHQ tools to your agent over MCP or a typed API — credentials injected server-side, every call audited, nothing leaving your infrastructure. Open source (AGPL-3.0) and self-hostable.

View source on GitHub All integrations →

What your agents can do

Real DeployHQ actions, managed and audited.

Your user connects DeployHQ once; your agent can then deploy your website from GitHub, GitLab & Bitbucket automatically. Zero-downtime deployments, build pipelines, one-click rollbacks — scoped to the OAuth permissions you grant and the tool allowlist you configure. Every action is least-privilege and written to a tamper-evident audit trail.

1
Your user grants DeployHQ access once (OAuth) — the token lands in the vault.
2
Your agent calls a tool over MCP or the typed API; Open Connector injects the credential server-side.
3
Every routed call appends a hash-chained audit record — nothing leaves your infra.

Tools & triggers

Supported DeployHQ tools.

208 tools are generated from the published DeployHQ catalog. Descriptions are plain text; each action remains subject to its configured authentication and tool allowlist.

Showing 208 tools. All published catalog entries are included in this page's server-rendered HTML.

Abort a running deployment: Immediately aborts a deployment that is currently in progress.; Deployments
AI Deployment Overview: Generates an AI-powered summary of changes between two revisions based on commit messages. Requires a configured and cloned repository.; Projects
Get billing status: Returns billing and subscription status for the account.; Account
Branches: Returns a map of branch names and their latest commit references for the project's repository.; Repositories
Commit Info: Returns detailed information about a specific commit including author, message, tags, and avatar URL. Queues a repository update if the commit is not found.; Repositories
Copy a global server to a project: Copy a global server to a project; Global Servers
Claim a network agent: Claims an unclaimed network agent using its claim code and registers it to the current account.; Network Agents
Enroll in managed-resources beta: Enroll the current account in the managed-resources beta.; Beta
Detect framework from a file manifest: Detects the project's framework/stack from an uploaded filename listing plus the contents of key manifest files. Returns the canonical stack, a suggested protocol (static_hosting or managed_vps), the static-hosting preset (output directory and SPA mode), and suggested build commands — the same detection pipeline the web onboarding wizard uses. Files not uploaded degrade detection precision gracefully; they never error. When AI features are enabled for the account and the rule-based result is ambiguous, AI services are consulted and their results merged into the response.; Detection
Create a folder: Creates a new folder in the account.; Folders
Create new global config file: Create new global config file; Global Config Files
Create a global environment variable: Creates a new account-level environment variable. Locked variables cannot be read back after creation.; Global Environment Variables
Create a global server: Create a global server; Global Servers
Create new global ssh command: Create new global ssh command; Global Ssh Commands
Create a project: Creates a new project in the account. Optionally applies a template to pre-populate servers, config files, and other settings.; Projects
Update automatic deployment settings: Enables or disables automatic deployments for individual servers and server groups. Unrecognized identifiers are skipped and reported in the response.; Automatic Deployments
Create a build cache file: Creates a new build cache file entry for the project. Build cache files persist between builds to speed up subsequent build runs.; Build Cache Files
Create a build command: Adds a new build command to the project's build pipeline. Commands execute in order during the build phase.; Build Commands
Create an empty build configuration override: Creates a new, empty non-default build environment override. No attributes are read from the request body; the override is returned with no target servers and no language versions set. Assign target servers with the update endpoint, and set language versions with the Language Versions endpoint.; Build Configurations
Create a build known host: Adds an SSH known host entry so the build server can connect to the specified hostname without host key verification prompts.; Build Known Hosts
Create an SSH command: Creates a new SSH command for the project. Commands can be configured to run before or after deployment on specified servers.; Ssh Commands
Create a config file: Creates a new configuration file for the project. The file will be deployed to the specified path on target servers during each deployment.; Config Files
Queue, preview or schedule a deployment: Creates a new deployment for the project. Set mode to 'queue' to execute immediately or 'preview' to generate a preview of changes without deploying. If a schedule block is provided, the deployment is scheduled for future or recurring execution. Use parent_identifier to target a specific server or server group. The deployment status field can be: pending, running, completed, failed, preview_pending, preview_ready, or preview_failed.; Deployments
Create a deployment check: Creates a new deployment check on the project. A check has a stage (pre_build or post_deploy) and a check_type (ssh, http, or vulnerability_scan). SSH checks run on selected servers; HTTP checks run from the deployment worker against the configured URL; vulnerability_scan checks run a scanner (Trivy, TruffleHog, or a custom CLI emitting SARIF) on the build server against the checked-out source, and are pre-build only.; Deployment Checks
Create an environment variable: Creates a new environment variable for the project. Variables can be locked to prevent value visibility and scoped to the build pipeline.; Environment Variables
Create an excluded file: Adds a file path to the project's exclusion list so it is skipped during deployments.; Excluded Files
Create an integration: Creates a new integration for the project. Only certain hook types are allowed via the API.; Integrations
Create or replace the repository: Replaces the project's repository configuration. Any existing repository is destroyed and a new one is created with the provided settings.; Repositories
Create a scheduled deployment: Creates a new scheduled deployment for the project.; Scheduled Deployments
Create a server: Creates a new server in the project. The protocol_type determines which additional connection parameters are required: SSH needs hostname and username, FTP needs hostname, username, and password, S3 needs bucket_name, access_key_id, and secret_access_key. For managed_vps, pass region, size, and os_image at the top level. For static_hosting, pass hosted_website_attributes at the top level.; Servers
Create a server group: Creates a new server group for the project to organize servers and control deployment order.; Server Groups
Run test access: Triggers a test access run for the project. Tests repository connectivity and all server connections. If a server_id is provided (via nested route), only that server is tested.; Test Access
Create an SSH command: Creates a new SSH command for the project. Commands can be configured to run before or after deployment on specified servers.; Ssh Commands
Run test access: Triggers a test access run for the project. Tests repository connectivity and all server connections. If a server_id is provided (via nested route), only that server is tested.; Test Access
Create an API key: Creates a new API key for the authenticated user. The full key value is only returned once in this response.; Security
Create a new DeployHQ account: Registers a new DeployHQ account. No authentication required. Returns API credentials and SSH public key for immediate use. Rate-limited per IP, per email address, and globally; see the RATE_LIMITS constant for thresholds.; Signup
Create an SSH key: Create an SSH key; Ssh Keys
Create a team: Creates a new team.; Teams
Create a template: Creates a new template, optionally copying configuration from an existing project.; Templates
Invite a user: Invites a new user to the account. Sends an invitation email.; Users
Delete a network agent: Permanently deletes a network agent from the account.; Network Agents
Delete a folder: Deletes a folder. Projects assigned to it are not deleted; they become ungrouped.; Folders
Delete global config file: Delete global config file; Global Config Files
Delete a global environment variable: Permanently removes a global environment variable from the account.; Global Environment Variables
Delete a global server: Delete a global server; Global Servers
Delete global ssh command: Delete global ssh command; Global Ssh Commands
Delete a project: Queues the project for deletion. Fails if any deployments are currently running.; Projects
Delete a build cache file: Removes a build cache file entry from the project. The cached files will no longer persist between builds.; Build Cache Files
Delete a build command: Removes a build command from the project's build pipeline.; Build Commands
Delete a build configuration override: Removes a non-default build environment configuration. The default configuration cannot be deleted.; Build Configurations
Delete a build known host: Removes an SSH known host entry from the project's build environment.; Build Known Hosts
Delete an SSH command: Removes an SSH command from the project.; Ssh Commands
Delete a config file: Removes a configuration file from the project. The file will no longer be deployed to servers.; Config Files
Delete a deployment check: Removes a deployment check from the project.; Deployment Checks
Delete an environment variable: Permanently removes an environment variable from the project.; Environment Variables
Delete an excluded file: Removes a file path from the project's exclusion list.; Excluded Files
Delete an integration: Permanently removes an integration from the project.; Integrations
Cancel a scheduled deployment: Cancels and deletes a scheduled deployment that has not yet run.; Scheduled Deployments
Delete a server: Removes a server from the project. Fails if any deployments are currently running against this server.; Servers
Delete a server group: Permanently removes a server group from the project.; Server Groups
Delete an SSH command: Removes an SSH command from the project.; Ssh Commands
Revoke an API key: Revokes an API key by its identifier.; Security
Delete an SSH key: Delete an SSH key; Ssh Keys
Delete a team: Deletes a team.; Teams
Delete a template: Permanently removes a template from the account.; Templates
Remove a user: Removes a user from the account. Cannot remove the account administrator.; Users
Download private key: Download private key; Ssh Keys
View account details: Returns the current account's settings including plan, status, and project usage.; Account
Download an invoice PDF: Downloads a single invoice as a PDF.; Invoices
View global config file: View global config file; Global Config Files
Get a global environment variable: Returns the details of a single global environment variable.; Global Environment Variables
View a global server: Returns the full details of a single global server. For managed_vps servers the response includes a `managed_vps` block (status, ip_address, region, size, ssh_key). The block is `null` when the underlying managed resource does not exist yet (e.g. provisioning failed before it was created). Poll this endpoint to track provisioning.; Global Servers
View global ssh command: View global ssh command; Global Ssh Commands
Show a hosted resource or hosted website: Returns a hosted resource (managed VPS) or hosted website (static hosting) based on the identifier. The `kind` field discriminates the response shape.; Hosted Resources
View your profile: Returns the authenticated user's profile including account details and capability flags. The capability fields (beta_features, static_hosting_eligible, managed_vps_eligible) allow any authenticated account member to detect managed-resource eligibility without requiring admin access (GET /account is admin-only and cannot serve this purpose).; Profile
View a project: Returns the full details of a single project including its repository info, zone, and starred status.; Projects
Get a build configuration: Returns details of a specific build environment configuration, including known hosts, cache files, and available packages.; Build Configurations
Get a build configuration: Returns details of a specific build environment configuration, including known hosts, cache files, and available packages.; Build Configurations
Get an SSH command: Returns details of a specific SSH command, including its timing, target servers, and error handling settings.; Ssh Commands
Get a config file: Returns details of a specific configuration file, including its content body and server assignments.; Config Files
View a deployment: Returns the full details of a deployment including its steps and log entries. Archived and legacy deployments return simplified responses.; Deployments
Show a deployment check: Returns a single deployment check by its identifier.; Deployment Checks
Get an environment variable: Returns details of a specific environment variable. Locked variables will have their values masked.; Environment Variables
Get an excluded file: Returns the details of a single excluded file by its identifier.; Excluded Files
Get an integration: Returns the details of a single integration by its identifier.; Integrations
View the repository: Returns the repository configuration for the specified project.; Repositories
Get a scheduled deployment: Returns the details of a single scheduled deployment.; Scheduled Deployments
View a server: Returns the full details of a single server including its connection configuration. Returns server details including provisioning state for managed protocols. For static_hosting servers the response includes a `static_hosting` block (status, url). For managed_vps servers the response includes a `managed_vps` block (status, ip_address, region, size, ssh_key). Either block is `null` when the underlying managed resource does not exist yet (e.g. provisioning failed before it was created). Poll this endpoint to track provisioning.; Servers
Get a server group: Returns the details of a single server group.; Server Groups
Get an SSH command: Returns details of a specific SSH command, including its timing, target servers, and error handling settings.; Ssh Commands
Get test access results: Returns the current status and results of a test access run.; Test Access
View a team: Returns details for a specific team.; Teams
View a user: Returns details for a specific user.; Users
Latest Revision: Returns the latest remote commit reference for the specified branch.; Repositories
Link a global SSH command: Links an account-level global SSH command to this project so it runs during deployments.; Ssh Commands
List invoices: Returns all finalised invoices for the account, each with a per-invoice PDF download URL. `paid_at` is null when the invoice is unpaid.; Invoices
List network agents: Returns all network agents registered to the current account.; Network Agents
List all folders: Returns all folders in the account, ordered alphabetically by name. Each folder includes a count of projects assigned to it.; Folders
List global config files: List global config files; Global Config Files
List global environment variables: Returns all account-level environment variables available to every project.; Global Environment Variables
List global servers: List global servers; Global Servers
List global ssh commands: List global ssh commands; Global Ssh Commands
List all hosted resources and hosted websites: Returns both managed VPS resources (hosted_resource) and static hosting sites (hosted_website) for the authenticated account. The `kind` field discriminates; type-specific fields are populated accordingly.; Hosted Resources
List DeployHQ deployment IP ranges: Returns the IP ranges DeployHQ deploys from, for allowlisting on server firewalls. No authentication required.; Ip Ranges
List available language versions: Returns all available language/runtime versions from the build server.; Language Versions
List available regions: Returns available managed VPS regions grouped geographically.; Managed Hosting
List available sizes: List available sizes; Managed Hosting
List DeployHQ plans and prices: Lists DeployHQ's current plans with prices, localised to the caller's region (GB, EU, or USD detected from the caller's IP). No authentication required.; Packages
List automatic deployment configuration: Returns the webhook URL and auto-deploy settings for each server and server group in the project.; Automatic Deployments
List build cache files: Returns all build cache files configured for the project.; Build Cache Files
List build commands: Returns all build commands configured for this project, ordered ascending. Build commands run during the build pipeline before deployment.; Build Commands
List build configurations: Returns all build environment configurations for the project, including the default and any overrides.; Build Configurations
List build known hosts: Returns all SSH known host entries configured for the project's build environment.; Build Known Hosts
List SSH commands: Returns all SSH commands configured for the project, ordered ascending. SSH commands run on target servers before or after deployment.; Ssh Commands
List config files: Returns all configuration files for the project, ordered ascending. Config files are deployed to servers with their content during each deployment.; Config Files
List deployment checks: Returns every deployment check configured for this project, ordered by position within each stage.; Deployment Checks
List log entries for a deployment step: Returns log entries for a specific deployment step, with optional pagination and download support.; Deployments
List deployments for a project: Returns a paginated list of deployments for the project, excluding previews. Can be filtered by target server/group or limited to currently running deployments.; Deployments
List environment variables: Returns all environment variables for the project, ordered by name. Variables can be scoped to the build pipeline or specific servers.; Environment Variables
List excluded files: Returns all files excluded from deployment for this project.; Excluded Files
Get project deployment insights: Returns aggregated deployment statistics and per-server metrics for the specified time period.; Projects
List integrations: Returns all permanent integrations configured for this project.; Integrations
Get project language versions: Returns the language versions configured for this project's default build environment.; Language Versions
List scheduled deployments: Returns all forthcoming scheduled deployments for the project, ordered ascending by scheduled time.; Scheduled Deployments
List server groups: Returns all server groups for the project, ordered ascending.; Server Groups
List all servers: Returns all servers belonging to the specified project, including their agent associations.; Servers
List SSH commands: Returns all SSH commands configured for the project, ordered ascending. SSH commands run on target servers before or after deployment.; Ssh Commands
List all projects: Returns all projects accessible to the authenticated user, sorted alphabetically. Each project includes its starred status.; Projects
List all SSH keys: List all SSH keys; Ssh Keys
List teams: Returns all teams in the account.; Teams
List templates: Returns all private templates belonging to the current account.; Templates
List users: Returns all users in the account.; Users
List available deployment zones: Returns all available deployment zones. Maintenance zones are only visible to admin users.; Zones
List public templates: Returns publicly available templates, optionally filtered by framework type.; Templates
Recent Commits: Returns recent commits and tags for the specified branch. Set update to '1' to fetch the latest data from the remote before returning results. Renders the data for the commit selector popup; Repositories
Regenerate project SSH key: Regenerates the project SSH key and returns the new public key. key_type is optional and defaults to the existing project's algorithm; must be one of ED25519 or RSA when provided.; Projects
Update account settings: Updates account settings. Only account administrators can perform this action.; Account
Update a network agent: Updates the name of an existing network agent.; Network Agents
Update a folder: Renames a folder.; Folders
Update global config file: Update global config file; Global Config Files
Update a global environment variable: Updates an existing global environment variable's name, value, or locked status.; Global Environment Variables
Update a global server: Update a global server; Global Servers
Update global ssh command: Update global ssh command; Global Ssh Commands
Update your profile: Updates the authenticated user's profile settings.; Profile
Update a project: Updates the project's settings such as name, notification preferences, zone, and permalink.; Projects
Update a build cache file: Updates the path of an existing build cache file entry.; Build Cache Files
Update a build command: Updates an existing build command's properties such as the command string, description, or error handling behavior.; Build Commands
Update a build configuration override's target servers: Updates which servers a build configuration override targets. Only the target server assignment can be changed here; language versions are set with the Language Versions endpoint. Send server_identifiers listing the servers the override applies to. An override with no target servers does not apply to any server.; Build Configurations
Update language version: Sets the version of a specific language or runtime package for the project's build environment. Optionally targets a specific build configuration override.; Language Versions
Update language version: Sets the version of a specific language or runtime package for the project's build environment. Optionally targets a specific build configuration override.; Language Versions
Update an SSH command: Updates an existing SSH command's properties. Server assignments are only modified when server parameters are explicitly provided.; Ssh Commands
Update a config file: Updates an existing configuration file's path, content, server assignments, or other properties.; Config Files
Update a deployment check: Updates an existing deployment check. Same payload shape as create — any field can be sent on its own (PATCH semantics: missing keys leave existing values untouched).; Deployment Checks
Update an environment variable: Updates an existing environment variable's name, value, or settings. Server assignments are only modified when server parameters are explicitly provided.; Environment Variables
Update an excluded file: Updates the path of an existing excluded file entry.; Excluded Files
Update an integration: Updates an existing integration's settings. The hook_type cannot be changed via the API.; Integrations
Update the repository: Updates the repository's branch, root path, or hosting service type without replacing the entire repository configuration.; Repositories
Update a scheduled deployment: Updates an existing scheduled deployment.; Scheduled Deployments
Update a server: Updates an existing server's configuration. If the server uses external authentication and is not yet authenticated, a redirect to the OAuth URL is returned.; Servers
Update a server group: Updates an existing server group's settings such as name, branch, or transfer order.; Server Groups
Update an SSH command: Updates an existing SSH command's properties. Server assignments are only modified when server parameters are explicitly provided.; Ssh Commands
Update a team: Updates an existing team.; Teams
Update a template: Updates an existing template's name or description.; Templates
Update a user: Updates an existing user's details and permissions. Only account administrators can change permission flags.; Users
Resend invitation: Resends the invitation email for a user who has not yet activated their account.; Users
Reset Host Key: Clears the stored SSH host key for the server, allowing it to accept a new key on the next connection.; Servers
Reset password: Initiates a password reset for the given email address. No authentication required.; Account
Retry a deployment: Retries a failed deployment by resetting it and re-queuing. Only deployments that have completed (successfully or with failure) can be retried.; Deployments
Retry provisioning a hosted resource: Retries provisioning for a hosted resource that is in an error state. Resets the status to provisioning and enqueues a new provision job.; Hosted Resources
Revoke a network agent: Revokes the agent's claim, releasing it from the account so it can be reclaimed.; Network Agents
Rollback a deployment: Creates a new deployment that reverts the project to the state of the specified deployment. Archived deployments cannot be rolled back.; Deployments
Get server metrics: Returns real-time server metrics (CPU, memory, disk, uptime) collected over SSH. Requires beta features and an SSH-capable server.; Servers
Get a public template: Returns the full details of a single public template by its permalink.; Templates
Toggle star/unstar on a project: Toggles the starred status of a project for the current user. Starred projects appear prioritized in listings.; Projects
Get deployment status badge: Returns an SVG badge showing the last deployment status for the project or a specific server/group. No authentication required.; Projects
Get deployment status badge: Returns an SVG badge showing the last deployment status for the project or a specific server/group. No authentication required.; Projects
Sync a hosted resource: Sync a hosted resource; Hosted Resources
List undeployed commits for a project: Returns the undeployed commits between the last completed deployment in the default branch and the current HEAD. Commit list is capped at 100; when capped, `truncated` is true.; Projects
Unlink a global SSH command: Removes a linked global SSH command from this project.; Ssh Commands
Update account settings: Updates account settings. Only account administrators can perform this action.; Account
Update a network agent: Updates the name of an existing network agent.; Network Agents
Update a folder: Renames a folder.; Folders
Update global config file: Update global config file; Global Config Files
Update a global environment variable: Updates an existing global environment variable's name, value, or locked status.; Global Environment Variables
Update a global server: Update a global server; Global Servers
Update global ssh command: Update global ssh command; Global Ssh Commands
Update your profile: Updates the authenticated user's profile settings.; Profile
Update a project: Updates the project's settings such as name, notification preferences, zone, and permalink.; Projects
Update a build cache file: Updates the path of an existing build cache file entry.; Build Cache Files
Update a build command: Updates an existing build command's properties such as the command string, description, or error handling behavior.; Build Commands
Update a build configuration override's target servers: Updates which servers a build configuration override targets. Only the target server assignment can be changed here; language versions are set with the Language Versions endpoint. Send server_identifiers listing the servers the override applies to. An override with no target servers does not apply to any server.; Build Configurations
Update language version: Sets the version of a specific language or runtime package for the project's build environment. Optionally targets a specific build configuration override.; Language Versions
Update language version: Sets the version of a specific language or runtime package for the project's build environment. Optionally targets a specific build configuration override.; Language Versions
Update an SSH command: Updates an existing SSH command's properties. Server assignments are only modified when server parameters are explicitly provided.; Ssh Commands
Update a config file: Updates an existing configuration file's path, content, server assignments, or other properties.; Config Files
Update a deployment check: Updates an existing deployment check. Same payload shape as create — any field can be sent on its own (PATCH semantics: missing keys leave existing values untouched).; Deployment Checks
Update an environment variable: Updates an existing environment variable's name, value, or settings. Server assignments are only modified when server parameters are explicitly provided.; Environment Variables
Update an excluded file: Updates the path of an existing excluded file entry.; Excluded Files
Update an integration: Updates an existing integration's settings. The hook_type cannot be changed via the API.; Integrations
Update the repository: Updates the repository's branch, root path, or hosting service type without replacing the entire repository configuration.; Repositories
Update a scheduled deployment: Updates an existing scheduled deployment.; Scheduled Deployments
Update a server: Updates an existing server's configuration. If the server uses external authentication and is not yet authenticated, a redirect to the OAuth URL is returned.; Servers
Update a server group: Updates an existing server group's settings such as name, branch, or transfer order.; Server Groups
Update an SSH command: Updates an existing SSH command's properties. Server assignments are only modified when server parameters are explicitly provided.; Ssh Commands
Update a team: Updates an existing team.; Teams
Update a template: Updates an existing template's name or description.; Templates
Update a user: Updates an existing user's details and permissions. Only account administrators can change permission flags.; Users
Upload custom key: Uploads a custom SSH private key for the project and returns the corresponding public key.; Projects

FAQ

DeployHQ integration, answered

How do AI agents use DeployHQ through Open Connector?: Your user connects DeployHQ once with one of its cataloged authentication methods. Open Connector stores the credential in an encrypted vault and exposes DeployHQ tools to your agent over MCP or a typed API, with credentials injected server-side on each call.
Is this a DeployHQ MCP server?: Yes. Open Connector can serve DeployHQ as a named MCP server with a scoped allowlist and a per-user connection URL, so any MCP client can call DeployHQ actions with credentials injected server-side.
Where do DeployHQ credentials live?: In your own infrastructure. Open Connector keeps credentials in its own vault and injects them at call time, so they never leave your environment.

Give your agents DeployHQ — keep the keys.

Open source, self-hostable, with DeployHQ credentials that never leave your infrastructure. Run it from source today.

View source on GitHub How the MCP gateway works →