DevOps and deployment MCP servers, compared
A database MCP server reads your data. These read your infrastructure and then change it — create a service, issue a domain, roll a variable, redeploy. Five of them have hand-written guides here, and the question that separates them is not which has more tools. It is how much of your account the connection can reach when the model is wrong.
Two patterns to know before you connect one. First, almost every server in this cluster authorises as you— Vercel documents that a connection grants the same access as your own user account, and the others differ mainly in whether a narrower option exists. There is no read-only flag to fall back on the way there is with a database, so credential scope is the guard. Second, remote is not automatically the fuller product: Railway’s local server has roughly fifty tools and its hosted one has eleven. Read the tool list, not the transport.
Railway MCP Server
sources re-read 2026-08-13Four things answer to the name. The archived repo and the deprecated npm package both still install cleanly, which is why people are months behind without knowing.
- What it is
- Bundled in the Railway CLI — `railway mcp` starts a local stdio server, `railway mcp install` writes the client config. There is also a hosted server at mcp.railway.com with a different, much smaller tool set.
- What the connection can reach
- Whatever your `railway login` session can reach. Local exposes ~50 tools including domains, volumes, TCP proxies and service deletion; Remote exposes 11 and refuses project tokens outright, because it wants a user identity for the audit trail.
Vercel MCP Server
sources re-read 2026-08-11Remote and OAuth-only, and the client allowlist means "it will not connect" is frequently not a bug you can fix.
- What it is
- Hosted at mcp.vercel.com, in Beta, on all plans, nothing to install. Vercel only accepts connections from AI clients it has reviewed.
- What the connection can reach
- Vercel says it plainly: the same access as your own Vercel user account. Nearly every tool also requires a teamId, so an agent that has not called list_teams first fails in a way that reads as a permissions error and is not.
Cloudflare MCP Server
sources re-read 2026-08-11Not one server. One API server with two tools that reach everything, plus sixteen product servers with curated tools that reach one thing each.
- What it is
- mcp.cloudflare.com/mcp fronts 2,500+ API endpoints behind `search` and `execute` (the Code Mode pattern). The sixteen product servers each live on their own *.mcp.cloudflare.com hostname — Observability, Workers Bindings, Radar, Browser Rendering, DNS Analytics, CASB.
- What the connection can reach
- The API server reaches the entire Cloudflare API, which is the argument for choosing a product server instead: a smaller, legible tool list whose names you can actually read in the client is also a smaller blast radius.
Datadog MCP Server
sources re-read 2026-08-10Nothing to install, and the setting that decides whether it is usable is how many tools you turned on.
- What it is
- A hosted endpoint on your own Datadog site at mcp.<your-site>/api/unstable/mcp-server/mcp, authorised by OAuth from inside the client. Use Datadog's own plugin or connector rather than a hand-written entry.
- What the connection can reach
- Read-heavy by nature — this is the observability half of the cluster. The practical constraint is context, not permissions: `core` is deliberately small and `toolsets=all` runs to hundreds of tools across two dozen toolsets and will eat your window before the first question.
Sentry MCP Server
sources re-read 2026-08-11Deliberately not a wrapper around the Sentry API — the tool selection is skewed to debugging, not administration.
- What it is
- Remote by default at mcp.sentry.dev/mcp, running on Cloudflare's remote-MCP infrastructure. The stdio transport exists mainly so self-hosted installs have a path, and its README calls it a work in progress.
- What the connection can reach
- Your Sentry org's issues and events. The gotcha is orthogonal to scope: the AI-powered search tools need their own LLM provider key, and without one they do not appear at all rather than failing loudly.
Choosing between them
These are not alternatives to each other, which is the first thing to get straight. You connect the one that hosts your app, and then you connect the one that tells you why it broke. The combination is what makes an agent useful for a deploy failure: the platform server has the build log and the observability server has the exception that followed it.
Where there is a real choice, it is usually within a vendor rather than between them. Cloudflare’s API server reaches 2,500+ endpoints behind two tools; its sixteen product servers each reach one product with named tools you can read. Railway’s local and remote servers share a name and almost no tools. In both cases the narrower option is the better default, and the broader one is something you reach for deliberately.
Then scope the credential, because that is the only guard that holds regardless of which tool the model picks. Prefer OAuth over a long-lived token where the vendor offers it — Railway’s CLI proxy exists precisely so no durable credential sits in an editor config file. Point the connection at a staging workspace when the work does not need production. And know where to revoke: OAuth tokens are short-lived and revocable from the vendor’s own account settings, which a pasted API key is not.
DevOps MCP servers: common questions
What is a DevOps MCP server?
A server that exposes a deployment platform or observability tool to an AI client through the Model Context Protocol, so the model can create a service, read a build log, roll an environment variable or query error events by calling named tools. It is a control plane, not a data source: the interesting tools change infrastructure rather than return rows.
Which MCP server should I connect for deployments?
The one for the platform you deploy to — Railway, Vercel and Cloudflare all publish first-party servers and none of them manages the others. Then pair it with the observability server you already pay for: Sentry for errors, Datadog for metrics and logs. The pairing is the point, because 'deploy failed, why' is a question that spans both.
Is a remote MCP server better than a local one?
Not automatically, and Railway is the counterexample worth knowing. The usual assumption is that a hosted server is the fuller product; Railway's local server exposes roughly fifty tools while its remote one exposes eleven. Remote does get one tool local does not — railway-agent, which hands multi-step debugging to Railway's own agent. Check the tool list before choosing on transport convenience.
How much access does an infrastructure MCP server have?
As much as the identity you authorised it with, which for OAuth-based servers is usually your own account. Vercel documents this explicitly. That makes credential scope the real guard here rather than any read-only flag: prefer a scoped token or a product-specific server over an account-wide one, keep the connection pointed at non-production where you can, and remember that OAuth tokens are short-lived and revocable from the vendor's own settings.
Can an AI agent delete my production service?
If the tool is registered and the credential permits it, yes — remove_service, delete_domain and remove_volume are real tools in this cluster. Servers mark destructive tools with protocol-level hints and good clients prompt, but a hint is only honoured by clients that implement it. The durable prevention is the same as everywhere else: an identity that lacks the permission, and a server whose tool list is narrow because you chose the narrow one.
Connecting a database instead? Database MCP servers, compared · Workspace MCP servers, compared · All setup guides.