Railway MCP

npx add-mcp 'https://mcp.railway.com'

The Railway MCP Server implements the Model Context Protocol (MCP). It lets AI assistants create projects, deploy templates, manage environments, pull variables, and redeploy services.

The server runs at mcp.railway.com. Connect to it in one of two ways:

• Through the CLI (default). The railway mcp command connects your editor to mcp.railway.com through the Railway CLI, reusing your railway login credentials so no second authentication is required.
• With OAuth. Editors that support OAuth connect directly to https://mcp.railway.com without the CLI.

Note: Connecting through the CLI requires CLI version 5.44.0 or later.

Quick start

Install the Railway CLI and configure agent skills, MCP, and authentication in one command. Select the options to generate the setup command:

If the CLI is already installed, skip the bootstrap and run:

railway setup agent          # connect through the CLI (default)
railway setup agent --oauth  # connect with OAuth

Read on for per-editor manual configuration, the available tool list, and security considerations.

Per-editor configuration

If you'd rather configure an editor manually, or want to inspect what railway mcp install writes, use the selector to switch between the CLI connection, OAuth, and running the server locally:

railway mcp install merges the Railway server entry into existing configs without removing other MCP servers. Re-run it any time to update.

Understanding MCP

The Model Context Protocol (MCP) defines a standard for how AI applications (hosts) can interact with external tools and data sources through a client-server architecture.

• Hosts: Applications such as Cursor, VS Code, Claude Code, or Windsurf that connect to MCP servers.
• Clients: The layer within hosts that maintains one-to-one connections with individual MCP servers.
• Servers: Standalone programs (like the Railway MCP Server) that expose tools and workflows for managing external systems.

The Railway MCP server runs on Railway's infrastructure. The railway mcp command connects to it over stdio and attaches credentials from your railway login session to each request. Editors that support OAuth connect directly instead.

Prerequisites

Connecting to the Railway MCP server requires a Railway account. The default CLI connection also requires an installed Railway CLI and a railway login session so it can reuse those credentials. OAuth doesn't require the CLI.

Example usage

Use prompts that describe the Railway outcome you want the agent to produce.

• Create and deploy a new app

  Create a Next.js app in this directory and deploy it to Railway.
  Also assign it a domain.
  

• Deploy from a template

  Deploy a Postgres database
  

• Pull environment variables

  Pull environment variables for my project and save them to a .env file
  

• Debug a failing deployment (uses the railway-agent tool)

  Use the railway agent to figure out why my backend service is
  crashing on deploy
  

• Redeploy a service

  Redeploy my api service in the production environment
  

• Manage feature flags

  List feature flags for project <projectId>
  

  Set the checkout-v2 feature flag to true on project <projectId>
  

Available MCP tools

The Railway MCP Server exposes the following tools. Your AI assistant selects tools based on your request. Use railway-agent for multi-step operations.

• Account
  • whoami
• Projects
  • list-projects, create-project, list-services
• Feature flags
  • list-feature-flags, get-feature-flag
  • set-feature-flag, delete-feature-flag (admin; destructive delete is marked at the protocol level)
• Deployments
  • redeploy
  • accept-deploy: commit staged changes and deploy (destructive; clients prompt for confirmation)
• Agent
  • railway-agent: hand a natural-language request to Railway's AI agent for multi-step operations like log analysis, debugging, and service configuration
• Cloud agent tasks (see Tasks)
  • run-cloud-agent-task: hand work to a cloud agent (starting a new agent is billed; clients prompt for confirmation)
  • check-cloud-agent-task, list-cloud-agent-tasks, get-cloud-agent-transcript
  • respond-cloud-agent-task, cancel-cloud-agent-task
  • list-cloud-agent-models

Run the server locally

The CLI also ships an in-process MCP server for machines that can't reach mcp.railway.com, for example on egress-restricted networks. Start it with railway mcp local, or write the configuration for supported editors with railway mcp install --local. It talks directly to the Railway API using your CLI credentials, marks destructive tools with protocol-level hints, and returns a preview before requiring confirm: true.

The local server exposes a different tool set from mcp.railway.com:

• Account: whoami
• Projects and services: list_workspaces, list_projects, create_project, list_services, create_service, remove_service, connect_service_source, disconnect_service_source, link_service, get_service_config, update_service, and scale_service
• Environments and deployments: create_environment, link_environment, environment_status, list_deployments, and deploy
• Variables: list_variables, set_variables, and add_reference_variable
• Domains: generate_domain, list_domains, domain_status, update_domain, delete_domain, and retry_domain_certificate
• Networking: list_tcp_proxies, get_tcp_proxy, create_tcp_proxy, remove_tcp_proxy, private_network_status, and private_network_update
• Templates: search_templates and deploy_template
• Storage: create_bucket, remove_bucket, create_volume, update_volume, and remove_volume
• Observability: get_logs, service_metrics, http_requests, http_error_rate, and http_response_time
• Documentation: docs_search and docs_fetch

Security considerations

The Railway MCP Server invokes Railway APIs on your behalf. Keep these points in mind:

• CLI authentication. The railway mcp command reads and refreshes your railway login credentials. Editor configuration doesn't contain a long-lived Railway credential.
• OAuth scoping. With OAuth, you choose which workspaces and projects the client can access. Tokens are short-lived and can be revoked from your Railway account settings.
• Destructive actions are marked at the protocol level. Clients that respect these hints will prompt for confirmation.
• Project tokens are not accepted. The server requires a user identity for billing and audit trails.

You should still:

• Review actions requested by the LLM before approving them, especially destructive ones (redeploy, accept-deploy, railway-agent, and the local server's remove_service, delete_domain, remove_tcp_proxy, remove_bucket, and remove_volume).
• Restrict access to ensure only trusted users can invoke the MCP server.
• Avoid production risks by limiting usage to non-critical environments where possible.

Feature requests

Share feature requests on the Railway MCP Server Central Station post.