Faable — Deploy & Auth

npx add-mcp 'https://mcp.faable.com/mcp'

Products Docs MCP Console

Faable MCP server · 37 tools

Hosted in the EU · GDPR by default

Your apps and your users, from your AI agent

The Faable MCP server connects Claude Code, Codex, Cursor and any MCP client to Faable Deploy and Faable Auth: deploy a repository and get the URL back, read why a build failed, see who signed in today and suspend an account — without pasting a single log into the chat.

claude mcp add --transport http faable https://mcp.faable.com/mcp

The first time, your client opens a browser: sign in with Faable, choose the project and allow what the agent may do. Nothing to paste. By default: every read, plus deploy.

Endpoint https://mcp.faable.com/mcp Read the docs

Your platform, answered in the editor

Your agent already has the code open. With the Faable MCP server it also sees the platform: it finds the failed deployment, reads the reason and the end of the build log, tells you whether the fix is in your code or on our side — and fixes it.

It sees your users too. Ask who signed in, how many people joined this week or why someone can't log in, and it reads it from Faable Auth. Suspend an account, sign someone out of every device or resend a password email — with your go-ahead.

And it ships: “deploy this repository and give me the URL” creates the app, deploys it and waits until it is live.

Why did the last deploy of shop-api fail?

list_deploymentsapp: "shop-api", limit: 1

get_deploymentapp: "shop-api"

get_build_logsapp: "shop-api", tail: 200

It's in the code, not the platform: npm run build fails with Module not found: Can't resolve 'sharp'. It's imported in lib/images.ts but missing from dependencies. I've added it — push and the next build will pass.

Who signed in to the app today? Anything odd?

count_auth_userslast_login_since: "24h"

list_auth_loginssince: "24h", status: "failed"

142 users signed in in the last 24 hours. One stands out: 37 failed attempts on ana@example.com from a single IP in ten minutes, with no success. Want me to sign that account out of every device and send a password reset?

37 tools, written for agents

Every read and one deploy by default, for your apps and for the users who sign in to them. Reversible writes — create an app, suspend a user — only when the connection asks for them. Nothing destructive, ever: deleting stays in the CLI and the dashboard.

Faable Deploy

Your apps: deployments, logs, traffic, domains and secrets.

Inspect

Find the app, see what is live, read why it broke.

whoami read

Who is logged in

The Faable account this server acts as, the active project and its Auth tenant. Use it first when unsure whether the user is logged in or which project is active.

list_projects read

List projects

The user's Faable projects. Apps, domains and Auth tenants live in a project; pass its id as project to the other tools.

query

list_apps read

List apps

The apps of a project, with their live phase, URL and linked repository. Start here to find the app the user means.

get_app read

Get an app

One app: phase, URL, repository, deploy branch and mode, detected stack, and its newest deployment (which may have failed while an older one keeps serving). Use it to answer 'is my app up?' or 'what is deployed?'.

app

list_deployments read

List deployments

Recent deployments of an app, newest first, with phase, commit and the first line of any failure reason. Use it to find the deployment behind 'my last deploy failed'.

applimit

get_deployment read

Get a deployment

Everything recorded about one deployment: phase, commit, detected stack, the runnable artifact, the FULL failure reason and, when it failed, fault — whether it is the user's to fix (user) or Faable's (platform). Without deployment, the newest one of the app.

appdeployment

get_build_logs read

Read build logs

The build output of a deployment — the first thing to read when a deploy failed and the user asks why. The cause is usually at the end. Without deployment, the newest one.

appdeploymenttail

get_runtime_logs read

Read runtime logs

What the running app printed (last 24 hours, up to 200 lines). Use it when the app is up but misbehaving, or crashes after starting. A deployment retired more than a day ago has none — read its build logs instead.

appdeploymenttail

get_app_traffic read

Read app traffic

Requests the app served: status codes, busiest paths and failing paths. Trails reality by up to 15 minutes.

appsincedeployment

get_usage read

Read project usage

This billing period's usage of a project: plan, apps, domains, deployments and egress.

get_quota read

Read deploy quota

Today's deploy allowance of a project and the builds held waiting for it. Use it when a deploy did not start: a held build is waiting, not failing.

list_domains read

List custom domains

Custom domains of an app and whether their DNS is verified.

app

check_domain read

Check a domain

DNS diagnostic of one custom domain: the CNAME it expects, what DNS answers today, and why it is not verified yet. prevalidation_cname.ready says whether the optional _acme-challenge record is in place, so the certificate is issued without waiting for the CNAME; status.tls_state is ok once the edge serves a valid certificate for the domain (status.tls_expires_at).

appfqdn

list_secrets read

List secret names

The environment variables set on an app. Names only — values are masked and this tool can never reveal them. Use it to check whether a variable the app needs is set.

app

Ship

Create an app from a repository, deploy and get the URL back — from Git or a local folder.

list_github_repos read

List deployable GitHub repositories

The GitHub repositories Faable can deploy: those the Faable GitHub App is installed on. Use it before create_app to find the repository the user means. When the app is not installed (or the repository is missing), give the user install_url — installing it is a step in their browser.

querylimit

deploy_app deploy

Deploy an app

Build and deploy the latest commit of the app's deploy branch on Faable's servers — the same as a git push. Nothing is uploaded from this machine. With wait, returns once it is live (with the URL) or failed (with the reason and whether it is the user's code or Faable's); without it, returns the deployment id at once. Only for apps with push-to-deploy.

appwait

create_app mode=write

Create an app from a repository

Create an app from a GitHub repository in a project, link it and start its first deploy (the dashboard's Create & connect). Needs the Faable GitHub App installed on the repository; if the link fails, the new app is removed and the error says what to fix.

reponamebranchdeploywait

redeploy mode=write

Retry a failed deployment

Rebuild a failed deployment from the source it recorded. Without deployment, the newest failed one. Refused for code older than what production serves.

appdeployment

cancel_deployment mode=write

Cancel a build

Stop a deployment that is still queued or building. Production keeps serving what it served. Without deployment, the one in flight.

appdeployment

Configure

Secrets, domains and how an app deploys.

set_secrets mode=write

Set environment variables

Add or update environment variables of an app. The app restarts to apply them when a value changed. Returns the names added, updated and unchanged — never the values.

appvariables

add_domain mode=write

Add a custom domain

Attach a custom domain to an app. Returns the CNAME record the user must create at their DNS provider; Faable verifies it and issues the certificate on its own. If the domain already serves traffic somewhere else, tell the user to create prevalidation_cname (_acme-challenge.<fqdn> CNAME) FIRST and switch the main CNAME only once check_domain shows it ready: the certificate then exists before traffic moves, with no TLS gap.

appfqdn

configure_repo mode=write

Configure how an app deploys

Change the deploy branch, the monorepo root directory ("" clears it) or the deploy mode (push: every push; ci: once CI tags a release; workflow: the repo's own GitHub workflow). Applies to the next deploy.

appbranchroot_dirmode

link_repo mode=write

Link a repository to an app

Link a GitHub repository to an app that already exists, so a push deploys it (for a new app, create_app does both). What is live keeps serving until the next push — linking starts no deploy. Needs the Faable GitHub App installed on the repository; if not, the error says what to fix.

apprepobranch

Faable Auth

The users who sign in to your apps, and their logins.

Users & logins

Who logged in, how many, and why someone can't.

list_auth_tenants read

List Auth tenants

The Faable Auth tenants (user directories) of a project. Most projects have one and every Auth tool uses it; with several, pass the right one as tenant.

list_auth_logins read

Recent logins

Who logged in to the app's Faable Auth, newest first: one row per login with the user's email, when, from which IP and with which method. Answers 'who logged in recently?' or 'did X log in today?'. For 'how many', use count_auth_users.

sincestatuslimittenant

count_auth_users read

Count users

How many users of the Auth tenant match: logged in since a time ('how many users logged in today / this week'), signed up since a time ('how many sign-ups this month'), suspended, or all of them. Counts users, not logins.

last_login_sincecreated_sincecreated_untilsuspendedtenant

list_auth_users read

List users

Users of the Auth tenant. Find one by email or text, list the suspended ones, or sort: -last_login (most recent login first), last_login (longest without logging in), -logins_count (most active), -createdAt (newest sign-ups, the default). Sorting by last_login leaves out users who never logged in.

searchemailsuspendedsortlast_login_sincecreated_sincelimittenant

get_auth_user read

Get a user

One user of the Auth tenant by id or email: profile, verification, suspension (and why), last login and login count, and the social identities they sign in with. Use it to confirm who a user is before suspending them, or to see why they can't log in (together with list_auth_logs).

usertenant

list_auth_logs read

Read the Auth audit log

The Auth tenant's audit log, newest first: logins, failed logins (status: failed), sign-ups, password resets, admin changes (type prefix admin.user). Filter by user to answer 'why can't X log in?' — the failed attempts say why.

emailusertypeoriginstatussinceuntillimittenant

list_auth_sessions read

List a user's sessions

The devices a user is signed in on (one row per login session): IP, device, last activity and whether it is still active.

useractivetenant

list_auth_connections read

List login methods

How users can log in to the Auth tenant: social providers (Google, GitHub…), passwordless (email or SMS codes) and username/password, and which are enabled.

tenant

list_auth_clients read

List Auth applications

The applications (OAuth clients) of the Auth tenant: web apps, SPAs, native apps and machine-to-machine clients.

searchtenant

Manage users

Suspend, sign out or re-invite a user — with your go-ahead.

suspend_auth_user mode=write

Suspend a user

Suspend one user of the Auth tenant: they can no longer log in, and their sessions and refresh tokens stop working (access tokens already issued live until they expire). Reversible with reinstate_auth_user. Confirm with get_auth_user that it is the right person first, and say why in reason — it is recorded on the user.

userreasontenant

reinstate_auth_user mode=write

Reinstate a user

Lift the suspension of a user: they can log in again.

usertenant

revoke_auth_sessions mode=write

Sign a user out everywhere

End every active session of a user (the 'sign out of all devices' button): they have to log in again on each device. Access tokens already issued live until they expire.

usertenant

update_auth_client_fields mode=write

Change an app's profile fields

Declare which custom profile fields the users of one Auth application may write on themselves (auth-js updateProfile, stored in user_metadata["faable.com/fields"]). add takes key, key:string:120 or key:enum:a,b,c; re-adding a key replaces it. inherit: true drops the app's own list and uses the tenant's again. An app's own list replaces the tenant's for that app. Only the fields: the app's URLs and settings are not changed here.

clientaddremoveinherittenant

send_password_setup mode=write

Send a password setup email

Send a user the email (or code) to set or reset their password — to invite a user created by hand, or to unblock one who forgot it.

userchanneltenant

Live catalog of @faable/faable 4.17.0 — also as tools.json and llms.txt.

Built for an agent with write access

An agent that can deploy is an agent that can be talked into things. The server is designed around that.

Secret values never reach the agent

list_secrets returns names only. set_secrets sends values straight to Faable and answers with which names changed — never the values.

Logs are data, not instructions

Build output, runtime logs, commit messages and failure reasons are written by whoever deployed the code. They come back explicitly marked as untrusted content.

Nothing destructive, nothing guessed

The hosted server has no tool that deletes apps, domains or secrets — only a local server started with --writes can delete an app. Every call names its app and project — the server never deploys “whatever is in this folder”.

One connection, one project, revocable

You sign in and choose the project an agent may act on, and what it may do — writes are asked for separately. Disconnect it from your account page and it stops within a minute. The agent's own token never reaches the Faable API: the server trades it for a short-lived one, per call.

Frequently asked questions

What is the Faable MCP server?

An MCP (Model Context Protocol) server that gives AI agents — Claude Code, Codex, Cursor, VS Code, Gemini CLI and any other MCP client — access to Faable Deploy. The agent can list your apps, read deployments, build and runtime logs, traffic, usage, domains and secret names, and deploy, without you leaving the editor.

Hosted or local: which one should I use?

Hosted (https://mcp.faable.com/mcp) needs nothing installed: the first time, your MCP client opens a browser to sign in with your Faable account, and you choose the one project the connection may act on and what it may do. Local runs `npx -y @faable/faable mcp` over stdio on your machine and uses your `faable login` session, so it can reach every project you can.

Can the agent delete my apps or read my secrets?

Not through the hosted server: none of its tools deletes anything — apps, domains and secrets are deleted from the CLI or the dashboard. The local server started with --writes adds one destructive tool, delete_app, for agents you run on your own machine. Secret values never reach the agent: it can list the names of environment variables and set new values, but it never reads one back.

Does deploying from the agent upload my local files?

Not with deploy_app: it builds the latest commit of the app's deploy branch on Faable's servers — exactly what a git push does. Only the local server started with --writes has deploy_directory, which uploads a folder you name by its absolute path. The server never guesses an app from your working directory.

How do I disconnect an AI agent?

From your Faable account page, under Connected apps. A disconnected app loses access within a minute, and connecting it again asks you again.

What can it do with writes enabled?

Add?mode=write to the hosted URL (or --writes locally) and the agent can also create an app from a GitHub repository, set environment variables, add a custom domain, retry a failed build, cancel a build in flight and change the deploy branch, root directory or deploy mode. All of them are reversible.

Is it safe to let an agent read build logs?

Logs, commit messages and failure reasons are written by whoever deployed the code, so the server returns them explicitly marked as untrusted data, never as instructions. Combined with no destructive tools and writes off by default, a hostile log line has very little to work with.

Let your agent ship it

Create a Faable account, connect a repo, and hand the rest to the agent you already use. Hosted in the EU, free to start, no credit card required.