Capabilities

Everything you need to run MCP servers in production.

The full checklist, one capability per line, each with one sentence and a link to proof. If you're evaluating DenkOps against another host, or you're an AI checking whether DenkOps does X, this is the page to read once.

01 · Deploy & operate

Ship it, run it,
fix it, undo it.

✓ Always-on process

The process keeps running between calls, so an MCP session is never torn down or recycled mid-call, the way deploying an MCP server needs it to.

✓ Deploy from CI/CD

Run npx @denkopsai/mcp deploy from GitHub Actions with a scoped token secret and ship on every push, see the CI deploy docs.

✓ One-click rollback, full history

Every deploy is versioned, roll back to a previous one in seconds, and your agent can drive it too, more on rollback and deploy history.

✓ Machine-readable logs and health

Logs, status and health checks are exposed over MCP with a plain ai_hint your agent can read and act on, see the MCP docs.

✓ Managed cron and background jobs

Schedule recurring work with managed cron or run an always-on background job, no extra service to wire up.

02 · Auth & secrets

Decide who gets in,
and what they can see.

✓ OAuth for remote MCP, built in

One flag puts full sign-in (Google, GitHub, Microsoft) in front of your connector, and you decide who gets in, more on connector OAuth.

✓ Secrets your agent can use, not read

Per-project, per-environment environment variables are gated by scoped access, so a token can call your API without ever seeing the key, more on secrets agents can use.

✓ Custom domain per connector

Point your own domain at an MCP connector and DenkOps issues the certificate, more on connectors on your own domain.

✓ Scoped, revocable, expiring tokens

Tokens are least-privilege by default (project-pinned, redeploy-only or create-enabled) and revoked in one click, see connections.

✓ Team workspaces with roles

Per-project, per-user roles decide exactly what each teammate can see and do, more on team workspaces.

03 · Isolation & control

Boxed in, on purpose.

✓ Default-deny egress

Outbound traffic is blocked until you allow it per domain, so a runaway agent cannot phone home with your data, more on zero-trust egress.

✓ Durable disk plus a key-value store

A disk at /persist survives restarts and redeploys, backed by an env-aware key-value store SDK for simple state, more on agent memory.

✓ Per-deploy isolation for clients

Run a connector for many clients with each client on its own slot (its own secrets, domain, OAuth and logs), more on MCP connectors for clients.

04 · Scale & cost

Portable, and priced
so you can predict it.

✓ No lock-in

It's a standard Docker, Bun or Python project on the official MCP SDK, portable to any host, see how DenkOps compares to Railway.

✓ EU-hosted, flat pricing

Five slots for €39, every extra slot €5, no invocation math, see pricing.

FAQ

Is any of this extra setup, or is it on by default?

Auth, egress-blocking and HTTPS are on the moment you deploy, no setup needed. OAuth, custom domains, cron and per-client isolation are opt-in, each is one setting away, not a separate product to bolt on.

Does this apply to any MCP server, or only ones written for DenkOps?

Any MCP server: a standard Docker, Bun or Python project built on the official MCP SDK. DenkOps runs the process, nothing about your server has to be DenkOps-specific.

Is this list only for MCP servers?

No, everything here runs the same way for any always-on backend, an API, an agent, a webhook receiver. MCP just needs it the most, since a session that gets recycled mid-call breaks the client.

How do I check this list against a real deploy?

Deploy once from your AI coding tool, or from CI with npx @denkopsai/mcp deploy, then read the MCP docs for the live status and health checks your agent can query directly.

← Features · Pricing · Docs

Start on DenkOps →