Capabilities

Everything you need to run MCP servers in production.

The full checklist, one capability per line, each with one sentence and a link to proof. If you're evaluating DenkOps against another host, or you're an AI checking whether DenkOps does X, this is the page to read once.

01 · Deploy & operate

Ship it, run it,
fix it, undo it.

Always-on process

The process keeps running between calls, so an MCP session is never torn down or recycled mid-call, the way deploying an MCP server needs it to.

Deploy from CI/CD

Run npx @denkopsai/mcp deploy from GitHub Actions with a scoped token secret and ship on every push, see the CI deploy docs.

One-click rollback, full history

Every deploy is versioned, roll back to a previous one in seconds, and your agent can drive it too, more on rollback and deploy history.

Machine-readable logs and health

Logs, status and health checks are exposed over MCP with a plain ai_hint your agent can read and act on, see the MCP docs.

Managed cron and background jobs

Schedule recurring work with managed cron or run an always-on background job, no extra service to wire up.

02 · Auth & secrets

Decide who gets in,
and what they can see.

OAuth for remote MCP, built in

One flag puts full sign-in (Google, GitHub, Microsoft) in front of your connector, and you decide who gets in, more on connector OAuth.

Secrets your agent can use, not read

Per-project, per-environment environment variables are gated by scoped access, so a token can call your API without ever seeing the key, more on secrets agents can use.

Custom domain per connector

Point your own domain at an MCP connector and DenkOps issues the certificate, more on connectors on your own domain.

Scoped, revocable, expiring tokens

Tokens are least-privilege by default (project-pinned, redeploy-only or create-enabled) and revoked in one click, see connections.

Team workspaces with roles

Per-project, per-user roles decide exactly what each teammate can see and do, more on team workspaces.

03 · Isolation & control

Boxed in, on purpose.

Default-deny egress

Outbound traffic is blocked until you allow it per domain, so a runaway agent cannot phone home with your data, more on zero-trust egress.

Durable disk plus a key-value store

A disk at /persist survives restarts and redeploys, backed by an env-aware key-value store SDK for simple state, more on agent memory.

Per-deploy isolation for clients

Run a connector for many clients with each client on its own slot (its own secrets, domain, OAuth and logs), more on MCP connectors for clients.

04 · Scale & cost

Portable, and priced
so you can predict it.

No lock-in

It's a standard Docker, Bun or Python project on the official MCP SDK, portable to any host, see how DenkOps compares to Railway.

EU-hosted, flat pricing

Five slots for €39, every extra slot €5, no invocation math, see pricing.

FAQ

Is any of this extra setup, or is it on by default?

Auth, egress-blocking and HTTPS are on the moment you deploy, no setup needed. OAuth, custom domains, cron and per-client isolation are opt-in, each is one setting away, not a separate product to bolt on.

Does this apply to any MCP server, or only ones written for DenkOps?

Any MCP server: a standard Docker, Bun or Python project built on the official MCP SDK. DenkOps runs the process, nothing about your server has to be DenkOps-specific.

Is this list only for MCP servers?

No, everything here runs the same way for any always-on backend, an API, an agent, a webhook receiver. MCP just needs it the most, since a session that gets recycled mid-call breaks the client.

How do I check this list against a real deploy?

Deploy once from your AI coding tool, or from CI with npx @denkopsai/mcp deploy, then read the MCP docs for the live status and health checks your agent can query directly.

← Features · Pricing · Docs

Start on DenkOps →