Netlify

Create projects, trigger deploys and manage env vars on Netlify.

Add to Agentman Studio

Opens Agent Studio, where connecting is one click. The connector URL below works in any MCP client.

Paste it into any MCP client. Setup docs

Resources

What the Netlify connector does

The Netlify MCP server connects Netlify hosting to Claude, ChatGPT and any MCP-compatible agent. It exposes eight grouped dispatcher tools carrying 19 operations that create projects, trigger deploys, set environment variables and change who can view a site. Sign-in is OAuth against Netlify's own authorization server, verified live by an authentication challenge.

Verified connector

Listed by Anthropic as a partner connector in its Connectors Directory.

Connection checked by Agentman on .

Anthropic states this reflects the level of review a connector received, not a security audit.

Netlify tools (11)

  • netlify-coding-rules
  • netlify-user-services
  • netlify-deploy-services
  • netlify-team-services
  • netlify-project-services
  • netlify-extension-services

Tool names from Anthropic's directory listing. This server requires sign-in, so we could not read tool descriptions or parameter schemas.

Limits

  • Anthropic's directory tool list does not match the server. The directory names six tools — netlify-coding-rules, netlify-user-services, netlify-deploy-services, netlify-team-services, netlify-project-services and netlify-extension-services. The server registers none of those strings. Five are the dispatcher names without the -reader or -updater suffix the source appends, so the directory collapses every domain's read and write tools into one name and hides that a write tool exists at all. netlify-coding-rules is the
  • No tool carries a destructive annotation. readOnlyHint is the only annotation this server sets. A client cannot distinguish renaming a project from deleting a secret.
  • The OAuth scopes are not a boundary. read and write are advertised by the authorization server and sanitised at client registration, but we found no scope check in the tool-dispatch path at the commit we read. Granting read does not appear to prevent a write.
  • The claudeai scope is a workaround, not a permission. Netlify's source annotates it as temporary, pending a fix to an upstream Model Context Protocol issue it links by number.
  • initialize-database does not initialise a database. It returns instructions telling the agent to install an npm package and restart the dev server. It takes no parameters and calls no API, yet is registered as a write tool.
  • Netlify publishes no tool list of its own. Its MCP documentation page and its README describe capabilities in prose — creating projects, modifying access controls, managing environment variables — but enumerate no tool names. The names here come from source, not from a vendor enumeration, so they can change at any commit.
  • The directory's documentation URL is a redirect. docs.netlify.com/build/build-with-ai/netlify-mcp-server/ returned 301 on 2026-08-22 to the agent setup overview. The MCP content is a section of that larger page, not a dedicated one.
  • Anthropic's directory snapshot predates our source read. The snapshot is dated 2026-08-16 and the commit we read was pushed 2026-08-13, so the drift is not explained by the directory being older than the code.

Frequently asked questions

Can the Netlify connector deploy to my production site?

Yes, but not directly from the remote server. The remote deploy operation returns a shell command rather than deploying, because the upload has to happen where your files are. It mints a proxy token valid for thirty minutes, scoped in the source to one builds endpoint plus deploy reads. Running that command uploads your repo and starts a real Netlify build.

Does the Netlify MCP server have separate read-only and write permissions?

Its authorization server advertises read and write scopes, but no code path checks them. Netlify's repository contains no scope enforcement in the tool-dispatch path at the commit we read, and tools call the Netlify API with your full access token. The real read-write split is the tool names: reader tools carry readOnlyHint true, updater tools carry false.

How many tools does the Netlify MCP server actually expose?

Between nine and twenty, depending on your client and your URL. A non-Claude client sees nine tools, Claude.ai sees eleven because two design-import tools are gated on the user agent, and adding a verbose query parameter registers every operation separately for about twenty. Anthropic's directory lists six names, none of which the current server registers.

Can the connector delete my Netlify environment variables?

Yes, and nothing on the tool list says so. Deletion lives inside the environment-variable operation as a boolean flag, which issues a DELETE against Netlify's account environment endpoint. That operation is reached through the project updater dispatcher, whose only annotation is that it is not read-only. No tool carries a destructive hint anywhere on this server.

Can an AI agent turn off password protection on my Netlify site?

Yes, and it can happen without anyone asking for it. The visitor access-control operation builds a payload that resets the password to an empty string and disables SSO login by default, then applies whatever you enabled. Calling it to change one setting therefore clears the other. Netlify documents the operation as protection rather than as removal.

Can the Netlify connector read my secret environment variables?

It can read environment variables, and secret values are the open question. The environment-variable operation fetches every variable for a site and returns them to the agent, and the same operation writes variables with a secret flag. Netlify's API treats secret values as write-only in some responses, but the connector code does not filter anything itself.

What permissions should I give the Netlify connector in Claude?

Netlify recommends splitting them by tool type. Its documentation for Claude Web suggests always allowing read-only tools, requiring approval for write and delete tools, and always allowing other tools. That maps cleanly onto the reader and updater tool names, which is the practical reason the server groups operations that way rather than exposing them individually.

Why does Claude show different Netlify tools than my other AI agent?

Because two tools are gated on the client. Netlify's server inspects the user agent and client name, and registers a Claude Design import pair only when either matches Claude or Anthropic. Claude Code is deliberately excluded as a coding CLI. So claude.ai and Claude Desktop see eleven tools while Cursor, Windsurf and Claude Code see nine.

Does the Netlify connector delete form submissions from my site?

It can, through an action value rather than its own tool. The form-submission operation takes an action enum whose second value deletes a submission by id, issuing a DELETE against Netlify's submissions endpoint. The same operation otherwise reads submissions in pages. Form submissions are data your site visitors wrote, so deletion here removes visitor-supplied records permanently.

Sources

More Developer Tools connectors

  • Base44

    Build and edit Base44 apps from an AI assistant, and query data your app's users submit.

  • CircleCI

    Diagnose failed builds, read job logs, inspect test results and rerun or roll back deployments from your AI assistant.

  • Claude Managed Agents

    Create, run, monitor and debug Anthropic's Claude Managed Agents from inside Claude itself.

Browse all MCP connectorsClaude and ChatGPT setup guideBrowse AI skills

Product names and logos belong to their owners. Agentman is not affiliated with a connector's maker unless the page says the connector is built and run by Agentman.

Use it in an agent

Put Netlify to work.

Connect Netlify once and your agents call these tools on their own: on a schedule, in a workflow, with nobody at the keyboard.

Open in Agentman Studio