Railway

Deploy, redeploy and debug apps on Railway's usage-billed cloud.

Add to Agentman Studio

Opens Agent Studio, where connecting is one click. The connector URL below works in any MCP client.

Paste it into any MCP client. Setup docs

Resources

What the Railway connector does

The Railway MCP server connects Claude, ChatGPT and other MCP clients to Railway, the usage-billed platform-as-a-service, over OAuth at a hosted endpoint. Its 16 tools create projects, deploy and redeploy services, read production logs, and set or delete feature flags — a control plane that provisions billable compute and changes what is running live.

Verified connector

Listed by Anthropic as a partner connector in its Connectors Directory.

Connection checked by Agentman on .

Anthropic states this reflects the level of review a connector received, not a security audit.

Railway tools (16)

  • accept-deploy
  • create-deployment
  • create-project
  • delete-feature-flag
  • deploy-artifact
  • get-feature-flag
  • get-logs
  • get-status
  • list-deployments
  • list-feature-flags
  • list-projects
  • list-services
  • railway-agent
  • redeploy
  • set-feature-flag
  • whoami

Tool names from Anthropic's directory listing. This server requires sign-in, so we could not read tool descriptions or parameter schemas.

Limits

  • No permissions label in the directory record. Anthropic's entry has no permissions field, over a tool set that deploys to production. Railway's own docs are far more detailed; the directory is not.
  • Five of 16 tools are undocumented. create-deployment, deploy-artifact, get-logs, get-status and list-deployments appear nowhere in Railway's documentation corpus. Two of them write.
  • We did not authenticate. No tools/list was performed, so we have no tool annotations — no readOnlyHint or destructiveHint values for any of the 16. Every safety claim here is Railway's documented prose, not a protocol annotation we observed. Railway says destructive tools are marked at the protocol level; we did not verify which ones carry the marking.
  • The scope grant does not separate read from deploy. One Railway scope covers everything the server does.
  • No documented log scrubbing. Railway's docs describe no redaction of application log content that get-logs returns.
  • accept-deploy has no documented human-in-the-loop. Staged changes are a review buffer for the same actor. The only gate is the MCP client's confirmation prompt.
  • The compute spend guard is a monthly cycle cap, not a per-action one. It stops a runaway month; it does not stop a single deployment.
  • Feature flags are beta. Railway states they are available through Priority Boarding and that breaking changes may occur, and that the TypeScript SDK's API may change in breaking ways between releases.
  • Cache propagation on flag deletion is unverified. The SDK caches flags in memory and refreshes in the background; Railway does not document how quickly a deletion reaches running instances.
  • railway-agent is a second model. It hands the request to Railway's own agent, which acts with your access and bills separately on token consumption.

Frequently asked questions

Can the Railway MCP server deploy code to my production app?

Yes. Railway documents accept-deploy as committing staged changes and deploying, and redeploy as redeploying a service, and the directory description says the connector can deploy services from connected GitHub repositories. Railway's docs list both among destructive tools you should review before approving. Anthropic's directory record for this connector carries no permissions field at all over that surface.

Does accept-deploy let an agent approve its own deployment?

Effectively yes, because Railway's staged changes are a review buffer rather than a second-person approval. The docs describe staging as changes collected for you to review, then applied by clicking Deploy, with no separate approver named. An agent holding accept-deploy stages and applies as one actor. The documented brake is the client confirmation prompt, not Railway.

How much does it cost when an AI agent deploys to Railway?

Railway bills resource usage on top of a plan fee: 10 dollars per GB of RAM per month and 20 dollars per vCPU per month, with plans at 0, 5 and 20 dollars monthly. A deployment an agent creates therefore accrues charges until it is removed. Railway documents workspace usage limits with a hard cap that shuts workloads down, minimum 10 dollars.

What does the Railway MCP server see in my application logs?

Whatever your application writes. Railway captures anything a build or deployment emits to standard output or standard error, plus HTTP logs carrying request paths, user agents and source IP addresses. Railway's logging documentation describes no redaction or scrubbing of application log content. The get-logs tool pipes that material straight into a model's context window.

Which Railway plan do I need to use the MCP connector?

Any plan with a Railway account, including the free tier. Railway documents Free at 0 dollars a month with 1 dollar of monthly credit, and a 30-day trial granting 5 dollars. Remote MCP requires only a Railway account and rejects project tokens, requiring a user identity for billing and audit. Feature flag writes additionally require a project admin role.

Sources

  • Anthropic connector directory entry for Railway — tier, 16 tool names, endpoint, transport, absence of a permissions field
  • Railway MCP Server — Remote MCP tool list, destructive markings, security considerations, project-token rejection
  • Claude connector — OAuth connection flow, no CLI required
  • Feature Flags — flag types, targeting, SDK fallback semantics, per-tool role table, Priority Boarding status
  • Staged Changes — changeset review flow and the Deploy button
  • Logs — what is captured, HTTP and DNS log attributes, filter syntax
  • Pricing Plans — plan fees, resource rates, included usage, VM rates
  • Cost Control — usage limits, hard limits, compute versus agent caps, replica limits
  • Free Trial — trial grant and duration
  • Project Members — Owner, Editor and Viewer permissions
  • Guardrails — approved deployment sources, API-level enforcement
  • Environment RBAC — restricted environments
  • Functions — single-file Bun services, 96 KB limit, instant deploys
  • Railway Agent — token-based billing at Anthropic's published rates
  • Railway documentation full-text export — corpus searched for all 16 tool names and for redaction and scrubbing terms
  • https://mcp.railway.com/ — anonymous initialize returning 401 with a www-authenticate header
  • https://mcp.railway.com/.well-known/oauth-protected-resource — RFC 9728 descriptor, 200
  • https://mcp.railway.com/.well-known/oauth-authorization-server — RFC 8414 metadata, 200

More Developer Tools connectors

  • Base44

    Build and edit Base44 apps from an AI assistant, and query data your app's users submit.

  • CircleCI

    Diagnose failed builds, read job logs, inspect test results and rerun or roll back deployments from your AI assistant.

  • Claude Managed Agents

    Create, run, monitor and debug Anthropic's Claude Managed Agents from inside Claude itself.

Browse all MCP connectorsClaude and ChatGPT setup guideBrowse AI skills

Product names and logos belong to their owners. Agentman is not affiliated with a connector's maker unless the page says the connector is built and run by Agentman.

Use it in an agent

Put Railway to work.

Connect Railway once and your agents call these tools on their own: on a schedule, in a workflow, with nobody at the keyboard.

Open in Agentman Studio