Compared · Infra & deploy · Claude Code

Best MCP servers for Infra & deploy in Claude Code

13 entries in the AgentTask Atlas catalog fit infra & deploy and have Claude Code setup instructions in their official README or docs. Claude Code adds MCP servers with claude mcp add or through plugins from Anthropic's official marketplace. For infrastructure work the real choice is where you deploy and how much of that account the agent can touch: every entry below acts with your own login, CLI session or token, and several can create, redeploy or delete live resources. The steps cover the vendors' own Claude Code instructions plus the settings that keep changes behind a prompt.

Based on official docs, not hands-on tested. Claude Code steps checked 2026-11-03; catalog entries verified 2026-10-26 to 2026-10-28. Not ranked by a score: entries that document more clients come first.

Hosted (remote URL) option: Vercel MCP, Prisma MCP Server, Sanity MCP Server (hosted), Railway MCP Server, Render MCP Server (hosted), AWS MCP Servers, Upstash MCP Server, LaunchDarkly MCP Server (hosted), Neon MCP Server.
Runs locally (npx, uvx, Docker, binary or CLI): Auth0 MCP Server, Terraform MCP Server, Docker MCP Gateway, Microsoft MCP (Azure MCP Server).
Credentials optional or depend on what you enable: Terraform MCP Server, Docker MCP Gateway; every other entry needs an account login, OAuth grant, key or cloud identity.

Name	Hosted	Credentials	License	Verdict
Vercel MCP Vercel	Yes	Required	Not stated (hosted service, no public source repository)	Pick it to inspect deployments and logs or manage Vercel projects from the agent; it acts with your account's access, so keep human confirmation on for changes.
Prisma MCP Server Prisma	Yes	Required	Not stated (hosted service, no public source repository)	Pick it if you run Prisma Postgres or Prisma Compute and want the agent to query data, check backups or read deploy logs; review every destructive approval, it acts on live resources.
Sanity MCP Server (hosted) Sanity	Yes	Required	Not stated (hosted service)	Pick it when the agent works on a Sanity-backed site and should query content, evolve schemas and draft documents itself; edits land as drafts, but use a token with a limited role if it should not publish or touch datasets.
Railway MCP Server Railway	Yes	Required	MIT (Railway CLI, which ships the `railway mcp` proxy and local server); hosted server under Railway terms	Pick it to create, deploy and debug Railway services from your editor without pasting tokens; review redeploy and accept-deploy calls, and keep it off production projects where you can.
Render MCP Server (hosted) Render	Yes	Required	Apache-2.0 (render-oss/render-mcp-server); hosted service under Render terms	Pick it to spin up Render services, check deploys and read logs or metrics from the agent; it can rewrite env vars and trigger deploys, so review those calls.
Auth0 MCP Server Auth0 (Okta)	—	Required	MIT	Pick it to set up Auth0 apps, APIs and Actions or debug login logs from your editor; it is beta, so start with --read-only and point it at a dev tenant.
AWS MCP Servers AWS Labs	Yes	Required	Apache-2.0	Pick the specific AWS server you need; the docs server needs no credentials, others use your IAM profile.
Upstash MCP Server Upstash	Yes	Required	MIT (upstash/mcp-server; hosted service under Upstash terms)	Pick it to inspect and debug Upstash Redis, QStash and Workflow from your editor; use the hosted server with a read-only grant first and scope it with ?features=.
Terraform MCP Server HashiCorp	—	Optional	MPL-2.0	Pick it for Terraform Registry lookups; add TFE_TOKEN only if you need HCP Terraform workspaces.
Docker MCP Gateway Docker	—	Optional	MIT	Pick it to run several MCP servers in containers; permissions depend on the servers you enable.
LaunchDarkly MCP Server (hosted) LaunchDarkly	Yes	Required	Not stated (hosted service; the local server repo launchdarkly/mcp-server is MIT)	Pick it to create and roll out feature flags from your editor; connect as a member with the smallest role you need and never auto-approve flag changes in production.
Neon MCP Server Neon	Yes	Required	MIT	Pick it to manage Neon branches and run SQL; it acts with your account's rights.
Microsoft MCP (Azure MCP Server) Microsoft	—	Required	MIT	Pick it for Azure resources from the agent; it acts with your signed-in identity and RBAC.

How to add them to Claude Code

1. Pick a scope before you add anything
claude mcp add writes to local scope by default (only you, only this project, stored in ~/.claude.json). Add --scope project to write .mcp.json at the repository root so the team shares the same deploy servers; Claude Code asks for approval before using servers from a .mcp.json it has not seen. Use --scope user for servers you want in every project.
2. Vercel: add the hosted server and sign in with /mcp
This is the command from Vercel's own Claude Code instructions. Run it inside your project, start Claude Code and type /mcp to authorize; Vercel asks for explicit consent for each client connection, so no token goes into a file.
```
claude mcp add --transport http vercel https://mcp.vercel.com
claude
# then, inside Claude Code:
/mcp
```
3. Railway: reuse your railway login
Railway's docs give two options for Claude Code. The default goes through the Railway CLI, which attaches your railway login session to each request, so you need the CLI installed and logged in; editors that support OAuth can connect to https://mcp.railway.com directly without the CLI. Its accept-deploy tool commits staged changes and deploys, and Railway marks it as destructive.
```
railway mcp install --agent claude-code
# or:
claude mcp add railway railway mcp
```
4. Render and Azure: install the official plugins
Render and Microsoft both point Claude Code users to a plugin in Anthropic's official marketplace. Render's plugin adds the MCP server and Render's skills: choose a scope, run /reload-plugins, and the first time Claude uses the server it opens a browser sign-in to your Render account. Microsoft's Azure plugin packages the Azure MCP Server with Azure agents and skills, and acts with your Azure identity (az login or Entra ID).
```
/plugin install render@claude-plugins-official
/reload-plugins
/plugin install azure@claude-plugins-official
```
5. Terraform: start local, add a token only for HCP Terraform
HashiCorp's README gives this local command (Docker, user scope). It works with the public Terraform Registry without any token; add TFE_ADDRESS and TFE_TOKEN to the docker run only if you need HCP Terraform or Terraform Enterprise tools. Tools that need explicit approval stay off unless you set ENABLE_TF_OPERATIONS=true.
```
claude mcp add terraform -s user -t stdio -- docker run -i --rm hashicorp/terraform-mcp-server
```
6. AWS: start with the AWS API server in read-only mode
awslabs/mcp is a collection of servers, one per AWS service; its README calls the AWS API MCP Server the place to start for general AWS work. It needs uv and configured AWS credentials, and its README recommends naming the profile with AWS_API_MCP_PROFILE_NAME. READ_OPERATIONS_ONLY=true limits it to operations AWS does not classify as Write; the README says IAM permissions remain the main control, so use a role with only the rights you want the agent to have. Command based on the README's Claude Code line and configuration table:
```
claude mcp add --env AWS_REGION=us-east-1 --env AWS_API_MCP_PROFILE_NAME=your-profile --env READ_OPERATIONS_ONLY=true aws-api -- uvx awslabs.aws-api-mcp-server@latest
```
7. Keep tokens out of a shared .mcp.json
Claude Code expands ${VAR} (and ${VAR:-default}) in command, args, env, url and headers in .mcp.json, so the team can commit the file and each person keeps the token in their own environment. Example for HashiCorp's remote Terraform server, whose README sends the token as a Bearer header:
```
{
  "mcpServers": {
    "terraform": {
      "type": "http",
      "url": "https://mcp.terraform.io/mcp",
      "headers": {
        "Authorization": "Bearer ${TFE_TOKEN}"
      }
    }
  }
}
```
8. Make deploy tools always ask first
Permission rules in .claude/settings.json (project) or ~/.claude/settings.json (user) control MCP tools. Ask rules accept a glob after mcp__<server>__, so you can make every tool from your deploy servers prompt before it runs, even if someone later allowlists them more broadly. The server names are the ones you used in claude mcp add.
```
{
  "permissions": {
    "ask": [
      "mcp__vercel__*",
      "mcp__railway__*",
      "mcp__terraform__*",
      "mcp__aws-api__*"
    ]
  }
}
```
9. Check that everything connected
claude mcp list shows each server with a status such as Connected, Needs authentication or Failed to connect; /mcp inside Claude Code shows the tools per server and is where you finish OAuth sign-ins. Docker- and uvx-based servers can be slow on first start while they download; MCP_TIMEOUT raises the startup timeout (for example MCP_TIMEOUT=10000 claude for 10 seconds).
```
claude mcp list
claude mcp get terraform
```

Render's docs say a Render API key grants access to all your workspaces and services; prefer the plugin's OAuth sign-in and keep the API-key option for non-interactive environments.
Upstash's hosted server lets you choose personal or team scope and read-only access on the consent screen, which is the simplest way to keep a Redis or QStash account read-only.
Neon, Prisma, Upstash and Sanity are listed here because they also manage infrastructure (projects, databases, datasets); for query-level read-only settings see the database pages.
Docker MCP Gateway runs other MCP servers in containers and manages their secrets through Docker, so the credentials needed depend on which servers you enable in it.
Plugins can run hooks and MCP servers, so Claude Code's docs say to read a plugin's details pane before installing it.

Full walkthrough for any server: How to add an MCP server to Claude Code.

Install notes and account access

Servers that log in to a vendor account act on real data and resources. The permissions line is what the vendor says the server can do with your account.

Vercel MCP · Vercel: Connect to https://mcp.vercel.com. Claude Code: `claude mcp add --transport http vercel https://mcp.vercel.com`, then `/mcp` to authenticate; or `npx add-mcp https://mcp.vercel.com` to configure detected clients (see docs). official docs ↗
Can do: Searches Vercel docs, manages projects and deployments, reads deployment logs and queries Web Analytics; Vercel says connecting grants the AI the same access as your Vercel user account (limited by the OAuth grant and team permissions).
Credentials: Vercel account OAuth (explicit consent for each client connection). · Maintenance: Hosted remote server; official docs last updated 2026-09-15; no public source repository or GitHub release · Verified 2026-10-26
Prisma MCP Server · Prisma: Connect to https://mcp.prisma.io/mcp (Streamable HTTP). Claude Code: `claude mcp add --transport http prisma https://mcp.prisma.io/mcp`; Gemini CLI: `gemini mcp add --transport http Prisma https://mcp.prisma.io/mcp --scope user` (see docs for other clients). official docs ↗
Can do: Manages Prisma Postgres databases (create, run SQL, restore backups), Prisma Compute deployments (logs, environment variables), Object Storage buckets and access keys, and searches Prisma docs in the workspace you approve; Prisma warns that tools that change or delete resources can cause data loss.
Credentials: Prisma Console account sign-in (OAuth), then pick a workspace and approve access. · Maintenance: Hosted remote server; official docs last updated 2026-09-22; the old prisma/mcp repo is archived; no GitHub release · Verified 2026-10-26
Sanity MCP Server (hosted) · Sanity: Run `npx sanity@latest mcp configure` to set up detected editors, or add it manually: Claude Code `claude mcp add Sanity -t http https://mcp.sanity.io --scope user`, then authenticate with OAuth; in Cursor or VS Code add an http server with url https://mcp.sanity.io and sign in when prompted. official docs ↗
Can do: Acts on your Sanity organization within your role: runs GROQ queries, reads and deploys schemas, creates, patches, publishes and unpublishes documents and release versions, uploads assets, manages datasets, projects and CORS origins, deploys a managed Studio, runs a limited subset of Sanity CLI commands, and searches Sanity docs. generate_image and transform_image spend AI credits.
Credentials: Sanity account via OAuth (default) or a Sanity API token in an `Authorization: Bearer` header, limited to that token's role. · Maintenance: Hosted remote server https://mcp.sanity.io (GA since v2.6.0, 2025-12-11); changelog v2.44.0 on 2026-10-27. The old open-source sanity-io/sanity-mcp-server repo is archived and points to the hosted server. · Verified 2026-10-28
Railway MCP Server · Railway: With the Railway CLI: `railway setup agent` (or `railway setup agent --oauth`), or `railway mcp install` to write the config into your editors; `railway mcp` proxies the hosted server over stdio. OAuth clients can connect straight to https://mcp.railway.com without the CLI; offline/egress-restricted: `railway mcp local`. official docs ↗
Can do: Acts on your Railway account: lists and creates projects and services, deploys templates, pulls variables, redeploys services, sets and deletes feature flags and can hand multi-step work (logs, debugging, config) to Railway's own agent; the local mode also manages domains, volumes, buckets, TCP proxies and variables. Destructive tools are marked for client confirmation.
Credentials: Railway account: the CLI proxy reuses your `railway login` session (no token in the editor config), or OAuth directly against https://mcp.railway.com with per-workspace/project scoping. Project tokens are not accepted. · Maintenance: Hosted server at mcp.railway.com, connected through the Railway CLI (needs CLI 5.44.0+; latest v5.71.0 on 2026-10-19). Replaces the archived railwayapp/railway-mcp-server repo. · Verified 2026-10-26
Render MCP Server (hosted) · Render: Connect to https://mcp.render.com/mcp. Claude Code: `/plugin install render@claude-plugins-official`, or `claude mcp add --transport http render https://mcp.render.com/mcp --header "Authorization: Bearer <YOUR_API_KEY>"`; Codex: `codex mcp add render --url https://mcp.render.com/mcp --oauth-client-id codex`; Cursor: `/add-plugin render`. Then tell the agent which Render workspace to use. official docs ↗
Can do: Acts on the selected Render workspace: creates web services, static sites, cron jobs, Render Postgres and Key Value; lists services; updates all environment variables of a service; triggers deploys; reads logs and metrics; runs read-only SQL on Render Postgres. No deletes or scaling changes.
Credentials: Render account via OAuth (official plugins for Claude Code, Codex, Cursor; Claude Desktop connector), or a Render API key as an Authorization: Bearer header. The API key grants access to all your workspaces and services. · Maintenance: Hosted server at https://mcp.render.com/mcp, auto-updated by Render; open-source code render-oss/render-mcp-server (Apache-2.0), last commit 2026-10-23; last GitHub release v0.3.0 on 2026-01-14 (for local runs, which Render discourages) · Verified 2026-10-26
Auth0 MCP Server · Auth0 (Okta): Run `npx @auth0/auth0-mcp-server init --client <claude-code|cursor|vscode|windsurf|gemini>` (Claude Desktop: `init` alone); add `--read-only` to expose only read tools. Other clients: stdio `npx -y @auth0/auth0-mcp-server run`. official docs ↗
Can do: Manages your Auth0 tenant: lists, creates and updates applications, APIs (resource servers) and client grants, creates and deploys Actions, reads logs, manages forms; `--read-only` or `--tools` patterns limit the tools, and secrets are redacted in responses.
Credentials: Auth0 account via OAuth 2.0 device authorization (`init` opens the browser); credentials stored in the system keychain. Private Cloud tenants use client credentials of an M2M app. · Maintenance: Beta: pre-release v0.1.0-beta.19 on 2026-08-13 (npm @auth0/auth0-mcp-server 0.1.0-beta.19); README marks it not recommended for production · Verified 2026-10-26
AWS MCP Servers · AWS Labs: Pick a server from the README table, e.g. `uvx awslabs.aws-documentation-mcp-server@latest`, or the remote AWS MCP Server (preview) via `mcp-proxy-for-aws`. official docs ↗
Can do: Each server acts on AWS with your local credentials/profile; scope depends on the IAM role.
Credentials: AWS credentials (profile / IAM) for servers that call AWS; docs server needs none. · Maintenance: Release 2026.10.20261015170211 on 2026-10-16; last commit 2026-10-23 · Verified 2026-10-26
Upstash MCP Server · Upstash: Connect to https://mcp.upstash.com/mcp (Streamable HTTP, OAuth). Claude Code: `claude mcp add --scope user --transport http upstash https://mcp.upstash.com/mcp`, then `/mcp` → Authenticate. Cursor: `{"mcpServers":{"upstash":{"url":"https://mcp.upstash.com/mcp"}}}`. Scope tools with e.g. `?features=redis,qstash_workflow`. official docs ↗
Can do: Manages your Upstash account across Redis, QStash, Workflow, Vector, Search, Box and Blob: lists and creates databases and indexes, runs Redis commands, reads stats, logs and the DLQ, and can change plans, budgets, reset credentials or delete resources (74 tools on the hosted server). A read-only OAuth grant or read-only API key disables every write/destructive tool; `?features=` limits which product tools load. Plan and budget tools change billing.
Credentials: Upstash account via OAuth on the hosted server (choose personal/team scope and read-only at consent), or a Developer API key as `Authorization: Bearer email:API_KEY` for headless use; the legacy local server takes --email and --api-key. · Maintenance: Hosted remote server at https://mcp.upstash.com/mcp is the recommended option; official repo upstash/mcp-server, release v0.4.0 on 2026-10-23. The README says the local stdio package @upstash/mcp-server is no longer maintained. · Verified 2026-10-26
Terraform MCP Server · HashiCorp: Docker image hashicorp/terraform-mcp-server or released binary (see README). official docs ↗
Can do: Queries Terraform Registry; with a token, works with HCP Terraform/TFE workspaces.
Credentials: Optional TFE_TOKEN for HCP Terraform / Enterprise features. · Maintenance: Release v1.4.1 on 2026-10-23; last commit 2026-10-23 · Verified 2026-10-26
Docker MCP Gateway · Docker: Docker Desktop MCP Toolkit or `docker mcp gateway run` (see README). official docs ↗
Can do: Runs other MCP servers in containers on your machine; permissions depend on the servers you enable.
Credentials: Depends on each enabled server (secrets managed by Docker). · Maintenance: No GitHub release; last commit 2026-10-21 · Verified 2026-10-26
LaunchDarkly MCP Server (hosted) · LaunchDarkly: Connect to https://mcp.launchdarkly.com/mcp/launchdarkly (Streamable HTTP, OAuth), or use the install page https://mcp.launchdarkly.com/mcp/launchdarkly/install. Claude Code: `claude mcp add --transport http "launchdarkly" "https://mcp.launchdarkly.com/mcp/launchdarkly"`; Cursor: add the URL in .cursor/mcp.json and click Connect. official docs ↗
Can do: Creates, reads, updates and deletes feature flags and AgentControl configs and reads observability data (logs, traces, errors, sessions) with the role of the member who authorized it; returned data (contexts, member emails, server-side SDK keys) goes to your model provider.
Credentials: LaunchDarkly account via OAuth (access tokens last two hours, reauthorize every 90 days). EU and federal instances need the local server (npm @launchdarkly/mcp-server) with an API access token. · Maintenance: Hosted remote server; local server for EU/federal released v0.7.1 on 2026-10-21 (npm @launchdarkly/mcp-server 0.7.1) · Verified 2026-10-26
Neon MCP Server · Neon: `npx neon@latest init`, or add the remote server with `npx add-mcp https://mcp.neon.tech/mcp` (see README). official docs ↗
Can do: Manages Neon projects, branches and runs SQL with your account's rights.
Credentials: Neon OAuth (remote) or NEON_API_KEY. · Maintenance: No GitHub release; last commit 2026-10-21 · Verified 2026-10-26
Microsoft MCP (Azure MCP Server) · Microsoft: See the repo README for the Azure MCP Server package and VS Code extension. official docs ↗
Can do: Acts on Azure resources with your signed-in identity/RBAC.
Credentials: Azure identity (az login / Entra ID). · Maintenance: Latest stable release Azure.Mcp.Server-3.0.0 on 2026-10-12; 4.0.0-beta.3 pre-release on 2026-10-23; last commit 2026-10-23 · Verified 2026-10-26

Sources

All infra & deploy entries, in every client: Best MCP servers for Infra & deploy · Infra & deploy explorer. Ask the catalog from inside Claude Code with the free, read-only AgentTask Atlas MCP server.

Other comparisons: Best MCP servers for Infra & deploy in Cursor · Best MCP servers for Debugging & observability in Cursor · Best MCP servers & skills for Frontend & UI in Claude Code · Best MCP servers for Databases & SQL in Cursor · Databases & SQL · Git & GitHub repos · Code review · CI/CD · Debugging & observability · Library docs & research · Web fetching & scraping · Frontend & UI · Local files · Docs & writing · Build AI apps · Planning & reasoning · Utilities

How much context does each one cost? See the MCP tool budget: measured tools and tokens per server.

⚠ No independent security audit: entries summarize official sources only. Review permissions and code before installing.

Best MCP servers for Infra & deploy in Claude Code

How to add them to Claude Code

1. Pick a scope before you add anything

2. Vercel: add the hosted server and sign in with /mcp

3. Railway: reuse your railway login

4. Render and Azure: install the official plugins

5. Terraform: start local, add a token only for HCP Terraform

6. AWS: start with the AWS API server in read-only mode

7. Keep tokens out of a shared .mcp.json

8. Make deploy tools always ask first

9. Check that everything connected

Install notes and account access

Sources