Netlify

Netlify

This connector works with Netlify through the Netlify API (https://api.netlify.com/api/v1): teams, sites, deploys and builds, build hooks, functions, forms and their submissions, environment variable names and Netlify DNS. It can start builds, publish an earlier deploy, roll back, lock or unlock auto publishing and cancel deploys after you confirm. It acts as the user who owns the token.

Setup (about 2 minutes)

1. In Netlify open User settings > Applications > Personal access tokens (https://app.netlify.com/user/applications#personal-access-tokens) and click New access token.
2. Give it a description and an expiration, copy it and paste it into NETLIFY_TOKEN. It is sent as Authorization: Bearer <token> to api.netlify.com only.
3. Check the setup with netlify_get_current_user, then netlify_list_sites.

A personal access token has the user's full rights in every team they belong to; Netlify has no read-only tokens. Share the MCP server only with people allowed to deploy, and switch off the write tools for a read-only setup.

How to work

1. netlify_list_accounts lists your teams; netlify_list_sites gives each site's id (a site's domain such as my-site.netlify.app works as site_id too).
2. Deploys: netlify_list_deploys (filter by branch, state or production), netlify_get_deploy; builds: netlify_list_builds, netlify_get_build, netlify_list_build_hooks.
3. Site details: netlify_get_site, netlify_list_functions, netlify_list_env_vars.
4. Forms: netlify_list_forms, then netlify_list_form_submissions. Submissions hold what visitors typed, often personal data.
5. DNS: netlify_list_dns_zones, then netlify_list_dns_records (only for domains on Netlify DNS).

Writes always need the user's confirmation: netlify_trigger_build (also the way to retry a failed deploy; a production build publishes when it succeeds), netlify_restore_deploy and netlify_rollback_site (change what visitors see immediately), netlify_lock_deploy, netlify_unlock_deploy and netlify_cancel_deploy. Say what will change and call only after the user agrees.

Secrets: netlify_list_env_vars returns names, scopes and contexts, never values. netlify_get_env_var_value is installed switched off: it returns non-secret values in plain text (secret ones stay masked). Turn it on only if the AI really needs a value. Build hook URLs, site passwords and deploy hook URLs are never returned.

Switched off at install: netlify_delete_form_submission and netlify_get_env_var_value.

Pagination: lists with page and per_page carry _pagination when there is another page; call again with page = _pagination.nextCursor until it is absent.

Errors: 401 means the token is wrong, expired or revoked. 403 means the user lacks the role for this team or site. 404 means a wrong site, deploy or form id, or one the user cannot see. 422 names an invalid value. 429 means the rate limit is reached (about 500 requests a minute, and only a few deploys a minute); wait and retry.

Out of scope here: creating, deleting or configuring sites, uploading files, editing environment variables, DNS records or domains, and site analytics, which Netlify does not offer in its public API.