AI AGENTS / MCP SERVER, CLI AND TERRAFORM

Let AI agents
manage your infrastructure.

Hakopod ships an MCP server, so Claude Code, Cursor or any MCP client can read your logs, find which commit is live, plan a fix, deploy it and roll it back. Each key covers one project and environment, expires, and does only what you allow.

Connect your agent Install Hakopod

Ships in every open-source (Apache-2.0) self-hosted release. Releases are evaluation alphas, and the HTTP endpoint isn't offered on shared Hakopod Cloud.

01 / CONNECTSTDIO OR STREAMABLE HTTP

How do I connect an AI agent to Hakopod?

Add hakopod mcp to your MCP client's config. It speaks MCP over stdio, so Claude Code, Cursor and any other MCP client start it like a local server and get Hakopod's tools.

Self-hosted installs also serve Streamable HTTP MCP at /api/v1/mcp, authenticated with a static bearer key, for agents that can't run a local process.

1. Install the CLI with curl | sh or npm. Windows works through npm.
2. Run hakopod login and approve one project and environment.
3. Drop the .mcp.json entry into your project and ask your agent what's running.

Read the agent setup guide ↗

.mcp.json

{
  "mcpServers": {
    "hakopod": {
      "command": "hakopod",
      "args": ["mcp", "--project", "demo", "--environment", "development"]
    }
  }
}

terminal

# Linux or macOS. On Windows: npm i -g @hakopod/cli
curl -fsSL https://hakopod.com/scripts/cli.sh | sh

# Approve one project and environment in your browser
hakopod login --api-url https://control.example.com \
  --project demo --environment development

02 / TOOLS AND FLAGSREAD BY DEFAULT, WRITE BY CHOICE

What can an AI agent do in Hakopod?

Out of the box, an agent can read everything it needs to diagnose a problem and plan a change, and nothing else. Every action that changes something sits behind a flag you add to the hakopod mcp command.

On by default: read and plan

applications, application List apps, then read one app's service health, jobs and replicas.
services, service Service configuration, health and the image-to-commit build mapping.
service_runtime Pods, readiness, restarts, events, and CPU and memory use.
logs Live logs plus stored history that survives restarts and rollouts.
provenance Which Git commit and CI run built each running image digest.
deployment, deployment_events A rollout, its events and how it recovered.
domains Custom-domain routing, ownership checks and target hostnames.
plan Validate a config change and return the diff. Never deploys.
detect_framework Suggest a build recipe from package.json and lockfile names.
api_operations, api_call Browse and call the API contract. Read-only unless you add --allow-write.

Opt in: each flag adds one power

--allow-deploy Deploy a reviewed plan, cancel a rollout, roll back to an earlier release.
--allow-write Write through api_call across the generic API operations.
--allow-sql Read-only SQL on managed databases, capped at 20 s, 1,000 rows and 1 MiB.
--allow-sql-write SQL writes, on top of --allow-sql and a separately approved write grant.
--allow-exec Run a command in a pod, with a 20 s limit.
--allow-terminal Open an interactive container terminal, together with --allow-exec.
--allow-credentials Read resource credentials when the key holds that grant too.
--installation --allow-admin A separate installation-wide connection for admin operations and host terminals.

The key needs the matching permission as well. A flag on its own grants nothing.

03 / IN PRACTICEEXAMPLE PROMPTS

What can you ask an AI agent to do?

Ask in plain words and the agent picks the tools. These are example prompts, not recorded sessions; the answers depend on your apps and the access you grant.

logs · service_runtime · deployment_events

Debug a 502 from the logs

Why is checkout returning 502s?

Reads the API's logs and pod restarts, and lines the errors up against the last rollout's events before it suggests anything.

provenance · services

Find which commit is live

What commit is running in production right now?

Maps each running image digest to the Git commit and CI run that built it. Unknown commits come back as unknown, never as a guess.

plan · deploy · needs --allow-deploy

Plan a fix and ship it

Point DATABASE_URL at the new primary and deploy it.

Writes the change, gets back a diff you can read, and deploys that exact plan once you say go. Then it follows the rollout to the end.

rollback · needs --allow-deploy

Roll back a bad release

The 14:05 deploy broke sign-in. Roll it back.

Returns the app to any earlier successful release. Database migrations aren't reversed, so the agent should check those with you.

database_query · needs --allow-sql

Query a managed database

How many orders failed in the last hour?

Runs read-only SQL against your managed PostgreSQL, capped at 20 seconds, 1,000 rows and 1 MiB, and answers from the result.

Dashboard button

Hand a failure to your coding agent

Copy fix prompt

On a failing deploy or a security advisory, one click copies a brief you paste into Claude Code, Cursor or any coding agent.

04 / ACCESSSCOPED, EXPIRING KEYS

Is it safe to give an AI agent access?

It's as safe as the key you hand it, and Hakopod keys are narrow. Each one is scoped to a single project and environment, expires, lists its permissions and can be revoked at any time.

How Hakopod handles security ↗

One project, one environment

A project key is bound to a single project and environment. Installation admin is a separate, explicit connection.

Expiring and revocable

Keys carry an expiry and an explicit permission list, and you can revoke one at any time.

Two locks on every write

A write needs both the MCP flag and the matching permission on the key. A flag never widens a key.

Exec and SQL stay separate

The admin wildcard doesn't grant pod exec or SQL. Audit keeps a hash of each command that runs.

Humans keep the front door

No cluster credentials

The agent talks to Hakopod's API. It never receives Kubernetes credentials.

05 / API COVERAGEOPENAPI CONTRACT

How much of the Hakopod API can an agent use?

About 282 of Hakopod's 329 API operations. The ones left out include login, MFA and OAuth consent, which stay human-only.

329: operations in the Hakopod OpenAPI contract
171: generic operations through api_call
33: dedicated project operations
78: installation admin operations

Your installation publishes the contract at /api/v1/openapi.json. Agents list operations with api_operations, scripts use hakopod api operations and hakopod api call, and each listing shows the permission an operation needs before you call it. Admin operations need a separate --installation --allow-admin connection.

06 / BEYOND MCPCLI, TERRAFORM, GITHUB ACTIONS

Can I use Hakopod from a CLI, Terraform or GitHub Actions?

Yes. The same API sits behind a CLI, a Terraform provider and a GitHub Action, so scripts and pipelines can do what your agent does.

CLI / LINUX, MACOS, WINDOWS

The hakopod CLI

Install with curl | sh or npm i -g @hakopod/cli. It covers the whole loop, from init to managed-database create, resize, switchover, import, restore and query.

login
init
validate
plan
deploy --dir
status
rollback
cancel
resume
logs --follow
terminal
exec
services
networks
projects
nodes
keys
audit
certificates
database
previews
api
mcp

TERRAFORM REGISTRY / V0.1.1

Terraform provider hakopod/hakopod

Declare projects, virtual networks, applications and secrets with four resources: hakopod_project, hakopod_virtual_network, hakopod_application and hakopod_secret. terraform plan shows the change; apply deploys it as one revision.

Terraform guide ↗

GITHUB MARKETPLACE

GitHub Action hakopod/deploy@v1

Deploy from a workflow with hakopod/deploy@v1 and an expiring CI key stored in your repository secrets. Builds run in your own GitHub Actions or GitLab CI, never on the Hakopod API host.

CI deployment guide ↗

Give your AI agent
read-only access first.

Connect with the default tools, ask your agent what's running and why it broke, and add --allow-deploy once you trust the answers.

Connect your agent Read the releases

Let AI agents manage your infrastructure.