10 Things You Can Do With Railway MCP Server (2026 Update)

I have written about deploying MCP servers to Railway before. This is the other direction: Railway MCP lets an AI agent drive Railway itself.

Create a project. Deploy a Postgres template. Pull environment variables into a .env. Redeploy a crashing service and read the logs that explain why it crashed.

The thing worth knowing before you follow an older tutorial: Railway rebuilt this integration. The npx package and stdio-only setup are gone.

If you copy a config from a guide written earlier this year, you will get a server entry that does not resolve. Here is the current shape.

What Changed in the Railway MCP Server

The old design ran @railway/mcp-server on your machine and shelled out to the Railway CLI for every operation.

The new design flips that. The server runs on Railway's infrastructure. The railway mcp command is now just a stdio pipe that attaches your login credentials to each request.

That is a meaningful change for three reasons.

• Tools ship server-side. Railway can add a tool without you upgrading a package.
• OAuth became an option. Editors that support it connect straight to https://mcp.railway.com with no CLI at all.
• Your editor config holds no long-lived credential. The CLI path reads and refreshes your existing railway login session.

If you want the background on why remote MCP servers won this argument generally, see our guide to remote MCP servers.

10 Things You Can Do With Railway MCP

Tool names below are Railway's own. Hyphenated names are on the remote server, underscored names on the local one.

1. Confirm which account and workspace you are pointed at

whoami is the least exciting tool and the one I would call first.

Agents deploy to the wrong workspace. Not often, but once is enough when a personal project and a production account share a machine.

The local server adds list_workspaces if you belong to several.

2. Create a project and scaffold services

create-project, list-projects and list-services are the inventory and setup layer.

The local server goes further with create_service, update_service, get_service_config, scale_service and remove_service.

Railway's own documented prompt is the honest test of this: "Create a Next.js app in this directory and deploy it to Railway. Also assign it a domain." That is one sentence spanning four tools.

3. Deploy a database from a template

"Deploy a Postgres database" is a documented example prompt, and it maps to deploy_template against Railway's template library.

search_templates finds one first when you do not know the exact name.

This is the fastest path from empty project to a stack your app can actually talk to. No Dockerfile, no dashboard clicking.

4. Pull environment variables into a local .env

list_variables and set_variables handle configuration. add_reference_variable wires one service to another's value.

Reference variables are the Railway feature worth knowing: a service can point at a sibling's connection string instead of copying it.

Railway documents the prompt directly: "Pull environment variables for my project and save them to a .env file."

5. Generate domains and chase down TLS certificates

generate_domain gives a service a shareable Railway hostname immediately after deploy.

For custom domains there is a full set: list_domains, update_domain, delete_domain, domain_status and retry_domain_certificate.

retry_domain_certificate is the quiet hero here. Certificate provisioning stalls on a DNS record that propagated late, and this is the retry you would otherwise hunt for in the dashboard.

6. Redeploy a service, and commit staged changes

redeploy restarts a service on its current build. "Redeploy my api service in the production environment" is the documented phrasing.

accept-deploy commits staged changes and deploys them. Railway flags it as destructive at the protocol level, so clients prompt.

Do not auto-approve that one. Staged changes are exactly the thing a human should look at before they ship.

7. Hand a crashing deploy to railway-agent

This is the tool that has no equivalent on other platform MCP servers.

railway-agent takes a natural-language request and hands it to Railway's own agent for multi-step work: log analysis, debugging, service configuration.

Railway's example: "Use the railway agent to figure out why my backend service is crashing on deploy."

It is an agent calling an agent. Powerful, and worth treating as a delegation rather than a query — you get less visibility into each step.

For direct log access, the local server exposes get_logs.

8. Manage feature flags without leaving your editor

A newer addition, and easy to miss: list-feature-flags, get-feature-flag, set-feature-flag and delete-feature-flag.

Railway documents prompts like "Set the checkout-v2 feature flag to true on project <projectId>".

These are admin-scoped, and the delete is marked destructive at the protocol level.

9. Read metrics and HTTP health

The local server carries a small observability surface: service_metrics, http_requests, http_response_time and http_error_rate.

"Error rate on the api service since the last deploy" becomes a question you ask rather than a dashboard you open.

Add list_deployments and environment_status and you have enough for a first-pass incident triage.

10. Provision storage, TCP proxies and private networking

The infrastructure tail is broader than most people realise.

• Volumes: create_volume, update_volume, remove_volume
• Object storage: create_bucket, remove_bucket
• TCP proxies: create_tcp_proxy, get_tcp_proxy, list_tcp_proxies, remove_tcp_proxy
• Private networking: private_network_status, private_network_update
• Docs, inline: docs_search and docs_fetch

docs_search deserves a mention. It lets the agent look up Railway's actual documentation mid-task instead of recalling a config format from training data.

That single tool cuts a surprising amount of confidently-wrong YAML.

Remote vs Local: Two Different Tool Sets

This trips people up, so it is worth stating plainly: the two servers do not expose the same tools.

The local server also returns a preview before requiring confirm: true on destructive operations. That is a nice touch and one more reason to reach for it when doing real infrastructure work.

Railway MCP Setup for Every Editor

The one-command path

# bootstrap the CLI, agent skills, MCP and auth in one go
curl -fsSL agents.railway.com | sh

# already have the CLI?
railway setup agent            # connect through the CLI (default)
railway setup agent --oauth    # connect with OAuth, no CLI needed

The CLI connection needs Railway CLI 5.44.0 or later. Older versions fail in a way that looks like an auth problem.

Per-editor commands

railway mcp install --agent cursor
railway mcp install --agent claude-code
railway mcp install --agent codex
railway mcp install --agent copilot
railway mcp install --agent factory-droid
railway mcp install --agent opencode

railway mcp install --local     # write the local-server config instead

railway mcp install merges its entry into existing configs without removing your other MCP servers. Re-run it any time to update.

Writing the config by hand

Cursor, in .cursor/mcp.json:

{
  "mcpServers": {
    "railway": {
      "command": "railway",
      "args": ["mcp"]
    }
  }
}

VS Code, in .vscode/mcp.json, using type: "stdio" with the same command. Claude Code is a one-liner: claude mcp add railway railway mcp. Codex: codex mcp add railway -- railway mcp.

Config file syntax varies more than it should between clients. Our MCP config file guide has the exact shape for each one.

Railway MCP Security

Railway made some genuinely good choices here, and they are worth understanding rather than just trusting.

• No long-lived credential in your editor config. The CLI path reads and refreshes your railway login session.
• OAuth is scoped and revocable. You choose which workspaces and projects a client can reach, tokens are short-lived, and you can revoke them from account settings.
• Project tokens are rejected outright. The server requires a user identity so actions land in billing and audit trails.
• Destructive tools carry protocol-level hints. Clients that respect them prompt before running.

That last point has a gap worth naming. The hint is advisory. A client that ignores it will run the tool without asking.

Railway names the tools to watch: redeploy, accept-deploy, railway-agent, and on the local server remove_service, delete_domain, remove_tcp_proxy, remove_bucket and remove_volume.

Learn on a non-production environment. Railway says this in its own docs and they are right.

If you run other MCP servers alongside this one, the wider risks are covered in our MCP server security guide. You can also scan any remote MCP server for transport, auth and disclosure issues before you grant it a token.

Railway MCP vs Vercel MCP

Both are now hosted remote servers, so the old "local vs hosted" distinction between them has collapsed.

The difference is what they manage. Vercel MCP is oriented around deployments, logs and project config for a serverless platform.

Railway MCP reaches deeper into infrastructure — volumes, buckets, TCP proxies, private networking — because Railway runs persistent containers.

Side by side: 10 things you can do with Vercel MCP, and if you are still choosing a host, the deployment comparison.

Railway MCP FAQ

The Short Version

Railway MCP is now a hosted server at mcp.railway.com, reached through the CLI or OAuth, with a wider local server available when you need deeper infrastructure control.

It covers the full loop: create a project, deploy a template, wire variables, generate a domain, redeploy, and debug the result with railway-agent.

Run railway setup agent, point it at a non-production project, and see how far one sentence gets you.

Sources and Related Reading

• Railway — MCP Server reference
• Railway — CLI documentation
• Railway — Template library
• Model Context Protocol — official documentation
• 10 Things You Can Do With Vercel MCP Server
• 10 Things You Can Do With the GitHub MCP Server
• Unity MCP: 10 Things You Can Do
• What Is the Model Context Protocol?