{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-10", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "digitalocean-mcp", "name": "DigitalOcean MCP Server", "vendor": "DigitalOcean, LLC", "vendorUrl": "https://www.digitalocean.com", "kind": "mcp", "category": "infrastructure", "summary": "DigitalOcean's official MCP servers let an agent manage Droplets, App Platform apps, Kubernetes, managed databases, networking and other DigitalOcean resources. Each service has a hosted endpoint, and the same MIT server runs locally from npm.", "url": "https://www.anchorterminal.com/tools/digitalocean-mcp", "markdownUrl": "https://www.anchorterminal.com/tools/digitalocean-mcp.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/digitalocean-mcp.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/digitalocean-mcp.json", "repo": "https://github.com/digitalocean-labs/mcp-digitalocean", "license": "MIT for the server. The DigitalOcean platform it acts on is a proprietary service under DigitalOcean's Terms of Service Agreement", "transports": [ "streamable-http", "stdio" ], "remoteUrl": "https://apps.mcp.digitalocean.com/mcp", "packages": [ { "registry": "npm", "name": "@digitalocean/mcp" } ], "auth": "mixed", "authNotes": "OAuth or a DigitalOcean API token. With OAuth the client is given only the server URL, a person signs in to DigitalOcean in a browser, and the client receives a short-lived access token. The server's challenge names the scopes `read` and `write`, with cloud.digitalocean.com as the authorisation server. Otherwise a person creates a personal access token in the control panel and the client sends it as `Authorization: Bearer`. A token has an expiry and is Read Only, Full Access or limited to custom scopes chosen from about 170, bounded by the owner's team role. The documentation server needs no credential. The local server reads `DIGITALOCEAN_API_TOKEN`.", "pricing": "byo-plan", "pricingNotes": "The servers are free. Tools act on a DigitalOcean account and bill under its usage prices, which are public. Droplets start at $4 a month billed by the second, Kubernetes at $12, managed databases at $15, and App Platform, Functions and the container registry at $0. The documentation server works with no account. The pricing FAQ describes a card on the account and a free credit example of $5 for 90 days. Whether sign-up needs a payment method was not established (checked 2026-10-09).", "priceSummary": "Your plan", "where": "both", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the MCP docs, the repository or the pricing page. A Stablecoin Payment Addendum covers paying an account's bill in stablecoin through Stripe, which is not a machine payment protocol on the endpoints (checked 2026-10-09).", "endpoints": [] }, "toolCount": 377, "popularity": { "githubStars": 137, "npmWeekly": 6361, "pypiWeekly": null, "asOf": "2026-10-09" }, "docsUrl": "https://docs.digitalocean.com/reference/mcp/", "mcpTools": { "url": "https://apps.mcp.digitalocean.com/mcp", "checkedAt": "2026-10-09T21:40:21.095323465Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-10-09T21:40:21.095323465Z" }, "llmsTxt": "https://docs.digitalocean.com/llms.txt", "capabilities": [ "infra.cloud", "code.deploy", "db.admin", "compute.containers", "compute.serverless", "code.docs" ], "tags": [ "official", "hosted", "open-source", "mcp", "oauth", "pat", "llms-txt", "status-page", "soc2", "bug-bounty", "npm" ], "lastRelease": "2026-10-07", "graded": true, "anchor": { "graded": true, "score": 60.6, "grade": "C", "agentReady": false, "rank": 503, "ranked": true, "rankOf": 950, "categoryRank": 6, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 67, "maintenance": 70, "payments": 33, "reliability": 62, "schema": 66, "security": 67, "transparency": 87 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 62, "points": 12.4, "reason": "Scored as a hosted server. status.digitalocean.com is a Statuspage with components by product and region (20). Its feed holds 25 entries from 24 July to 5 October 2026, eight of them maintenance. The incidents include the public API and control panel from a first update at 17:14 UTC on 24 August until mitigation at 00:54 on 25 August, write operations failing across several services for about two and a half hours on 6 August, account registration and Droplet creation on 8 and 9 August, and an interruption in the MKC1 region on 19 August. No component for the MCP servers was identified (5 of 30). The API's limits are published, 5,000 requests an hour and 250 a minute per token (15). The API docs describe rate-limit headers and `retry-after` on 429, and say PUT and DELETE are idempotent. There is no idempotency key for creates (10 of 15). The terms refer to Service Level Agreements, which were not read (3 of 10). The docs carry no beta label and the server is at 1.2.0, in an organisation named digitalocean-labs (9 of 10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 66, "points": 10.73, "reason": "Tools declare typed inputs through mcp-go, and about 300 also declare an output schema checked by a test. Two issues from February 2026 about array parameters without `items` are still open, and `db-cluster-list` reads `per_page` as a Go integer in the source, which a JSON number may not satisfy (22 of 25). llms.txt and a Markdown twin of every docs page (10). The median description is 48 characters and 156 of 365 are 40 or fewer, such as \"Delete a droplet\". A few say how to choose between arguments (9 of 20). Required fields and defaults are set, enums are rare, and argument names mix `ID` and `Page` with `id` and `per_page` (8 of 15). Each service has a README with arguments and example queries, generated into the docs. No list of error responses was found (9 of 15). Releases are semver tags. There is no changelog file, and the 90-day release notes have no MCP entry (8 of 15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 67, "points": 10.89, "reason": "About 377 tools in all, but each hosted endpoint and the local `--services` flag load one service. Networking has 54, evaluations 47, Droplets 42 and databases 38, while 15 services have 15 or fewer (14 of 25). 62 tools take page or limit arguments, and few take filters (13 of 20). Handlers name the missing argument and pass the API's message through, and the server separates errors a model can correct from those it cannot. No documented error codes (11 of 20). Every tool carries the four MCP hints and a risk label, enforced by a test, and 308 are marked idempotent. Creates cannot be retried safely with a key (17 of 20). Few required parameters, with godo, pydo and doctl as official clients of the same API (12 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 67, "points": 11.73, "reason": "OAuth with short-lived tokens, or a personal access token with an expiry and custom scopes from about 170, revocable in the control panel. The OAuth challenge names only `read` and `write`, and the metadata allows the bearer header only (28 of 30). A Read Only token or custom scopes limit what any tool can do. The server has no read-only mode, requested in an issue open since 2 March 2026, and only the custom model delete tool asks for a confirmation argument (13 of 20). App logs, function results and documentation pages are untrusted content. The README links a third-party briefing on MCP risks and gives no mitigation guidance (3 of 15). The tokens page shows when a token was last used. No audit log of MCP calls was found (4 of 15). Valid security.txt, a bug bounty on Intigriti, SOC 2 Type II and SOC 3, and CSA STAR Level 1. The repository has no SECURITY.md file (19 of 20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 33, "points": 4.13, "reason": "No x402 or other machine payment. Stablecoin payment of an account's bill through Stripe is not one (0). The servers are free and product prices are public by the month, hour or unit (20). The documentation server needs no account, and App Platform, Functions and the container registry start at $0. The pricing FAQ describes a card on the account, and whether sign-up needs one was not established (10 of 20). A person signs up and approves OAuth or creates a token. Only the documentation server is keyless (3 of 20)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 70, "points": 6.13, "reason": "v1.2.0 was tagged on 7 October 2026 and the npm package is at the same version (30). Eight tags since 23 July 2026 (20). 193 commits in 90 days. Eight open issues and 23 open pull requests. The credential issue of 26 May 2026 has two comments, neither from a maintainer, and the read-only request of 2 March 2026 is open (12 of 25). The official MCP registry returned one third-party server for the search digitalocean and none from DigitalOcean (0). Dependabot runs weekly, and CI lints, checks formatting and runs tests with the race detector on Linux and macOS. The workflow's result was not seen (8 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 87, "points": 7.61, "note": "editorial 74, provenance 100", "reason": "The server is MIT and the platform is closed with clear terms (28 of 30). A privacy policy and a DPA are published. The DPA promises deletion of personal data within 30 days of account deactivation. Nothing found says what the hosted MCP servers log, and the source can ship tool-call logs to a WebSocket endpoint when configured (20 of 30). The `alert-policy-*` tools carry a deprecation notice with no date, the terms promise as much notice of changes as is reasonably practicable, and the April 2026 service rename had no notice we found (9 of 20). Sub-processors are listed with locations on a page dated 10 June 2026, with 30 days to object to a new one (17 of 20)." } ], "assessment": { "date": "2026-10-09", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "About 377 tools in all, but each hosted endpoint and the local `--services` flag load one service. Networking has 54, evaluations 47, Droplets 42 and databases 38, while 15 services have 15 or fewer (14 of 25). 62 tools take page or limit arguments, and few take filters (13 of 20). Handlers name the missing argument and pass the API's message through, and the server separates errors a model can correct from those it cannot. No documented error codes (11 of 20). Every tool carries the four MCP hints and a risk label, enforced by a test, and 308 are marked idempotent. Creates cannot be retried safely with a key (17 of 20). Few required parameters, with godo, pydo and doctl as official clients of the same API (12 of 15).", "maintenance": "v1.2.0 was tagged on 7 October 2026 and the npm package is at the same version (30). Eight tags since 23 July 2026 (20). 193 commits in 90 days. Eight open issues and 23 open pull requests. The credential issue of 26 May 2026 has two comments, neither from a maintainer, and the read-only request of 2 March 2026 is open (12 of 25). The official MCP registry returned one third-party server for the search digitalocean and none from DigitalOcean (0). Dependabot runs weekly, and CI lints, checks formatting and runs tests with the race detector on Linux and macOS. The workflow's result was not seen (8 of 10).", "payments": "No x402 or other machine payment. Stablecoin payment of an account's bill through Stripe is not one (0). The servers are free and product prices are public by the month, hour or unit (20). The documentation server needs no account, and App Platform, Functions and the container registry start at $0. The pricing FAQ describes a card on the account, and whether sign-up needs one was not established (10 of 20). A person signs up and approves OAuth or creates a token. Only the documentation server is keyless (3 of 20).", "reliability": "Scored as a hosted server. status.digitalocean.com is a Statuspage with components by product and region (20). Its feed holds 25 entries from 24 July to 5 October 2026, eight of them maintenance. The incidents include the public API and control panel from a first update at 17:14 UTC on 24 August until mitigation at 00:54 on 25 August, write operations failing across several services for about two and a half hours on 6 August, account registration and Droplet creation on 8 and 9 August, and an interruption in the MKC1 region on 19 August. No component for the MCP servers was identified (5 of 30). The API's limits are published, 5,000 requests an hour and 250 a minute per token (15). The API docs describe rate-limit headers and `retry-after` on 429, and say PUT and DELETE are idempotent. There is no idempotency key for creates (10 of 15). The terms refer to Service Level Agreements, which were not read (3 of 10). The docs carry no beta label and the server is at 1.2.0, in an organisation named digitalocean-labs (9 of 10).", "schema": "Tools declare typed inputs through mcp-go, and about 300 also declare an output schema checked by a test. Two issues from February 2026 about array parameters without `items` are still open, and `db-cluster-list` reads `per_page` as a Go integer in the source, which a JSON number may not satisfy (22 of 25). llms.txt and a Markdown twin of every docs page (10). The median description is 48 characters and 156 of 365 are 40 or fewer, such as \"Delete a droplet\". A few say how to choose between arguments (9 of 20). Required fields and defaults are set, enums are rare, and argument names mix `ID` and `Page` with `id` and `per_page` (8 of 15). Each service has a README with arguments and example queries, generated into the docs. No list of error responses was found (9 of 15). Releases are semver tags. There is no changelog file, and the 90-day release notes have no MCP entry (8 of 15).", "security": "OAuth with short-lived tokens, or a personal access token with an expiry and custom scopes from about 170, revocable in the control panel. The OAuth challenge names only `read` and `write`, and the metadata allows the bearer header only (28 of 30). A Read Only token or custom scopes limit what any tool can do. The server has no read-only mode, requested in an issue open since 2 March 2026, and only the custom model delete tool asks for a confirmation argument (13 of 20). App logs, function results and documentation pages are untrusted content. The README links a third-party briefing on MCP risks and gives no mitigation guidance (3 of 15). The tokens page shows when a token was last used. No audit log of MCP calls was found (4 of 15). Valid security.txt, a bug bounty on Intigriti, SOC 2 Type II and SOC 3, and CSA STAR Level 1. The repository has no SECURITY.md file (19 of 20).", "transparency": "The server is MIT and the platform is closed with clear terms (28 of 30). A privacy policy and a DPA are published. The DPA promises deletion of personal data within 30 days of account deactivation. Nothing found says what the hosted MCP servers log, and the source can ship tool-call logs to a WebSocket endpoint when configured (20 of 30). The `alert-policy-*` tools carry a deprecation notice with no date, the terms promise as much notice of changes as is reasonably practicable, and the April 2026 service rename had no notice we found (9 of 20). Sub-processors are listed with locations on a page dated 10 June 2026, with 30 days to object to a new one (17 of 20)." }, "sources": [ { "what": "server source, README, tags, CI workflows and licence (shallow clone)", "url": "https://github.com/digitalocean-labs/mcp-digitalocean", "seen": "2026-10-09" }, { "what": "open issues", "url": "https://github.com/digitalocean-labs/mcp-digitalocean/issues", "seen": "2026-10-09" }, { "what": "issue on database credentials", "url": "https://github.com/digitalocean-labs/mcp-digitalocean/issues/372", "seen": "2026-10-09" }, { "what": "MCP servers overview", "url": "https://docs.digitalocean.com/reference/mcp/", "seen": "2026-10-09" }, { "what": "remote MCP setup and endpoint list", "url": "https://docs.digitalocean.com/reference/mcp/configure-mcp/", "seen": "2026-10-09" }, { "what": "MCP tools index", "url": "https://docs.digitalocean.com/reference/mcp/mcp-tools/", "seen": "2026-10-09" }, { "what": "Droplets tool reference", "url": "https://docs.digitalocean.com/reference/mcp/droplet-mcp-tools/", "seen": "2026-10-09" }, { "what": "prompting guidelines", "url": "https://docs.digitalocean.com/reference/mcp/prompting/", "seen": "2026-10-09" }, { "what": "llms.txt", "url": "https://docs.digitalocean.com/llms.txt", "seen": "2026-10-09" }, { "what": "personal access tokens", "url": "https://docs.digitalocean.com/reference/api/create-personal-access-token/", "seen": "2026-10-09" }, { "what": "token scopes", "url": "https://docs.digitalocean.com/reference/api/scopes/", "seen": "2026-10-09" }, { "what": "API rate limits", "url": "https://docs.digitalocean.com/reference/api/reference/public-apis/", "seen": "2026-10-09" }, { "what": "release notes, last 90 days", "url": "https://docs.digitalocean.com/release-notes/recent/", "seen": "2026-10-09" }, { "what": "pricing", "url": "https://www.digitalocean.com/pricing", "seen": "2026-10-09" }, { "what": "Terms of Service Agreement", "url": "https://www.digitalocean.com/legal/terms-of-service-agreement", "seen": "2026-10-09" }, { "what": "Privacy Policy", "url": "https://www.digitalocean.com/legal/privacy-policy", "seen": "2026-10-09" }, { "what": "Data Processing Agreement", "url": "https://www.digitalocean.com/legal/data-processing-agreement", "seen": "2026-10-09" }, { "what": "Acceptable Use Policy", "url": "https://www.digitalocean.com/legal/acceptable-use-policy", "seen": "2026-10-09" }, { "what": "Stablecoin Payment Addendum", "url": "https://www.digitalocean.com/legal/stablecoin-payment-addendum", "seen": "2026-10-09" }, { "what": "security page", "url": "https://www.digitalocean.com/security", "seen": "2026-10-09" }, { "what": "certification reports", "url": "https://www.digitalocean.com/trust/certification-reports", "seen": "2026-10-09" }, { "what": "sub-processors", "url": "https://www.digitalocean.com/trust/subprocessors", "seen": "2026-10-09" }, { "what": "security.txt", "url": "https://www.digitalocean.com/.well-known/security.txt", "seen": "2026-10-09" }, { "what": "status page", "url": "https://status.digitalocean.com/", "seen": "2026-10-09" }, { "what": "status history feed", "url": "https://status.digitalocean.com/history.atom", "seen": "2026-10-09" }, { "what": "npm package, latest version", "url": "https://registry.npmjs.org/@digitalocean/mcp/latest", "seen": "2026-10-09" }, { "what": "npm weekly downloads", "url": "https://api.npmjs.org/downloads/point/last-week/@digitalocean/mcp", "seen": "2026-10-09" }, { "what": "MCP registry search", "url": "https://registry.modelcontextprotocol.io/v0/servers?search=digitalocean", "seen": "2026-10-09" }, { "what": "RDAP for digitalocean.com", "url": "https://rdap.verisign.com/com/v1/domain/digitalocean.com", "seen": "2026-10-09" } ], "openQuestions": [ "unchecked: the hosted servers themselves. The request for robots.txt on docs.mcp.digitalocean.com answered 302 to a docs page, which the brief's rule does not cover, so no `initialize` or `tools/list` was sent. Tool counts are from the source at v1.2.0 and may differ from what the hosted endpoints serve.", "unchecked: the Service Level Agreements the terms refer to. No SLA page was read.", "unchecked: whether sign-up needs a payment method, and the current free credit for new accounts.", "unchecked: the result of the CI workflow on the default branch, and the GitHub releases page. Release dates are from git tags.", "unchecked: whether DigitalOcean keeps an audit log of API or MCP calls. The team security history docs were not read.", "unchecked: the OAuth authorisation server's metadata at cloud.digitalocean.com, including PKCE, dynamic client registration and token lifetime.", "unchecked: security incidents at DigitalOcean in the last 12 months beyond the status feed. No advisory list was searched.", "Whether the old `gradient-ai` hosted address still answers after the 23 April 2026 rename, and whether users were told, was not established. No deduction was taken.", "The password exposure in the database tools is the issue reporter's account plus our reading of the handlers. We did not call the tools, and did not read the godo type definitions.", "The Acceptable Use Policy forbids harvesting or scraping content of the Services. This matters before any probe is run.", "The lead was right on the vendor, the repository, the licence and the hosted and local servers. The docs list a 23rd endpoint, Knowledge Bases, on another domain." ] }, "negative": -3, "negativeNotes": [ "26 May 2026, still open on 9 October 2026. An issue reports that `db-cluster-list`, `db-cluster-get` and the database user tools return passwords in plaintext, so a lookup puts credentials in the model's context. The handlers at v1.2.0 return the API's object with no redaction. A token without `database:view_credentials` limits it. 3 points (https://github.com/digitalocean-labs/mcp-digitalocean/issues/372)." ], "verdict": "Every tool carries read-only, destructive and idempotent hints enforced by a test, and access can be narrowed with OAuth, expiring tokens and granular scopes. The server has no read-only mode, database tools return cluster objects unredacted, and DigitalOcean's status feed shows several long platform incidents since late July 2026.", "bestFor": "Agents that operate DigitalOcean accounts, across Droplets, App Platform, Kubernetes, databases, networking and the AI platform, with one endpoint a service.", "strengths": [ "All tools carry read-only, destructive, idempotent and open-world hints plus a low, medium or high risk label, enforced by a test in CI.", "Tools are split across 22 hosted endpoints, and the local server takes `--services`, so a client loads only the services it needs.", "Hosted servers accept OAuth sign-in with short-lived tokens, or a personal access token with an expiry and granular custom scopes.", "Eight tagged releases between 23 July and 7 October 2026, with the npm package at the same version as the latest tag.", "DigitalOcean holds SOC 2 Type II, publishes a valid security.txt and runs a bug bounty on Intigriti." ], "weaknesses": [ "No read-only mode on the server. A request for one has been open since 2 March 2026.", "`db-cluster-list` and `db-cluster-get` return the API's database object unredacted. An issue reporting plaintext passwords has been open since 26 May 2026.", "The status feed lists several long incidents since 24 July 2026, including the public API and control panel on 24 and 25 August.", "Many descriptions are one short phrase, such as \"Delete a droplet\", and argument names mix `ID`, `Page` and `per_page` styles.", "No DigitalOcean entry was found in the official MCP registry, and no changelog file or MCP release note was found." ], "agentNotes": [ "Add only the service endpoints the task needs. Networking has 54 tools, evaluations 47 and Droplets 42.", "Pass `--services` to the local server. With no value it loads every service, about 377 tools.", "Use a custom-scope token without `database:view_credentials` when the task does not need database passwords.", "Use the `insights-alert-rule-*` tools. The `alert-policy-*` tools are marked deprecated and will be removed.", "Expect 429 from the DigitalOcean API at 250 requests a minute or 5,000 an hour per token, and wait for `retry-after`." ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 60.6 } ], "editorialScores": { "ergonomics": 67, "maintenance": 70, "payments": 33, "reliability": 62, "schema": 66, "security": 67, "transparency": 74 }, "provenanceScore": 100 }, "connect": { "install": "npx @digitalocean/mcp --services apps,droplets", "claudeCode": "claude mcp add --transport http digitalocean-apps https://apps.mcp.digitalocean.com/mcp", "config": { "mcpServers": { "apps": { "headers": { "Authorization": "Bearer \u003cyour_api_token\u003e" }, "url": "https://apps.mcp.digitalocean.com/mcp" } } } }, "letme": { "capability": "https://letme.dev/infra.cloud", "tool": "https://letme.dev/digitalocean-mcp" }, "sameCompany": [ "digitalocean-spaces" ], "notable": [ "The README lists 22 hosted endpoints, one a service, at https://\u003cservice\u003e.mcp.digitalocean.com/mcp, and recommends them over the local install (https://github.com/digitalocean-labs/mcp-digitalocean)", "About 377 tools are registered in the source at v1.2.0, of which 182 are read-only and 53 are marked destructive (https://github.com/digitalocean-labs/mcp-digitalocean)", "Hosted servers accept OAuth with no stored credential, or a personal access token in the `Authorization` header. The documentation server needs no token (https://docs.digitalocean.com/reference/mcp/configure-mcp/)", "The docs page lists a 23rd endpoint, Knowledge Bases at https://kbaas.do-ai.run/v1/mcp, which is not in the open-source repository (https://docs.digitalocean.com/reference/mcp/configure-mcp/)", "The `gradient-ai` service and its hosted address were renamed `dedicated-inference` on 23 April 2026. No notice of the change was found (https://github.com/digitalocean-labs/mcp-digitalocean)", "An open issue of 26 May 2026 reports that the database tools return cluster and user passwords in plaintext. The handlers return the API object with no redaction (https://github.com/digitalocean-labs/mcp-digitalocean/issues/372)", "DigitalOcean's llms.txt has a section of instructions addressed to AI assistants, such as which CLI and products to prefer. It is recorded here as a fact about the site and was not acted on (https://docs.digitalocean.com/llms.txt)", "The Acceptable Use Policy forbids harvesting or scraping content of the Services. The docs robots.txt allows every path and says the Markdown pages are for agents (https://www.digitalocean.com/legal/acceptable-use-policy)" ], "area": "developer", "details": [ { "label": "Surface graded", "value": "The hosted remote MCP servers, which DigitalOcean recommends. The same Go server runs locally over stdio through `npx @digitalocean/mcp`. Both call the DigitalOcean API at https://api.digitalocean.com" }, { "label": "Hosted services", "value": "apps, accounts, databases, doks, droplets, docr, genai-batchinference, signals, genai-custom-models, genai-inferencerouter, dedicated-inference, inference-modelcatalog, insights, marketplace, networking, functions, spaces, docs, genai-evaluation, nfs, volumes, vector-databases" }, { "label": "Tools", "value": "About 377 in the source at v1.2.0, counted from the registrations and not from a running server. Networking 54, evaluations 47, Droplets 42, databases 38, Insights 30, Functions 26, container registry 18, Kubernetes 15, six in the documentation service" }, { "label": "Annotations", "value": "Six hint profiles (read, create, action, toggle, delete, replace) set all four MCP hints, and each tool has a risk of low, medium or high under `_meta`. About 225 low, 112 medium and 40 high" }, { "label": "Credentials", "value": "OAuth through cloud.digitalocean.com with `read` and `write` scopes in the challenge, bearer header only. Or a personal access token with an expiry, Read Only, Full Access or custom scopes, which cannot be edited after creation" }, { "label": "Rate limits", "value": "Those of the DigitalOcean API. 5,000 requests an hour and 250 a minute per token, with `ratelimit-limit`, `ratelimit-remaining`, `ratelimit-reset` and, on the burst limit, `retry-after`" }, { "label": "Releases", "value": "79 tags from v0.1.0 (21 April 2025) to v1.2.0 (7 October 2026), eight of them since 23 July 2026. No changelog file in the repository" }, { "label": "Local runtime", "value": "npm package `@digitalocean/mcp` 1.2.0 wrapping Go binaries for macOS, Linux and Windows, Node.js 18 or later. Go 1.26.4, mcp-go 0.55.1, godo 1.219.0" }, { "label": "Certifications", "value": "SOC 2 Type II and SOC 3 Type II from Schellman, PCI-DSS SAQ-A, CSA STAR Level 1 and Global PRP, per digitalocean.com/trust/certification-reports. Bug bounty on Intigriti" }, { "label": "Status", "value": "status.digitalocean.com on Statuspage with components by product and region, including the API. No component for the MCP servers was identified" }, { "label": "Sub-processors", "value": "List dated 10 June 2026 with locations. Amazon Web Services, Cloudflare and Traversal for all services, and optional ones by product. The DPA gives 30 days to object to a new one" } ], "unitPrices": [ { "item": "Droplet, smallest", "unit": "month", "usd": 4, "note": "billed by the second" }, { "item": "Kubernetes, starting price", "unit": "month", "usd": 12 }, { "item": "Managed database, starting price", "unit": "month", "usd": 15 }, { "item": "Spaces object storage, starting price", "unit": "month", "usd": 5 }, { "item": "Volumes block storage, starting price", "unit": "month", "usd": 10 }, { "item": "Load balancer, starting price", "unit": "month", "usd": 12 }, { "item": "App Platform, starting price", "unit": "month", "usd": 0 } ], "provenance": { "legalEntity": "DigitalOcean, LLC", "domain": "digitalocean.com", "domainRegistered": "2000-04-12", "endpointOnVendorDomain": true, "terms": "https://www.digitalocean.com/legal/terms-of-service-agreement", "privacy": "https://www.digitalocean.com/legal/privacy-policy", "statusPage": "https://status.digitalocean.com", "changelog": "https://github.com/digitalocean-labs/mcp-digitalocean/releases", "securityTxt": "valid", "checked": "2026-10-09", "notes": [ "The Terms of Service Agreement (last updated 22 August 2026) names DigitalOcean, LLC, 105 Edgeview Drive, Ste. 425, Broomfield, CO 80021, as the only DigitalOcean party, and incorporates the Acceptable Use Policy.", "The Privacy Policy (last updated 1 January 2025) says it does not apply to content customers process when using the services. The Data Processing Agreement of 6 February 2026 covers that.", "The hosted servers answer at \u003cservice\u003e.mcp.digitalocean.com, subdomains of digitalocean.com. The Knowledge Bases endpoint the docs list is on do-ai.run.", "www.digitalocean.com/.well-known/security.txt names security@digitalocean.com and the Intigriti programme and expires on 5 April 2028.", "RDAP for digitalocean.com gives a registration date of 2000-04-12.", "The changelog link is the repository's releases page. Release dates here were read from the git tags." ], "score": 100, "checks": [ { "check": "Legal entity named", "value": "DigitalOcean, LLC", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "digitalocean.com, registered 2000-04-12 (26 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "apps.mcp.digitalocean.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 7 of the 7 things a reader expects", "points": 10, "max": 10, "state": "ok" }, { "check": "Privacy policy", "value": "read, states 8 of the 8 things a reader expects", "points": 10, "max": 10, "state": "ok" }, { "check": "Status page", "value": "status.digitalocean.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "valid", "points": 10, "max": 10, "state": "ok" } ], "policies": [ { "kind": "terms", "url": "https://www.digitalocean.com/legal/terms-of-service-agreement", "state": "read", "readAt": "2026-10-09", "statedDate": "2026-08-22", "words": 9662, "points": 10, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last Updated on August 22, 2026", "says": "Last updated 2026-08-22" }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "This TOS and any dispute related thereto (including under Section 13) is governed by the laws of the State of Delaware without regard to conflict of law principles.", "says": "The law of the State of Delaware" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "IN NO EVENT WILL WE BE LIABLE FOR ANY INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, PUNITIVE OR EXEMPLARY DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUES, BUSINESS, DATA OR GOODWILL, ARISING OR RELATING TO THE BETA SERVICE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.", "says": "Rules out indirect and consequential losses, with no cap named in this sentence" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "DigitalOcean may suspend or terminate access to the Services if your use poses a security risk, threatens the integrity or availability of the Services, or may harm DigitalOcean systems or infrastructure." }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": true, "quote": "By continuing to access or use the Websites or Services after the date specified in the notice or updated TOS, you are agreeing to accept and be bound by the updated TOS and all of the terms incorporated therein.", "says": "Says it gives notice of a change" }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "You will not use, and will not permit Authorized Users or End Users to use, AI Features in any circumstance where failure or inaccuracy of an AI Feature could reasonably be expected to result in death, personal injury, or severe physical, property, or environmental damage, or to produce legal or similarly significant…" }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": true, "quote": "The Service Level Agreements do not apply to Beta Services." } ], "toKnow": [ { "key": "terms.cutoff", "label": "Says access can be ended without notice or for any reason", "found": true, "quote": "While we prefer to give advance notice of termination, we reserve the right, in our sole discretion, to terminate your access to all or any part of the Websites and/or Services at any time, with or without notice, effective immediately." }, { "key": "terms.arbitration", "label": "Requires arbitration or waives class actions", "found": true, "quote": "One requirement of our TOS is that you must agree to resolve disputes arising under this TOS through binding arbitration directly between you and DigitalOcean." } ], "notes": [ { "date": "2026-10-08", "text": "Liability is capped at the amount paid for the services at issue in the month before the event behind the claim.", "quote": "our aggregate liability to you for all claims arising out of or relating to this TOS or the Websites and Services, whether in contract, tort, or otherwise, is limited to the amount you have paid to us for the Services at issue in the month prior to the event or circumstance giving rise to the claim." }, { "date": "2026-10-08", "text": "The customer grants DigitalOcean permission to use its name, logos and trademarks in promotional and marketing materials.", "quote": "2.3 You grant us permission to include your name, logos, and trademarks in our promotional and marketing materials and communications." }, { "date": "2026-10-08", "text": "Termination may lead to the immediate forfeiture and destruction of the data associated with the account.", "quote": "Any such termination may result in the immediate forfeiture and destruction of data associated with your Account." } ] }, { "kind": "privacy", "url": "https://www.digitalocean.com/legal/privacy-policy", "state": "read", "readAt": "2026-10-09", "statedDate": "2025-01-01", "words": 3606, "points": 10, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last Updated on January 1, 2025", "says": "Last updated 2025-01-01" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "We may collect and receive information about users of our Services (“users,” “you,” or “your”) from various sources, including: (i) information you provide through your user account on the Services (your “Account”) if you register for the Services;" }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "All Account data will be deleted within 90 days of purging.", "says": "Names a period of 90 days" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "We may share information with third-party vendors and service providers that provide services on our behalf, such as helping to provide our Services, for promotional and/or marketing purposes, and to provide you with information relevant to you such as product announcements, software updates, special offers, or other…" }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "To learn more about these programs, or opt-out of personalized ads, visit the Digital Advertising Alliance’s Self-Regulatory program for Online Behavioral Advertising at www.aboutads.info, or the Network Advertising Initiative at www.networkadvertising.org." }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "Right to access, correct, update, or request deletion of your Personal Information, which you can do at any time by emailing privacy@digitalocean.com." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "If you have any questions about this Privacy Policy or DigitalOcean’s data collection, use, and disclosure practices, please contact us at privacy@digitalocean.com.", "says": "privacy@digitalocean.com" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "…or permits DigitalOcean to access, the parties agree that by executing the DPA they also execute the Standard Contractual Clauses, which will be incorporated by reference and form an integral part of the DPA.", "says": "Relies on standard contractual clauses" } ], "toKnow": [ { "key": "privacy.sells", "label": "Says it sells personal data or shares it for advertising", "found": true, "quote": "These advertising partners may set and access their own cookies, pixel tags, and similar technologies on our Services, and they may otherwise collect or have access to information about you which they may collect over time and across different online services." } ], "notes": [ { "date": "2026-10-08", "text": "The policy does not cover information or content that customers process when using the services.", "quote": "This Privacy Policy (the “Privacy Policy”) does not apply to information or content our customers may process when using our Services." }, { "date": "2026-10-08", "text": "Public activity on an account may stay stored and publicly accessible after the account is terminated.", "quote": "If you terminate your Account, any public activity on your Account prior to deletion may remain stored on our servers and may remain accessible to the public." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/digitalocean-mcp.json", "live": { "slug": "digitalocean-mcp", "probe": { "target": "https://apps.mcp.digitalocean.com/mcp", "method": "mcp-initialize", "lastAt": "2026-10-10T01:37:49.964320263Z", "lastOk": true, "lastStatus": 401, "lastMs": 131, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 147, "p95ms24h": 232, "samples24h": 102, "samples30d": 102, "days": [ { "date": "2026-10-09", "probes": 85, "ok": 85 }, { "date": "2026-10-10", "probes": 17, "ok": 17 } ] }, "vendorStatus": { "page": "https://status.digitalocean.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-10T01:33:36.132092681Z" }, "versions": [ { "registry": "github", "name": "digitalocean-labs/mcp-digitalocean", "version": "v1.3.0", "released": "2026-10-09", "seenAt": "2026-10-09T16:49:51.841223634Z" }, { "registry": "npm", "name": "@digitalocean/mcp", "version": "1.3.0", "seenAt": "2026-10-09T16:49:51.343749713Z" } ], "githubStars": 137, "npmWeekly": 6361, "pages": [ { "url": "https://www.digitalocean.com/legal/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-10-09T18:49:33.241909958Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "e56c84134993" }, { "url": "https://www.digitalocean.com/legal/terms-of-service-agreement", "kind": "terms", "status": 200, "checkedAt": "2026-10-09T18:49:35.83154664Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "000e9050bf44" } ], "mcpTools": { "url": "https://apps.mcp.digitalocean.com/mcp", "checkedAt": "2026-10-09T21:40:21.095323465Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-10-09T21:40:21.095323465Z" }, "updatedAt": "2026-10-10T01:37:49.964320263Z" } } }