{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-09", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "railway-mcp-server", "name": "Railway MCP Server", "vendor": "Railway Corporation", "vendorUrl": "https://railway.com", "kind": "mcp", "category": "infrastructure", "summary": "Railway's official MCP server is hosted at mcp.railway.com. It lets an agent list and create projects, redeploy services, manage feature flags and hand multi-step work to Railway's own agent, through OAuth or the Railway CLI.", "url": "https://www.anchorterminal.com/tools/railway-mcp-server", "markdownUrl": "https://www.anchorterminal.com/tools/railway-mcp-server.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/railway-mcp-server.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/railway-mcp-server.json", "repo": "https://github.com/railwayapp/cli", "license": "Proprietary hosted server under Railway's Terms of Service. The Railway CLI, which carries the stdio proxy and a separate local MCP server, is MIT", "transports": [ "streamable-http", "stdio" ], "remoteUrl": "https://mcp.railway.com", "packages": [ { "registry": "npm", "name": "@railway/cli" } ], "auth": "oauth", "authNotes": "OAuth, either handled by the MCP client or reused from a `railway login` session through the CLI. An unauthenticated request answers 401 with a pointer to the protected-resource metadata, which names the authorisation server at backboard.railway.com and one scope, `workspace:member`. The authorisation server supports the authorisation code grant with PKCE (S256), the device code grant, refresh tokens and dynamic client registration. On the consent screen a person picks which workspaces and projects the client reaches. Access tokens last one hour and refresh tokens rotate. Grants are revoked in the dashboard, and there is no revocation endpoint. Project tokens are refused.", "pricing": "byo-plan", "pricingNotes": "The server itself has no charge. Tools act on a Railway workspace and bill under its plan. A new account gets a 30-day trial with a one-time $5 credit and no card, then the Free plan with $1 of usage a month. Hobby is $5 a month and Pro $20 a month, each with the same amount of usage included, and Enterprise is priced by sales. Usage is metered by the second. The `railway-agent` tool runs Railway's own agent, which is billed for the model tokens it uses at Anthropic's published rates with no markup (checked 2026-10-09).", "priceSummary": "Your plan", "where": "both", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the MCP server docs, the CLI docs, llms.txt, auth.md or the pricing file (checked 2026-10-09). Railway can be provisioned through Stripe's Agentic Provisioning Protocol, which is a separate route and not a payment protocol on the MCP endpoint.", "endpoints": [] }, "toolCount": 11, "popularity": { "githubStars": null, "npmWeekly": 426205, "pypiWeekly": null, "asOf": "2026-10-09" }, "docsUrl": "https://docs.railway.com/ai/mcp-server", "llmsTxt": "https://docs.railway.com/llms.txt", "openapi": "https://railway.com/openapi.json", "registryName": "com.railway/mcp", "capabilities": [ "infra.cloud", "code.deploy", "analytics.flags" ], "tags": [ "official", "hosted", "mcp", "oauth", "llms-txt", "openapi", "status-page", "soc2", "free-tier" ], "lastRelease": "2026-10-08", "graded": true, "anchor": { "graded": true, "score": 56.7, "grade": "C", "agentReady": false, "rank": 565, "ranked": true, "rankOf": 842, "categoryRank": 6, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 59, "maintenance": 83, "payments": 40, "reliability": 60, "schema": 56, "security": 65, "transparency": 73 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 60, "points": 12, "reason": "Scored as a hosted server. status.railway.com is an in-house status page with component history by region and for the API and OAuth login (20). From 11 July to 8 October 2026 it lists about 25 incidents, on a page that says it reports only incidents with wide impact. Most are slow builds and deployments. They include services and databases unavailable for some users in US West on 3 October, API degradation that paused Hobby deployments on 29 September, a five-minute routing failure for all domains on 30 September and a hardware fault in US West on 29 August. Durations are not shown in the history, and the MCP server is not a component (10 of 30). No limit is stated for the MCP server. The public API's limits are published with numbers, 100 to 10,000 requests an hour by plan (8 of 15). The API docs give `Retry-After` on 429, backoff advice and retry rules for mutations, with no idempotency key (10 of 15). A 99.99% SLA is stated for Enterprise, with terms by contract (5 of 10). The docs carry no beta label and the registry entry is 1.0.0, but the April 2026 launch note called it ready for public testing and no later statement was found (7 of 10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 56, "points": 9.1, "reason": "The hosted server's source is closed and `tools/list` needs a signed-in client, so no tool schema was read. A server card and a registry entry are public, and the CLI proxy source shows that tools declare their parameters (15 of 25). llms.txt on both sites and a Markdown twin of every docs page (10). The docs name the 11 tools and describe four of them in a line each. The descriptions the server sends were not read (8 of 20). Input types, enums and bounds could not be read (5 of 15). The docs give example prompts and the 401 challenge, and the API docs list error codes. No list of tool errors was found (9 of 15). Railway's changelog is weekly and dated, but the growth from seven tools to 11 has no dated entry found, and the hosted server shows a fixed version 1.0.0 (9 of 15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 59, "points": 9.59, "reason": "Eleven tools, one over the ten that earns full marks, with `railway-agent` taking multi-step work in a single call (20 of 25). The three list tools are the only read tools apart from the flag tools. Pagination and size controls could not be read (6 of 20). A missing or expired token answers 401 with a `WWW-Authenticate` challenge, the CLI proxy returns a login hint, and API errors carry a code and a trace id (12 of 20). The docs say destructive tools are marked at the protocol level so clients prompt. Read-only hints were not established, and there is no idempotency key (12 of 20). The CLI proxy fills project context from the linked directory for tools that accept it. Two official SDKs for the platform API were not found (9 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 65, "points": 11.38, "reason": "OAuth with PKCE required, dynamic client registration, grants limited to the workspaces and projects a person picks, one-hour access tokens and rotating refresh tokens. Revocation is in the dashboard only, and the MCP resource lists a single scope, `workspace:member` (25 of 30). There is no read-only grant for the hosted server. Destructive tools carry hints that prompt in clients that respect them, and project tokens are refused (10 of 20). `railway-agent` reads logs and configuration, which are untrusted content. The docs tell users to review actions and keep to non-critical environments, with no prompt-injection guidance found (4 of 15). Workspace audit logs record the actor and can be exported through the API, kept 48 hours on Free and Hobby, 30 days on Pro and 18 months on Enterprise. No marker for MCP calls was found (11 of 15). SOC 2 Type II and SOC 3, a HIPAA BAA, a Bugcrowd bounty that is invite-only and public incident reports. No security.txt (15 of 20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 40, "points": 5, "reason": "No x402, MPP or L402 on the server (0). Railway can be provisioned through Stripe's Agentic Provisioning Protocol, which is a separate route and earns nothing here. Plan fees and per-second prices for CPU, memory, volumes and egress are public (20). The trial gives $5 of credit for 30 days with no card, followed by a Free plan with $1 a month (20). Dynamic client registration needs no setup, but a person has to sign in and approve the grant in a browser or with a device code (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 83, "points": 7.26, "reason": "The CLI that carries the proxy reached v5.64.1 on 8 October 2026 and Railway's changelog has an entry dated 1 October (30). More than 100 CLI tags in the last 90 days and a weekly changelog (20). GitHub's API refused us for its rate limit, so issue handling was not read. Railway runs a feedback thread for the server on Central Station (10 of 25). The official MCP registry lists `com.railway/mcp` as active under the vendor's domain namespace (15). The CLI has CI, a cargo-audit workflow and a lockfile. The workflow results were not seen (8 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 73, "points": 6.39, "note": "editorial 61, provenance 84", "reason": "The hosted server is closed source under clear terms. The CLI proxy and the local server are MIT (20 of 30). The DPA is published in full. The privacy policy's full text was not read. Audit log and image retention are stated by plan, and nothing was found on what the hosted server or `railway-agent` keeps from a session (18 of 30). The old npm server was deprecated on 23 May 2026 with a shim and a registry notice, and API fields are marked `@deprecated` before removal with no stated period. The terms let Railway suspend or discontinue any part of the Services (10 of 20). The DPA names Google Cloud Platform and the United States, promises ten days' notice of a new sub-processor and points to a list at trust.railway.com that was not read (13 of 20)." } ], "assessment": { "date": "2026-10-09", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Eleven tools, one over the ten that earns full marks, with `railway-agent` taking multi-step work in a single call (20 of 25). The three list tools are the only read tools apart from the flag tools. Pagination and size controls could not be read (6 of 20). A missing or expired token answers 401 with a `WWW-Authenticate` challenge, the CLI proxy returns a login hint, and API errors carry a code and a trace id (12 of 20). The docs say destructive tools are marked at the protocol level so clients prompt. Read-only hints were not established, and there is no idempotency key (12 of 20). The CLI proxy fills project context from the linked directory for tools that accept it. Two official SDKs for the platform API were not found (9 of 15).", "maintenance": "The CLI that carries the proxy reached v5.64.1 on 8 October 2026 and Railway's changelog has an entry dated 1 October (30). More than 100 CLI tags in the last 90 days and a weekly changelog (20). GitHub's API refused us for its rate limit, so issue handling was not read. Railway runs a feedback thread for the server on Central Station (10 of 25). The official MCP registry lists `com.railway/mcp` as active under the vendor's domain namespace (15). The CLI has CI, a cargo-audit workflow and a lockfile. The workflow results were not seen (8 of 10).", "payments": "No x402, MPP or L402 on the server (0). Railway can be provisioned through Stripe's Agentic Provisioning Protocol, which is a separate route and earns nothing here. Plan fees and per-second prices for CPU, memory, volumes and egress are public (20). The trial gives $5 of credit for 30 days with no card, followed by a Free plan with $1 a month (20). Dynamic client registration needs no setup, but a person has to sign in and approve the grant in a browser or with a device code (0).", "reliability": "Scored as a hosted server. status.railway.com is an in-house status page with component history by region and for the API and OAuth login (20). From 11 July to 8 October 2026 it lists about 25 incidents, on a page that says it reports only incidents with wide impact. Most are slow builds and deployments. They include services and databases unavailable for some users in US West on 3 October, API degradation that paused Hobby deployments on 29 September, a five-minute routing failure for all domains on 30 September and a hardware fault in US West on 29 August. Durations are not shown in the history, and the MCP server is not a component (10 of 30). No limit is stated for the MCP server. The public API's limits are published with numbers, 100 to 10,000 requests an hour by plan (8 of 15). The API docs give `Retry-After` on 429, backoff advice and retry rules for mutations, with no idempotency key (10 of 15). A 99.99% SLA is stated for Enterprise, with terms by contract (5 of 10). The docs carry no beta label and the registry entry is 1.0.0, but the April 2026 launch note called it ready for public testing and no later statement was found (7 of 10).", "schema": "The hosted server's source is closed and `tools/list` needs a signed-in client, so no tool schema was read. A server card and a registry entry are public, and the CLI proxy source shows that tools declare their parameters (15 of 25). llms.txt on both sites and a Markdown twin of every docs page (10). The docs name the 11 tools and describe four of them in a line each. The descriptions the server sends were not read (8 of 20). Input types, enums and bounds could not be read (5 of 15). The docs give example prompts and the 401 challenge, and the API docs list error codes. No list of tool errors was found (9 of 15). Railway's changelog is weekly and dated, but the growth from seven tools to 11 has no dated entry found, and the hosted server shows a fixed version 1.0.0 (9 of 15).", "security": "OAuth with PKCE required, dynamic client registration, grants limited to the workspaces and projects a person picks, one-hour access tokens and rotating refresh tokens. Revocation is in the dashboard only, and the MCP resource lists a single scope, `workspace:member` (25 of 30). There is no read-only grant for the hosted server. Destructive tools carry hints that prompt in clients that respect them, and project tokens are refused (10 of 20). `railway-agent` reads logs and configuration, which are untrusted content. The docs tell users to review actions and keep to non-critical environments, with no prompt-injection guidance found (4 of 15). Workspace audit logs record the actor and can be exported through the API, kept 48 hours on Free and Hobby, 30 days on Pro and 18 months on Enterprise. No marker for MCP calls was found (11 of 15). SOC 2 Type II and SOC 3, a HIPAA BAA, a Bugcrowd bounty that is invite-only and public incident reports. No security.txt (15 of 20).", "transparency": "The hosted server is closed source under clear terms. The CLI proxy and the local server are MIT (20 of 30). The DPA is published in full. The privacy policy's full text was not read. Audit log and image retention are stated by plan, and nothing was found on what the hosted server or `railway-agent` keeps from a session (18 of 30). The old npm server was deprecated on 23 May 2026 with a shim and a registry notice, and API fields are marked `@deprecated` before removal with no stated period. The terms let Railway suspend or discontinue any part of the Services (10 of 20). The DPA names Google Cloud Platform and the United States, promises ten days' notice of a new sub-processor and points to a list at trust.railway.com that was not read (13 of 20)." }, "sources": [ { "what": "MCP server docs", "url": "https://docs.railway.com/ai/mcp-server.md", "seen": "2026-10-09" }, { "what": "`railway mcp` CLI docs", "url": "https://docs.railway.com/cli/mcp.md", "seen": "2026-10-09" }, { "what": "docs llms.txt", "url": "https://docs.railway.com/llms.txt", "seen": "2026-10-09" }, { "what": "site llms.txt", "url": "https://railway.com/llms.txt", "seen": "2026-10-09" }, { "what": "agent setup briefing", "url": "https://railway.com/agents.md", "seen": "2026-10-09" }, { "what": "authentication guide for agents", "url": "https://railway.com/auth.md", "seen": "2026-10-09" }, { "what": "remote MCP summary", "url": "https://railway.com/mcp.md", "seen": "2026-10-09" }, { "what": "MCP server card", "url": "https://railway.com/.well-known/mcp/server-card.json", "seen": "2026-10-09" }, { "what": "MCP protected-resource metadata", "url": "https://mcp.railway.com/.well-known/oauth-protected-resource", "seen": "2026-10-09" }, { "what": "OAuth authorisation server metadata", "url": "https://mcp.railway.com/.well-known/oauth-authorization-server", "seen": "2026-10-09" }, { "what": "OAuth scopes and consent", "url": "https://docs.railway.com/integrations/oauth/scopes-and-user-consent.md", "seen": "2026-10-09" }, { "what": "OAuth login and tokens", "url": "https://docs.railway.com/integrations/oauth/login-and-tokens.md", "seen": "2026-10-09" }, { "what": "public API docs, rate limits, errors and retries", "url": "https://docs.railway.com/integrations/api.md", "seen": "2026-10-09" }, { "what": "OpenAPI description", "url": "https://railway.com/openapi.json", "seen": "2026-10-09" }, { "what": "Railway Agent docs and its pricing", "url": "https://docs.railway.com/ai/railway-agent.md", "seen": "2026-10-09" }, { "what": "pricing", "url": "https://railway.com/pricing.md", "seen": "2026-10-09" }, { "what": "plans docs", "url": "https://docs.railway.com/pricing/plans.md", "seen": "2026-10-09" }, { "what": "free trial docs", "url": "https://docs.railway.com/pricing/free-trial.md", "seen": "2026-10-09" }, { "what": "Stripe provisioning docs", "url": "https://docs.railway.com/integrations/stripe.md", "seen": "2026-10-09" }, { "what": "status page", "url": "https://status.railway.com/", "seen": "2026-10-09" }, { "what": "status history", "url": "https://status.railway.com/historical", "seen": "2026-10-09" }, { "what": "status feed", "url": "https://api.railwaystatus.com/status", "seen": "2026-10-09" }, { "what": "incident management docs", "url": "https://docs.railway.com/platform/incident-management.md", "seen": "2026-10-09" }, { "what": "blog index and full text, incident reports", "url": "https://blog.railway.com/llms.txt", "seen": "2026-10-09" }, { "what": "incident report of 30 March 2026", "url": "https://blog.railway.com/p/incident-report-march-30-2026-authenticated-user-data-cached", "seen": "2026-10-09" }, { "what": "changelog index", "url": "https://railway.com/llms-changelog.md", "seen": "2026-10-09" }, { "what": "remote MCP launch note", "url": "https://railway.com/changelog/2026-04-17-remote-mcp.md", "seen": "2026-10-09" }, { "what": "CLI source, MCP proxy, local server, tags and workflows", "url": "https://github.com/railwayapp/cli", "seen": "2026-10-09" }, { "what": "deprecated npm MCP server", "url": "https://github.com/railwayapp/railway-mcp-server", "seen": "2026-10-09" }, { "what": "CLI telemetry docs", "url": "https://docs.railway.com/cli/telemetry.md", "seen": "2026-10-09" }, { "what": "compliance docs", "url": "https://docs.railway.com/enterprise/compliance.md", "seen": "2026-10-09" }, { "what": "audit logs docs", "url": "https://docs.railway.com/enterprise/audit-logs.md", "seen": "2026-10-09" }, { "what": "bug bounty", "url": "https://railway.com/bug-bounty.md", "seen": "2026-10-09" }, { "what": "enterprise summary and SLA claim", "url": "https://railway.com/enterprise.md", "seen": "2026-10-09" }, { "what": "Terms of Service", "url": "https://railway.com/legal/terms", "seen": "2026-10-09" }, { "what": "Privacy Policy summary", "url": "https://railway.com/legal/privacy.md", "seen": "2026-10-09" }, { "what": "Data Processing Addendum", "url": "https://railway.com/legal/dpa.md", "seen": "2026-10-09" }, { "what": "Acceptable Use Policy", "url": "https://railway.com/legal/acceptable-use.md", "seen": "2026-10-09" }, { "what": "MCP registry search", "url": "https://registry.modelcontextprotocol.io/v0/servers?search=railway", "seen": "2026-10-09" }, { "what": "npm weekly downloads for the CLI", "url": "https://api.npmjs.org/downloads/point/last-week/@railway/cli", "seen": "2026-10-09" }, { "what": "RDAP for railway.com", "url": "https://rdap.verisign.com/com/v1/domain/railway.com", "seen": "2026-10-09" } ], "openQuestions": [ "unchecked: the hosted server's tool schemas, descriptions and annotations. The source is closed and `tools/list` needs a signed-in client, so Schema and Agent ergonomics are scored from the docs.", "unchecked: the full text of the Privacy Policy. Its Markdown twin is a summary, and the terms forbid scraping pages of the Services, so the HTML page was not read.", "unchecked: the sub-processor list at trust.railway.com, for the same reason.", "unchecked: GitHub stars and issue handling for railwayapp/cli. GitHub's API refused us for its rate limit.", "unchecked: whether the public API's rate limits apply to MCP tool calls, and whether audit logs mark MCP calls.", "unchecked: the terms of the Enterprise 99.99% SLA, which are not published.", "unchecked: incident durations. The status history lists titles and closing notes without start and end times.", "The Terms of Service were read once from the HTML page before the clause against crawling or scraping was seen. After that only Railway's published agent files, Markdown twins, well-known files and the status pages were requested. robots.txt on railway.com, docs.railway.com, status.railway.com and blog.railway.com signals ai-input=yes. This matters before our probes run.", "The lead's description (create projects, deploy templates, manage environments, pull variables) comes from the docs' opening line. The hosted tool list has `create-project` and `redeploy` but no template, environment or variable tool.", "The launch note of 17 April 2026 called the server ready for public testing. No later statement that it is generally available was found, and the docs carry no beta label.", "The registry name is `com.railway/mcp` while Railway's server card says `com.railway/railway`.", "`lastRelease` is the date of the CLI tag v5.64.1, which carries the proxy. The hosted server has no dated releases." ] }, "negative": -4, "negativeNotes": [ "30 March 2026. A CDN configuration change cached GET responses on about 0.05% of Railway domains for 52 minutes, so pages meant for one user may have been served to another. Railway reverted it, purged the cache and published a report the same day. Fixed and documented, so 4 is deducted (https://blog.railway.com/p/incident-report-march-30-2026-authenticated-user-data-cached)." ], "verdict": "A small hosted server with 11 tools, OAuth grants limited to chosen workspaces and one-hour tokens. Most infrastructure work goes through the `railway-agent` tool, which is billed by model tokens. The hosted server's source and tool schemas are not public, there is no read-only scope, and the status page lists about 25 incidents in 90 days.", "bestFor": "Agents that deploy and operate applications on Railway from an editor and are content to hand multi-step work to Railway's own agent.", "strengths": [ "OAuth with PKCE, dynamic client registration and a device code grant. A person picks the workspaces and projects a client reaches.", "Access tokens last one hour, refresh tokens rotate, and the CLI route keeps any long-lived credential out of editor configuration.", "Eleven tools keep the context cost low, with `railway-agent` taking multi-step work in one call.", "The trial needs no card and prices for CPU, memory, volumes and egress are public and metered by the second.", "The CLI that carries the proxy had more than 100 tagged releases in 90 days, the latest on 8 October 2026." ], "weaknesses": [ "The hosted server's source and tool schemas are not public, so inputs can only be read after signing in.", "The MCP resource lists one scope, `workspace:member`, with no read-only grant.", "The docs say the server can deploy templates, manage environments and pull variables, but no hosted tool is named for those. They go through `railway-agent` or the local server.", "status.railway.com lists about 25 incidents from 11 July to 8 October 2026, most on builds and deployments.", "Railway reported a 52-minute CDN caching error on 30 March 2026 that may have shown one user's pages to another." ], "agentNotes": [ "Connect to `https://mcp.railway.com` with OAuth, or run `railway mcp` after `railway login`. Project tokens are refused.", "Treat `redeploy`, `accept-deploy`, `delete-feature-flag` and `railway-agent` as actions that change production. Confirm the project and environment first.", "`railway-agent` spends model tokens billed to the workspace. Use the single-purpose tools for listing and redeploying.", "For variables, domains, volumes, logs or metrics as separate tools, use `railway mcp local`, which has a different tool set.", "On a 401, follow the `WWW-Authenticate` challenge and run the OAuth flow again. Access tokens expire after one hour." ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 56.7 } ], "editorialScores": { "ergonomics": 59, "maintenance": 83, "payments": 40, "reliability": 60, "schema": 56, "security": 65, "transparency": 61 }, "provenanceScore": 84 }, "connect": { "install": "railway mcp install", "claudeCode": "claude mcp add railway --transport http https://mcp.railway.com", "config": { "mcpServers": { "railway": { "url": "https://mcp.railway.com" } } } }, "letme": { "capability": "https://letme.dev/infra.cloud", "tool": "https://letme.dev/railway-mcp-server" }, "notable": [ "The hosted server lists 11 tools in the docs. `whoami`, `list-projects`, `create-project`, `list-services`, four feature flag tools, `redeploy`, `accept-deploy` and `railway-agent` (https://docs.railway.com/ai/mcp-server)", "The remote server went live on 17 April 2026 with seven tools, described then as ready for public testing (https://railway.com/changelog/2026-04-17-remote-mcp)", "Since CLI 5.44.0, tagged 25 August 2026, `railway mcp` is a stdio proxy to mcp.railway.com that attaches the `railway login` credential to each request (https://docs.railway.com/cli/mcp)", "The CLI also ships a different local server, `railway mcp local`, with 47 tools in the MIT source for services, variables, domains, volumes, buckets, logs and metrics (https://github.com/railwayapp/cli)", "The hosted server's source is not public. The earlier npm package `@railway/mcp-server` was deprecated on 23 May 2026 and is now a shim that runs `railway mcp` (https://github.com/railwayapp/railway-mcp-server)", "The official MCP registry lists `com.railway/mcp` 1.0.0 as active, published 22 April 2026. Railway's own server card names it `com.railway/railway` (https://railway.com/.well-known/mcp/server-card.json)", "The OAuth metadata for the MCP resource lists one resource scope, `workspace:member`. The wider platform has viewer scopes that the MCP resource does not list (https://mcp.railway.com/.well-known/oauth-protected-resource)", "Railway reported that on 30 March 2026 a CDN change cached responses on about 0.05% of domains for 52 minutes, so pages meant for one user may have been served to another (https://blog.railway.com/p/incident-report-march-30-2026-authenticated-user-data-cached)", "Railway's Terms of Service, effective 20 April 2026, forbid crawling or scraping any page of the Services, while robots.txt on railway.com signals ai-input=yes (https://railway.com/legal/terms)", "railway.com/agents.md is written as instructions to AI agents, including an install command to propose to the user. It is recorded here as a fact about the site and was not acted on (https://railway.com/agents.md)" ], "area": "developer", "details": [ { "label": "Surface graded", "value": "The hosted MCP server at https://mcp.railway.com, reached with OAuth from the MCP client or through the `railway mcp` stdio proxy in the Railway CLI (5.44.0 or later). The CLI's local server, `railway mcp local`, and the GraphQL API at https://backboard.railway.com/graphql/v2 are separate surfaces" }, { "label": "Tools", "value": "11 per the docs. `whoami`, `list-projects`, `create-project`, `list-services`, `list-feature-flags`, `get-feature-flag`, `set-feature-flag`, `delete-feature-flag`, `redeploy`, `accept-deploy` and `railway-agent`" }, { "label": "Not in the hosted tool list", "value": "Tools for variables, environments, domains, volumes, buckets, templates, logs and metrics. The docs send multi-step work to `railway-agent`, and the local server has 47 tools covering these" }, { "label": "Protocol", "value": "Streamable HTTP, run statelessly with no session id per the CLI proxy source. The proxy does not forward server-initiated messages" }, { "label": "Credentials", "value": "OAuth authorisation code with PKCE (S256 required), device code grant, dynamic client registration and client ID metadata documents at backboard.railway.com. One resource scope, `workspace:member`. One-hour access tokens, rotating refresh tokens with a one-year life, revocation in the dashboard only" }, { "label": "Rate limits", "value": "None stated for the MCP server. The public API allows 100 requests an hour on Free, 1,000 on Hobby and 10,000 on Pro, with 10 a second on Hobby and 50 on Pro, and sends `Retry-After` on 429" }, { "label": "Audit", "value": "Workspace audit logs for admins, exportable through the GraphQL API. Kept 48 hours on Free, Trial and Hobby, 30 days on Pro and 18 months on Enterprise. Actor types are user, Railway staff and Railway system, with no marker for MCP calls found" }, { "label": "Releases", "value": "The hosted server shows version 1.0.0 in its server card and the registry and has no public release history. The CLI that carries the proxy reached v5.64.1 on 8 October 2026" }, { "label": "Certifications", "value": "SOC 2 Type II and SOC 3 per the compliance docs, with a HIPAA BAA as a paid add-on. Reports are requested through trust.railway.com" }, { "label": "Status", "value": "status.railway.com, built in-house, with components by region and for the dashboard, the API at backboard.railway.com and Railway OAuth login. No component for the MCP server. A JSON feed is at https://api.railwaystatus.com/status" }, { "label": "Sub-processors", "value": "The DPA points to a list at trust.railway.com, which was not read, and promises ten days' notice of a new one. The DPA names Google Cloud Platform for infrastructure and the United States as the primary place of processing" } ], "unitPrices": [ { "item": "Free plan", "unit": "month", "usd": 0, "note": "$1 of usage included" }, { "item": "Hobby plan", "unit": "month", "usd": 5, "note": "$5 of usage included" }, { "item": "Pro workspace", "unit": "month", "usd": 20, "note": "$20 of usage included" }, { "item": "CPU, one vCPU", "unit": "month", "usd": 20, "note": "metered by the second" }, { "item": "Memory", "unit": "gb-month", "usd": 10, "note": "metered by the second" }, { "item": "Volume storage", "unit": "gb-month", "usd": 0.15 }, { "item": "Network egress", "unit": "gb", "usd": 0.05 } ], "provenance": { "legalEntity": "Railway Corporation", "domain": "railway.com", "domainRegistered": "1996-01-09", "endpointOnVendorDomain": true, "terms": "https://railway.com/legal/terms", "privacy": "https://railway.com/legal/privacy", "statusPage": "https://status.railway.com", "changelog": "https://railway.com/changelog", "securityTxt": "none", "checked": "2026-10-09", "notes": [ "The Terms of Service (effective 20 April 2026) are a contract with Railway Corporation under Delaware law and cover the website, products, services and applications. They incorporate the Privacy Policy, and the DPA supplements them.", "The Markdown twins of the terms and the privacy policy are summaries that name the HTML pages as the binding text. The terms were read once from the HTML page. The privacy policy's full text was not read, because the terms forbid scraping pages of the Services.", "The MCP server answers at mcp.railway.com and its authorisation server at backboard.railway.com, both railway.com subdomains.", "railway.com/.well-known/security.txt answered 404. Security reports go to bugbounty@railway.com and an invite-only Bugcrowd programme.", "RDAP for railway.com gives a registration date of 1996-01-09.", "The status feed at api.railwaystatus.com is on a second domain of Railway's." ], "score": 84, "checks": [ { "check": "Legal entity named", "value": "Railway Corporation", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "railway.com, registered 1996-01-09 (30 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "mcp.railway.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "published, but our reader couldn't read it", "points": 7, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "published, but our reader couldn't read it", "points": 7, "max": 10, "state": "part" }, { "check": "Status page", "value": "status.railway.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ], "policies": [ { "kind": "terms", "url": "https://railway.com/legal/terms", "state": "unreadable", "reason": "the page our reader gets is a short summary that points to the full document, not the document itself", "readAt": "2026-10-08", "points": 7, "max": 10 }, { "kind": "privacy", "url": "https://railway.com/legal/privacy", "state": "unreadable", "reason": "the page our reader gets is a short summary that points to the full document, not the document itself", "readAt": "2026-10-08", "points": 7, "max": 10 } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/railway-mcp-server.json", "live": { "slug": "railway-mcp-server", "probe": { "target": "https://mcp.railway.com", "method": "mcp-initialize", "lastAt": "2026-10-09T11:46:38.208802525Z", "lastOk": true, "lastStatus": 401, "lastMs": 172, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 211, "p95ms24h": 264, "samples24h": 44, "samples30d": 44, "days": [ { "date": "2026-10-09", "probes": 44, "ok": 44 } ] }, "vendorStatus": { "page": "https://status.railway.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-09T07:58:28.33749143Z" }, "updatedAt": "2026-10-09T11:46:38.208802525Z" } } }