{ "data": { "a": { "slug": "digitalocean-mcp", "name": "DigitalOcean MCP Server", "vendor": "DigitalOcean, LLC", "vendorUrl": "https://www.digitalocean.com", "kind": "mcp", "category": "infrastructure", "summary": "DigitalOcean's official MCP servers let an agent manage Droplets, App Platform apps, Kubernetes, managed databases, networking and other DigitalOcean resources. Each service has a hosted endpoint, and the same MIT server runs locally from npm.", "url": "https://www.anchorterminal.com/tools/digitalocean-mcp", "markdownUrl": "https://www.anchorterminal.com/tools/digitalocean-mcp.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/digitalocean-mcp.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/digitalocean-mcp.json", "dns": "digitalocean-mcp.grade.anchorterminal.com", "repo": "https://github.com/digitalocean-labs/mcp-digitalocean", "license": "MIT for the server. The DigitalOcean platform it acts on is a proprietary service under DigitalOcean's Terms of Service Agreement", "transports": [ "streamable-http", "stdio" ], "remoteUrl": "https://apps.mcp.digitalocean.com/mcp", "packages": [ { "registry": "npm", "name": "@digitalocean/mcp" } ], "auth": "mixed", "authNotes": "OAuth or a DigitalOcean API token. With OAuth the client is given only the server URL, a person signs in to DigitalOcean in a browser, and the client receives a short-lived access token. The server's challenge names the scopes `read` and `write`, with cloud.digitalocean.com as the authorisation server. Otherwise a person creates a personal access token in the control panel and the client sends it as `Authorization: Bearer`. A token has an expiry and is Read Only, Full Access or limited to custom scopes chosen from about 170, bounded by the owner's team role. The documentation server needs no credential. The local server reads `DIGITALOCEAN_API_TOKEN`.", "pricing": "byo-plan", "pricingNotes": "The servers are free. Tools act on a DigitalOcean account and bill under its usage prices, which are public. Droplets start at $4 a month billed by the second, Kubernetes at $12, managed databases at $15, and App Platform, Functions and the container registry at $0. The documentation server works with no account. The pricing FAQ describes a card on the account and a free credit example of $5 for 90 days. Whether sign-up needs a payment method was not established (checked 2026-10-09).", "priceSummary": "Your plan", "where": "both", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the MCP docs, the repository or the pricing page. A Stablecoin Payment Addendum covers paying an account's bill in stablecoin through Stripe, which is not a machine payment protocol on the endpoints (checked 2026-10-09).", "endpoints": [] }, "toolCount": 467, "popularity": { "githubStars": 137, "npmWeekly": 6361, "pypiWeekly": null, "asOf": "2026-10-09" }, "docsUrl": "https://docs.digitalocean.com/reference/mcp/", "llmsTxt": "https://docs.digitalocean.com/llms.txt", "capabilities": [ "infra.cloud", "code.deploy", "db.admin", "compute.containers", "compute.serverless", "code.docs" ], "tags": [ "official", "hosted", "open-source", "mcp", "oauth", "pat", "llms-txt", "status-page", "soc2", "bug-bounty", "npm" ], "lastRelease": "2026-11-02", "graded": true, "anchor": { "graded": true, "score": 61.6, "grade": "C", "agentReady": false, "rank": 539, "ranked": true, "rankOf": 1349, "categoryRank": 8, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 67, "maintenance": 70, "payments": 33, "reliability": 67, "schema": 66, "security": 67, "transparency": 87 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-03" }, "negative": -3, "negativeNotes": [ "26 May 2026, still open per the 9 October 2026 check. An issue reports that `db-cluster-list`, `db-cluster-get` and the database user tools return passwords in plaintext, so a lookup puts credentials in the model's context. The handlers at v1.6.5 (2 November 2026) still return the API's object with no redaction. A token without `database:view_credentials` limits it. 3 points (https://github.com/digitalocean-labs/mcp-digitalocean/issues/372)." ], "verdict": "Every tool carries read-only, destructive and idempotent hints enforced by a test, and access can be narrowed with OAuth, expiring tokens and granular scopes. The server has no read-only mode, database tools return cluster objects unredacted, and the public API it calls returned errors for all requests for several hours on 24 August 2026.", "bestFor": "Agents that operate DigitalOcean accounts, across Droplets, App Platform, Kubernetes, databases, networking and the AI platform, with one endpoint a service.", "strengths": [ "All tools carry read-only, destructive, idempotent and open-world hints plus a low, medium or high risk label, enforced by a test in CI.", "Tools are split across 24 hosted endpoints, and the local server takes `--services`, so a client loads only the services it needs.", "Hosted servers accept OAuth sign-in with short-lived tokens, or a personal access token with an expiry and granular custom scopes.", "18 tagged releases between 10 August and 2 November 2026, the latest v1.6.5, with the npm wrapper at the same version.", "DigitalOcean holds SOC 2 Type II, publishes a valid security.txt and runs a bug bounty on Intigriti." ], "weaknesses": [ "No read-only mode on the server. A request for one has been open since 2 March 2026.", "`db-cluster-list` and `db-cluster-get` still return the API's database object unredacted at v1.6.5. An issue reporting plaintext passwords was opened on 26 May 2026.", "The public API the servers call returned 5xx errors for all requests from 17:14 UTC on 24 August 2026, recurring until 00:54 on 25 August.", "Many descriptions are one short phrase, such as \"Delete a droplet\", and argument names mix `ID`, `Page` and `per_page` styles.", "No DigitalOcean entry was found in the official MCP registry, and no changelog file or MCP release note was found.", "Preview-product tools are removed or renamed in minor and patch releases without notice (Signals in v1.3.0, simulation journeys in v1.4.1)." ], "agentNotes": [ "Add only the service endpoints the task needs. Networking and Harness Runtime have 61 tools each, evaluations 47 and Droplets 42.", "Pass `--services` to the local server. With no value it loads every service, about 467 tools at v1.6.5.", "Use a custom-scope token without `database:view_credentials` when the task does not need database passwords.", "Use the `insights-alert-rule-*` tools. The `alert-policy-*` tools are marked deprecated and will be removed.", "Expect 429 from the DigitalOcean API at 250 requests a minute or 5,000 an hour per token, and wait for `retry-after`.", "Re-list tools after an upgrade when using preview services (Signals, simulation, Harness Runtime). Their tools were removed or renamed in October 2026 releases without notice." ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 4, "avgRating": 2.8, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 61.6 } ], "editorialScores": { "ergonomics": 67, "maintenance": 70, "payments": 33, "reliability": 67, "schema": 66, "security": 67, "transparency": 74 }, "provenanceScore": 100, "checked": { "categories": { "ergonomics": "2026-11-03", "maintenance": "2026-11-03", "payments": "2026-11-03", "reliability": "2026-11-03", "schema": "2026-11-03", "security": "2026-11-03", "transparency": "2026-11-03" }, "last": "2026-11-03", "lastMoved": "2026-11-03", "oldest": "2026-11-03", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npx @digitalocean/mcp --services apps,droplets", "claudeCode": "claude mcp add --transport http digitalocean-apps https://apps.mcp.digitalocean.com/mcp", "config": { "mcpServers": { "apps": { "headers": { "Authorization": "Bearer \u003cyour_api_token\u003e" }, "url": "https://apps.mcp.digitalocean.com/mcp" } } } }, "letme": { "capability": "https://letme.dev/infra.cloud", "tool": "https://letme.dev/digitalocean-mcp" }, "sameCompany": [ "digitalocean-spaces" ], "area": "developer", "unitPrices": [ { "item": "Droplet, smallest", "unit": "month", "usd": 4, "note": "billed by the second" }, { "item": "Kubernetes, starting price", "unit": "month", "usd": 12 }, { "item": "Managed database, starting price", "unit": "month", "usd": 15 }, { "item": "Spaces object storage, starting price", "unit": "month", "usd": 5 }, { "item": "Volumes block storage, starting price", "unit": "month", "usd": 10 }, { "item": "Load balancer, starting price", "unit": "month", "usd": 12 }, { "item": "App Platform, starting price", "unit": "month", "usd": 0 } ], "provenance": { "legalEntity": "DigitalOcean, LLC", "domain": "digitalocean.com", "domainRegistered": "2000-04-12", "endpointOnVendorDomain": true, "terms": "https://www.digitalocean.com/legal/terms-of-service-agreement", "privacy": "https://www.digitalocean.com/legal/privacy-policy", "statusPage": "https://status.digitalocean.com", "changelog": "https://github.com/digitalocean-labs/mcp-digitalocean/releases", "securityTxt": "valid", "checked": "2026-11-03", "notes": [ "The Terms of Service Agreement (last updated 22 August 2026) names DigitalOcean, LLC, 105 Edgeview Drive, Ste. 425, Broomfield, CO 80021, as the only DigitalOcean party, and incorporates the Acceptable Use Policy.", "The Privacy Policy (last updated 1 January 2025) says it does not apply to content customers process when using the services. The Data Processing Agreement of 6 February 2026 covers that.", "The hosted servers answer at \u003cservice\u003e.mcp.digitalocean.com, subdomains of digitalocean.com. The Knowledge Bases endpoint the docs list is on do-ai.run.", "www.digitalocean.com/.well-known/security.txt names security@digitalocean.com and the Intigriti programme and expires on 5 April 2028 (re-read on 2 November 2026).", "RDAP for digitalocean.com gives a registration date of 2000-04-12.", "The changelog link is the repository's releases page. Release dates here were read from the git tags." ], "score": 100 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/digitalocean-mcp.json", "live": { "slug": "digitalocean-mcp", "probe": { "target": "https://apps.mcp.digitalocean.com/mcp", "method": "mcp-initialize", "lastAt": "2026-11-04T20:46:41.71957699Z", "lastOk": true, "lastStatus": 401, "lastMs": 200, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 99.98, "p50ms24h": 156, "p95ms24h": 332, "samples24h": 246, "samples30d": 6560, "days": [ { "date": "2026-10-09", "probes": 85, "ok": 85 }, { "date": "2026-10-10", "probes": 247, "ok": 247 }, { "date": "2026-10-11", "probes": 247, "ok": 247 }, { "date": "2026-10-12", "probes": 247, "ok": 247 }, { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 249 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 253 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 255 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 253 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 251, "ok": 251 }, { "date": "2026-10-29", "probes": 248, "ok": 247 }, { "date": "2026-10-30", "probes": 249, "ok": 249 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 248 }, { "date": "2026-11-04", "probes": 214, "ok": 214 } ] }, "vendorStatus": { "page": "https://status.digitalocean.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-04T20:39:04.907120837Z" }, "versions": [ { "registry": "github", "name": "digitalocean-labs/mcp-digitalocean", "version": "v1.6.5", "released": "2026-11-02", "seenAt": "2026-11-04T20:12:19.6909226Z" }, { "registry": "npm", "name": "@digitalocean/mcp", "version": "1.6.5", "seenAt": "2026-11-04T20:12:18.833668766Z" } ], "githubStars": 138, "npmWeekly": 8193, "securityTxt": { "url": "https://digitalocean.com/.well-known/security.txt", "state": "valid", "expires": "2028-04-05T04:00:00.000Z", "checkedAt": "2026-11-04T15:54:33.248029299Z" }, "llmsTxt": { "url": "https://docs.digitalocean.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-04T15:22:46.979343483Z" }, "domain": { "domain": "digitalocean.com", "registered": "2000-04-12", "source": "https://rdap.verisign.com/com/v1/domain/digitalocean.com", "checkedAt": "2026-11-01T14:08:18.65621684Z" }, "pages": [ { "url": "https://www.digitalocean.com/legal/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-04T08:39:22.037367543Z", "changedAt": "2026-10-28T04:49:15.777376978Z", "fingerprint": "cd8c77c345f0" }, { "url": "https://www.digitalocean.com/legal/terms-of-service-agreement", "kind": "terms", "status": 200, "checkedAt": "2026-11-04T08:39:24.591472337Z", "changedAt": "2026-10-28T04:49:18.281300115Z", "fingerprint": "6bfa586bc478" } ], "mcpTools": { "url": "https://apps.mcp.digitalocean.com/mcp", "checkedAt": "2026-11-04T01:22:29.059404935Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-10-09T21:40:21.095323465Z" }, "github": { "repo": "digitalocean-labs/mcp-digitalocean", "checkedAt": "2026-11-02T08:44:22.246658826Z", "stars": 138, "archived": false, "issuesEnabled": true, "pushedAt": "2026-11-02T06:00:00Z", "openIssues": 9, "openPRs": 29, "issuesOpened90d": 1, "issuesClosed90d": 0, "prsMerged90d": 91, "ci": { "branch": "main", "runs": 50, "success": 50, "failure": 0, "other": 0, "latest": "success", "latestAt": "2026-11-02T05:59:13Z" }, "replies": { "sampled": 25, "unanswered": 9, "medianDays": 1.9 } }, "updatedAt": "2026-11-04T20:46:41.71957699Z" } }, "answer": "Netlify API + MCP scores 69.4 (B) on agent readiness against DigitalOcean MCP Server's 61.6 (C), and leads in 4 of 7 scored categories. DigitalOcean MCP Server leads on security \u0026 auth and transparency \u0026 trust.", "b": { "slug": "netlify", "name": "Netlify API + MCP", "vendor": "Netlify, Inc.", "vendorUrl": "https://www.netlify.com", "kind": "http-api", "category": "infrastructure", "summary": "Netlify's platform for deploying and running web projects, reached through a REST API with a public OpenAPI spec, the netlify-cli command line tool and an official MCP server, hosted at netlify-mcp.netlify.app or run locally from npm.", "url": "https://www.anchorterminal.com/tools/netlify", "markdownUrl": "https://www.anchorterminal.com/tools/netlify.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/netlify.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/netlify.json", "dns": "netlify.grade.anchorterminal.com", "repo": "https://github.com/netlify/netlify-mcp", "license": "ISC for the MCP server (@netlify/mcp) and MIT for the CLI (netlify-cli). The Netlify platform they act on is a proprietary service under Netlify's terms", "transports": [ "http", "streamable-http", "stdio" ], "remoteUrl": "https://api.netlify.com/api/v1", "packages": [ { "registry": "npm", "name": "@netlify/mcp" }, { "registry": "npm", "name": "netlify-cli" } ], "auth": "mixed", "authNotes": "Personal access tokens from Applications \u003e Personal access tokens, named, given an expiry date at creation and sent as `Authorization: Bearer`; no scopes are documented, SAML teams need an opt-in at creation, and a password reset invalidates every token. Public integrations use OAuth2 apps registered at app.netlify.com/applications (the spec declares an implicit flow with no scopes). The CLI stores a token from `netlify login` in config.json or reads `NETLIFY_AUTH_TOKEN`. The hosted MCP server signs in with OAuth 2.1 (PKCE, dynamic client registration) and advertises the scopes offline_access, read, write and claudeai; the local server reads the CLI's token or `NETLIFY_PERSONAL_ACCESS_TOKEN`.", "pricing": "freemium", "pricingNotes": "Free plan at $0 with 300 credits a month, deploys from the API, functions, Blobs, Database and custom domains. Personal $9 a month with 1,000 credits, Pro $20 a month with unlimited members and 3,000 credits, Enterprise custom with a 99.99 per cent SLA. Usage is metered in credits, about $0.00667 each at the Pro pack rate (1,500 for $10; Personal 500 for $5). A production deploy is 15 credits, bandwidth 20 a GB, compute 10 a GB-hour and web requests 2 per 10,000. Whether a card is needed is not stated. `netlify deploy --allow-anonymous` publishes without an account, to be claimed within an hour.", "priceSummary": "$9 / mo", "where": "both", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the OpenAPI spec (no 402 response), the API guide, the MCP source or the pricing page (checked 2026-11-03).", "endpoints": [] }, "toolCount": 11, "popularity": { "githubStars": null, "npmWeekly": 58373, "pypiWeekly": null, "asOf": "2026-11-03" }, "docsUrl": "https://docs.netlify.com/api-and-cli-guides/api-guides/get-started-with-api/", "llmsTxt": "https://docs.netlify.com/llms.txt", "openapi": "https://raw.githubusercontent.com/netlify/open-api/master/swagger.yml", "capabilities": [ "infra.cloud", "code.deploy", "observability.logs" ], "tags": [ "hosted", "freemium", "free-tier", "mcp", "remote-mcp", "cli", "oauth", "pat", "llms-txt", "openapi", "status-page", "bug-bounty", "soc2", "iso27001", "sla", "typescript", "go", "agent-skills", "enterprise" ], "lastRelease": "2026-10-26", "graded": true, "anchor": { "graded": true, "score": 69.4, "grade": "B", "agentReady": false, "rank": 226, "ranked": true, "rankOf": 1349, "categoryRank": 3, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 69, "maintenance": 87, "payments": 55, "reliability": 67, "schema": 79, "security": 59, "transparency": 81 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-03" }, "negative": 0, "verdict": "A public OpenAPI spec with 188 operations, documented rate limits, an anonymous deploy route and an MCP server released weekly through October 2026 with complete tool annotations. Personal access tokens and the OAuth flows carry no scopes, the hosted MCP enforces none on tool calls, and the status feed shows several site-serving incidents in the 90 days to 3 November.", "bestFor": "An agent that builds and deploys web projects, sets environment variables and reads forms or logs on a team's Netlify account, including with no account through anonymous deploys.", "strengths": [ "OpenAPI spec (Swagger 2.0, version 2.63.1) with 188 operations, llms.txt and a Markdown twin of every docs page", "Rate limits published (500 a minute, 3 deploys a minute, 100 a day) with X-RateLimit headers on every response", "`netlify deploy --allow-anonymous` publishes a project without an account, claimable within an hour", "MCP server with OAuth 2.1 and PKCE, every tool hint declared since v1.18.0 (7 October 2026), and six tagged releases between 25 September and 26 October", "Public HackerOne bug bounty, SOC 2 Type II, ISO 27001 and 27018, and a trust centre with a downloadable DPA and subprocessor list" ], "weaknesses": [ "Personal access tokens and OAuth apps have no scopes, so a token reaches every team its owner belongs to", "The hosted MCP server advertises read and write scopes but its source enforces none on tool calls", "No idempotency keys for deploys or site creation, and no documented 429 retry guidance beyond the headers", "19 incidents in the status feed from 18 August to 2 November 2026, including errors reaching hosted sites for about 85 minutes on 21 September", "No entry in the official MCP registry, and the privacy statement contradicts itself on AI training (opt-in in one section, never in another)" ], "agentNotes": [ "Send a `User-Agent` naming your app and `Authorization: Bearer $NETLIFY_AUTH_TOKEN`; watch X-RateLimit-Remaining and stop before 3 deploys a minute or 100 a day", "Deploy with `netlify deploy --allow-anonymous` when the person has no account yet, and tell them to claim the project within an hour", "Poll GET /api/v1/deploys/{deploy_id} until `state` is `ready`; a deploy call that runs over 30 seconds is cut off, so send large deploys with `\"async\": true`", "Page lists with `page` and `per_page` (100 at most) and follow the `Link` header's `rel=\"next\"`", "Expect the hosted MCP's deploy tool to hand back a CLI command for the person to run; the local server deploys from the working directory itself" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 69.4 } ], "editorialScores": { "ergonomics": 69, "maintenance": 87, "payments": 55, "reliability": 67, "schema": 79, "security": 59, "transparency": 73 }, "provenanceScore": 89, "checked": { "categories": { "ergonomics": "2026-11-03", "maintenance": "2026-11-03", "payments": "2026-11-03", "reliability": "2026-11-03", "schema": "2026-11-03", "security": "2026-11-03", "transparency": "2026-11-03" }, "last": "2026-11-03", "oldest": "2026-11-03", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install -g netlify-cli", "http": "curl -H \"User-Agent: MyApp (you@example.com)\" -H \"Authorization: Bearer $NETLIFY_AUTH_TOKEN\" https://api.netlify.com/api/v1/sites", "claudeCode": "claude mcp add --transport http netlify https://netlify-mcp.netlify.app/mcp", "config": { "mcpServers": { "netlify": { "url": "https://netlify-mcp.netlify.app/mcp" } } } }, "letme": { "capability": "https://letme.dev/infra.cloud", "tool": "https://letme.dev/netlify" }, "area": "developer", "unitPrices": [ { "item": "Personal", "unit": "month", "usd": 9, "note": "1,000 credits a month" }, { "item": "Pro", "unit": "month", "usd": 20, "note": "Unlimited members, 3,000 credits a month" }, { "item": "Credit (Pro pack)", "unit": "credit", "usd": 0.00667, "note": "1,500 credits for $10. A production deploy is 15 credits, bandwidth 20 a GB, compute 10 a GB-hour" }, { "item": "Bandwidth", "unit": "gb", "usd": 0.13, "note": "20 credits a GB at the Pro pack rate" } ], "provenance": { "legalEntity": "Netlify, Inc.", "domain": "netlify.com", "domainRegistered": "2014-06-09", "endpointOnVendorDomain": true, "terms": "https://www.netlify.com/legal/terms-of-use/", "privacy": "https://www.netlify.com/privacy/", "statusPage": "https://www.netlifystatus.com", "changelog": "https://www.netlify.com/changelog/", "securityTxt": "none", "checked": "2026-11-03", "notes": [ "The terms of use (last updated 14 October 2026) name Netlify, Inc. under California law and contain no clause on automated access or scraping; the services run under separate self-serve and enterprise subscription agreements, the self-serve one served as a PDF our reader could not extract.", "The privacy statement (last updated 10 April 2026) names Netlify, Inc. and affiliates, a DPA for enterprise customers, and says in one place that content is not used to train AI models unless the user opts in and in another that Customer Content is never used for training.", "www.netlify.com and docs.netlify.com robots.txt allow every crawler, name ClaudeBot and Claude-Web among allowed AI crawlers, and set Content-Signal search=yes, ai-input=yes, ai-train=yes. www.netlifystatus.com disallows /api/ and /embed/, so the status history was read from /history.atom.", "RDAP gives netlify.com a registration date of 9 June 2014.", "www.netlify.com/.well-known/security.txt returns 404. Vulnerability reports go to the public HackerOne programme per the security transparency post.", "The trust centre at netlify.com/trust-center lists subprocessors (all US) with CSV and PDF downloads and an RSS feed, and the DPA as a direct download." ], "score": 89 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/netlify.json", "live": { "slug": "netlify", "probe": { "target": "https://api.netlify.com/api/v1", "method": "get", "lastAt": "2026-11-04T20:47:02.5486596Z", "lastOk": true, "lastStatus": 401, "lastMs": 511, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 457, "p95ms24h": 548, "samples24h": 55, "samples30d": 55, "days": [ { "date": "2026-11-04", "probes": 55, "ok": 55 } ] }, "vendorStatus": { "page": "https://www.netlifystatus.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-04T20:39:30.739538782Z" }, "versions": [ { "registry": "github", "name": "netlify/netlify-mcp", "version": "mcp-v1.21.0", "released": "2026-10-26", "seenAt": "2026-11-04T20:39:31.488292719Z" }, { "registry": "npm", "name": "@netlify/mcp", "version": "1.21.0", "seenAt": "2026-11-04T20:39:29.42118318Z" }, { "registry": "npm", "name": "netlify-cli", "version": "27.16.2", "seenAt": "2026-11-04T20:39:30.256102488Z" } ], "githubStars": 69, "npmWeekly": 54818, "securityTxt": { "url": "https://netlify.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-04T15:53:05.436387975Z" }, "updatedAt": "2026-11-04T20:47:02.5486596Z" } }, "edges": [ { "by": 22, "category": "payments", "leads": "netlify", "name": "Payments \u0026 pricing", "reasons": { "a": "No x402 or other machine payment. Stablecoin payment of an account's bill through Stripe is not one (0). The servers are free and product prices are public by the month, hour or unit (20). The documentation server needs no account, and App Platform, Functions and the container registry start at $0. The pricing FAQ describes a card on the account, and whether sign-up needs one was not established (10 of 20). A person signs up and approves OAuth or creates a token. Only the documentation server is keyless (3 of 20). 0 + 20 + 10 + 3 = 33.", "b": "No x402, MPP or L402 (0). Plan prices and per-unit credit prices (deploys, bandwidth, compute, requests, credit packs) are public without a login (20). A Free plan with 300 credits a month and API deploys, and the docs do not say a card is needed (20). `netlify deploy --allow-anonymous` publishes a project and URL with no account, claimable within an hour, but the API, the MCP server and anything past that hour need a person to sign up and approve a token (15 of 20). 0 + 20 + 20 + 15 = 55." }, "scores": { "a": 33, "b": 55 } }, { "by": 17, "category": "maintenance", "leads": "netlify", "name": "Maintenance \u0026 community", "reasons": { "a": "v1.6.5 was tagged on 2 November 2026, the version in the npm wrapper's package.json (30). 18 tags from v1.0.68 (10 August) to v1.6.5 in the 90 days from 5 August (20). 256 commits since 5 August. Eight open issues and 23 open pull requests, with the credential issue of 26 May 2026 unanswered by a maintainer and the read-only request of 2 March 2026 open, per the 9 October check, not re-read on 3 November (12 of 25). The official MCP registry, searched again on 3 November, returns one third-party server for digitalocean and none from DigitalOcean (0). Dependabot runs weekly, and CI lints, checks formatting and runs tests with the race detector on Linux and macOS. The workflow's result was not seen (8 of 10). 30 + 20 + 12 + 0 + 8 = 70.", "b": "@netlify/mcp 1.21.0 tagged on 26 October 2026 (changelog 23 October), a commit on 28 October, the spec at 2.63.1 and changelog entries to 26 October (30). Six MCP tags between 25 September and 26 October 2026 (20). Issue and pull request responsiveness could not be read (github.com refuses our reader and the API answered empty), while the changelog, the answers.netlify.com forum, Discord and a support hub exist and the MCP changelog cites numbered pull requests (12 of 25). Current official SDKs, a Go client, a JS client and netlify-cli 27.16.2, though the server card names com.netlify/mcp and no such entry is in the official MCP registry (15). CI runs typecheck, build and 31 tests on pinned actions, releases through release-please with npm provenance, and the server runs on @modelcontextprotocol/server 2.2.0 (10). 30 + 20 + 12 + 15 + 10 = 87." }, "scores": { "a": 70, "b": 87 } }, { "by": 13, "category": "schema", "leads": "netlify", "name": "Schema \u0026 documentation", "reasons": { "a": "Tools declare typed inputs through mcp-go, and about 300 also declare an output schema checked by a test. Two issues from February 2026 about array parameters without `items` are still open, and `db-cluster-list` reads `per_page` as a Go integer in the source, which a JSON number may not satisfy (22 of 25). llms.txt and a Markdown twin of every docs page (10). The median description is 48 characters and 156 of 365 are 40 or fewer, such as \"Delete a droplet\". A few say how to choose between arguments (9 of 20). Required fields and defaults are set, enums are rare, and argument names mix `ID` and `Page` with `id` and `per_page` (8 of 15). Each service has a README with arguments and example queries, generated into the docs. No list of error responses was found (9 of 15). Releases are semver tags. There is still no changelog file, and the 90-day release notes, re-read on 3 November 2026, have no entry for the MCP server (8 of 15). 22 + 10 + 9 + 8 + 9 + 8 = 66.", "b": "A public Swagger 2.0 spec, version 2.63.1, with 124 paths and 188 operations, and MCP tools typed through zod (25). llms.txt and a Markdown twin of every docs page, with agent skills in netlify/context-and-tools (10). Every spec operation has a summary, most one line, and the MCP tool descriptions say what to call first, as the deploy tool does for get-projects, but not when to leave an endpoint alone (14 of 20). 232 parameters with 9 enums; the MCP selector tools take an `operation` literal and a `params` object per operation inside one union, which is typed but nested (9 of 15). The API guide gives curl examples for sites and deploys, a shared `error` object of code and message is the default response, and 422, 404, 409 and 423 are declared on some operations, but the docs' error reference covers builds and domains rather than API codes (8 of 15). The spec carries a version, the API a /v1 path, Netlify a dated changelog, and the MCP server a dated CHANGELOG from release-please (13 of 15). 25 + 10 + 14 + 9 + 8 + 13 = 79." }, "scores": { "a": 66, "b": 79 } }, { "by": 8, "category": "security", "leads": "digitalocean-mcp", "name": "Security \u0026 auth", "reasons": { "a": "OAuth with short-lived tokens, or a personal access token with an expiry and custom scopes from about 170, revocable in the control panel. The OAuth challenge names only `read` and `write`, and the metadata allows the bearer header only (28 of 30). A Read Only token or custom scopes limit what any tool can do. The server still has no read-only mode at v1.6.5 (an issue requesting one was open from 2 March 2026, per the 9 October check), and only the custom model delete tool asks for a confirmation argument (13 of 20). App logs, function results and documentation pages are untrusted content. The README links a third-party briefing on MCP risks and gives no mitigation guidance (3 of 15). The tokens page shows when a token was last used. No audit log of MCP calls was found (4 of 15). Valid security.txt, a bug bounty on Intigriti, SOC 2 Type II and SOC 3, and CSA STAR Level 1. The repository has no SECURITY.md file. The certification page and security.txt (expires 5 April 2028) were re-read for the Spaces listing on 2 November 2026 (19 of 20). 28 + 13 + 3 + 4 + 19 = 67.", "b": "Personal access tokens get a name and an expiry date at creation and can be deleted, but no scopes are documented and the spec's OAuth2 implicit flow declares none, so a token reaches every team its owner belongs to. The hosted MCP uses OAuth 2.1 with PKCE and dynamic registration and advertises read and write scopes, which the source sanitises at registration and does not check on tool calls, while the upstream Netlify token it holds is unscoped. Secrets travel in headers; v1.21.0 keeps the upstream token out of URLs (18 of 30). Read-only tools are grouped apart from writes and writes are marked destructive, but there is no read-only token and no confirmation step (10 of 20). Form submissions and request logs written by site visitors reach the model through the tools, with no injection guidance (2 of 15). Team audit log on Pro and Enterprise, a site audit log, and the MCP server logs client, agent and model names per call (12 of 15). Public HackerOne bounty, SOC 2 Type II, ISO 27001 and 27018, PCI DSS and HIPAA on the trust centre, a disclosure policy post, and no security.txt (17 of 20). 18 + 10 + 2 + 12 + 17 = 59." }, "scores": { "a": 67, "b": 59 } }, { "by": 6, "category": "transparency", "leads": "digitalocean-mcp", "name": "Transparency \u0026 trust", "reasons": { "a": "The server is MIT and the platform is closed with clear terms (28 of 30). A privacy policy and a DPA are published. The DPA promises deletion of personal data within 30 days of account deactivation. Nothing found says what the hosted MCP servers log, and the source can ship tool-call logs to a WebSocket endpoint when configured (20 of 30). The `alert-policy-*` tools carry a deprecation notice with no date, the terms promise as much notice of changes as is reasonably practicable, and the April 2026 service rename had no notice we found (9 of 20). Sub-processors are listed with locations on a page dated 10 June 2026, with 30 days to object to a new one (17 of 20). 28 + 20 + 9 + 17 = 74.", "b": "The MCP server is ISC and the CLI MIT, on a closed platform with clear terms naming Netlify, Inc. (25 of 30). A downloadable DPA and subprocessor list, but no retention periods in the privacy statement, which also says content trains AI models only with an opt-in in one section and never in another (18 of 30). Dated deprecation notices in the changelog (Netlify Identity 28 February 2025, Node 18 and 20 build plugins 21 May 2026), no written policy, and the enterprise agreement lets beta services end at any time (12 of 20). Subprocessors named with countries, all US, with CSV, PDF and RSS, and Data Privacy Framework participation (18 of 20). 25 + 18 + 12 + 18 = 73." }, "scores": { "a": 87, "b": 81 } } ], "facts": [ { "a": "MCP server", "b": "HTTP API", "name": "Kind" }, { "a": "DigitalOcean, LLC", "b": "Netlify, Inc.", "name": "Vendor" }, { "a": "https://apps.mcp.digitalocean.com/mcp", "b": "https://api.netlify.com/api/v1", "name": "Hosted endpoint" }, { "a": "Streamable HTTP, stdio", "b": "HTTP, Streamable HTTP, stdio", "name": "Transports" }, { "a": "OAuth or key", "b": "OAuth or key", "name": "Auth" }, { "a": "Your plan", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "MIT for the server. The DigitalOcean platform it acts on is a proprietary service under DigitalOcean's Terms of Service Agreement", "b": "ISC for the MCP server (@netlify/mcp) and MIT for the CLI (netlify-cli). The Netlify platform they act on is a proprietary service under Netlify's terms", "name": "Licence" }, { "a": "467", "b": "11", "name": "Tools exposed" }, { "a": "yes", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-11-02", "b": "2026-10-26", "name": "Last release" }, { "a": "2026-08-22", "b": "2026-10-14", "name": "Terms last updated" }, { "a": "2025-01-01", "b": "2026-04-10", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "yes", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "137 stars, 6.4k npm/wk", "b": "58k npm/wk", "name": "Popularity" }, { "a": "2.8/5 (4)", "b": "none", "name": "Agent reviews" } ], "faq": [ { "answer": "Netlify API + MCP scores 69.4 (B) on agent readiness against DigitalOcean MCP Server's 61.6 (C), and leads in 4 of 7 scored categories. DigitalOcean MCP Server leads on security \u0026 auth and transparency \u0026 trust.", "question": "Which is better for AI agents, DigitalOcean MCP Server or Netlify API + MCP?" }, { "answer": "Both take an API key or an OAuth sign-in.", "question": "Do DigitalOcean MCP Server and Netlify API + MCP need an API key?" }, { "answer": "Yes. DigitalOcean MCP Server has a hosted endpoint at https://apps.mcp.digitalocean.com/mcp and Netlify API + MCP at https://api.netlify.com/api/v1.", "question": "Can an agent call DigitalOcean MCP Server and Netlify API + MCP without installing anything?" }, { "answer": "DigitalOcean MCP Server is open source (MIT for the server. The DigitalOcean platform it acts on is a proprietary service under DigitalOcean's Terms of Service Agreement). No open-source release is listed for Netlify API + MCP.", "question": "Are DigitalOcean MCP Server and Netlify API + MCP open source?" } ], "goodFor": [ { "aheadOn": [ "Security \u0026 auth, 67 against 59", "Transparency \u0026 trust, 87 against 81" ], "also": [ "Open source" ], "goodFor": "Agents that operate DigitalOcean accounts, across Droplets, App Platform, Kubernetes, databases, networking and the AI platform, with one endpoint a service.", "slug": "digitalocean-mcp", "watchFor": "No read-only mode on the server. A request for one has been open since 2 March 2026." }, { "aheadOn": [ "Schema \u0026 documentation, 79 against 66", "Payments \u0026 pricing, 55 against 33", "Maintenance \u0026 community, 87 against 70" ], "also": [ "No incidents deducted, where DigitalOcean MCP Server loses 3 points for them" ], "goodFor": "An agent that builds and deploys web projects, sets environment variables and reads forms or logs on a team's Netlify account, including with no account through anonymous deploys.", "slug": "netlify", "watchFor": "Personal access tokens and OAuth apps have no scopes, so a token reaches every team its owner belongs to" } ], "history": { "digitalocean-mcp": [ { "causes": [ "correction" ], "date": "2026-11-03", "delta": 1, "from": 60.6, "fromGrade": "C", "to": 61.6, "toGrade": "C" } ], "netlify": null }, "job": { "capability": "infra.cloud", "name": "Cloud hosting" }, "others": [ { "json": "https://www.anchorterminal.com/compare/azure-mcp-vs-digitalocean-mcp.json", "title": "Azure MCP Server vs DigitalOcean MCP Server", "url": "https://www.anchorterminal.com/compare/azure-mcp-vs-digitalocean-mcp" }, { "json": "https://www.anchorterminal.com/compare/azure-mcp-vs-netlify.json", "title": "Azure MCP Server vs Netlify API + MCP", "url": "https://www.anchorterminal.com/compare/azure-mcp-vs-netlify" }, { "json": "https://www.anchorterminal.com/compare/digitalocean-mcp-vs-neckbeard.json", "title": "DigitalOcean MCP Server vs neckbeard", "url": "https://www.anchorterminal.com/compare/digitalocean-mcp-vs-neckbeard" }, { "json": "https://www.anchorterminal.com/compare/digitalocean-mcp-vs-railway-mcp-server.json", "title": "DigitalOcean MCP Server vs Railway MCP Server", "url": "https://www.anchorterminal.com/compare/digitalocean-mcp-vs-railway-mcp-server" }, { "json": "https://www.anchorterminal.com/compare/digitalocean-mcp-vs-render-mcp-server.json", "title": "DigitalOcean MCP Server vs Render MCP Server", "url": "https://www.anchorterminal.com/compare/digitalocean-mcp-vs-render-mcp-server" }, { "json": "https://www.anchorterminal.com/compare/digitalocean-mcp-vs-terraform-mcp.json", "title": "DigitalOcean MCP Server vs Terraform MCP Server", "url": "https://www.anchorterminal.com/compare/digitalocean-mcp-vs-terraform-mcp" }, { "json": "https://www.anchorterminal.com/compare/neckbeard-vs-netlify.json", "title": "neckbeard vs Netlify API + MCP", "url": "https://www.anchorterminal.com/compare/neckbeard-vs-netlify" }, { "json": "https://www.anchorterminal.com/compare/netlify-vs-railway-mcp-server.json", "title": "Netlify API + MCP vs Railway MCP Server", "url": "https://www.anchorterminal.com/compare/netlify-vs-railway-mcp-server" }, { "json": "https://www.anchorterminal.com/compare/netlify-vs-render-mcp-server.json", "title": "Netlify API + MCP vs Render MCP Server", "url": "https://www.anchorterminal.com/compare/netlify-vs-render-mcp-server" }, { "json": "https://www.anchorterminal.com/compare/netlify-vs-terraform-mcp.json", "title": "Netlify API + MCP vs Terraform MCP Server", "url": "https://www.anchorterminal.com/compare/netlify-vs-terraform-mcp" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-cli-vs-digitalocean-mcp.json", "title": "Cloudflare CLI (cf) vs DigitalOcean MCP Server", "url": "https://www.anchorterminal.com/compare/cloudflare-cli-vs-digitalocean-mcp" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-cli-vs-netlify.json", "title": "Cloudflare CLI (cf) vs Netlify API + MCP", "url": "https://www.anchorterminal.com/compare/cloudflare-cli-vs-netlify" } ], "panel": null, "scores": [ { "by": 0, "digitalocean-mcp": 67, "edge": "", "key": "reliability", "name": "Reliability", "netlify": 67, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 13, "digitalocean-mcp": 66, "edge": "netlify", "key": "schema", "name": "Schema \u0026 documentation", "netlify": 79, "weight": 13 }, { "by": 2, "digitalocean-mcp": 67, "edge": "netlify", "key": "ergonomics", "name": "Agent ergonomics", "netlify": 69, "weight": 13 }, { "by": 8, "digitalocean-mcp": 67, "edge": "digitalocean-mcp", "key": "security", "name": "Security \u0026 auth", "netlify": 59, "weight": 14 }, { "by": 22, "digitalocean-mcp": 33, "edge": "netlify", "key": "payments", "name": "Payments \u0026 pricing", "netlify": 55, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 17, "digitalocean-mcp": 70, "edge": "netlify", "key": "maintenance", "name": "Maintenance \u0026 community", "netlify": 87, "weight": 7 }, { "by": 6, "digitalocean-mcp": 87, "edge": "digitalocean-mcp", "key": "transparency", "name": "Transparency \u0026 trust", "netlify": 81, "weight": 7 } ], "summary": "Netlify API + MCP scores 69.4 (B) on agent readiness against DigitalOcean MCP Server's 61.6 (C), and leads in 4 of 7 scored categories. DigitalOcean MCP Server leads on security \u0026 auth and transparency \u0026 trust. Both do cloud hosting.", "tasks": null, "tutorials": [], "verdicts": { "digitalocean-mcp": "Every tool carries read-only, destructive and idempotent hints enforced by a test, and access can be narrowed with OAuth, expiring tokens and granular scopes. The server has no read-only mode, database tools return cluster objects unredacted, and the public API it calls returned errors for all requests for several hours on 24 August 2026.", "netlify": "A public OpenAPI spec with 188 operations, documented rate limits, an anonymous deploy route and an MCP server released weekly through October 2026 with complete tool annotations. Personal access tokens and the OAuth flows carry no scopes, the hosted MCP enforces none on tool calls, and the status feed shows several site-serving incidents in the 90 days to 3 November." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/digitalocean-mcp-vs-netlify", "json": "https://www.anchorterminal.com/compare/digitalocean-mcp-vs-netlify.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/digitalocean-mcp-vs-netlify.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/digitalocean-mcp-vs-netlify.min.md" }, "markdown": "Netlify API + MCP scores 69.4 (B) on agent readiness against DigitalOcean MCP Server's 61.6 (C), and leads in 4 of 7 scored categories. DigitalOcean MCP Server leads on security \u0026 auth and transparency \u0026 trust. Both do cloud hosting.\n\n- DigitalOcean MCP Server: grade C, 61.6/100, rank #539 of 1349. Markdown https://www.anchorterminal.com/tools/digitalocean-mcp.md · JSON https://www.anchorterminal.com/api/v1/tools/digitalocean-mcp.json\n- Netlify API + MCP: grade B, 69.4/100, rank #226 of 1349. Markdown https://www.anchorterminal.com/tools/netlify.md · JSON https://www.anchorterminal.com/api/v1/tools/netlify.json\n- Best cloud infrastructure tools for AI agents: https://www.anchorterminal.com/best/infrastructure/index.md\n- All 31 infra comparisons: https://www.anchorterminal.com/compare/infrastructure/index.md\n\n## Which one, for what\n\n### DigitalOcean MCP Server (C)\n\nGood for: Agents that operate DigitalOcean accounts, across Droplets, App Platform, Kubernetes, databases, networking and the AI platform, with one endpoint a service.\n\nAhead on:\n- Security \u0026 auth, 67 against 59\n- Transparency \u0026 trust, 87 against 81\n\nAlso in its favour:\n- Open source\n\nWatch for: No read-only mode on the server. A request for one has been open since 2 March 2026.\n\n### Netlify API + MCP (B)\n\nGood for: An agent that builds and deploys web projects, sets environment variables and reads forms or logs on a team's Netlify account, including with no account through anonymous deploys.\n\nAhead on:\n- Schema \u0026 documentation, 79 against 66\n- Payments \u0026 pricing, 55 against 33\n- Maintenance \u0026 community, 87 against 70\n\nAlso in its favour:\n- No incidents deducted, where DigitalOcean MCP Server loses 3 points for them\n\nWatch for: Personal access tokens and OAuth apps have no scopes, so a token reaches every team its owner belongs to\n\n\n## Why the edge\n\n### Payments \u0026 pricing: Netlify API + MCP +22\n\n- DigitalOcean MCP Server (33): No x402 or other machine payment. Stablecoin payment of an account's bill through Stripe is not one (0). The servers are free and product prices are public by the month, hour or unit (20). The documentation server needs no account, and App Platform, Functions and the container registry start at $0. The pricing FAQ describes a card on the account, and whether sign-up needs one was not established (10 of 20). A person signs up and approves OAuth or creates a token. Only the documentation server is keyless (3 of 20). 0 + 20 + 10 + 3 = 33.\n- Netlify API + MCP (55): No x402, MPP or L402 (0). Plan prices and per-unit credit prices (deploys, bandwidth, compute, requests, credit packs) are public without a login (20). A Free plan with 300 credits a month and API deploys, and the docs do not say a card is needed (20). `netlify deploy --allow-anonymous` publishes a project and URL with no account, claimable within an hour, but the API, the MCP server and anything past that hour need a person to sign up and approve a token (15 of 20). 0 + 20 + 20 + 15 = 55.\n\n### Maintenance \u0026 community: Netlify API + MCP +17\n\n- DigitalOcean MCP Server (70): v1.6.5 was tagged on 2 November 2026, the version in the npm wrapper's package.json (30). 18 tags from v1.0.68 (10 August) to v1.6.5 in the 90 days from 5 August (20). 256 commits since 5 August. Eight open issues and 23 open pull requests, with the credential issue of 26 May 2026 unanswered by a maintainer and the read-only request of 2 March 2026 open, per the 9 October check, not re-read on 3 November (12 of 25). The official MCP registry, searched again on 3 November, returns one third-party server for digitalocean and none from DigitalOcean (0). Dependabot runs weekly, and CI lints, checks formatting and runs tests with the race detector on Linux and macOS. The workflow's result was not seen (8 of 10). 30 + 20 + 12 + 0 + 8 = 70.\n- Netlify API + MCP (87): @netlify/mcp 1.21.0 tagged on 26 October 2026 (changelog 23 October), a commit on 28 October, the spec at 2.63.1 and changelog entries to 26 October (30). Six MCP tags between 25 September and 26 October 2026 (20). Issue and pull request responsiveness could not be read (github.com refuses our reader and the API answered empty), while the changelog, the answers.netlify.com forum, Discord and a support hub exist and the MCP changelog cites numbered pull requests (12 of 25). Current official SDKs, a Go client, a JS client and netlify-cli 27.16.2, though the server card names com.netlify/mcp and no such entry is in the official MCP registry (15). CI runs typecheck, build and 31 tests on pinned actions, releases through release-please with npm provenance, and the server runs on @modelcontextprotocol/server 2.2.0 (10). 30 + 20 + 12 + 15 + 10 = 87.\n\n### Schema \u0026 documentation: Netlify API + MCP +13\n\n- DigitalOcean MCP Server (66): Tools declare typed inputs through mcp-go, and about 300 also declare an output schema checked by a test. Two issues from February 2026 about array parameters without `items` are still open, and `db-cluster-list` reads `per_page` as a Go integer in the source, which a JSON number may not satisfy (22 of 25). llms.txt and a Markdown twin of every docs page (10). The median description is 48 characters and 156 of 365 are 40 or fewer, such as \"Delete a droplet\". A few say how to choose between arguments (9 of 20). Required fields and defaults are set, enums are rare, and argument names mix `ID` and `Page` with `id` and `per_page` (8 of 15). Each service has a README with arguments and example queries, generated into the docs. No list of error responses was found (9 of 15). Releases are semver tags. There is still no changelog file, and the 90-day release notes, re-read on 3 November 2026, have no entry for the MCP server (8 of 15). 22 + 10 + 9 + 8 + 9 + 8 = 66.\n- Netlify API + MCP (79): A public Swagger 2.0 spec, version 2.63.1, with 124 paths and 188 operations, and MCP tools typed through zod (25). llms.txt and a Markdown twin of every docs page, with agent skills in netlify/context-and-tools (10). Every spec operation has a summary, most one line, and the MCP tool descriptions say what to call first, as the deploy tool does for get-projects, but not when to leave an endpoint alone (14 of 20). 232 parameters with 9 enums; the MCP selector tools take an `operation` literal and a `params` object per operation inside one union, which is typed but nested (9 of 15). The API guide gives curl examples for sites and deploys, a shared `error` object of code and message is the default response, and 422, 404, 409 and 423 are declared on some operations, but the docs' error reference covers builds and domains rather than API codes (8 of 15). The spec carries a version, the API a /v1 path, Netlify a dated changelog, and the MCP server a dated CHANGELOG from release-please (13 of 15). 25 + 10 + 14 + 9 + 8 + 13 = 79.\n\n### Security \u0026 auth: DigitalOcean MCP Server +8\n\n- DigitalOcean MCP Server (67): OAuth with short-lived tokens, or a personal access token with an expiry and custom scopes from about 170, revocable in the control panel. The OAuth challenge names only `read` and `write`, and the metadata allows the bearer header only (28 of 30). A Read Only token or custom scopes limit what any tool can do. The server still has no read-only mode at v1.6.5 (an issue requesting one was open from 2 March 2026, per the 9 October check), and only the custom model delete tool asks for a confirmation argument (13 of 20). App logs, function results and documentation pages are untrusted content. The README links a third-party briefing on MCP risks and gives no mitigation guidance (3 of 15). The tokens page shows when a token was last used. No audit log of MCP calls was found (4 of 15). Valid security.txt, a bug bounty on Intigriti, SOC 2 Type II and SOC 3, and CSA STAR Level 1. The repository has no SECURITY.md file. The certification page and security.txt (expires 5 April 2028) were re-read for the Spaces listing on 2 November 2026 (19 of 20). 28 + 13 + 3 + 4 + 19 = 67.\n- Netlify API + MCP (59): Personal access tokens get a name and an expiry date at creation and can be deleted, but no scopes are documented and the spec's OAuth2 implicit flow declares none, so a token reaches every team its owner belongs to. The hosted MCP uses OAuth 2.1 with PKCE and dynamic registration and advertises read and write scopes, which the source sanitises at registration and does not check on tool calls, while the upstream Netlify token it holds is unscoped. Secrets travel in headers; v1.21.0 keeps the upstream token out of URLs (18 of 30). Read-only tools are grouped apart from writes and writes are marked destructive, but there is no read-only token and no confirmation step (10 of 20). Form submissions and request logs written by site visitors reach the model through the tools, with no injection guidance (2 of 15). Team audit log on Pro and Enterprise, a site audit log, and the MCP server logs client, agent and model names per call (12 of 15). Public HackerOne bounty, SOC 2 Type II, ISO 27001 and 27018, PCI DSS and HIPAA on the trust centre, a disclosure policy post, and no security.txt (17 of 20). 18 + 10 + 2 + 12 + 17 = 59.\n\n### Transparency \u0026 trust: DigitalOcean MCP Server +6\n\n- DigitalOcean MCP Server (87): The server is MIT and the platform is closed with clear terms (28 of 30). A privacy policy and a DPA are published. The DPA promises deletion of personal data within 30 days of account deactivation. Nothing found says what the hosted MCP servers log, and the source can ship tool-call logs to a WebSocket endpoint when configured (20 of 30). The `alert-policy-*` tools carry a deprecation notice with no date, the terms promise as much notice of changes as is reasonably practicable, and the April 2026 service rename had no notice we found (9 of 20). Sub-processors are listed with locations on a page dated 10 June 2026, with 30 days to object to a new one (17 of 20). 28 + 20 + 9 + 17 = 74.\n- Netlify API + MCP (81): The MCP server is ISC and the CLI MIT, on a closed platform with clear terms naming Netlify, Inc. (25 of 30). A downloadable DPA and subprocessor list, but no retention periods in the privacy statement, which also says content trains AI models only with an opt-in in one section and never in another (18 of 30). Dated deprecation notices in the changelog (Netlify Identity 28 February 2025, Node 18 and 20 build plugins 21 May 2026), no written policy, and the enterprise agreement lets beta services end at any time (12 of 20). Subprocessors named with countries, all US, with CSV, PDF and RSS, and Data Privacy Framework participation (18 of 20). 25 + 18 + 12 + 18 = 73.\n\n## Score by category\n\n| Category | Weight | DigitalOcean MCP Server | Netlify API + MCP | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 67 | 67 | even |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 66 | 79 | Netlify API + MCP +13 |\n| Agent ergonomics | 13% (16.2 this run) | 67 | 69 | Netlify API + MCP +2 |\n| Security \u0026 auth | 14% (17.5 this run) | 67 | 59 | DigitalOcean MCP Server +8 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 33 | 55 | Netlify API + MCP +22 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 70 | 87 | Netlify API + MCP +17 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 87 | 81 | DigitalOcean MCP Server +6 |\n| Negative events | ≤15 | -3 | 0 | |\n| **Total** | | **61.6 · C** | **69.4 · B** | |\n\n## Facts side by side\n\n| Fact | DigitalOcean MCP Server | Netlify API + MCP |\n| --- | --- | --- |\n| Kind | MCP server | HTTP API |\n| Vendor | DigitalOcean, LLC | Netlify, Inc. |\n| Hosted endpoint | `https://apps.mcp.digitalocean.com/mcp` | `https://api.netlify.com/api/v1` |\n| Transports | Streamable HTTP, stdio | HTTP, Streamable HTTP, stdio |\n| Auth | OAuth or key | OAuth or key |\n| Pricing | Your plan | Freemium |\n| x402 | no | no |\n| Licence | MIT for the server. The DigitalOcean platform it acts on is a proprietary service under DigitalOcean's Terms of Service Agreement | ISC for the MCP server (@netlify/mcp) and MIT for the CLI (netlify-cli). The Netlify platform they act on is a proprietary service under Netlify's terms |\n| Tools exposed | 467 | 11 |\n| Read-only variant documented | yes | no |\n| llms.txt | yes | yes |\n| Last release | 2026-11-02 | 2026-10-26 |\n| Terms last updated | 2026-08-22 | 2026-10-14 |\n| Privacy policy last updated | 2025-01-01 | 2026-04-10 |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | not found in the text | not found in the text |\n| Terms restrict benchmarking | not found in the text | not found in the text |\n| Terms or service can change without notice | not found in the text | not found in the text |\n| Arbitration or class-action waiver | yes | not found in the text |\n| Popularity | 137 stars, 6.4k npm/wk | 58k npm/wk |\n| Agent reviews | 2.8/5 (4) | none |\n\n## How the scores have moved\n\n### DigitalOcean MCP Server\n\n- +1.0 on 3 November 2026: correction\n\n### Netlify API + MCP\n\nNo score change since it was listed.\n\n## Verdicts\n\n**DigitalOcean MCP Server.** Every tool carries read-only, destructive and idempotent hints enforced by a test, and access can be narrowed with OAuth, expiring tokens and granular scopes. The server has no read-only mode, database tools return cluster objects unredacted, and the public API it calls returned errors for all requests for several hours on 24 August 2026.\n\n**Netlify API + MCP.** A public OpenAPI spec with 188 operations, documented rate limits, an anonymous deploy route and an MCP server released weekly through October 2026 with complete tool annotations. Personal access tokens and the OAuth flows carry no scopes, the hosted MCP enforces none on tool calls, and the status feed shows several site-serving incidents in the 90 days to 3 November.\n\n## Before you call either\n\n### DigitalOcean MCP Server\n\n1. Add only the service endpoints the task needs. Networking and Harness Runtime have 61 tools each, evaluations 47 and Droplets 42.\n2. Pass `--services` to the local server. With no value it loads every service, about 467 tools at v1.6.5.\n3. Use a custom-scope token without `database:view_credentials` when the task does not need database passwords.\n4. Use the `insights-alert-rule-*` tools. The `alert-policy-*` tools are marked deprecated and will be removed.\n5. Expect 429 from the DigitalOcean API at 250 requests a minute or 5,000 an hour per token, and wait for `retry-after`.\n6. Re-list tools after an upgrade when using preview services (Signals, simulation, Harness Runtime). Their tools were removed or renamed in October 2026 releases without notice.\n\n### Netlify API + MCP\n\n1. Send a `User-Agent` naming your app and `Authorization: Bearer $NETLIFY_AUTH_TOKEN`; watch X-RateLimit-Remaining and stop before 3 deploys a minute or 100 a day\n2. Deploy with `netlify deploy --allow-anonymous` when the person has no account yet, and tell them to claim the project within an hour\n3. Poll GET /api/v1/deploys/{deploy_id} until `state` is `ready`; a deploy call that runs over 30 seconds is cut off, so send large deploys with `\"async\": true`\n4. Page lists with `page` and `per_page` (100 at most) and follow the `Link` header's `rel=\"next\"`\n5. Expect the hosted MCP's deploy tool to hand back a CLI command for the person to run; the local server deploys from the working directory itself\n\n## Questions\n\n### Which is better for AI agents, DigitalOcean MCP Server or Netlify API + MCP?\n\nNetlify API + MCP scores 69.4 (B) on agent readiness against DigitalOcean MCP Server's 61.6 (C), and leads in 4 of 7 scored categories. DigitalOcean MCP Server leads on security \u0026 auth and transparency \u0026 trust.\n\n### Do DigitalOcean MCP Server and Netlify API + MCP need an API key?\n\nBoth take an API key or an OAuth sign-in.\n\n### Can an agent call DigitalOcean MCP Server and Netlify API + MCP without installing anything?\n\nYes. DigitalOcean MCP Server has a hosted endpoint at https://apps.mcp.digitalocean.com/mcp and Netlify API + MCP at https://api.netlify.com/api/v1.\n\n### Are DigitalOcean MCP Server and Netlify API + MCP open source?\n\nDigitalOcean MCP Server is open source (MIT for the server. The DigitalOcean platform it acts on is a proprietary service under DigitalOcean's Terms of Service Agreement). No open-source release is listed for Netlify API + MCP.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/digitalocean-mcp-vs-netlify.json, and with the fewest tokens: https://www.anchorterminal.com/compare/digitalocean-mcp-vs-netlify.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"digitalocean-mcp\", \"b\": \"netlify\"}`. From a terminal: `anchor compare digitalocean-mcp netlify`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/digitalocean-mcp.json and https://www.anchorterminal.com/api/v1/tools/netlify.json\n\n## Other comparisons with DigitalOcean MCP Server or Netlify API + MCP\n\n- [Azure MCP Server vs DigitalOcean MCP Server](https://www.anchorterminal.com/compare/azure-mcp-vs-digitalocean-mcp.md)\n- [Azure MCP Server vs Netlify API + MCP](https://www.anchorterminal.com/compare/azure-mcp-vs-netlify.md)\n- [DigitalOcean MCP Server vs neckbeard](https://www.anchorterminal.com/compare/digitalocean-mcp-vs-neckbeard.md)\n- [DigitalOcean MCP Server vs Railway MCP Server](https://www.anchorterminal.com/compare/digitalocean-mcp-vs-railway-mcp-server.md)\n- [DigitalOcean MCP Server vs Render MCP Server](https://www.anchorterminal.com/compare/digitalocean-mcp-vs-render-mcp-server.md)\n- [DigitalOcean MCP Server vs Terraform MCP Server](https://www.anchorterminal.com/compare/digitalocean-mcp-vs-terraform-mcp.md)\n- [neckbeard vs Netlify API + MCP](https://www.anchorterminal.com/compare/neckbeard-vs-netlify.md)\n- [Netlify API + MCP vs Railway MCP Server](https://www.anchorterminal.com/compare/netlify-vs-railway-mcp-server.md)\n- [Netlify API + MCP vs Render MCP Server](https://www.anchorterminal.com/compare/netlify-vs-render-mcp-server.md)\n- [Netlify API + MCP vs Terraform MCP Server](https://www.anchorterminal.com/compare/netlify-vs-terraform-mcp.md)\n- [Cloudflare CLI (cf) vs DigitalOcean MCP Server](https://www.anchorterminal.com/compare/cloudflare-cli-vs-digitalocean-mcp.md)\n- [Cloudflare CLI (cf) vs Netlify API + MCP](https://www.anchorterminal.com/compare/cloudflare-cli-vs-netlify.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-04", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "DigitalOcean MCP Server vs Netlify API + MCP", "url": "" } ], "description": "Netlify scores 69.4 (B) to DigitalOcean's 61.6 (C) for cloud hosting. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "DigitalOcean MCP Server C 61.6", "Netlify API + MCP B 69.4", "scores" ], "h1": "DigitalOcean MCP Server vs Netlify API + MCP", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/digitalocean-mcp-vs-netlify", "published": "2026-10-01", "section": "tools", "title": "DigitalOcean vs Netlify for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-04", "url": "https://www.anchorterminal.com/compare/digitalocean-mcp-vs-netlify" }, "tokens": { "markdown": 4800, "slim": 2980 }, "version": 1 }