# Netlify API + MCP (slim)

> Netlify's platform for deploying and running web projects, reached through a REST API with a public OpenAPI spec, the netlify-cli command line tool and an official MCP server, hosted at netlify-mcp.netlify.app or run locally from npm.

- Full: https://www.anchorterminal.com/tools/netlify.md (~9,350 tokens) · this version ~1,930 tokens · JSON https://www.anchorterminal.com/tools/netlify.json · canonical https://www.anchorterminal.com/tools/netlify
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-04 · pricing https://www.anchorterminal.com/tools/netlify#pricing · reviews https://www.anchorterminal.com/tools/netlify#reviews
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

**B · 69.4/100 · rank #225 of 1349 · #3 in Cloud & infrastructure · not agent-ready · confidence medium**


Assessment: A public OpenAPI spec with 188 operations, documented rate limits, an anonymous deploy route and an MCP server released weekly through October 2026 with complete tool annotations. Personal access tokens and the OAuth flows carry no scopes, the hosted MCP enforces none on tool calls, and the status feed shows several site-serving incidents in the 90 days to 3 November.

## Facts

- Kind: HTTP API · vendor: Netlify, Inc. · category: Cloud & infrastructure · legal entity: Netlify, Inc. · provenance 89/100
- Endpoint: `https://api.netlify.com/api/v1` (HTTP, Streamable HTTP, stdio)
- Auth: OAuth or key · pricing: Freemium · x402: no · licence: ISC for the MCP server (@netlify/mcp) and MIT for the CLI (netlify-cli). The Netlify platform they act on is a proprietary service under Netlify's terms
- Probe metrics: not measured yet (probes haven't run)
- Surface listed: The REST API at https://api.netlify.com/api/v1, the netlify-cli tool and the official MCP server (hosted at netlify-mcp.netlify.app/mcp, local as @netlify/mcp), read from docs.netlify.com, the open-api and netlify-mcp repositories (shallow clone), npm, the status feed, the trust centre and the legal pages on 3 November 2026. No account was made and no tool was called; a plain GET to the MCP endpoint answered 401
- REST operations: 188 across 124 paths in the 2.63.1 spec, covering sites, deploys, builds, files, functions, forms and submissions, DNS zones, hooks, environment variables, members, accounts, agent runners and the database, among others
- MCP tools: By default about 11, a reader and an updater selector tool per domain (user, deploy, team, project, extension, observability) wrapping 25 operations, plus get-netlify-coding-context and a Claude design import. OpenAI clients get each operation as its own tool. The remote server's deploy tool returns a CLI command; the local one deploys itself
- Rate limits: About 500 requests a minute; 3 deploys a minute and 100 a day; stricter limits on some operations. X-RateLimit-Limit, -Remaining and -Reset headers. Higher limits through support
- Pagination: `page` (from 1) and `per_page` (100 at most) with a `Link` header carrying next, prev and last
- Errors: A shared `error` object with `code` and `message` as the default response; 400, 401, 403, 404, 409, 422, 423 and 429 declared on some operations. The docs' error reference covers builds and domains, not API codes
- Status: netlifystatus.com (Statuspage) with incident history and an Atom feed. 19 incidents from 18 August to 2 November 2026, none naming the API
- SDKs: Official Go client in netlify/open-api, JS client in netlify/build, netlify-cli 27.16.2 (Node 22.13 or later, about 496,000 downloads a week), agent skills in netlify/context-and-tools
- Audit logs: Team audit log on Pro and Enterprise with team and project events, retention by plan, plus a site audit log. The MCP server logs the agent name, model and client on each call
- Certifications: SOC 2 Type II, ISO/IEC 27001 and 27018, PCI DSS v4, HIPAA, Data Privacy Framework, per the trust centre. Public bug bounty at hackerone.com/netlify
- Legal entity: Netlify, Inc., 101 2nd Street, San Francisco, named in the terms of use (14 October 2026) and privacy statement (10 April 2026). Affiliates include Netlify EMEA Limited and Netlify UK Limited
- Prices: Personal $9 per month (plan); Pro $20 per month (plan); Credit (Pro pack) $0.0067 per credit; Bandwidth $0.13 per GB of traffic

- Scores: Reliability 67, Performance pending, Schema & documentation 79, Agent ergonomics 69, Security & auth 59, Payments & pricing 55, Task success pending, Maintenance & community 87, Transparency & trust 81 · total over the 7 assessed categories
- Why: Reliability, Read with the hosted lines. · Schema & documentation, A public Swagger 2.0 spec, version 2.63.1, with 124 paths and 188 operations, and MCP tools typed through zod (25). · Agent ergonomics, Lists are sized with `per_page` up to 100 and there is no field selection. · Security & auth, Personal access tokens get a name and an expiry date at creation and can be deleted, but no scopes are documented and the spec's OAuth2 impl… · Payments & pricing, No x402, MPP or L402 (0). · Maintenance & community, @netlify/mcp 1.21.0 tagged on 26 October 2026 (changelog 23 October), a commit on 28 October, the spec at 2.63.1 and changelog entries to 26… · Transparency & trust, The MCP server is ISC and the CLI MIT, on a closed platform with clear terms naming Netlify, Inc.
- Sources: 30, open questions: 9, both in the full twin
- Capabilities: infra.cloud, code.deploy, observability.logs
- JSON: https://www.anchorterminal.com/api/v1/tools/netlify.json
- Verify (for the vendor): the badge `https://www.anchorterminal.com/badges/netlify.svg` or a link to https://www.anchorterminal.com/tools/netlify from a page on netlify.com or one of its subdomains, or the README at the root of github.com/netlify/netlify-mcp, then `POST https://www.anchorterminal.com/api/v1/verify` `{"slug", "url"}` or `verify_listing` at /mcp; re-checked weekly, no effect on the grade. Snippets in the full twin.
- Support: Discord https://discord.gg/netlify; https://www.netlify.com/support/; https://docs.netlify.com/; more in the full twin

## Before you call it

1. Send a `User-Agent` naming your app and `Authorization: Bearer $NETLIFY_AUTH_TOKEN`; watch X-RateLimit-Remaining and stop before 3 deploys a minute or 100 a day
2. Deploy with `netlify deploy --allow-anonymous` when the person has no account yet, and tell them to claim the project within an hour
3. Poll GET /api/v1/deploys/{deploy_id} until `state` is `ready`; a deploy call that runs over 30 seconds is cut off, so send large deploys with `"async": true`
4. Page lists with `page` and `per_page` (100 at most) and follow the `Link` header's `rel="next"`
5. Expect the hosted MCP's deploy tool to hand back a CLI command for the person to run; the local server deploys from the working directory itself

## Connect

```bash
npm install -g netlify-cli
```

```bash
curl -H "User-Agent: MyApp (you@example.com)" -H "Authorization: Bearer $NETLIFY_AUTH_TOKEN" https://api.netlify.com/api/v1/sites
```

```bash
claude mcp add --transport http netlify https://netlify-mcp.netlify.app/mcp
```
Full config and headless snippets are in the full page. Through letme (picks today, calling later): https://letme.dev/netlify

## Similar tools

| Tool | Grade | Score | Shared capabilities | Slim |
| --- | --- | --- | --- | --- |
| Render MCP Server | B | 66.9 | infra.cloud, code.deploy, observability.logs | https://www.anchorterminal.com/tools/render-mcp-server.min.md |
| DigitalOcean MCP Server | C | 60.6 | infra.cloud, code.deploy | https://www.anchorterminal.com/tools/digitalocean-mcp.min.md |
| Railway MCP Server | C | 56.8 | infra.cloud, code.deploy | https://www.anchorterminal.com/tools/railway-mcp-server.min.md |
| Google Cloud Secret Manager | BB | 75.7 | infra.cloud | https://www.anchorterminal.com/tools/google-secret-manager.min.md |
| LaunchDarkly | BB | 71.3 | observability.logs | https://www.anchorterminal.com/tools/launchdarkly.min.md |


## Panel reviews (0, desk reviews from public material, no calls made)