MCP server for agents

@redswitches/mcp lets AI agents and assistants that speak the Model Context Protocol read your RedSwitches account, and, only if you allow it, order and power servers.

Hosted or local

The same tools come in two forms:

• Hosted: https://mcp.redswitches.com/mcp, nothing to install. Your client sends your key as Authorization: Bearer rsw_live_XXXX… on every request; the server uses it for that request only and never stores or logs it. Writes are allowed per connection with the header X-RedSwitches-Allow-Writes: true, reinstall and rescue also with X-RedSwitches-Allow-Destructive: true. Setup for each client is on AI agents and assistants.
• Local: @redswitches/mcp, which runs over stdio on your machine. The rest of this page shows its flags; the hosted server's headers do the same.

Read-only by default

The local server runs over stdio. Out of the box it offers read tools only: account, offers, servers, traffic, orders, invoices (with read_billing), SSH keys, reverse DNS requests, cancellation state and actions. An agent cannot change anything.

Write tools (order, power, label, reverse DNS, SSH keys, cancellation) appear only when both are true:

• the key holds the permission (order, power, manage, ssh_keys, cancel), and
• you start the server with --allow-writes.

Reinstall and rescue tools need a third step: start with --allow-writes --allow-destructive, and the key must hold reinstall or rescue.

The server reads the key's permissions when it starts. If it cannot, it offers read tools only.

Give the agent its own key with only the permissions it needs, an IP list if you can, and a low monthly spend limit if it may order.

Client configuration

Read-only:

{
  "mcpServers": {
    "redswitches": {
      "command": "npx",
      "args": ["-y", "@redswitches/mcp"],
      "env": { "REDSWITCHES_API_KEY": "rsw_live_XXXX…" }
    }
  }
}

With writes allowed:

{
  "mcpServers": {
    "redswitches": {
      "command": "npx",
      "args": ["-y", "@redswitches/mcp", "--allow-writes"],
      "env": { "REDSWITCHES_API_KEY": "rsw_live_XXXX…" }
    }
  }
}

How write tools behave

• Every write tool requires an idempotency key. The agent makes one per action and reuses it when it retries, so a repeated tool call does not order or reboot twice.
• Ordering takes two tools. quote_order runs a dry run and shows the exact total. create_order orders only with that total as expected_total, and only after a quote for the same offer and OS; if the price moved, nothing is ordered.
• Reinstall and rescue do not return a password to the agent. It is delivered as in the client area.
• Power tools return the action and can wait for it to finish.
• Errors come back with the API's error code and message, so the agent can tell sold_out from insufficient_credit.
• Tool descriptions tell the agent that text from the API, such as server labels and host names, is data to show, never instructions to follow.

Good practice

• Start read-only. Add --allow-writes only for agents you supervise, and --allow-destructive only when the agent must reinstall or rescue servers.
• Keep the agent's key separate from your own automation, so you can revoke it alone.
• The API's own limits still apply: rate limits, order limits, and the power-off brake. See Rate limits and errors and the Power and actions guide.