AI overview
What an AI assistant can do with pfcloud, three ways to give it access, and what still needs a human.
What an AI can do
With a token, an AI assistant (Claude, Cursor, ChatGPT agents, your own agent) can do what the token allows, in plain language:
- "Which certificates expire this month?" then renew them.
- "Why did the last deploy of shop fail?" It reads the deployment log and the code scan findings.
- "Deploy staging, and if it works, promote it."
- "Check the security report of web-1 and tell me what to fix first."
- "Create a site for this repository on web-2 and point DNS at it."
Three ways to give it access
| Route | How | Best for |
|---|---|---|
| MCP server | The AI tool connects to POST /api/mcp with a token. Tools are ready-made and safe by design. |
Chat assistants and coding tools. Simplest and safest. |
| REST API | The agent calls /api/v1 itself, guided by openapi.json and a system prompt. |
Your own agents and automations that need more than the MCP tools. |
| Command line | php artisan myforge:* on the pfcloud host. |
Operators of the pfcloud install. |
MCP offers a fixed list of tools (reads, deploy, roll back, renew certificate, back up, security check). The REST API offers everything, including creating sites and servers, DNS, .env and commands, depending on the scopes you grant.
What an AI can never do
- Delete servers, sites or databases. It can only ask, and a human approves. See Deleting safely.
- Do more than the person who made the token, or more than the token's scopes, plan and the team owner's rules allow.
- Create tokens or change who owns the team.
- Approve a commit that the code scan blocked.
What still needs a human
- Making the token, and deciding its scopes, expiry and limits.
- Approving deletions.
- Approving a code-scan finding after reviewing the code.
- Paying, changing plans, changing roles, removing members.
- Judgement: whether to roll back, whether a restore is worth losing recent data, whether to open a firewall port.
How to start
- Read AI token recipes and pick the smallest recipe that fits.
- Read AI security. It is short and it matters.
- Connect: MCP server or AI with the REST API.
- Start with a read-only token for a day. Watch API, then Activity. Then add rights one by one.