# AI overview

## What an AI can do

With a token, an AI assistant (Claude, Cursor, ChatGPT agents, your own agent) can do what the token allows, in plain language:

- "Which certificates expire this month?" then renew them.
- "Why did the last deploy of shop fail?" It reads the deployment log and the code scan findings.
- "Deploy staging, and if it works, promote it."
- "Check the security report of web-1 and tell me what to fix first."
- "Create a site for this repository on web-2 and point DNS at it."

## Three ways to give it access

| Route | How | Best for |
| --- | --- | --- |
| [MCP server](/developers/mcp-server) | The AI tool connects to `POST /api/mcp` with a token. Tools are ready-made and safe by design. | Chat assistants and coding tools. Simplest and safest. |
| [REST API](/developers/ai-with-the-rest-api) | The agent calls `/api/v1` itself, guided by `openapi.json` and a system prompt. | Your own agents and automations that need more than the MCP tools. |
| Command line | `php artisan myforge:*` on the pfcloud host. | Operators of the pfcloud install. |

MCP offers a fixed list of tools (reads, deploy, roll back, renew certificate, back up, security check). The REST API offers everything, including creating sites and servers, DNS, `.env` and commands, depending on the scopes you grant.

## What an AI can never do

- Delete servers, sites or databases. It can only ask, and a human approves. See [Deleting safely](/developers/deleting-safely).
- Do more than the person who made the token, or more than the token's scopes, plan and the team owner's rules allow.
- Create tokens or change who owns the team.
- Approve a commit that the code scan blocked.

## What still needs a human

- Making the token, and deciding its scopes, expiry and limits.
- Approving deletions.
- Approving a code-scan finding after reviewing the code.
- Paying, changing plans, changing roles, removing members.
- Judgement: whether to roll back, whether a restore is worth losing recent data, whether to open a firewall port.

## How to start

1. Read [AI token recipes](/developers/ai-token-recipes) and pick the smallest recipe that fits.
2. Read [AI security](/developers/ai-security). It is short and it matters.
3. Connect: [MCP server](/developers/mcp-server) or [AI with the REST API](/developers/ai-with-the-rest-api).
4. Start with a read-only token for a day. Watch **API**, then **Activity**. Then add rights one by one.