# Introduction

pfcloud sets up servers over SSH and deploys apps to them. Everything you do in the dashboard can also be done by a program: a script, a CI job, your own website, or an AI assistant.

## What you can do

- Add and connect servers, check their health and security, open firewall ports, create databases, manage PHP versions.
- Create sites (Laravel, PHP, static, Next.js, Node, Python, custom apps in any language, Docker, WordPress), turn on HTTPS, set DNS.
- Deploy, roll back, promote a staging environment to production, move a site to another server.
- Read logs, back up and restore databases, read and change `.env` files, run commands.
- Read the team's activity log, invite people.
- Ask to delete things. Deleting always needs a human to approve it in the dashboard.

## Three ways to connect

| Way | Use it when | Start here |
| --- | --- | --- |
| REST API (`/api/v1`) | You write code or scripts. | [Quickstart](/developers/quickstart) |
| MCP server (`POST /api/mcp`) | You want Claude, Cursor or another AI tool to work with pfcloud in plain language. | [MCP server](/developers/mcp-server) |
| OpenAPI file and `llms.txt` | You generate a client, or you give an AI agent the full reference. | [OpenAPI and clients](/developers/openapi-and-clients) |

All three use the same API token (it starts with `mf_`). An AI tool never gets more rights than the token you give it.

## How access works, in one minute

1. A person makes a token in the dashboard (**API**, then **Tokens**) and ticks the rights ("scopes") it needs.
2. The token acts as that person, inside one team. It can never do more than that person can do.
3. Four checks run on every request: the token, the plan, the team owner's rules, and the person's own permissions. See [Scopes and permissions](/developers/scopes-and-permissions).
4. Deleting is never done by the API. It creates a request that an owner or admin approves. See [Deleting safely](/developers/deleting-safely).

## Map of these docs

**Getting started**
- [Quickstart](/developers/quickstart): your first token and first calls.
- [Authentication](/developers/authentication): how tokens work, expiry, IP limits.
- [Scopes and permissions](/developers/scopes-and-permissions): every scope, its risk, and who may use it.
- [Requests and errors](/developers/requests-and-errors): ids, pages, errors, retries, rate limits, waiting for slow jobs.

**Guides**
- [Create a site](/developers/create-a-site), [Deploy and roll back](/developers/deploy-and-rollback), [Servers and health](/developers/servers-and-health), [HTTPS certificates](/developers/https-certificates), [Backups and restore](/developers/backups-and-restore), [.env and commands](/developers/env-and-commands), [DNS and domains](/developers/dns-and-domains), [Teams and the audit log](/developers/teams-and-audit-log), [Deleting safely](/developers/deleting-safely).

**Using AI**
- [AI overview](/developers/ai-overview), [MCP server](/developers/mcp-server), [AI with the REST API](/developers/ai-with-the-rest-api), [AI token recipes](/developers/ai-token-recipes), [AI security](/developers/ai-security).

**Reference**
- [Webhooks](/developers/webhooks), [OpenAPI and clients](/developers/openapi-and-clients), [Troubleshooting](/developers/troubleshooting).
- API reference, one page per area, written from the OpenAPI file: [Servers](/developers/api-servers), [Sites](/developers/api-sites), [Site services](/developers/api-site-services), [Site web](/developers/api-site-web), [Environments](/developers/api-environments), [Environment](/developers/api-environment), [Logs and commands](/developers/api-logs-and-commands), [Backups](/developers/api-backups), [DNS](/developers/api-dns), [Team](/developers/api-team), [Recipes](/developers/api-recipes), [Standby servers](/developers/api-standby-servers), [Moving sites](/developers/api-moving-sites).

## For AI agents

The same docs are available as plain Markdown: add `.md` to any page address, or read `/llms.txt` (index) and `/llms-full.txt` (everything in one file).