mcp-dokku

claude mcp add mcp-dokku -- node /opt/mcp/mcp-dokku/build/index.js
# env: DOKKU_HOST, DOKKU_USER, DOKKU_SSH_KEY (path to the deploy key)

About twenty tools across the Dokku surface I actually use: apps, process state, domains, letsencrypt, ports, config, and logs. Enough to create an app, point a domain at it, and turn on SSL from inside the agent.

There is no Dokku API

Dokku has no HTTP API. It is a CLI on the host, full stop. So every tool shells out over SSH with execFile("ssh", ["-i", KEY, ...]) and parses the output. execFile, not a shell string, so an app name never gets the chance to become a command injection.

The server also ships ordered instructions for the multi-step flows, because the steps have a required sequence: create the app, add domains, then enable letsencrypt. SSL before DNS resolves just fails. Encoding the order in the server means the agent follows the path that works instead of discovering the constraint the hard way.