MCP DigitalOcean Integration

What it does

This is DigitalOcean's own MCP server for its cloud. It calls the DigitalOcean public API through the godo Go client, so an assistant can list, create, change and delete resources in your account. That covers droplets and images, App Platform apps, managed databases, Kubernetes (DOKS) clusters, the container registry, domains and DNS, firewalls, load balancers, VPCs and CDNs, Spaces object storage, volumes, NFS shares, serverless functions, Marketplace apps, Insights monitoring and uptime checks, account and billing details, and several GenAI and inference products. A docs service searches DigitalOcean's public documentation.

Tools come in 24 services. Locally, the npm package @digitalocean/mcp starts a Go binary over stdio, and --services picks which groups load (apps,droplets for example). Leave it out and every service loads, which makes for a very long tool list. An unknown service name stops it at start. DigitalOcean also hosts each service at its own HTTPS address, such as https://apps.mcp.digitalocean.com/mcp, which takes OAuth sign-in or a personal access token as a bearer header.

The same binary can serve HTTP itself with --transport http. It binds to 127.0.0.1:8080 unless --bind-addr is set, and reads the token from each request's Authorization header. Since 1.6.5 there is an --allow-anonymous switch (or ALLOW_ANONYMOUS) for running the docs service over HTTP with no token check and no OAuth metadata. main.go refuses to start with it unless --services names docs alone, and on stdio it is ignored.

What it needs

For the local npm way you need npm 8 or later and a personal access token in DIGITALOCEAN_API_TOKEN, created in the DigitalOcean control panel. The token's scopes decide what the tools can do. On stdio the binary exits without a token even when only the docs service is loaded, though the docs tools themselves never use it. The hosted endpoints need no local runtime: a client with OAuth support signs in through the browser, and others send the token as a bearer header.

Limits

• Limit On stdio the server exits at start without DIGITALOCEAN_API_TOKEN or --digitalocean-api-token, whatever services are chosen
• Limit --allow-anonymous works only over HTTP with --services set to docs alone, and the server refuses to start otherwise
• Not covered Hosted endpoints are one address per service, so each product you want is a separate client entry
• Size cap With no --services every service loads, a long tool list. The README advises loading only what you need
• Limit The README's example names droplet-resize and droplet-enable-backups differ from the droplet service's own names (resize-droplet, enable-backups-droplet)
• Early release The v1 alert-policy tools are marked deprecated in favour of the insights-alert-rule tools
• Size cap insights-logs-search, insights-spans-search and insights-traces-search take a From/To window of at most 7 days
• Cost Creating droplets, databases, clusters and other resources bills your DigitalOcean account

The hosted endpoints are one URL per service, so you add one entry for each product you want. In stdio mode the server exits at start if it has no token (set by DIGITALOCEAN_API_TOKEN or --digitalocean-api-token). The README advises enabling only the services you need, to keep context small and answers accurate. Its example tool names for droplets (droplet-resize, droplet-enable-backups) differ from the names in the droplet service's own README (resize-droplet, enable-backups-droplet). The makers link a warning that using MCP with a DigitalOcean account carries risks. Actions such as creating droplets or databases bill your account.

Who it suits

Suits DigitalOcean users who want an assistant to inspect and run their infrastructure and prefer the vendor's own server. The hosted OAuth endpoints suit people who would rather not handle a token. The local npm way suits clients without OAuth, or anyone who wants one process carrying several services picked with --services. Teams self-hosting a public docs lookup can run the docs service over HTTP with --allow-anonymous. It is a poor fit for read-only use: delete tools for droplets, apps and VPC peerings load with their service, so limit what the token can do. Teams on AWS, Google Cloud or Azure need a different server.