# Security model

## Token separation

Use three unrelated credentials:

1. `MCP_ACCESS_TOKEN` authenticates Codex, OpenCode, Antigravity, or another MCP client to the hosted mm-skills endpoint.
2. `COOLIFY_API_TOKEN` authenticates the server to `https://panel.meyermedia.eu/api/v1` and should normally have only `read`, plus `write` or `deploy` when explicitly needed.
3. `COOLIFY_SENSITIVE_TOKEN` is optional and should have `read` plus `read:sensitive` when the agent must inspect the complete API shape while the MCP redacts secret values.

Never reuse the Coolify token as the MCP access token. Never commit any token.

## Coolify permissions

- `read`: servers, projects, applications, databases, services, and other non-sensitive metadata.
- `read:sensitive`: passwords, private keys, environment values, logs, and other sensitive fields. Avoid on the normal token.
- `write`: create, update, and delete-capable API families, subject to endpoint checks.
- `deploy`: deployments and deploy webhooks.
- `root`: bypasses permission checks. Avoid for a persistent MCP deployment.

Tokens are team-scoped. Use separate MCP deployments or separate upstream tokens for different teams.

## Server-side gates

All non-read capabilities are off by default. Tool arguments cannot enable them.

- `COOLIFY_MCP_ALLOW_DEPLOY`
- `COOLIFY_MCP_ALLOW_WRITES`
- `COOLIFY_MCP_ALLOW_DESTRUCTIVE`
- `COOLIFY_MCP_ALLOW_ROOT`
- `COOLIFY_MCP_ALLOW_SENSITIVE_READS`
- `COOLIFY_MCP_FULL_READ`

A confirmation string is required after the matching gate is enabled. Confirmation protects against accidental tool selection; it is not authentication.

## Redaction

The server redacts by field name, object context, credential-bearing URL, PEM structure, bearer-token pattern, Coolify token pattern, GitHub token pattern, JWT pattern, and common `KEY=value` log syntax.

Environment-variable values are redacted while names and flags remain visible. Connection URLs preserve host and database metadata while replacing passwords and sensitive query parameters.

Redaction is defense in depth. Keep `read:sensitive` off the normal token. Full-read mode deliberately moves that permission to a separate credential and uses it for all reads only when both sensitive-read gates are enabled.

## Network controls

- Keep `COOLIFY_BASE_URL` fixed to `https://panel.meyermedia.eu/api/v1`.
- Set `MCP_ALLOWED_HOSTS` to the public MCP hostname.
- Keep `MCP_REQUIRE_AUTH=true` in production.
- Restrict Coolify API Allowed IPs to the outbound IP of the MCP host when stable egress is available.
- Terminate TLS through Coolify and expose only the application port through the managed proxy.
- Do not publish the application container port directly on the host.