Levelrail by GLINR STUDIOS
Docs GitHub Install
Levelrail

Use cases

Compare

Migrate from

Star on GitHub Docs Install

Use case: AI agents

The Levelrail MCP server lets an AI assistant list apps, read logs and diagnose a crashloop through the same API and permissions as the dashboard and CLI. The assistant sits beside the deterministic reconciler, never inside it: it reads and suggests, and any write is explicit and confirmed.

curl -fsSL https://levelrail.com/install.sh | sudo sh
MCP tools and write mode Source on GitHub
The CLI access page of the Levelrail dashboard, showing the pinned server identity and fingerprint, no pending CLI logins, and a CLI tokens table with a token holding read, write and deploy abilities and a Revoke button. The CLI access page of the Levelrail dashboard, showing the pinned server identity and fingerprint, no pending CLI logins, and a CLI tokens table with a token holding read, write and deploy abilities and a Revoke button.
Scoped tokens
  • Beta MCP server status Beta
  • Off Write tools until you pass an allow-write flag
  • Any MCP client works
  • 0 AI inside the reconciler

How it works

From assistant to reconciler

The assistant talks to the MCP server, and every call passes the token's permissions before it reaches the platform API. Write tools stay blocked until allow-write is set, and AI sits beside the reconciler, never inside it.

What you get

Everything this use case leans on

  • Beta

    Read tools

    Tools for apps, logs, metrics and status, plus read-only diagnostics such as crashloop analysis.

    Docs Source
  • Beta

    Token-scoped tool lists

    The tool list follows the token. A read-only token never sees a write tool.

    Docs
  • Beta

    Read-only flag

    The --readonly flag checks the token's abilities with the API and refuses to start if it holds write, deploy or root.

    Source
  • Beta

    On-demand toolsets

    A small core loads first. Enable a toolset (databases, backups and so on) only when the conversation needs it, which keeps the tool list short.

    Docs
  • Behind a flag

    In-app AI chat

    The chat inside the dashboard is behind a feature flag and off by default.

    Docs Source

In the product

What it looks like

  • The Security center page showing a security score of 36 with grade D, a tabbed layout for checklist, sessions and devices, policy, secret rotations and compliance, and findings for two-factor, off-box backups and untrusted certificates. The Security center page showing a security score of 36 with grade D, a tabbed layout for checklist, sessions and devices, policy, secret rotations and compliance, and findings for two-factor, off-box backups and untrusted certificates.
    The Security center. Review sessions, devices and policy before you hand a token to an agent. This is not an MCP screen. Read the docs
  • The Logs view of an app named marketing-site with Live, Search, Errors and Archive tabs, level filters, and a stream of HTTP request log lines. The Logs view of an app named marketing-site with Live, Search, Errors and Archive tabs, level filters, and a stream of HTTP request log lines.
    App logs, the kind of data a read tool returns to an assistant. This is the dashboard view, not an MCP screen.

Get started

From zero to running

  1. Create a narrow token

    Create a token with the narrowest ability that works, for example read only. Scoping and transports are covered in the integration guide.

  2. Print a client config

    Print a config block for your assistant, paste it into the client, add your token, and start the server in read-only mode.

  3. Add write mode later

    If a token needs to act, enable write mode for that token only and add an explicit IAM Deny on production.

Print a client config 
levelrail-mcp --print-config claude    # also cursor, vscode, zed
levelrail-mcp --print-config vscode --allow-write --team platform

The block holds a token placeholder and --mode read-only. It never prints your real token, so you add that yourself.

Go deeper

Read it, run it, or read the code

Source

glincker/levelrailApache 2.0, open source

Docs

Related use cases

Weighing it against something else? Compare Levelrail with the tools below, or migrate an existing setup.

Good to know

Scope and maturity, stated plainly so you can plan around them.

  • The MCP server covers apps, logs, metrics, diagnostics and the write tools described above, and its tool registry has unit tests. It is beta, though, and the full surface has not been exercised end to end, so start with read-only mode.
  • The in-app AI chat works when you turn on its feature flag. It is off by default, and the MCP server does not depend on it.
  • Any agent that reads logs can be fed hostile text, which is prompt injection. Narrow tokens, read-only mode and confirm-gated writes limit the damage; the MCP threat model explains how tool output is marked as untrusted.

Maturity differs by feature. Feature status lists what is stable, beta or behind a flag, with the evidence for each.

FAQ

Questions

Is AI involved in deciding what gets deployed?

No. The reconciler is deterministic and level-triggered, with no AI inside it. The MCP server is a read and suggest layer over the API, and writes need an explicit flag and a confirmation.

Which AI assistants work with the MCP server?

Any MCP client. The server prints a ready config block for Claude, Cursor, VS Code and Zed with `levelrail-mcp --print-config <client>`. Tool counts per toolset show what each one costs in context.

Can an AI agent change or delete my apps?

Only if you allow it. A read-only token cannot, and write tools stay off until you pass --allow-write. Even then each call needs a matching confirm value and respects the token's abilities.

How do I try it?

Install the control plane on one server, create a read-only token, then run `levelrail-mcp --print-config claude` and paste the block into your client.

Run it on a server you own

One command installs the control plane. Apache 2.0, no license key and no paid tier.

curl -fsSL https://levelrail.com/install.sh | sudo sh
Install guide Quickstart