Spacelift MCP

Spacelift's MCP server takes an unusual approach: instead of a long fixed catalog of hand-written wrappers, it exposes the platform through a handful of general tools built on its GraphQL API. A discover tool browses the schema so the agent can find the right query or mutation and inspect types and fields. A query tool then runs read-only GraphQL across stacks, runs, spaces, policies, modules, contexts, worker pools and blueprints. A provider tool inspects Terraform and OpenTofu provider, resource and data source schemas, which is what lets an assistant draft configuration that actually matches the provider version in play. With write scope, two more tools appear. Mutate applies GraphQL mutations against Spacelift resources, and intent creates, updates, deletes and otherwise manages cloud resources. Because the interface is the schema itself, new API surface becomes reachable without waiting for the server to add a tool for it. The server is hosted at the /mcp endpoint of your own Spacelift account. Authentication is browser-based OAuth with either an mcp:read or mcp:write scope, or a bearer token issued through spacectl, and everything the agent can do is bounded by your session permissions, RBAC roles and login policies. Aimed at platform engineers who want an agent explaining a failed run, auditing policy coverage, or reasoning about stack dependencies.