Railway MCP Server

The Railway MCP server connects AI assistants to Railway, a cloud platform for deploying applications and databases. Instead of switching between editor, terminal, and dashboard, you tell the assistant what you need: "Create a new project", "Which services are running in this project?", or "Trigger a new deployment". The assistant calls the matching tools of the server and reports the result. The server is operated by Railway itself and described in the official documentation. Its strength is closeness to everyday development: anyone who already uses Railway can handle routine tasks straight from Claude Code, Cursor, VS Code, or Windsurf.

What is the Railway MCP server?

The server implements the Model Context Protocol (MCP), an open standard through which AI applications talk to tools. It runs hosted at https://mcp.railway.com; a local installation of the server is not needed in the normal case. According to the documentation the assistant can use it to create projects, deploy templates, manage environments, pull variables, and redeploy services. The earlier open-source repository of the server on GitHub is now archived; the hosted variant described in the documentation is the authoritative one.

Which tools the hosted server provides

For the hosted server the documentation lists several groups. With whoami the assistant shows the signed-in account. With list-projects, create-project, and list-services you get an overview and create projects. For feature flags there are list-feature-flags, get-feature-flag, set-feature-flag, and delete-feature-flag. For deployments redeploy and accept-deploy are available, plus a tool called railway-agent for multi-step tasks. In addition there is a local server that the Railway CLI starts with railway mcp local; according to the documentation it has a different, larger tool set, covering among other things variables, domains, networking, templates, storage, and observability.

Setup and sign-in

The recommended way is the command railway setup agent; it connects the assistant through the Railway CLI and, according to the documentation, requires CLI version 5.44.0 or later. The server then uses your existing railway login session, so no long-lived Railway credential sits in the editor configuration. Alternatively railway setup agent --oauth connects directly to the hosted server via OAuth; the tokens are then short-lived and revocable in the account settings, and you choose which workspaces and projects the access covers. If you want to write the configuration for a specific editor, use railway mcp install, also with the --local option for the local server. The server does not accept project tokens because it requires a user identity.

Security and limits

The server can change things, not just read them. The documentation marks destructive tools at the protocol level, so clients that respect these hints ask before running them. It also advises reviewing actions requested by the language model before approving them, especially redeploy, accept-deploy, and railway-agent, restricting access to trusted users, and using the server with non-critical environments where possible. A redeploy can briefly disturb a running production application. Limit the OAuth access to the projects the assistant really needs.

Costs

The documentation names no separate fee for the MCP server. Usage counts toward your Railway account. According to the pricing page Railway uses usage-based billing in which compute, memory, and storage are metered by the second. There is a free trial with a one-time credit and no credit card, a free plan, paid plans for individuals and teams, and Enterprise with custom terms. Current amounts are on the official pricing page. The documentation makes no statement about the license of the hosted server.

Who is the Railway MCP server for?

It is worthwhile for developers who already run their applications on Railway and want to handle recurring tasks such as creating projects, checking status, or redeploying from the chat. It is especially handy when the assistant is writing code anyway and the result should be deployed right away. Anyone not using Railway gains nothing, because the server is an access path to the platform. For critical production environments you should deliberately approve every write action by hand.

A Railway account, the Railway CLI version 5.44.0 or later (for the recommended route) or an OAuth-capable MCP client, and an MCP client such as Claude Code, Cursor, VS Code, or Windsurf.

The Railway MCP server runs hosted by Railway. This guide walks through setup, limiting access, and the first commands.

Step 1: Prerequisites

You need a Railway account and an MCP client such as Claude Code, Cursor, VS Code, or Windsurf. For the recommended route the Railway CLI version 5.44.0 or later must be installed.

Step 2: Connect with the CLI

Sign in with railway login and run railway setup agent. The server then uses your CLI session, and no long-lived Railway credential sits in the editor configuration.

Step 3: Connect with OAuth

If you want to work without a CLI session, use railway setup agent --oauth. The client connects directly to https://mcp.railway.com. The tokens are short-lived and revocable in the account settings, and you choose which workspaces and projects the access covers.

Step 4: Set up for a specific editor

railway mcp install writes the configuration for the chosen editor and merges it with existing MCP entries. With railway mcp install --local you set up the local server instead, which has a different tool set.

First commands

Start read-only: let the assistant list the account, the projects, and the services. Only then move on to write actions, and approve redeploy, accept-deploy, and railway-agent only after your own review.

railway setup agent

Existing railway login session of the CLI, or OAuth against mcp.railway.com with short-lived, revocable tokens; project tokens are not accepted.

List projects and services, create projects, manage feature flags, redeploy services, and accept deployments; with OAuth selectable by workspace and project.

The server runs hosted by Railway. Results of tool calls enter the AI client context and therefore reach the model provider.

Write tools such as redeploy, accept-deploy, and railway-agent can affect running applications; overly broad workspace access and variables containing secrets in the model context.