heroku-mcp-serverBLOCK
Heroku Platform MCP Server using the Heroku CLI
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://cursor.com/install-mcp?name=heroku&config=eyJjb21tYW5kIjoibnB4IC15IEBoZXJva3UvbWNwLXNlcnZlciIsImVudiI6eyJIRVJPS1VfQVBJX0tFWSI6IjxZT1VSX0hFUk9LVV9BVVRIX1RPS0VOPiJ9fQ%3D%3D)
The Heroku Platform MCP Server works on Common Runtime, Cedar Private and Shield Spaces, and Fir Private Spaces.
Prerequisites
- Heroku CLI must be installed globally on your system, version 10.8.1 or higher.
- Install or upgrade the Heroku CLI
Deploy on Heroku
[](https://www.heroku.com/deploy?template=https://github.com/heroku/heroku-mcp-server)
Overview
The Heroku Platform MCP Server is a specialized Model Context Protocol (MCP) implementation designed to facilitate seamless interaction between large language models (LLMs) and the Heroku Platform. This server provides a robust set of tools and capabilities that enable LLMs to read, manage, and operate Heroku Platform resources.
Key Features:
- Direct interaction with Heroku Platform resources through LLM-driven tools
- Secure and authenticated access to Heroku Platform APIs, leveraging the Heroku CLI
- Natural language interface for Heroku Platform interactions
Note: The Heroku Platform MCP Server is currently in early development. As we continue to enhance and refine the implementation, the available functionality and tools may evolve. We welcome feedback and contributions to help shape the future of this project.
Note: The Heroku Platform MCP Server requires the Heroku CLI to be installed globally (v10.8.1+). Ensure you have the correct version by running heroku --version.Configure the Heroku Platform MCP Server
You can configure Claude Desktop, Zed, Cursor, Windsurf, and other clients to work with the Heroku Platform MCP Server.
##
b3e3ff4c37b3OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mcp-server --env HEROKU_API_KEY=${HEROKU_API_KEY} -- npx -y @heroku/[email protected]{
"mcpServers": {
"mcp-server": {
"command": "npx",
"args": [
"-y",
"@heroku/[email protected]"
],
"env": {
"HEROKU_API_KEY": "${HEROKU_API_KEY}"
}
}
}
}Exposed tools (39)
25 read · 13 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
create_addon | write | Create add-on: specify service, plan, custom names |
create_app | write | Create app: custom name, region (US/EU), team, private space |
deploy_one_off_dyno | write | |
deploy_to_heroku | write | Use for all deployments. Deploys new/existing apps, with or without teams/spaces, and env vars to Heroku. |
get_addon_info | write | Get add-on details: plan, state, billing |
get_app_info | read | Get app details: config, dynos, addons, access, domains |
get_app_logs | read | App logs: monitor/debug/filter by dyno/process/source |
list_addon_plans | read | List service plans: features, pricing, availability |
list_addon_services | write | List available add-on services and features |
list_addons | write | List add-ons: all apps or specific app, detailed metadata |
list_ai_available_models | read | List available AI inference models |
list_apps | read | List Heroku apps: owned, collaborator access, team/space filtering |
list_private_spaces | read | Lists Heroku Private Spaces with CIDR blocks, regions, compliance and capacity details. JSON output supported. |
list_teams | read | Lists accessible Heroku Teams. Use for: viewing teams, checking membership, getting team metadata, and verifying access. JSON output available. |
maintenance_off | write | Disable maintenance mode and restore normal app operations |
maintenance_on | write | Enable maintenance mode and redirect traffic for a Heroku app |
make_ai_inference | read | Make inference request to Heroku AI API |
pg_backups | read | Manage backups: schedules, status, verification, recovery |
pg_credentials | read | Manage access: credentials, permissions, security, monitoring |
pg_info | read | View database status: config, metrics, resources, health |
pg_kill | destructive | Stop processes: stuck queries, blocking transactions, runaway operations |
pg_locks | read | Analyze locks: blocked queries, deadlocks, concurrency |
pg_maintenance | read | Track maintenance: windows, schedules, progress, planning |
pg_outliers | read | Find resource-heavy queries: performance, patterns, optimization |
pg_ps | read | Monitor active queries: progress, resources, performance |
pg_psql | write | Execute SQL queries: analyze, debug, modify schema, manage data |
pg_upgrade | read | Upgrade PostgreSQL: version migration, compatibility, safety |
pipelines | read | Lists and manages Heroku pipelines with configuration visibility |
pipelines_create | write | Creates new Heroku deployment pipeline with configurable stages, apps, and team settings |
pipelines_info | read | Displays detailed pipeline configuration, stages, and connected applications |
pipelines_list | read | Lists accessible Heroku pipelines with ownership and configuration details |
pipelines_promote | read | Promotes apps between pipeline stages with configurable target applications |
provision_ai_model | read | Provision AI model access for app |
ps_list | read | List and monitor Heroku app dynos. View running dynos, check status/health, monitor process states, verify configurations. |
ps_restart | write | Restart Heroku app processes. Restart specific dynos, process types, or all dynos. Reset dyno states selectively. |
ps_scale | read | Scale Heroku app dynos. Adjust quantities, change sizes, view formation details, manage resources. |
rename_app | write | Rename app: validate and update app name |
test-app | read | Test app |
test_tool | read | A test tool |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- declared (5 observation(s))
- Shell
- declared (3 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (14)
Manage access: credentials, permissions, security, monitoring
const SECRET = 'SUPER-SECRET-EXTERNAL-CANARY';
pg_kill
.mocharc.json
.nycrc.json
.prettier.mjs
.prettierignore
.github/CODEOWNERS
expect(isSafeSourceRelativePath('/etc/passwd')).to.be.false;import * as pjson from '../../package.json' with { type: 'json' };import * as pjson from '../../package.json' with { type: 'json' };const pkg = await import('../../package.json', { with: { type: 'json' } });@heroku-cli/schema, @modelcontextprotocol/sdk, cheerio, jsonschema, node-fetch, tar-stream, zod, zod-to-json-schema
creation, network access, environment variables, and automatic cleanup. Ideal for running scripts, tests, or temporary
Gates applied: no_behavioural_pass.
b3e3ff4c37b3full audit observations/trust-audit/mcp-server/heroku__heroku-mcp-server.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | b3e3ff4c37b3 | BLOCK | D | 69 | first audit |
Questions
What is the @heroku/mcp-server MCP server?
Heroku Platform MCP Server using the Heroku CLI
What tools does @heroku/mcp-server expose?
39 in total: 25 read-only, 13 that write, and 1 that can delete or overwrite (pg_kill). Every one is listed on this page with its risk.
Is @heroku/mcp-server safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does @heroku/mcp-server need?
It reads HEROKU_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does @heroku/mcp-server run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as @heroku/mcp-server at 1.2.11.
How current is this page?
The grade is for one exact copy of the source (b3e3ff4c37b3), read on 2026-10-12. The repository is watched and re-audited when it changes.