Atlas / MCP servers / netlify / Netlify

NetlifyBLOCK

Name: Netlify
Author: netlify

mcp/netlify/netlify-3

MCP server by netlify · Audited 2026-10-08

⚑ Report / re-scan Source ↗

Netlify's Official MCP server

Verdict

BLOCK

Grade

Trust score

69 /100

Exposed tools

3 3r · 0w · 0d

Transport

streamable-http

License

—

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Netlify MCP Server follows the Model Context Protocol (MCP) to enable code agents to use the Netlify API and CLI—so they can create new projects, build, deploy, and manage your Netlify resources using natural language prompts.

Overview

The Model Context Protocol is an emerging standard protocol for connecting code agents with MCP servers, allowing them to manage resources and perform tasks using natural language. The Netlify MCP Server acts as a bridge, providing API access, CLI tools, prompts, and more for your agents.

You can connect to the Netlify MCP Server using a variety of MCP clients, including:

Windsurf
Cursor
Claude
Copilot (VSCode)
Cline
Warp
LM Studio
See the full list

Use Cases

With Netlify MCP Server, your AI agents can:

Create, manage, and deploy Netlify projects
Modify access controls for enhanced project security
Install or uninstall Netlify extensions
Fetch user and team information
Enable and manage form submissions
Create and manage environment variables and secrets
and more...

Prerequisites

Node.js 22 or higher

Check with node --version

A Netlify account
An MCP client (e.g., Windsurf, Cursor, Claude, Copilot)

Tip: Install the Netlify CLI globally for the best experience: npm install -g netlify-cli

MCP Configuration

For the production MCP server, use the following configuration:

Editors with one-click install:

[](https://cursor.com/install-mcp?name=netlify&config=eyJjb21tYW5kIjoibnB4IC15IEBuZXRsaWZ5L21jcCJ9)

[](https://lmstudio.ai/install-mcp?name=netlify&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIt

Read from source at commit 87402cb383a7OBSERVED · 2026-10-08

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add mcp --env CLIENT_SECRET_AZURE_AI_FOUNDRY=${CLIENT_SECRET_AZURE_AI_FOUNDRY} --env CLIENT_SECRET_AZURE_AI_FOUNDRY_TESTING=${CLIENT_SECRET_AZURE_AI_FOUNDRY_TESTING} --env EVENTS_RELAY_JWE_SECRET=${EVENTS_RELAY_JWE_SECRET} --env JWE_SECRET=${JWE_SECRET} -- npx -y @netlify/[email protected]

claude-desktop

{
  "mcpServers": {
    "mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@netlify/[email protected]"
      ],
      "env": {
        "CLIENT_SECRET_AZURE_AI_FOUNDRY": "${CLIENT_SECRET_AZURE_AI_FOUNDRY}",
        "CLIENT_SECRET_AZURE_AI_FOUNDRY_TESTING": "${CLIENT_SECRET_AZURE_AI_FOUNDRY_TESTING}",
        "EVENTS_RELAY_JWE_SECRET": "${EVENTS_RELAY_JWE_SECRET}",
        "JWE_SECRET": "${JWE_SECRET}"
      }
    }
  }
}

Exposed tools (3)

3 read · 0 write · 0 destructive.

Tool	Risk	Description
`get-netlify-coding-context`	read	ALWAYS call when writing code. Required step before creating or editing any type of functions, Netlify sdk/library usage, etc. Use other operations for project management.
`needs-auth`	read
`netlify-coding-rules`	read	ALWAYS call when writing serverless or Netlify code. required step before creating or editing any type of functions, Netlify sdk/library usage, etc.

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	FAIL
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (3 observation(s))
Network: declared (3 observation(s))
Shell: declared (1 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (20)

HIGHInventory / provenance · inv.suspicious_name · CWE-1104

netlify/functions/mcp-server/events/project-payload.ts

project-payload.ts

Why it matters. member named after an attack tool

Fix. remove or justify

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/utils/cmd.ts:18

const childProcess = exec(

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWInventory / provenance · inv.hidden_file · CWE-1104

.release-please-manifest.json

.release-please-manifest.json

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.no_license · CWE-1104

Why it matters. no LICENSE file and no repo licence

Fix. add a licence

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

netlify/functions/mcp-server/coding-context-tool.test.ts:12

const { SKILLS_HOST, resetCodingContextCachesForTests } = await import('../../../src/context/coding-context.ts');

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

netlify/functions/mcp-server/events-subscription.test.ts:134

assert.equal(parseRelayPath(`/events/relay/${subId}/../../etc/passwd`), null);

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

netlify/functions/mcp-server/events/hooks-api.ts:7

import { authenticatedFetch, getAPIJSONResult, getTokenIdentity, NetlifyApiError } from '../../../../src/utils/api-networking.ts';

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

netlify/functions/mcp-server/proxy.test.ts:3

import { handleProxy } from '../../edge-functions/proxy.ts';

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

netlify/functions/mcp.ts:7

import { registerCodingContextTool } from "../../src/context/register-coding-context-tool.ts";

LOWNetwork egress · net.metadata_ip · CWE-200, CWE-319

netlify/functions/mcp-server/events-guard.test.ts:12

'169.254.169.254',              // cloud metadata — the classic SSRF target