Openpouch MCP server

Read from the package source without running it. The installed server may list more.

• openpouch_data_ls

  List the files in a named app's persistent /data volume \u2014 names, sizes and timestamps only, never contents. Owner-only (account key). Use it to verify a data push/migration landed.

• openpouch_data_pull

  Download a named app's persistent /data volume as a gzipped tar file (L13 \u2014 the BACKUP primitive: your human's data is never locked in). Owner-only (account key). Writes the archive to a local path and returns its location + size.

• openpouch_data_push

  Replace a named app's persistent /data volume with a local directory's contents (L13 \u2014 the migration/restore primitive). The server stops the app for the write and restarts it health-gated, so files like a SQLite DB are never swapped under a running process. Owner-only (account key); file CONTENTS never appear in logs or results (counts/sizes only). Typical migration: export data from the old

• openpouch_deletewrite action

  Delete one of YOUR OWN instant-lane apps by name (slug) \u2192 frees a quota slot. This is the self-service fix for a 'limit reached' deploy error: list your apps, delete an unused one, redeploy. Owner-only \u2014 it uses your account key and the server verifies ownership, so you can never delete another account's app. Deleting an ephemeral preview is NOT a governed-production action, so it needs

• openpouch_deploywrite action
• openpouch_deploy_previewwrite action

  Deploy the preview environment through the governed pipeline (policy check \u2192 deploy \u2192 poll \u2192 smoke \u2192 evidence). Default policy allows previews autonomously. For the zero-config instant preview (no manifest/provider key) use openpouch_deploy instead. On success the live URL is returned at top-level `url`, plus a plain-language `summary` to relay to your human.

• openpouch_deploy_productionwrite action

  Deploy production through the governed pipeline. If policy requires approval, this returns approvalRequest{id} with isError \u2014 ask your HUMAN to run `openpouch approve <id>` in their own terminal, then call this tool again. Agents cannot approve; there is intentionally no approve tool. Every result carries a plain-language `summary` to relay to your human; on a live deploy the URL is at top-le

• openpouch_init

  Initialize a project for openpouch: detects framework/build/env vars, writes deploy.manifest.json + deploy.policy.json (default policy: previews autonomous, production requires human approval), auto-matches an existing provider service by name. Idempotent.

• openpouch_inspect

  Answer: what is deployed, where, on which commit, which required env vars are missing (names only \u2014 never values), and what drift exists between manifest and provider. Env vars passed at deploy time (--var/--env-file) appear as `deployProvided` (names from local evidence \u2014 the instant lane never exposes them via the API). Read-only. The result carries a plain-language `summary` you can r

• openpouch_list

  List the instant-lane apps owned by the current openpouch account key: name (slug), kind (static/dynamic), status, live URL, and expiry. Read-only; needs an account key (anonymous previews aren't grouped under an account \u2192 an empty list with a signup pointer). Carries a plain-language `summary` to relay to your human. Pair with openpouch_delete to free a quota slot when a deploy hits a 'limit

• openpouch_list_approvals

  List pending approval requests (read-only). Approving itself is human-only via `openpouch approve <id>` in an interactive terminal \u2014 by design not available to agents.

• openpouch_logs

  Structured runtime logs ({timestamp, message}) of the mapped service. Read-only. This is the first step of the self-repair loop: when a deploy comes back unhealthy (a failed verify, a non-200 app, or a pending/not-yet-live URL), read the logs to find the cause, fix the code or config, redeploy, then verify \u2014 repeat until it passes.

• openpouch_plan

  Per environment: the policy decision (allowed / requires-approval / denied), blockers, readiness, and concrete next steps including the human-approval path. Read-only \u2014 reports, never acts.

• openpouch_rollback

  Redeploy the recorded rollback anchor commit (the deploy that was live before the latest one). Approval-gated like any write action \u2014 may return approvalRequest{id} for your human.

• openpouch_upgrade

  Get a hosted-checkout URL for a paid openpouch tier (plan). Payment is deliberately a HUMAN step: hand the returned checkoutUrl to your human \u2014 they pay in the browser at the Merchant of Record; agents never enter payment data and there is no pay tool. The account tier updates automatically after payment (verify with openpouch_whoami). Needs an API key; returns availablePlans in the error whe

• openpouch_verifywrite action

  Run the healthcheck/smoke against the environment's live URL and append the results to the evidence (deploy.evidence.json + DEPLOYMENT.md). For a full-stack app pass healthPath (e.g. /api/health) \u2014 it is checked IN ADDITION to `/`, because a live shell can hide a dead API. The result carries a plain-language `summary` (healthy / has a problem) you can relay to your human.

• openpouch_whoami

  Report the openpouch account behind the current API key: tier (plan) and current usage (live apps, deploys this hour/day), or that the caller is anonymous. Read-only. The key is read from OPENPOUCH_API_KEY / ~/.openpouch/openpouch-run.key and never echoed. Carries a plain-language `summary` you can relay to your human. (Signup/activation are CLI/web only \u2014 they involve a human email or browse

• Code scan2 source files scanned20/25
• –Live reliabilityno gateway calls yet and no remote to proben/a
• –Tool poisoningtools not inspected (local package is not executed); not countedn/a
• Auth qualitylocal package, no credentials required12/15
• Maintenancelast push 69 days ago12/15
• Maintainer identityregistry namespace matches repository owner7/10

Safety score

78/100

higher than 50% of 1,119 Developer tools servers

Tools

17

the typical Developer tools server has 7

Tools that change things

29%

typical: 5%. Fewer write tools means less an agent can break

Downloads a week

32

more than 16% of 436 Developer tools servers with a package

Openpouch: common questions

Is Openpouch MCP server safe?

Mostly: it is graded B (78/100). Read the Openpouch safety report

How do I install Openpouch?

It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.

Does Openpouch need an API key?

Not as far as the registry entry and our scan can tell: no credentials are declared or required.

Is Openpouch maintained?

The last commit was 109 days ago (2026-07-18). The latest release is v0.4.0.

What can I use instead of Openpouch?

Servers from other publishers that do the same job: Dockhold MCP server, Agent Harnesses MCP server and walkerOS Flow MCP server.

How does Openpouch compare with other Developer tools MCP servers?

safety score 78/100 (higher than 50% of 1,119 Developer tools servers); tools 17 (the typical Developer tools server has 7); tools that change things 29% (typical: 5%. Fewer write tools means less an agent can break). Full comparison.