plesk-deploy-mcp

An MCP server that helps any AI agent (Claude Code, Claude Desktop, Cursor, VS Code and others) set up and run safe deployments to Plesk servers. Deploys work like this:

1. GitHub Actions tests your project and builds a release bundle.
2. A person approves it.
3. A small release manager on the server unpacks it into a new release folder, backs up the database, migrates, switches over atomically and checks health.
4. If the new release isn't healthy, it rolls back by itself.

The server packages a workflow that has been proven in production. It inspects your project, generates the whole deploy kit as a diff you review, and validates it. Once you turn the SSH tools on, it can also read deploy status and logs and roll back over your own SSH.

Not affiliated with or endorsed by Plesk or WebPros.

Contents

• How it keeps production safe
• Install
• Turning on the SSH tools
• Using it
• Tools
• Resources and prompt
• Configuration
• FAQ

How it keeps production safe

• No secrets pass through it.
  • No tool accepts or returns a key, password or token.
  • SSH uses your system ssh, your ~/.ssh/config alias, your ssh-agent and your known_hosts.
  • Env files are read for variable names only, and real .env files are never opened.
  • Every result is scanned, and anything that looks like a secret is redacted.
• No deploys from your laptop. Deploys always run in GitHub Actions, behind an approval in the production environment. No tool builds, uploads or deploys.
• The SSH tools are off until you name the hosts they may reach, in PLESK_DEPLOY_SSH_HOSTS.
• The SSH tools run fixed commands only. They run read-only discovery commands from a fixed list, or the release manager's own --status, --log and --rollback. There is no "run this command" tool.
• Every input is checked against a strict pattern before it reaches a file or a command line, and is then shell-quoted.
• Host keys are always checked strictly (StrictHostKeyChecking=yes), and agent forwarding is always off. Your own config can't loosen this.
• Generating the kit is a dry run by default.
  • It writes only with write: true, inside your git repository, and never through a symlink.
  • It never deletes anything.
  • It never replaces an existing file unless you list that file in overwrite.
• Rollback needs an exact confirmation: confirm: "<app>@<host>". It is never interrupted halfway.
• No telemetry. The only network traffic is SSH to the hosts you named, and api.github.com when you ask for run status.

Details: the threat model and the privacy policy.

Install

You need Node.js 22 or later, except in Claude Desktop, which brings its own.

Claude Code

claude mcp add --transport stdio --scope user plesk-deploy -- npx -y plesk-deploy-mcp

With the SSH tools on for the alias myserver (see below):

claude mcp add --env PLESK_DEPLOY_SSH_HOSTS=myserver --transport stdio --scope user plesk-deploy -- npx -y plesk-deploy-mcp

Check it with claude mcp list (it should say ✔ Connected), or /mcp in a session.

Or as a plugin. It brings the server and the plesk-deploy skill, which loads by itself when you talk about deploying to Plesk:

/plugin marketplace add usama-saeed831/plesk-deploy-mcp
/plugin install plesk-deploy@plesk-deploy-mcp

Claude Code then asks for the allowed SSH host aliases (leave it empty to keep the SSH tools off) and an optional read-only GitHub token, which it stores as a secret.

Claude Desktop

As an extension: download `plesk-

... View full README on GitHub