Provider REST API

19 actions

Connect Claude to Netlify

Manage Netlify sites, deploys, builds, forms and environment variables. Toolspoke puts 19 of its actions behind one MCP endpoint that Claude, Cursor, and Codex all speak.

Connect View pricing

Connection: Provider REST API
Authentication: Personal access token
Actions exposed: 19
What a call bills: Nothing
Adapter: Maintained by Toolspoke

Connected in three steps

1
Install Netlify
Open the marketplace in your workspace, add Netlify to the project your agents work in, and it appears on the gateway immediately.
2
Connect the credential
Authenticate with personal access token. Where to get one, and what it has to be able to reach, is the next section.
3
Point your agent at the gateway
Give your client one address, https://toolspoke.com/mcp. Claude Code takes it as a command, Claude and Claude Desktop add it as a custom connector, and Cursor, Codex and VS Code each read it from a config file of their own.

.mcp.json

{
  "mcpServers": {
    "toolspoke": {
      "type": "http",
      "url": "https://toolspoke.com/mcp"
    }
  }
}

One block covers every tool you have installed. Netlify shows up in the client as soon as your policy allows it, and so does everything else you install later.

Where the address goes, per client

Claude Code: Run it in your project, then /mcp to sign in
claude mcp add --transport http toolspoke https://toolspoke.com/mcp
Claude and Claude Desktop: Settings, then Connectors, then Add custom connector
https://toolspoke.com/mcp
Cursor: ~/.cursor/mcp.json, or .cursor/mcp.json for one project
{ "mcpServers": { "toolspoke": { "url": "https://toolspoke.com/mcp" } } }
Codex: ~/.codex/config.toml
[mcp_servers.toolspoke] url = "https://toolspoke.com/mcp"
VS Code: .vscode/mcp.json, or the MCP: Add Server command
{ "servers": { "toolspoke": { "type": "http", "url": "https://toolspoke.com/mcp" } } }

What Netlify asks for

Personal access token. You provide it once, when you install the connector. Toolspoke encrypts it at rest and decrypts it only for the length of a single call, and the gateway attaches it to the outbound request itself, so it is never part of the arguments an agent sends.

Personal access tokenRequired: Netlify → your avatar → User settings → Applications → Personal access tokens → New access token. The token acts as you, on every team you belong to.; nfp_…

What Claude can do in Netlify

19 actions, each one declared and named by the connector rather than discovered at runtime. A workspace policy grants a person all of them, a hand-picked selection, everything on the read side, everything on the write side, or none.

Reads: 11Reads
Writes: 3Writes
Destructive: 5Destructive

Reads

Fetches data and changes nothing.

list_sites
List the sites this token can reach, with their id, name, URL, linked repository and the latest published deploy. Takes no required arguments, which is why an install tests itself with it.
get_site
Read one site's settings, custom domain, build settings, linked repository and the deploy currently published.
get_current_user
Return the user this token belongs to, with their name, email and the teams they can reach.
list_accounts
List the team accounts this token can reach. An account id is what the environment variable actions take.
list_site_deploys
List a site's deploys, newest first, with their state, branch, commit, context and error message if one failed.
get_deploy
Read one deploy by id, including its state, URLs, commit, summary of changes and error message. The first call when a deploy failed.
list_site_builds
List a site's builds, newest first, with their deploy id, state and timing.
get_build
Read one build by id, with its state, deploy id and timing.
list_forms
List the forms Netlify detected on a site, with their field names and submission counts.
list_form_submissions
List the submissions to one form, newest first. They are what visitors typed, so the response is never written to the audit log.
list_env_vars
List environment variables on a team account, or on one site when site_id is given, with their scopes and values per deploy context. Values can be secrets, so the response is never written to the audit log.

Writes

Creates or updates something on the other side.

lock_deploy
Lock publishing on this deploy, so later builds of the production branch are built but not published until unlock_deploy. Reversible.
unlock_deploy
Unlock publishing that lock_deploy locked, so the next production build publishes automatically again.
set_env_var_value
Set the value of an existing environment variable for one deploy context. It takes effect on the next build. The value is masked in the audit log.

Destructive

Deletes or permanently alters something. Worth granting on purpose.

trigger_build
Start a new build of the site from its linked repository. Destructive because a build of the production branch publishes to the live site as soon as it succeeds, unless publishing is locked. Pass branch to build another branch, and clear_cache to build without the dependency cache.
restore_deploy
Publish an earlier deploy of the site to production again. Destructive because it changes what visitors see at once; restore the previous deploy to undo it.
cancel_deploy
Cancel a deploy that is still building or processing. Destructive because a cancelled deploy cannot be resumed; a new build has to start from the beginning.
delete_submission
Delete one form submission permanently. There is no undo.
delete_env_var
Delete an environment variable and all its values. Destructive because the values are gone and the next build runs without them.

What it will not do

Enforced by the gateway rather than left to convention, which is why each of these can be stated flatly.

It cannot call anything else: The 19 actions above are the whole of it. A call to any other name is refused before it reaches Netlify rather than forwarded on, and connecting your account does not add to the list: it is fixed by the connector, not discovered at run time.
It reaches no further than your credential: Toolspoke holds no access to Netlify of its own. Every call carries the credential you stored and nothing besides, so whatever that credential cannot reach, this connector cannot reach either.
It never hears from Netlify: Nothing is pushed to it. There is no webhook, no subscription and no polling, so this connector cannot notice by itself that something changed in Netlify. An agent has to ask.
It does not smooth over provider limits: Toolspoke does not retry, queue or back off around Netlify's own rate limits. A call that Netlify refuses comes back to the agent as a failed call.

Before you connect it

What can Claude do in Netlify?

19 named actions: 11 that only read, 3 that write and 5 that delete or permanently alter something. They include list_sites, get_site and get_current_user. Nothing outside that list is reachable: the connector declares each operation by name rather than proxying whatever an agent asks for.

What credentials does the Netlify connector need?

Personal access token. The connector asks for personal access token. Values are encrypted at rest and attached to the outbound request by the gateway, so they are never part of the arguments an agent sends and never reach the audit log.

Does the Netlify connector work with Cursor and Codex, or only Claude?

Any client that speaks MCP, and every one of them gets the same 19 actions. There is a single address, https://toolspoke.com/mcp. Claude Code adds it with claude mcp add --transport http, Claude and Claude Desktop take it as a custom connector in settings, Cursor reads it from .cursor/mcp.json, Codex from ~/.codex/config.toml, and VS Code from .vscode/mcp.json. Each of them signs in to the gateway itself, so there is no key to paste.

What does the Netlify connector not do?

The 19 actions above are the whole of it. A call to any other name is refused before it reaches Netlify rather than forwarded on, and connecting your account does not add to the list: it is fixed by the connector, not discovered at run time. Toolspoke holds no access to Netlify of its own. Every call carries the credential you stored and nothing besides, so whatever that credential cannot reach, this connector cannot reach either. Nothing is pushed to it. There is no webhook, no subscription and no polling, so this connector cannot notice by itself that something changed in Netlify. An agent has to ask. Toolspoke does not retry, queue or back off around Netlify's own rate limits. A call that Netlify refuses comes back to the agent as a failed call.

Can I limit which actions an agent can call?

Yes, in two places. The project switches Netlify's actions on and off one at a time, for everyone in the project at once, and the screen groups them by read, write and destructive so turning off everything that deletes is one click. An individual agent key can then be narrowed further, to particular toolkits in a project and to particular actions in a toolkit. Whatever it was granted, a key never reaches a project its owner cannot.

What gets recorded when an agent calls Netlify?

Every attempt, with the agent that made it and the person that agent belongs to, the full request payload, the response payload, the status, the duration, and what the call cost in sandbox time and model tokens. Values whose key names a secret are masked out before the record is shown to anyone. An operation the connector marks as not retained never has its response body written at all, so the gateway keeps no second copy of what was read.

More infrastructure connectors

Browse all of them