Provider REST API

15 actions

Connect Claude to Railway

Manage Railway projects, services, deployments, logs and variables. Toolspoke puts 15 of its actions behind one MCP endpoint that Claude, Cursor, and Codex all speak.

Connect View pricing

Connection: Provider REST API
Authentication: API token
Actions exposed: 15
What a call bills: Nothing
Adapter: Maintained by Toolspoke

Connected in three steps

1
Install Railway
Open the marketplace in your workspace, add Railway to the project your agents work in, and it appears on the gateway immediately.
2
Connect the credential
Authenticate with api token. Where to get one, and what it has to be able to reach, is the next section.
3
Point your agent at the gateway
Give your client one address, https://toolspoke.com/mcp. Claude Code takes it as a command, Claude and Claude Desktop add it as a custom connector, and Cursor, Codex and VS Code each read it from a config file of their own.

.mcp.json

{
  "mcpServers": {
    "toolspoke": {
      "type": "http",
      "url": "https://toolspoke.com/mcp"
    }
  }
}

One block covers every tool you have installed. Railway shows up in the client as soon as your policy allows it, and so does everything else you install later.

Where the address goes, per client

Claude Code: Run it in your project, then /mcp to sign in
claude mcp add --transport http toolspoke https://toolspoke.com/mcp
Claude and Claude Desktop: Settings, then Connectors, then Add custom connector
https://toolspoke.com/mcp
Cursor: ~/.cursor/mcp.json, or .cursor/mcp.json for one project
{ "mcpServers": { "toolspoke": { "url": "https://toolspoke.com/mcp" } } }
Codex: ~/.codex/config.toml
[mcp_servers.toolspoke] url = "https://toolspoke.com/mcp"
VS Code: .vscode/mcp.json, or the MCP: Add Server command
{ "servers": { "toolspoke": { "type": "http", "url": "https://toolspoke.com/mcp" } } }

What Railway asks for

API token. You provide it once, when you install the connector. Toolspoke encrypts it at rest and decrypts it only for the length of a single call, and the gateway attaches it to the outbound request itself, so it is never part of the arguments an agent sends.

API tokenRequired: Railway → Account Settings → Tokens → Create Token. Leave the workspace empty for an account token that reaches every workspace you belong to, or choose one workspace to limit it. Project tokens are not accepted here.; xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

What Claude can do in Railway

15 actions, each one declared and named by the connector rather than discovered at runtime. A workspace policy grants a person all of them, a hand-picked selection, everything on the read side, everything on the write side, or none.

Reads: 9Reads
Writes: 3Writes
Destructive: 3Destructive

Reads

Fetches data and changes nothing.

get_me
Return the user an account token belongs to, with the workspaces they can reach. A workspace token has no user, so this fails for one; use list_projects instead.
list_projects
List projects with their id, name and workspace. Takes no required arguments, which is why an install tests itself with it. Pass workspace_id to list one workspace's projects.
get_project
Read one project with its environments and services. The environment and service ids here are what the deployment, log and variable actions take.
get_service
Read one service by id.
list_deployments
List deployments, newest first, narrowed to a project, environment or service. Shows each one's status (SUCCESS, FAILED, CRASHED, BUILDING …) and URL.
get_deployment
Read one deployment, with its status and whether it can be redeployed or rolled back to.
get_deployment_logs
Read a deployment's runtime logs. Logs can contain user data and secrets the app printed, so the response is never written to the audit log.
get_build_logs
Read a deployment's build logs. The first call when a deployment FAILED before it started. Never written to the audit log.
list_variables
Return the variables of a service in an environment as a name-to-value map, or the environment's shared variables when service_id is omitted. Values are secrets, so the response is never written to the audit log.

Writes

Creates or updates something on the other side.

upsert_variable
Create or update one variable on a service, or a shared one when service_id is omitted. Railway redeploys the affected services unless skip_deploys is true. The value is masked in the audit log.
redeploy_service
Redeploy a service's latest deployment in an environment, with the same code. Use it to pick up changed variables.
restart_deployment
Restart a running deployment's containers without rebuilding. Requests in flight are dropped while it restarts.

Destructive

Deletes or permanently alters something. Worth granting on purpose.

delete_variable
Delete one variable. Destructive because its value is gone and the next deployment runs without it.
rollback_deployment
Make an earlier deployment live again. Destructive because it changes the code serving traffic at once.
cancel_deployment
Cancel a deployment that is still building or deploying. Destructive because it cannot be resumed.

What it will not do

Enforced by the gateway rather than left to convention, which is why each of these can be stated flatly.

It cannot call anything else: The 15 actions above are the whole of it. A call to any other name is refused before it reaches Railway rather than forwarded on, and connecting your account does not add to the list: it is fixed by the connector, not discovered at run time.
It reaches no further than your credential: Toolspoke holds no access to Railway of its own. Every call carries the credential you stored and nothing besides, so whatever that credential cannot reach, this connector cannot reach either.
It never hears from Railway: Nothing is pushed to it. There is no webhook, no subscription and no polling, so this connector cannot notice by itself that something changed in Railway. An agent has to ask.
It does not smooth over provider limits: Toolspoke does not retry, queue or back off around Railway's own rate limits. A call that Railway refuses comes back to the agent as a failed call.

Before you connect it

What can Claude do in Railway?

15 named actions: 9 that only read, 3 that write and 3 that delete or permanently alter something. They include get_me, list_projects and get_project. Nothing outside that list is reachable: the connector declares each operation by name rather than proxying whatever an agent asks for.

What credentials does the Railway connector need?

API token. The connector asks for api token. Values are encrypted at rest and attached to the outbound request by the gateway, so they are never part of the arguments an agent sends and never reach the audit log.

Does the Railway connector work with Cursor and Codex, or only Claude?

Any client that speaks MCP, and every one of them gets the same 15 actions. There is a single address, https://toolspoke.com/mcp. Claude Code adds it with claude mcp add --transport http, Claude and Claude Desktop take it as a custom connector in settings, Cursor reads it from .cursor/mcp.json, Codex from ~/.codex/config.toml, and VS Code from .vscode/mcp.json. Each of them signs in to the gateway itself, so there is no key to paste.

What does the Railway connector not do?

The 15 actions above are the whole of it. A call to any other name is refused before it reaches Railway rather than forwarded on, and connecting your account does not add to the list: it is fixed by the connector, not discovered at run time. Toolspoke holds no access to Railway of its own. Every call carries the credential you stored and nothing besides, so whatever that credential cannot reach, this connector cannot reach either. Nothing is pushed to it. There is no webhook, no subscription and no polling, so this connector cannot notice by itself that something changed in Railway. An agent has to ask. Toolspoke does not retry, queue or back off around Railway's own rate limits. A call that Railway refuses comes back to the agent as a failed call.

Can I limit which actions an agent can call?

Yes, in two places. The project switches Railway's actions on and off one at a time, for everyone in the project at once, and the screen groups them by read, write and destructive so turning off everything that deletes is one click. An individual agent key can then be narrowed further, to particular toolkits in a project and to particular actions in a toolkit. Whatever it was granted, a key never reaches a project its owner cannot.

What gets recorded when an agent calls Railway?

Every attempt, with the agent that made it and the person that agent belongs to, the full request payload, the response payload, the status, the duration, and what the call cost in sandbox time and model tokens. Values whose key names a secret are masked out before the record is shown to anyone. An operation the connector marks as not retained never has its response body written at all, so the gateway keeps no second copy of what was read.

More infrastructure connectors

Browse all of them