v2.15.0

What's Changed

Fixed

• env_vars now exposes the preview/production scope (#291 — thanks @petteremil) — the application list branch projects rows through toEnvVarSummary, which emitted uuid/key/value/is_buildtime/is_runtime and dropped is_preview. Preview and production are separate scopes in Coolify, so the same key legitimately exists in both with different values; with the flag stripped, a caller saw what looked like a duplicated variable with conflicting values, concluded it was misconfigured, and "corrected" whichever row it happened to pick. is_preview is now part of the summary. (Service and database lists return the full object and were never affected.)

  The write side had the matching gap: is_preview was only accepted inside bulk_update's data[] array, so the single create and update actions could not target the preview scope at all, despite CreateEnvVarRequest/UpdateEnvVarRequest already supporting it and upstream documenting it on both request bodies. It is now accepted on create and update across application, service and database. Omitting it targets production, unchanged. The tool description now states that the two scopes are distinct and that a key existing in both is normal configuration rather than an error to reconcile.

• Coolify v4.2 compatibility: state-changing endpoints moved from GET to POST (#292 — thanks @StreamlinedStartup) — v4.2 (coollabsio/coolify#10872) requires POST on start/stop/restart/deploy/enable/disable/validate and returns a hard 405 for GET. Six client call sites still sent GET and would have broken on upgrade, affecting the control (services), deploy, validate_server and system (enable_api/disable_api) tools.

  Checking upstream's routes/api.php at v4.1.2, v4.0.0 and older betas showed the fix does not have to break anyone still on 4.1. Service start/stop/restart and /deploy were already registered Route::match(['get','post']) well before v4.2, so those now send POST unconditionally. Only /enable, /disable and /servers/{uuid}/validate genuinely diverge — GET-only up to v4.1.2, POST-only from v4.2 — and those send POST and retry once with GET on a 405, caching the resolved method per endpoint. The retry is safe because a 405 is raised by the router before the controller runs, so nothing has executed; only 405 triggers it, and every other failure propagates untouched. The cache self-heals in both directions — if a remembered GET later returns a 405 because the instance was upgraded to v4.2 mid-session, the stale preference is dropped and POST is re-probed rather than failing until restart. No version probing, no config flag, and no breaking change for pre-4.2 users.

• Secrets hidden by v4.2 no longer look like present-but-empty values (#292) — v4.2 (coollabsio/coolify#9893) strips sensitive fields from responses unless the token has sensitive-read scope. PrivateKey.private_key, EnvironmentVariable.value and EnvVarSummary.value were typed as required, so a withheld secret arrived as undefined behind a type that promised a string and flowed downstream silently. They are now optional, forcing callers to handle the missing case. Outbound Create*Request types are unchanged, since request payloads are unaffected.

Changed

• 405 and 403 errors now explain the v4.2 changes (#292) — a 405 previously surfaced as a bare HTTP 405: Method Not Allowed. It now points at the GET-to-POST move, and the 401/403 hint notes that v4.2 Member-role tokens are read-only, which is the likely cause of a 403 that appears immediately after upgrading.

Security

• env_vars list now masks database secrets by default (#276) — the application and service list branches masked values (***) unless reveal=true was passed, but the database branch called listDatabaseEnvVars with no options, so it returned every value in plaintext and silently ignored reveal. Database env vars are the most sensitive data the server touches (passwords, connection strings), so this was the exact leak the masking layer exists to prevent, and it directly contradicted the tool's documented default. listDatabaseEnvVars now masks value/real_value by default and honors reveal, matching the application and service behaviour.

---

📦 View on npm

🖱️ One-click Claude Desktop install: download coolify-mcp.mcpb below and drag it into Settings → Extensions.