How to set up the DigitalOcean MCP server

DigitalOcean provides cloud compute, networking, storage, and managed database services. Choose either its MCP Router, which fronts most first-party services through one connection, or individual service endpoints when an agent needs a smaller surface area.

This guide prepares DigitalOcean for an MCP client. The DigitalOcean agent template is a separate Dome deployment.

Choose a connection method

Choose the server topology before choosing its credential:

• MCP Router (recommended): Connect once to https://mcp.digitalocean.com/mcp to discover and use tools from DigitalOcean's supported first-party MCP services.
• Individual service endpoints: Connect only the services an agent needs, such as App Platform at https://apps.mcp.digitalocean.com/mcp or Databases at https://databases.mcp.digitalocean.com/mcp.
• Knowledge Bases: Connect directly to https://kbaas.do-ai.run/v1/mcp; it is not available through the MCP Router.

Use OAuth where the MCP client can complete browser sign-in. Use a DigitalOcean API token only for non-interactive automation or a client that cannot use OAuth. The router and individual authenticated services support OAuth.

Recommended: OAuth with the MCP Router

Use OAuth when the MCP server should represent a user. DigitalOcean's hosted MCP services publish their own OAuth discovery metadata: do not create a separate OAuth application and do not send a literal default scope. Follow DigitalOcean's OAuth authentication instructions for the vendor's current client-specific steps.

1. Create a non-production project and a dedicated test team member before authorization.
2. Add the MCP Router at https://mcp.digitalocean.com/mcp. It is DigitalOcean's recommended OAuth entry point and forwards a single authorization to App Platform and the other supported first-party services.
3. Start the connection without an Authorization header and without a hard-coded OAuth scope. The MCP server starts the browser sign-in and requests its supported permissions.
4. On DigitalOcean's consent screen, select Manage permissions and keep only the access the MCP workflow needs; start with Read unless writes are explicitly required. Then select the intended test team and authorize the connection.
5. Read a known test resource and verify that production resources are inaccessible.

Alternative: API token with the MCP Router

For a non-interactive connection, create a Personal Access Token under a dedicated team member and keep it read-only when the server supports read-only operation. Add it as Authorization: Bearer <token> on the router connection. Record its owner and expiry, and rotate it when the automation changes. DigitalOcean's token documentation covers creation and revocation.

• Open the vendor's credential documentation as the dedicated least-privileged identity.
• Create a named credential for the intended test workspace, project, organization, or account—never reuse an owner or administrator credential.
• Select the minimum scopes, repositories, projects, or resources the MCP server needs; begin read-only whenever the product supports it.
• Copy the secret once into the MCP client's secret store, record its owner and rotation date, then test both an allowed record and a denied boundary.

Alternative: Individual service endpoints

Use direct service endpoints when the agent should only discover tools for a small set of DigitalOcean products. Configure each endpoint separately, then choose OAuth by omitting the Authorization header or supply the same least-privileged API token as a bearer header for non-interactive access.

• Add only the required endpoints, for example https://apps.mcp.digitalocean.com/mcp for App Platform and https://databases.mcp.digitalocean.com/mcp for Databases.
• Use the MCP Router instead if the agent needs tools across several supported DigitalOcean services; one OAuth connection is easier to operate and review.
• Connect Knowledge Bases directly at https://kbaas.do-ai.run/v1/mcp; it is the exception to the router's coverage.
• Confirm that the client discovers tools only from the selected services before granting broader access.

Verify DigitalOcean MCP

Use this checklist to confirm the MCP server is connected with the intended access.

• Connect the MCP client using the newly created authorization.
• Confirm that DigitalOcean MCP tools are discovered.
• Read one known test resource that the authorized identity is allowed to access.
• Attempt to read a resource outside the approved DigitalOcean boundary; it should be unavailable or denied.
• Confirm that no write capability beyond the reviewed setup is available.

Troubleshooting

If the authorization page says default is not a valid scope, the client sent an unsupported literal default scope. Remove the explicit scope, restart the OAuth flow, and let the hosted MCP server supply its own authorization parameters. If a server returns 401 Unable to authenticate you after successful consent, verify that the client sends DigitalOcean's protected-resource value, https://mcp.digitalocean.com, as the OAuth resource parameter—not the router endpoint URL with /mcp appended—on both authorization and token requests. Reconnect after correcting the resource value. If expected resources are missing after consent, check team membership and project association before granting broader token access. Treat a token as a credential for the full permissions of its owner.

Next steps

Deploy the DigitalOcean agent template to create a governed agent in Dome that can work with the approved cloud project, with the template's included model, tools, and rules.