Netlify deploys web projects and manages sites, builds, and environment configuration. Use OAuth for user-delegated access or a personal access token held by a dedicated identity for non-interactive automation.
This guide covers Netlify-side prerequisites for an MCP server. The Netlify agent template is separate from Netlify access setup.
Choose a connection method
Choose OAuth when access should follow a Netlify member. Choose a personal access token only for a named non-interactive identity. Netlify documents OAuth applications and personal access tokens.
Recommended: OAuth
Use OAuth for a user-delegated connection. Create a test Netlify team and site or use an isolated preview site; authorize a member who is not the production-team owner.
- Register the OAuth application in Netlify and add the MCP client's exact redirect URI. For Dome, use
https://api.domesystems.ai/oauth/callback. - Request the smallest scopes required for the site's intended use.
- Authorize as the test member and approve only the intended team.
- Retrieve deployment status for the test site.
- Confirm a site in an unshared team is unavailable.
Netlify's OAuth documentation is the source of truth for app registration and current scope behavior.
Alternative: Personal access token
Use a personal access token only for a non-interactive integration. Create it under a dedicated member, not a team owner, and rotate it on a schedule. Do not give a read-only status workflow deployment or DNS-write access.
- Open the vendor's credential documentation as the dedicated least-privileged identity.
- Create a named credential for the intended test workspace, project, organization, or account—never reuse an owner or administrator credential.
- Select the minimum scopes, repositories, projects, or resources the MCP server needs; begin read-only whenever the product supports it.
- Copy the secret once into the MCP client's secret store, record its owner and rotation date, then test both an allowed record and a denied boundary.
Verify Netlify MCP
Use this checklist to confirm the MCP server is connected with the intended access.
- Connect the MCP client using the newly created authorization.
- Confirm that Netlify MCP tools are discovered.
- Read one known test resource that the authorized identity is allowed to access.
- Attempt to read a resource outside the approved Netlify boundary; it should be unavailable or denied.
- Confirm that no write capability beyond the reviewed setup is available.
Troubleshooting
If authentication succeeds but the expected site is absent, check team membership and site ownership. An OAuth callback mismatch must be corrected in the registered Netlify app.
Next steps
Deploy the Netlify agent template to create a governed agent in Dome that can work with the approved sites and deployments, with the template's included model, tools, and rules.
