DenkOps

Create an email/password account for a connector project. A strong password is generated and shown only once; pass it to the person securely. Password sign-in must be enabled for it to work. Workspace owners only.

Attach a custom domain to a DenkOps project. Returns the DNS TXT record (and CNAME target) to set at the DNS provider; the domain starts routing once its TXT record is verified.

Cancel a pending workspace invite. Workspace owners only.

Create an alert rule for an event (crash, killed, rate_limit, deploy_failed) on one project or all, optionally posting to an https webhook (e.g. Slack). Workspace owners only.

Mint a new scoped, revocable DenkOps connection token for a CLI, CI job or agent (e.g. GitHub Actions deploys). The token is returned exactly once and cannot be retrieved again. Workspace owners only.

Create a new workspace owned by the signed-in person. This connection keeps acting in its current workspace; reconnect to use the new one.

Delete an alert rule. Workspace owners only.

PERMANENTLY delete a DenkOps deployment and ALL its data (containers, images, volume and records). Cannot be undone. Only deletes when `confirm` equals the project's exact slug; without it nothing is deleted and the confirmation requirement is returned.

Deploy a project to DenkOps by sending its files, and get the live URL back. Include every source file (and denkops.json if the project has one; without it a new project is created, named from `name`, package.json or pyproject.toml). Pass project_id to ship a new version of an existing project. Secrets do not belong in files: .env files are rejected (set environment variables separately). Limits: 500 files, 5 MB.

Show the workspace's recent audit log: who did what, when. Workspace owners only.

Get a one-click Stripe link for this workspace: subscribe (optionally with extra slots), add slots to an existing subscription, or fix a failed payment. Nothing is charged until the user confirms on Stripe. Workspace owners only; other members are told which owner to ask.

Show recent actions performed with one connection token. Workspace owners only.

Show who may connect to a connector project (public, an email allowlist, or workspace members) and which sign-in methods are allowed. Workspace owners only.

Show the brand colours and icon used on a connector project's hosted sign-in and consent pages.

Read recent container logs for a DenkOps project, e.g. to debug a failing deploy. Optional `since` (15m, 2h, 3d or an ISO timestamp) and `level` (a token matched in the log line, e.g. error) filter the persisted log store.

Explains how to structure, configure (denkops.json) and deploy a DenkOps project: bun-Hono or python-FastAPI APIs and MCP servers built with defineMcp.

Read a project's outbound-network (egress) allow-list policy: enabled, allowed hosts and recently blocked hosts.

List the per-project role overrides of one workspace member. Workspace owners only.

Get a DenkOps project's request metrics (latency percentiles, error rate), latest resource sample and rejected-request count over the last 24h.

Show the workspace's plan: slots used and still free, subscription status and renewal date, and prices. Use it when a new project might not fit or the user asks about their plan or slots.

Show each member's workspace role and effective role on one project (none = the project is hidden from them). Workspace owners only.

List a DenkOps project's public (unauthenticated) paths, plus the routes DenkOps has observed the app serve.

Get a DenkOps project's status and active version by project_id.

Get the spans of a single DenkOps request trace by project_id and trace_id.

One overview of the workspace: slot usage and every project with status, active version and latest memory/CPU use.

Invite someone to the workspace by email address (or GitHub username) with a role. No email is sent: the result contains a short text with the sign-in link to pass on. They join when they sign in with that email (Google, or their primary GitHub email); an existing DenkOps user with that email is added right away. Workspace owners only.

Show recent alert events (crashes, kills, rate limits, failed deploys). Workspace owners only.

List the workspace's alert rules (crash, killed, rate_limit, deploy_failed) and where they notify. Workspace owners only.

List the workspace's DenkOps connection tokens (scoped, revocable agent/CLI credentials): label, agent type, scopes and status. Workspace owners only.

List the email/password accounts that can sign in to a connector project. Workspace owners only.

List a project's managed scheduled (cron) jobs with next and last run and status.

List a project's deployed versions (newest first) with status and when; the active version is marked. Useful before rolling back.

List a DenkOps project's custom domains and whether each is verified.

List a DenkOps project's environment variable KEYS (values are write-only and never shown), and whether changes are pending a redeploy.

List the workspace's members with their roles, and pending invites. Workspace owners only.

List the DenkOps projects in the signed-in workspace with their status and URL.

List recent request traces for a DenkOps project (name, status, duration, span count).

List the workspaces of the signed-in account with roles, and which one this connection acts in.

Re-run the current version of a DenkOps project to apply staged env or path changes or restart the app. Reuses the last upload; no code is sent.

Issue a new token for a connection and revoke the old one (e.g. after a leak). The new token is shown only once. Not for the connection this chat uses. Workspace owners only.

Delete an email/password account from a connector project. Workspace owners only.

Detach a custom domain from a DenkOps project.

Remove a member from the workspace; their access (including chat connections) ends immediately. The last owner can't be removed. Workspace owners only.

Generate a new password for a connector project's email/password account; the old one stops working. Shown only once. Workspace owners only.

Immediately revoke a DenkOps connection token by its connection_id. Workspace owners only.

Roll a DenkOps project back to a previous healthy version (omit version for the previous one).

Trigger a managed scheduled job immediately (recorded as a manual run).

Change who may connect to a connector project: public on/off, the email allowlist (replaces it), allowed sign-in providers (github, google, microsoft; null = all) and email/password accounts on/off. Omitted fields stay. Workspace owners only.

Brand a connector project's hosted sign-in and consent pages: accent colour (buttons/links), background colour (hex like #2563eb; null resets to the DenkOps default) and/or an icon (PNG, JPEG or WebP as base64, max 2 MB). Omitted fields stay unchanged; text colour is chosen automatically for contrast. A `branding` block in denkops.json overrides these values on the next deploy. Workspace owners only; the connector must be enabled.

Pause (enabled=false) or resume (enabled=true) a project's scheduled job.

Set a project's egress allow-list. enabled=true is default-deny: only listed hosts (exact or *.domain) may be reached. Allow-list edits apply live; enabling or disabling applies on the next deploy.

Set or overwrite a DenkOps project's environment variable (for secrets such as API keys). Values are write-only. The change is staged and takes effect on the next deploy or redeploy. Reserved keys (DENKOPS_*) are rejected.

Change a workspace member's role (owner, member or viewer). The last owner can't be demoted. Workspace owners only.

Set a member's role on one project: none (hidden), viewer, member or owner — or inherit to fall back to their workspace role. Workspace owners only.

Replace a DenkOps project's list of public (unauthenticated) paths. The change is staged and takes effect on the next deploy or redeploy.

Start a stopped DenkOps deployment again (reactivates its active version).

Stop a DenkOps deployment: its containers stop and it goes offline. Reversible by starting the project again.

Delete a DenkOps project's environment variable. Takes effect on the next deploy or redeploy.

Turn an alert rule on/off or change its webhook (null removes it). Workspace owners only.

Change what a connection token may do: env / public paths / egress access (none, read, write), whether it may create projects, and which projects it may touch (null = all). Not for the connection this chat uses. Workspace owners only.

Check a DenkOps custom domain's DNS TXT record and activate routing when it is present. Reports not-verified if the record isn't visible yet.

Show which DenkOps account and workspace this connection acts as.