Skip to main content

Set up the Octopus Deploy MCP server

The Octopus Deploy MCP server gives AI agents access to your Octopus Deploy instance: inspecting projects, releases, deployments, environments, and audit data, and, when the key allows it, triggering deployments and runbook runs. This guide covers creating an API key in Octopus and installing the server from the MintMCP MCP store.

Prerequisites​

  • A MintMCP admin account
  • An Octopus Deploy instance (Cloud or self-hosted) reachable over HTTPS
  • An Octopus account that can create API keys

The Octopus instance must be reachable from MintMCP's runtime. Octopus Cloud and other public endpoints work directly. For a self-hosted instance behind a firewall or VPN, allowlist MintMCP's dedicated egress IP.

Choose a credential model​

Octopus offers two kinds of API key, and the choice determines how you configure the connector in MintMCP.

Key typeWho it representsMintMCP authentication method
AI AgentOne shared identity for the agent, with write capability stripped outShared API key, entered once by the admin
UserThe individual who created it, with their full permissionsPer-user API key, entered by each member when they connect

Start with an AI Agent key. It inherits the permissions of the account it was created on minus anything that writes, so it can never do more than that account, and its activity is filterable separately in the audit log.

Create an API key in Octopus​

A key on a dedicated service account gives the agent its own identity, so its permissions are scoped by team and its activity is separable in the audit log. A key on your own account is faster to set up but inherits your permissions.

  1. In Octopus, go to Configuration > Users.
Octopus Configuration sidebar with Users selected
  1. Click Create Service Account.
Users page with the Create Service Account, Add AI Service Account, and Invite User buttons
  1. Enter a username and display name (for example, mintmcp and MintMCP), leave The user is a service account checked, and click Save.
Create User form with username, display name, and the service account checkbox
  1. Assign the account to one or more teams that grant the permissions the agent needs. For read-only use, a team with view permissions is enough.
  2. Expand API Keys and click New API Key for AI Agent.
Service account page with the API Keys section expanded and the New API Key for AI Agent button

Generate the key​

  1. Enter a purpose (for example, MintMCP) and set an expiration date.
  2. Select a permissions level, then click Generate New.
Generate New API Key for AI Agent form showing purpose, expiration date, and Read-only and Full access permission levels
Permissions levelUse when
Read-onlyThe agent only reads projects, releases, and audit data (recommended)
Full accessThe agent also triggers deployments and runbook runs
  1. Copy the key and store it in a secrets manager. Octopus keeps only a one-way hash and won't show it again.
Generated New API Key dialog showing the key and a copy button

Add Octopus Deploy to MintMCP​

Octopus Deploy is pre-listed as a recommended server in the MintMCP MCP store, so MintMCP runs it on its own infrastructure and you only supply the URL and key.

  1. In MintMCP, go to MCP store > Manage store.

  2. Find Octopus Deploy in the recommended servers list and click Install.

  3. Select an authentication method:

    MethodBehavior
    Shared API keyYou supply one service account key that every user's requests run with
    Per-user API keyEach user supplies their own key when they connect, so their own Octopus permissions apply

  4. Enter the Octopus Server URL: https://your-org.octopus.app for Cloud, or your server address if self-hosted.

  5. For Shared API key, enter the Octopus API Key you copied above.

  6. Click Install.

Security considerations​

  • An AI Agent key runs every user's tool calls as one shared identity, so Octopus audit logs attribute all activity to that account. Per-user keys tie each call back to the individual who made it.
  • An AI Agent key inherits the permissions of the account it was created on, with write capability removed. On a service account, scope those permissions by assigning it only the teams the agent needs.
  • The Read-only permissions level keeps the agent from changing anything in Octopus. Choose Full access only when the agent needs to trigger deployments and runbook runs.
  • The key is shown only once at creation. Store it in a secrets manager, and rotate by generating a new key and updating the connector.
  • Keys expire on the date set at creation. Rotate before expiry to avoid connection failures.
  • The connector runs inside MintMCP's infrastructure and connects outbound to your Octopus instance only. No deployment data is stored in MintMCP beyond what individual tool calls return.

Next steps​