From 7ab16ad7b5e34e0da37f91f4be4c7396bc97264a Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Wed, 29 Apr 2026 10:30:43 +0200
Subject: [PATCH 01/14] feat(mcp): add MCP server with read-only tools for
 Coolify resources

Add Model Context Protocol server exposing Coolify infrastructure data
to AI assistants. Includes tools for listing/fetching servers, projects,
applications, databases, and services, scoped to authenticated team tokens.

- Add CoolifyServer with 10 read-only tools (list/get for all resource types)
- Add BuildsResponse and ResolvesTeam traits for shared tool logic
- Add EnsureMcpEnabled middleware guarding /mcp routes
- Add enable/disable MCP API endpoints (root-only)
- Add is_mcp_server_enabled toggle in instance settings and advanced UI
- Add migration for is_mcp_server_enabled column
- Add feature tests for MCP endpoints and toggle API
- Scrub sensitive keys (passwords, tokens, raw IDs) from all responses
---
 app/Http/Controllers/Api/OtherController.php  | 112 +++++++++
 app/Http/Kernel.php                           | 102 +++++---
 app/Http/Middleware/EnsureMcpEnabled.php      |  25 ++
 app/Livewire/Settings/Advanced.php            |   6 +
 app/Mcp/Concerns/BuildsResponse.php           | 225 ++++++++++++++++++
 app/Mcp/Concerns/ResolvesTeam.php             |  35 +++
 app/Mcp/Servers/CoolifyServer.php             |  50 ++++
 app/Mcp/Tools/GetApplication.php              |  60 +++++
 app/Mcp/Tools/GetDatabase.php                 |  58 +++++
 app/Mcp/Tools/GetInfrastructureOverview.php   |  93 ++++++++
 app/Mcp/Tools/GetServer.php                   |  57 +++++
 app/Mcp/Tools/GetService.php                  |  61 +++++
 app/Mcp/Tools/ListApplications.php            |  74 ++++++
 app/Mcp/Tools/ListDatabases.php               |  69 ++++++
 app/Mcp/Tools/ListProjects.php                |  66 +++++
 app/Mcp/Tools/ListServers.php                 |  67 ++++++
 app/Mcp/Tools/ListServices.php                |  68 ++++++
 app/Models/InstanceSettings.php               |   2 +
 composer.json                                 |   1 +
 composer.lock                                 | 150 ++++++------
 ...ver_enabled_to_instance_settings_table.php |  28 +++
 openapi.json                                  | 104 ++++++++
 openapi.yaml                                  |  58 +++++
 .../livewire/settings/advanced.blade.php      |  11 +
 routes/ai.php                                 |   7 +
 routes/api.php                                |   2 +
 tests/Feature/Mcp/McpEndpointTest.php         | 194 +++++++++++++++
 tests/Feature/Mcp/McpToggleApiTest.php        | 107 +++++++++
 28 files changed, 1783 insertions(+), 109 deletions(-)
 create mode 100644 app/Http/Middleware/EnsureMcpEnabled.php
 create mode 100644 app/Mcp/Concerns/BuildsResponse.php
 create mode 100644 app/Mcp/Concerns/ResolvesTeam.php
 create mode 100644 app/Mcp/Servers/CoolifyServer.php
 create mode 100644 app/Mcp/Tools/GetApplication.php
 create mode 100644 app/Mcp/Tools/GetDatabase.php
 create mode 100644 app/Mcp/Tools/GetInfrastructureOverview.php
 create mode 100644 app/Mcp/Tools/GetServer.php
 create mode 100644 app/Mcp/Tools/GetService.php
 create mode 100644 app/Mcp/Tools/ListApplications.php
 create mode 100644 app/Mcp/Tools/ListDatabases.php
 create mode 100644 app/Mcp/Tools/ListProjects.php
 create mode 100644 app/Mcp/Tools/ListServers.php
 create mode 100644 app/Mcp/Tools/ListServices.php
 create mode 100644 database/migrations/2026_04_22_183029_add_is_mcp_server_enabled_to_instance_settings_table.php
 create mode 100644 routes/ai.php
 create mode 100644 tests/Feature/Mcp/McpEndpointTest.php
 create mode 100644 tests/Feature/Mcp/McpToggleApiTest.php

diff --git a/app/Http/Controllers/Api/OtherController.php b/app/Http/Controllers/Api/OtherController.php
index 5ac274f93..17c5a884a 100644
--- a/app/Http/Controllers/Api/OtherController.php
+++ b/app/Http/Controllers/Api/OtherController.php
@@ -153,6 +153,118 @@ public function disable_api(Request $request)
         return response()->json(['message' => 'API disabled.'], 200);
     }
 
+    #[OA\Get(
+        summary: 'Enable MCP Server',
+        description: 'Enable the MCP server endpoint at /mcp (only with root permissions).',
+        path: '/mcp/enable',
+        operationId: 'enable-mcp',
+        security: [
+            ['bearerAuth' => []],
+        ],
+        responses: [
+            new OA\Response(
+                response: 200,
+                description: 'MCP server enabled.',
+                content: new OA\JsonContent(
+                    type: 'object',
+                    properties: [
+                        new OA\Property(property: 'message', type: 'string', example: 'MCP server enabled.'),
+                    ]
+                )),
+            new OA\Response(
+                response: 403,
+                description: 'You are not allowed to enable the MCP server.',
+                content: new OA\JsonContent(
+                    type: 'object',
+                    properties: [
+                        new OA\Property(property: 'message', type: 'string', example: 'You are not allowed to enable the MCP server.'),
+                    ]
+                )),
+            new OA\Response(
+                response: 401,
+                ref: '#/components/responses/401',
+            ),
+            new OA\Response(
+                response: 400,
+                ref: '#/components/responses/400',
+            ),
+        ]
+    )]
+    public function enable_mcp(Request $request)
+    {
+        $teamId = getTeamIdFromToken();
+        if (is_null($teamId)) {
+            return invalidTokenResponse();
+        }
+        if ($teamId !== '0') {
+            auditLog('api.mcp.enable_denied', ['team_id' => $teamId], 'warning');
+
+            return response()->json(['message' => 'You are not allowed to enable the MCP server.'], 403);
+        }
+        $settings = instanceSettings();
+        $settings->update(['is_mcp_server_enabled' => true]);
+
+        auditLog('api.mcp.enabled', ['team_id' => $teamId]);
+
+        return response()->json(['message' => 'MCP server enabled.'], 200);
+    }
+
+    #[OA\Get(
+        summary: 'Disable MCP Server',
+        description: 'Disable the MCP server endpoint at /mcp (only with root permissions).',
+        path: '/mcp/disable',
+        operationId: 'disable-mcp',
+        security: [
+            ['bearerAuth' => []],
+        ],
+        responses: [
+            new OA\Response(
+                response: 200,
+                description: 'MCP server disabled.',
+                content: new OA\JsonContent(
+                    type: 'object',
+                    properties: [
+                        new OA\Property(property: 'message', type: 'string', example: 'MCP server disabled.'),
+                    ]
+                )),
+            new OA\Response(
+                response: 403,
+                description: 'You are not allowed to disable the MCP server.',
+                content: new OA\JsonContent(
+                    type: 'object',
+                    properties: [
+                        new OA\Property(property: 'message', type: 'string', example: 'You are not allowed to disable the MCP server.'),
+                    ]
+                )),
+            new OA\Response(
+                response: 401,
+                ref: '#/components/responses/401',
+            ),
+            new OA\Response(
+                response: 400,
+                ref: '#/components/responses/400',
+            ),
+        ]
+    )]
+    public function disable_mcp(Request $request)
+    {
+        $teamId = getTeamIdFromToken();
+        if (is_null($teamId)) {
+            return invalidTokenResponse();
+        }
+        if ($teamId !== '0') {
+            auditLog('api.mcp.disable_denied', ['team_id' => $teamId], 'warning');
+
+            return response()->json(['message' => 'You are not allowed to disable the MCP server.'], 403);
+        }
+        $settings = instanceSettings();
+        $settings->update(['is_mcp_server_enabled' => false]);
+
+        auditLog('api.mcp.disabled', ['team_id' => $teamId]);
+
+        return response()->json(['message' => 'MCP server disabled.'], 200);
+    }
+
     public function feedback(Request $request)
     {
         $data = $request->validate([
diff --git a/app/Http/Kernel.php b/app/Http/Kernel.php
index 515d40c62..a584bc111 100644
--- a/app/Http/Kernel.php
+++ b/app/Http/Kernel.php
@@ -2,7 +2,40 @@
 
 namespace App\Http;
 
+use App\Http\Middleware\ApiAbility;
+use App\Http\Middleware\ApiSensitiveData;
+use App\Http\Middleware\Authenticate;
+use App\Http\Middleware\CanAccessTerminal;
+use App\Http\Middleware\CanCreateResources;
+use App\Http\Middleware\CanUpdateResource;
+use App\Http\Middleware\CheckForcePasswordReset;
+use App\Http\Middleware\DecideWhatToDoWithUser;
+use App\Http\Middleware\EncryptCookies;
+use App\Http\Middleware\EnsureMcpEnabled;
+use App\Http\Middleware\PreventRequestsDuringMaintenance;
+use App\Http\Middleware\RedirectIfAuthenticated;
+use App\Http\Middleware\TrimStrings;
+use App\Http\Middleware\TrustHosts;
+use App\Http\Middleware\TrustProxies;
+use App\Http\Middleware\ValidateSignature;
+use App\Http\Middleware\VerifyCsrfToken;
+use Illuminate\Auth\Middleware\AuthenticateWithBasicAuth;
+use Illuminate\Auth\Middleware\Authorize;
+use Illuminate\Auth\Middleware\EnsureEmailIsVerified;
+use Illuminate\Auth\Middleware\RequirePassword;
+use Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse;
 use Illuminate\Foundation\Http\Kernel as HttpKernel;
+use Illuminate\Foundation\Http\Middleware\ConvertEmptyStringsToNull;
+use Illuminate\Foundation\Http\Middleware\ValidatePostSize;
+use Illuminate\Http\Middleware\HandleCors;
+use Illuminate\Http\Middleware\SetCacheHeaders;
+use Illuminate\Routing\Middleware\SubstituteBindings;
+use Illuminate\Routing\Middleware\ThrottleRequests;
+use Illuminate\Session\Middleware\AuthenticateSession;
+use Illuminate\Session\Middleware\StartSession;
+use Illuminate\View\Middleware\ShareErrorsFromSession;
+use Laravel\Sanctum\Http\Middleware\CheckAbilities;
+use Laravel\Sanctum\Http\Middleware\CheckForAnyAbility;
 
 class Kernel extends HttpKernel
 {
@@ -14,13 +47,13 @@ class Kernel extends HttpKernel
      * @var array<int, class-string|string>
      */
     protected $middleware = [
-        \App\Http\Middleware\TrustHosts::class,
-        \App\Http\Middleware\TrustProxies::class,
-        \Illuminate\Http\Middleware\HandleCors::class,
-        \App\Http\Middleware\PreventRequestsDuringMaintenance::class,
-        \Illuminate\Foundation\Http\Middleware\ValidatePostSize::class,
-        \App\Http\Middleware\TrimStrings::class,
-        \Illuminate\Foundation\Http\Middleware\ConvertEmptyStringsToNull::class,
+        TrustHosts::class,
+        TrustProxies::class,
+        HandleCors::class,
+        PreventRequestsDuringMaintenance::class,
+        ValidatePostSize::class,
+        TrimStrings::class,
+        ConvertEmptyStringsToNull::class,
 
     ];
 
@@ -31,21 +64,21 @@ class Kernel extends HttpKernel
      */
     protected $middlewareGroups = [
         'web' => [
-            \App\Http\Middleware\EncryptCookies::class,
-            \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
-            \Illuminate\Session\Middleware\StartSession::class,
-            \Illuminate\View\Middleware\ShareErrorsFromSession::class,
-            \App\Http\Middleware\VerifyCsrfToken::class,
-            \Illuminate\Routing\Middleware\SubstituteBindings::class,
-            \App\Http\Middleware\CheckForcePasswordReset::class,
-            \App\Http\Middleware\DecideWhatToDoWithUser::class,
+            EncryptCookies::class,
+            AddQueuedCookiesToResponse::class,
+            StartSession::class,
+            ShareErrorsFromSession::class,
+            VerifyCsrfToken::class,
+            SubstituteBindings::class,
+            CheckForcePasswordReset::class,
+            DecideWhatToDoWithUser::class,
 
         ],
 
         'api' => [
             // \Laravel\Sanctum\Http\Middleware\EnsureFrontendRequestsAreStateful::class,
-            \Illuminate\Routing\Middleware\ThrottleRequests::class.':api',
-            \Illuminate\Routing\Middleware\SubstituteBindings::class,
+            ThrottleRequests::class.':api',
+            SubstituteBindings::class,
         ],
     ];
 
@@ -57,22 +90,23 @@ class Kernel extends HttpKernel
      * @var array<string, class-string|string>
      */
     protected $middlewareAliases = [
-        'auth' => \App\Http\Middleware\Authenticate::class,
-        'auth.basic' => \Illuminate\Auth\Middleware\AuthenticateWithBasicAuth::class,
-        'auth.session' => \Illuminate\Session\Middleware\AuthenticateSession::class,
-        'cache.headers' => \Illuminate\Http\Middleware\SetCacheHeaders::class,
-        'can' => \Illuminate\Auth\Middleware\Authorize::class,
-        'guest' => \App\Http\Middleware\RedirectIfAuthenticated::class,
-        'password.confirm' => \Illuminate\Auth\Middleware\RequirePassword::class,
-        'signed' => \App\Http\Middleware\ValidateSignature::class,
-        'throttle' => \Illuminate\Routing\Middleware\ThrottleRequests::class,
-        'verified' => \Illuminate\Auth\Middleware\EnsureEmailIsVerified::class,
-        'abilities' => \Laravel\Sanctum\Http\Middleware\CheckAbilities::class,
-        'ability' => \Laravel\Sanctum\Http\Middleware\CheckForAnyAbility::class,
-        'api.ability' => \App\Http\Middleware\ApiAbility::class,
-        'api.sensitive' => \App\Http\Middleware\ApiSensitiveData::class,
-        'can.create.resources' => \App\Http\Middleware\CanCreateResources::class,
-        'can.update.resource' => \App\Http\Middleware\CanUpdateResource::class,
-        'can.access.terminal' => \App\Http\Middleware\CanAccessTerminal::class,
+        'auth' => Authenticate::class,
+        'auth.basic' => AuthenticateWithBasicAuth::class,
+        'auth.session' => AuthenticateSession::class,
+        'cache.headers' => SetCacheHeaders::class,
+        'can' => Authorize::class,
+        'guest' => RedirectIfAuthenticated::class,
+        'password.confirm' => RequirePassword::class,
+        'signed' => ValidateSignature::class,
+        'throttle' => ThrottleRequests::class,
+        'verified' => EnsureEmailIsVerified::class,
+        'abilities' => CheckAbilities::class,
+        'ability' => CheckForAnyAbility::class,
+        'api.ability' => ApiAbility::class,
+        'api.sensitive' => ApiSensitiveData::class,
+        'can.create.resources' => CanCreateResources::class,
+        'can.update.resource' => CanUpdateResource::class,
+        'can.access.terminal' => CanAccessTerminal::class,
+        'mcp.enabled' => EnsureMcpEnabled::class,
     ];
 }
diff --git a/app/Http/Middleware/EnsureMcpEnabled.php b/app/Http/Middleware/EnsureMcpEnabled.php
new file mode 100644
index 000000000..9c4f1339c
--- /dev/null
+++ b/app/Http/Middleware/EnsureMcpEnabled.php
@@ -0,0 +1,25 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Models\InstanceSettings;
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+class EnsureMcpEnabled
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param  Closure(Request): (Response)  $next
+     */
+    public function handle(Request $request, Closure $next): Response
+    {
+        if (! InstanceSettings::get()->is_mcp_server_enabled) {
+            abort(404);
+        }
+
+        return $next($request);
+    }
+}
diff --git a/app/Livewire/Settings/Advanced.php b/app/Livewire/Settings/Advanced.php
index d31f68859..3a6237183 100644
--- a/app/Livewire/Settings/Advanced.php
+++ b/app/Livewire/Settings/Advanced.php
@@ -37,6 +37,9 @@ class Advanced extends Component
     #[Validate('boolean')]
     public bool $is_wire_navigate_enabled;
 
+    #[Validate('boolean')]
+    public bool $is_mcp_server_enabled;
+
     public function rules()
     {
         return [
@@ -49,6 +52,7 @@ public function rules()
             'is_sponsorship_popup_enabled' => 'boolean',
             'disable_two_step_confirmation' => 'boolean',
             'is_wire_navigate_enabled' => 'boolean',
+            'is_mcp_server_enabled' => 'boolean',
         ];
     }
 
@@ -67,6 +71,7 @@ public function mount()
         $this->disable_two_step_confirmation = $this->settings->disable_two_step_confirmation;
         $this->is_sponsorship_popup_enabled = $this->settings->is_sponsorship_popup_enabled;
         $this->is_wire_navigate_enabled = $this->settings->is_wire_navigate_enabled ?? true;
+        $this->is_mcp_server_enabled = $this->settings->is_mcp_server_enabled ?? false;
     }
 
     public function submit()
@@ -150,6 +155,7 @@ public function instantSave()
             $this->settings->is_sponsorship_popup_enabled = $this->is_sponsorship_popup_enabled;
             $this->settings->disable_two_step_confirmation = $this->disable_two_step_confirmation;
             $this->settings->is_wire_navigate_enabled = $this->is_wire_navigate_enabled;
+            $this->settings->is_mcp_server_enabled = $this->is_mcp_server_enabled;
             $this->settings->save();
             $this->dispatch('success', 'Settings updated!');
         } catch (\Exception $e) {
diff --git a/app/Mcp/Concerns/BuildsResponse.php b/app/Mcp/Concerns/BuildsResponse.php
new file mode 100644
index 000000000..10d87ae92
--- /dev/null
+++ b/app/Mcp/Concerns/BuildsResponse.php
@@ -0,0 +1,225 @@
+<?php
+
+namespace App\Mcp\Concerns;
+
+use Laravel\Mcp\Request;
+use Laravel\Mcp\Response;
+
+trait BuildsResponse
+{
+    protected int $defaultPerPage = 50;
+
+    protected int $maxPerPage = 100;
+
+    /**
+     * Keys removed at any depth from get_* responses.
+     *
+     * Covers: raw integer surrogate keys (id and *_id columns; uuid stays),
+     * Eloquent morph types, encrypted secrets, DB passwords, and bulky
+     * payloads that should never traverse the MCP boundary.
+     *
+     * @var array<int, string>
+     */
+    protected array $sensitiveKeys = [
+        // raw IDs / morph types (uuid is the public identifier)
+        'id', 'team_id', 'tokenable_id', 'tokenable_type',
+        'server_id', 'private_key_id', 'cloud_provider_token_id',
+        'hetzner_server_id', 'environment_id', 'destination_id',
+        'source_id', 'repository_project_id', 'application_id',
+        'service_id', 'project_id', 'parent_id',
+        'resourceable', 'resourceable_id', 'resourceable_type',
+        'destination_type', 'source_type', 'tokenable',
+
+        // sentinel / observability secrets
+        'sentinel_token', 'sentinel_custom_url',
+        'logdrain_newrelic_license_key', 'logdrain_axiom_api_key',
+        'logdrain_custom_config', 'logdrain_custom_config_parser',
+
+        // database passwords
+        'postgres_password', 'dragonfly_password', 'keydb_password',
+        'redis_password', 'mongo_initdb_root_password',
+        'mariadb_password', 'mariadb_root_password',
+        'mysql_password', 'mysql_root_password',
+        'clickhouse_admin_password',
+
+        // app/env secrets
+        'value', 'real_value', 'http_basic_auth_password',
+
+        // database connection strings embed credentials
+        'internal_db_url', 'external_db_url', 'init_scripts',
+
+        // webhook secrets
+        'manual_webhook_secret_bitbucket', 'manual_webhook_secret_gitea',
+        'manual_webhook_secret_github', 'manual_webhook_secret_gitlab',
+
+        // bulky / unsafe blobs
+        'dockerfile', 'docker_compose', 'docker_compose_raw',
+        'custom_labels', 'environment_variables',
+        'environment_variables_preview', 'validation_logs',
+        'server_metadata',
+    ];
+
+    /**
+     * Recursively remove sensitive keys from any nested array structure.
+     *
+     * @param  array<array-key, mixed>  $data
+     * @return array<array-key, mixed>
+     */
+    protected function scrubSensitive(array $data): array
+    {
+        $deny = array_flip($this->sensitiveKeys);
+
+        $walk = function ($value) use (&$walk, $deny) {
+            if (! is_array($value)) {
+                return $value;
+            }
+
+            $out = [];
+            foreach ($value as $key => $inner) {
+                if (is_string($key) && isset($deny[$key])) {
+                    continue;
+                }
+                $out[$key] = $walk($inner);
+            }
+
+            return $out;
+        };
+
+        return $walk($data);
+    }
+
+    /**
+     * @param  array<string, mixed>|array<int, mixed>  $data
+     * @param  array<int, array<string, mixed>>  $actions
+     * @param  array<string, mixed>|null  $pagination
+     */
+    protected function respond(array $data, array $actions = [], ?array $pagination = null): Response
+    {
+        $payload = ['data' => $data];
+
+        if ($actions !== []) {
+            $payload['_actions'] = $actions;
+        }
+
+        if ($pagination !== null) {
+            $payload['_pagination'] = $pagination;
+        }
+
+        return Response::json($payload);
+    }
+
+    /**
+     * @return array{page:int, per_page:int, offset:int}
+     */
+    protected function paginationArgs(Request $request): array
+    {
+        $page = max(1, (int) ($request->get('page') ?? 1));
+        $perPage = (int) ($request->get('per_page') ?? $this->defaultPerPage);
+        $perPage = max(1, min($this->maxPerPage, $perPage));
+
+        return [
+            'page' => $page,
+            'per_page' => $perPage,
+            'offset' => ($page - 1) * $perPage,
+        ];
+    }
+
+    /**
+     * @param  array{page:int, per_page:int, offset:int}  $args
+     * @return array<string, mixed>|null
+     */
+    protected function paginationMeta(string $tool, array $args, int $total, array $extraArgs = []): ?array
+    {
+        $page = $args['page'];
+        $perPage = $args['per_page'];
+        $totalPages = (int) ceil($total / $perPage);
+
+        $meta = [
+            'page' => $page,
+            'per_page' => $perPage,
+            'total' => $total,
+            'total_pages' => $totalPages,
+        ];
+
+        if ($page < $totalPages) {
+            $meta['next'] = [
+                'tool' => $tool,
+                'args' => array_merge($extraArgs, ['page' => $page + 1, 'per_page' => $perPage]),
+            ];
+        }
+
+        return $meta;
+    }
+
+    /**
+     * HATEOAS-style action suggestions for an application.
+     *
+     * @return array<int, array<string, mixed>>
+     */
+    protected function actionsForApplication(string $uuid, ?string $status = null): array
+    {
+        $actions = [
+            ['tool' => 'get_application', 'args' => ['uuid' => $uuid], 'hint' => 'Full details'],
+        ];
+
+        $s = strtolower((string) $status);
+        if (str_contains($s, 'running')) {
+            $actions[] = ['tool' => 'control', 'args' => ['resource' => 'application', 'action' => 'restart', 'uuid' => $uuid], 'hint' => 'Restart'];
+            $actions[] = ['tool' => 'control', 'args' => ['resource' => 'application', 'action' => 'stop', 'uuid' => $uuid], 'hint' => 'Stop'];
+        } else {
+            $actions[] = ['tool' => 'control', 'args' => ['resource' => 'application', 'action' => 'start', 'uuid' => $uuid], 'hint' => 'Start'];
+        }
+
+        return $actions;
+    }
+
+    /**
+     * @return array<int, array<string, mixed>>
+     */
+    protected function actionsForDatabase(string $uuid, ?string $status = null): array
+    {
+        $actions = [
+            ['tool' => 'get_database', 'args' => ['uuid' => $uuid], 'hint' => 'Full details'],
+        ];
+
+        $s = strtolower((string) $status);
+        if (str_contains($s, 'running')) {
+            $actions[] = ['tool' => 'control', 'args' => ['resource' => 'database', 'action' => 'restart', 'uuid' => $uuid], 'hint' => 'Restart'];
+            $actions[] = ['tool' => 'control', 'args' => ['resource' => 'database', 'action' => 'stop', 'uuid' => $uuid], 'hint' => 'Stop'];
+        } else {
+            $actions[] = ['tool' => 'control', 'args' => ['resource' => 'database', 'action' => 'start', 'uuid' => $uuid], 'hint' => 'Start'];
+        }
+
+        return $actions;
+    }
+
+    /**
+     * @return array<int, array<string, mixed>>
+     */
+    protected function actionsForService(string $uuid, ?string $status = null): array
+    {
+        $actions = [
+            ['tool' => 'get_service', 'args' => ['uuid' => $uuid], 'hint' => 'Full details'],
+        ];
+
+        $s = strtolower((string) $status);
+        if (str_contains($s, 'running')) {
+            $actions[] = ['tool' => 'control', 'args' => ['resource' => 'service', 'action' => 'restart', 'uuid' => $uuid], 'hint' => 'Restart'];
+            $actions[] = ['tool' => 'control', 'args' => ['resource' => 'service', 'action' => 'stop', 'uuid' => $uuid], 'hint' => 'Stop'];
+        } else {
+            $actions[] = ['tool' => 'control', 'args' => ['resource' => 'service', 'action' => 'start', 'uuid' => $uuid], 'hint' => 'Start'];
+        }
+
+        return $actions;
+    }
+
+    /**
+     * @return array<int, array<string, mixed>>
+     */
+    protected function actionsForServer(string $uuid): array
+    {
+        return [
+            ['tool' => 'get_server', 'args' => ['uuid' => $uuid], 'hint' => 'Full details'],
+        ];
+    }
+}
diff --git a/app/Mcp/Concerns/ResolvesTeam.php b/app/Mcp/Concerns/ResolvesTeam.php
new file mode 100644
index 000000000..f75219fcf
--- /dev/null
+++ b/app/Mcp/Concerns/ResolvesTeam.php
@@ -0,0 +1,35 @@
+<?php
+
+namespace App\Mcp\Concerns;
+
+use Laravel\Mcp\Request;
+use Laravel\Mcp\Response;
+
+trait ResolvesTeam
+{
+    protected function ensureAbility(Request $request, string $ability = 'read'): ?Response
+    {
+        $user = $request->user();
+        if (! $user) {
+            return Response::error('Unauthenticated.');
+        }
+
+        $token = $user->currentAccessToken();
+        if (! $token) {
+            return Response::error('Invalid token.');
+        }
+
+        if ($token->can('root') || $token->can($ability)) {
+            return null;
+        }
+
+        return Response::error("Missing required permissions: {$ability}");
+    }
+
+    protected function resolveTeamId(Request $request): ?int
+    {
+        $token = $request->user()?->currentAccessToken();
+
+        return $token?->team_id;
+    }
+}
diff --git a/app/Mcp/Servers/CoolifyServer.php b/app/Mcp/Servers/CoolifyServer.php
new file mode 100644
index 000000000..aff7e3f76
--- /dev/null
+++ b/app/Mcp/Servers/CoolifyServer.php
@@ -0,0 +1,50 @@
+<?php
+
+namespace App\Mcp\Servers;
+
+use App\Mcp\Tools\GetApplication;
+use App\Mcp\Tools\GetDatabase;
+use App\Mcp\Tools\GetInfrastructureOverview;
+use App\Mcp\Tools\GetServer;
+use App\Mcp\Tools\GetService;
+use App\Mcp\Tools\ListApplications;
+use App\Mcp\Tools\ListDatabases;
+use App\Mcp\Tools\ListProjects;
+use App\Mcp\Tools\ListServers;
+use App\Mcp\Tools\ListServices;
+use Laravel\Mcp\Server;
+use Laravel\Mcp\Server\Attributes\Instructions;
+use Laravel\Mcp\Server\Attributes\Name;
+use Laravel\Mcp\Server\Attributes\Version;
+
+#[Name('Coolify')]
+#[Version('0.1.0')]
+#[Instructions(<<<'MD'
+Read-only MCP server for Coolify, scoped to the authenticated team token.
+
+Recommended workflow:
+1. get_infrastructure_overview — start here; single call returns all servers, projects with resource counts, and aggregates.
+2. list_servers / list_projects / list_applications / list_databases / list_services — paginated summary listings (default 50 per page, cap 100).
+3. get_server / get_application / get_database / get_service — full details for a single UUID.
+
+Every response is `{ data, _actions?, _pagination? }`. `_actions` suggests the next tool + args; `_pagination.next` is the args to call again for the next page.
+MD)]
+class CoolifyServer extends Server
+{
+    protected array $tools = [
+        GetInfrastructureOverview::class,
+        ListServers::class,
+        GetServer::class,
+        ListProjects::class,
+        ListApplications::class,
+        GetApplication::class,
+        ListDatabases::class,
+        GetDatabase::class,
+        ListServices::class,
+        GetService::class,
+    ];
+
+    protected array $resources = [];
+
+    protected array $prompts = [];
+}
diff --git a/app/Mcp/Tools/GetApplication.php b/app/Mcp/Tools/GetApplication.php
new file mode 100644
index 000000000..f7ac8db77
--- /dev/null
+++ b/app/Mcp/Tools/GetApplication.php
@@ -0,0 +1,60 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use App\Mcp\Concerns\BuildsResponse;
+use App\Mcp\Concerns\ResolvesTeam;
+use App\Models\Application;
+use Illuminate\Contracts\JsonSchema\JsonSchema;
+use Laravel\Mcp\Request;
+use Laravel\Mcp\Response;
+use Laravel\Mcp\Server\Attributes\Description;
+use Laravel\Mcp\Server\Attributes\Name;
+use Laravel\Mcp\Server\Tool;
+
+#[Name('get_application')]
+#[Description('Get full details for a single application by UUID.')]
+class GetApplication extends Tool
+{
+    use BuildsResponse;
+    use ResolvesTeam;
+
+    public function handle(Request $request): Response
+    {
+        if ($error = $this->ensureAbility($request, 'read')) {
+            return $error;
+        }
+
+        $teamId = $this->resolveTeamId($request);
+        if (is_null($teamId)) {
+            return Response::error('Invalid token.');
+        }
+
+        $uuid = $request->get('uuid');
+        if (! is_string($uuid) || $uuid === '') {
+            return Response::error('uuid argument is required.');
+        }
+
+        $application = Application::ownedByCurrentTeamAPI($teamId)->where('uuid', $uuid)->first();
+        if (! $application) {
+            return Response::error("Application [{$uuid}] not found.");
+        }
+
+        // Drop relations that the server_status accessor lazy-loads — they
+        // pull in sensitive nested data (server.settings.sentinel_token, etc.)
+        $application->setRelations([]);
+        $application->makeHidden(['destination', 'source', 'additional_servers', 'environment', 'tags', 'environmentVariables']);
+
+        return $this->respond(
+            $this->scrubSensitive($application->toArray()),
+            $this->actionsForApplication($uuid, $application->status),
+        );
+    }
+
+    public function schema(JsonSchema $schema): array
+    {
+        return [
+            'uuid' => $schema->string()->description('Application UUID.')->required(),
+        ];
+    }
+}
diff --git a/app/Mcp/Tools/GetDatabase.php b/app/Mcp/Tools/GetDatabase.php
new file mode 100644
index 000000000..4eee9c961
--- /dev/null
+++ b/app/Mcp/Tools/GetDatabase.php
@@ -0,0 +1,58 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use App\Mcp\Concerns\BuildsResponse;
+use App\Mcp\Concerns\ResolvesTeam;
+use Illuminate\Contracts\JsonSchema\JsonSchema;
+use Laravel\Mcp\Request;
+use Laravel\Mcp\Response;
+use Laravel\Mcp\Server\Attributes\Description;
+use Laravel\Mcp\Server\Attributes\Name;
+use Laravel\Mcp\Server\Tool;
+
+#[Name('get_database')]
+#[Description('Get full details for a standalone database by UUID. Detects type across postgresql, mysql, mariadb, mongodb, redis, keydb, dragonfly, clickhouse.')]
+class GetDatabase extends Tool
+{
+    use BuildsResponse;
+    use ResolvesTeam;
+
+    public function handle(Request $request): Response
+    {
+        if ($error = $this->ensureAbility($request, 'read')) {
+            return $error;
+        }
+
+        $teamId = $this->resolveTeamId($request);
+        if (is_null($teamId)) {
+            return Response::error('Invalid token.');
+        }
+
+        $uuid = $request->get('uuid');
+        if (! is_string($uuid) || $uuid === '') {
+            return Response::error('uuid argument is required.');
+        }
+
+        $database = queryDatabaseByUuidWithinTeam($uuid, (string) $teamId);
+        if (! $database) {
+            return Response::error("Database [{$uuid}] not found.");
+        }
+
+        // Drop relations so deep server/destination data doesn't leak.
+        $database->setRelations([]);
+        $database->makeHidden(['destination', 'source', 'environment', 'environment_variables', 'environment_variables_preview']);
+
+        return $this->respond(
+            $this->scrubSensitive($database->toArray()),
+            $this->actionsForDatabase($uuid, $database->status ?? null),
+        );
+    }
+
+    public function schema(JsonSchema $schema): array
+    {
+        return [
+            'uuid' => $schema->string()->description('Database UUID.')->required(),
+        ];
+    }
+}
diff --git a/app/Mcp/Tools/GetInfrastructureOverview.php b/app/Mcp/Tools/GetInfrastructureOverview.php
new file mode 100644
index 000000000..06e91ff57
--- /dev/null
+++ b/app/Mcp/Tools/GetInfrastructureOverview.php
@@ -0,0 +1,93 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use App\Mcp\Concerns\BuildsResponse;
+use App\Mcp\Concerns\ResolvesTeam;
+use App\Models\Project;
+use App\Models\Server;
+use Illuminate\Contracts\JsonSchema\JsonSchema;
+use Laravel\Mcp\Request;
+use Laravel\Mcp\Response;
+use Laravel\Mcp\Server\Attributes\Description;
+use Laravel\Mcp\Server\Attributes\Name;
+use Laravel\Mcp\Server\Tool;
+
+#[Name('get_infrastructure_overview')]
+#[Description('High-level overview of the authenticated team: Coolify version, all servers, projects with resource counts, and aggregate counts. Start here to understand the setup.')]
+class GetInfrastructureOverview extends Tool
+{
+    use BuildsResponse;
+    use ResolvesTeam;
+
+    public function handle(Request $request): Response
+    {
+        if ($error = $this->ensureAbility($request, 'read')) {
+            return $error;
+        }
+
+        $teamId = $this->resolveTeamId($request);
+        if (is_null($teamId)) {
+            return Response::error('Invalid token.');
+        }
+
+        $servers = Server::whereTeamId($teamId)
+            ->select('id', 'name', 'uuid', 'ip', 'description')
+            ->with('settings:id,server_id,is_reachable,is_usable')
+            ->get()
+            ->map(fn ($s) => [
+                'uuid' => $s->uuid,
+                'name' => $s->name,
+                'ip' => $s->ip,
+                'is_reachable' => $s->settings?->is_reachable,
+                'is_usable' => $s->settings?->is_usable,
+            ])
+            ->values()
+            ->all();
+
+        $projects = Project::where('team_id', $teamId)->get();
+
+        $appCount = 0;
+        $serviceCount = 0;
+        $databaseCount = 0;
+        $projectSummaries = [];
+
+        foreach ($projects as $project) {
+            $apps = $project->applications()->count();
+            $services = $project->services()->count();
+            $databases = $project->databases()->count();
+
+            $appCount += $apps;
+            $serviceCount += $services;
+            $databaseCount += $databases;
+
+            $projectSummaries[] = [
+                'uuid' => $project->uuid,
+                'name' => $project->name,
+                'counts' => [
+                    'applications' => $apps,
+                    'services' => $services,
+                    'databases' => $databases,
+                ],
+            ];
+        }
+
+        return $this->respond([
+            'coolify_version' => config('constants.coolify.version'),
+            'servers' => $servers,
+            'projects' => $projectSummaries,
+            'counts' => [
+                'servers' => count($servers),
+                'projects' => count($projectSummaries),
+                'applications' => $appCount,
+                'services' => $serviceCount,
+                'databases' => $databaseCount,
+            ],
+        ]);
+    }
+
+    public function schema(JsonSchema $schema): array
+    {
+        return [];
+    }
+}
diff --git a/app/Mcp/Tools/GetServer.php b/app/Mcp/Tools/GetServer.php
new file mode 100644
index 000000000..fc3e72f14
--- /dev/null
+++ b/app/Mcp/Tools/GetServer.php
@@ -0,0 +1,57 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use App\Mcp\Concerns\BuildsResponse;
+use App\Mcp\Concerns\ResolvesTeam;
+use App\Models\Server;
+use Illuminate\Contracts\JsonSchema\JsonSchema;
+use Laravel\Mcp\Request;
+use Laravel\Mcp\Response;
+use Laravel\Mcp\Server\Attributes\Description;
+use Laravel\Mcp\Server\Attributes\Name;
+use Laravel\Mcp\Server\Tool;
+
+#[Name('get_server')]
+#[Description('Get full details for a single server by UUID.')]
+class GetServer extends Tool
+{
+    use BuildsResponse;
+    use ResolvesTeam;
+
+    public function handle(Request $request): Response
+    {
+        if ($error = $this->ensureAbility($request, 'read')) {
+            return $error;
+        }
+
+        $teamId = $this->resolveTeamId($request);
+        if (is_null($teamId)) {
+            return Response::error('Invalid token.');
+        }
+
+        $uuid = $request->get('uuid');
+        if (! is_string($uuid) || $uuid === '') {
+            return Response::error('uuid argument is required.');
+        }
+
+        $server = Server::whereTeamId($teamId)->where('uuid', $uuid)->with('settings')->first();
+        if (! $server) {
+            return Response::error("Server [{$uuid}] not found.");
+        }
+
+        $data = $this->scrubSensitive($server->toArray());
+        $data['is_reachable'] = $server->settings?->is_reachable;
+        $data['is_usable'] = $server->settings?->is_usable;
+        $data['connection_timeout'] = $server->settings?->connection_timeout;
+
+        return $this->respond($data, $this->actionsForServer($uuid));
+    }
+
+    public function schema(JsonSchema $schema): array
+    {
+        return [
+            'uuid' => $schema->string()->description('Server UUID.')->required(),
+        ];
+    }
+}
diff --git a/app/Mcp/Tools/GetService.php b/app/Mcp/Tools/GetService.php
new file mode 100644
index 000000000..475958272
--- /dev/null
+++ b/app/Mcp/Tools/GetService.php
@@ -0,0 +1,61 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use App\Mcp\Concerns\BuildsResponse;
+use App\Mcp\Concerns\ResolvesTeam;
+use App\Models\Service;
+use Illuminate\Contracts\JsonSchema\JsonSchema;
+use Laravel\Mcp\Request;
+use Laravel\Mcp\Response;
+use Laravel\Mcp\Server\Attributes\Description;
+use Laravel\Mcp\Server\Attributes\Name;
+use Laravel\Mcp\Server\Tool;
+
+#[Name('get_service')]
+#[Description('Get full details for a single service (multi-container stack) by UUID.')]
+class GetService extends Tool
+{
+    use BuildsResponse;
+    use ResolvesTeam;
+
+    public function handle(Request $request): Response
+    {
+        if ($error = $this->ensureAbility($request, 'read')) {
+            return $error;
+        }
+
+        $teamId = $this->resolveTeamId($request);
+        if (is_null($teamId)) {
+            return Response::error('Invalid token.');
+        }
+
+        $uuid = $request->get('uuid');
+        if (! is_string($uuid) || $uuid === '') {
+            return Response::error('uuid argument is required.');
+        }
+
+        $service = Service::whereRelation('environment.project.team', 'id', $teamId)
+            ->where('uuid', $uuid)
+            ->first();
+
+        if (! $service) {
+            return Response::error("Service [{$uuid}] not found.");
+        }
+
+        $service->setRelations([]);
+        $service->makeHidden(['destination', 'source', 'environment', 'applications', 'databases', 'serviceApplications', 'serviceDatabases']);
+
+        return $this->respond(
+            $this->scrubSensitive($service->toArray()),
+            $this->actionsForService($uuid, $service->status ?? null),
+        );
+    }
+
+    public function schema(JsonSchema $schema): array
+    {
+        return [
+            'uuid' => $schema->string()->description('Service UUID.')->required(),
+        ];
+    }
+}
diff --git a/app/Mcp/Tools/ListApplications.php b/app/Mcp/Tools/ListApplications.php
new file mode 100644
index 000000000..947d49ed1
--- /dev/null
+++ b/app/Mcp/Tools/ListApplications.php
@@ -0,0 +1,74 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use App\Mcp\Concerns\BuildsResponse;
+use App\Mcp\Concerns\ResolvesTeam;
+use App\Models\Application;
+use Illuminate\Contracts\JsonSchema\JsonSchema;
+use Laravel\Mcp\Request;
+use Laravel\Mcp\Response;
+use Laravel\Mcp\Server\Attributes\Description;
+use Laravel\Mcp\Server\Attributes\Name;
+use Laravel\Mcp\Server\Tool;
+
+#[Name('list_applications')]
+#[Description('List applications owned by the authenticated team. Returns summary (uuid, name, status, fqdn, git_repository). Optional "tag" argument filters by tag name. Use get_application for full details.')]
+class ListApplications extends Tool
+{
+    use BuildsResponse;
+    use ResolvesTeam;
+
+    public function handle(Request $request): Response
+    {
+        if ($error = $this->ensureAbility($request, 'read')) {
+            return $error;
+        }
+
+        $teamId = $this->resolveTeamId($request);
+        if (is_null($teamId)) {
+            return Response::error('Invalid token.');
+        }
+
+        $tagName = $request->get('tag');
+        $args = $this->paginationArgs($request);
+
+        $query = Application::ownedByCurrentTeamAPI($teamId)
+            ->when($tagName, function ($query, $tagName) {
+                $query->whereHas('tags', fn ($q) => $q->where('name', $tagName));
+            });
+
+        $total = (clone $query)->count();
+
+        $summaries = $query
+            ->skip($args['offset'])
+            ->take($args['per_page'])
+            ->get()
+            ->map(fn ($app) => [
+                'uuid' => $app->uuid,
+                'name' => $app->name,
+                'status' => $app->status,
+                'fqdn' => $app->fqdn,
+                'git_repository' => $app->git_repository,
+            ])
+            ->values()
+            ->all();
+
+        $extra = $tagName ? ['tag' => $tagName] : [];
+
+        return $this->respond(
+            $summaries,
+            [],
+            $this->paginationMeta('list_applications', $args, $total, $extra),
+        );
+    }
+
+    public function schema(JsonSchema $schema): array
+    {
+        return [
+            'tag' => $schema->string()->description('Optional tag name filter.'),
+            'page' => $schema->integer()->description('Page number (default 1).'),
+            'per_page' => $schema->integer()->description('Items per page (default 50, max 100).'),
+        ];
+    }
+}
diff --git a/app/Mcp/Tools/ListDatabases.php b/app/Mcp/Tools/ListDatabases.php
new file mode 100644
index 000000000..7eb1fde00
--- /dev/null
+++ b/app/Mcp/Tools/ListDatabases.php
@@ -0,0 +1,69 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use App\Mcp\Concerns\BuildsResponse;
+use App\Mcp\Concerns\ResolvesTeam;
+use App\Models\Project;
+use Illuminate\Contracts\JsonSchema\JsonSchema;
+use Laravel\Mcp\Request;
+use Laravel\Mcp\Response;
+use Laravel\Mcp\Server\Attributes\Description;
+use Laravel\Mcp\Server\Attributes\Name;
+use Laravel\Mcp\Server\Tool;
+
+#[Name('list_databases')]
+#[Description('List standalone databases owned by the authenticated team. Returns summary (uuid, name, status, type). Use get_database for full details.')]
+class ListDatabases extends Tool
+{
+    use BuildsResponse;
+    use ResolvesTeam;
+
+    public function handle(Request $request): Response
+    {
+        if ($error = $this->ensureAbility($request, 'read')) {
+            return $error;
+        }
+
+        $teamId = $this->resolveTeamId($request);
+        if (is_null($teamId)) {
+            return Response::error('Invalid token.');
+        }
+
+        $args = $this->paginationArgs($request);
+
+        $projects = Project::where('team_id', $teamId)->get();
+        $databases = collect();
+        foreach ($projects as $project) {
+            $databases = $databases->merge($project->databases());
+        }
+
+        $total = $databases->count();
+
+        $summaries = $databases
+            ->sortBy('name')
+            ->slice($args['offset'], $args['per_page'])
+            ->map(fn ($db) => [
+                'uuid' => $db->uuid,
+                'name' => $db->name,
+                'status' => $db->status ?? null,
+                'type' => method_exists($db, 'type') ? $db->type() : class_basename($db),
+            ])
+            ->values()
+            ->all();
+
+        return $this->respond(
+            $summaries,
+            [],
+            $this->paginationMeta('list_databases', $args, $total),
+        );
+    }
+
+    public function schema(JsonSchema $schema): array
+    {
+        return [
+            'page' => $schema->integer()->description('Page number (default 1).'),
+            'per_page' => $schema->integer()->description('Items per page (default 50, max 100).'),
+        ];
+    }
+}
diff --git a/app/Mcp/Tools/ListProjects.php b/app/Mcp/Tools/ListProjects.php
new file mode 100644
index 000000000..9ce1576b9
--- /dev/null
+++ b/app/Mcp/Tools/ListProjects.php
@@ -0,0 +1,66 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use App\Mcp\Concerns\BuildsResponse;
+use App\Mcp\Concerns\ResolvesTeam;
+use App\Models\Project;
+use Illuminate\Contracts\JsonSchema\JsonSchema;
+use Laravel\Mcp\Request;
+use Laravel\Mcp\Response;
+use Laravel\Mcp\Server\Attributes\Description;
+use Laravel\Mcp\Server\Attributes\Name;
+use Laravel\Mcp\Server\Tool;
+
+#[Name('list_projects')]
+#[Description('List projects owned by the authenticated team. Returns summary (uuid, name, description).')]
+class ListProjects extends Tool
+{
+    use BuildsResponse;
+    use ResolvesTeam;
+
+    public function handle(Request $request): Response
+    {
+        if ($error = $this->ensureAbility($request, 'read')) {
+            return $error;
+        }
+
+        $teamId = $this->resolveTeamId($request);
+        if (is_null($teamId)) {
+            return Response::error('Invalid token.');
+        }
+
+        $args = $this->paginationArgs($request);
+
+        $query = Project::whereTeamId($teamId);
+        $total = (clone $query)->count();
+
+        $summaries = $query
+            ->select('name', 'description', 'uuid')
+            ->orderBy('name')
+            ->skip($args['offset'])
+            ->take($args['per_page'])
+            ->get()
+            ->map(fn ($p) => [
+                'uuid' => $p->uuid,
+                'name' => $p->name,
+                'description' => $p->description,
+            ])
+            ->values()
+            ->all();
+
+        return $this->respond(
+            $summaries,
+            [],
+            $this->paginationMeta('list_projects', $args, $total),
+        );
+    }
+
+    public function schema(JsonSchema $schema): array
+    {
+        return [
+            'page' => $schema->integer()->description('Page number (default 1).'),
+            'per_page' => $schema->integer()->description('Items per page (default 50, max 100).'),
+        ];
+    }
+}
diff --git a/app/Mcp/Tools/ListServers.php b/app/Mcp/Tools/ListServers.php
new file mode 100644
index 000000000..20250c454
--- /dev/null
+++ b/app/Mcp/Tools/ListServers.php
@@ -0,0 +1,67 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use App\Mcp\Concerns\BuildsResponse;
+use App\Mcp\Concerns\ResolvesTeam;
+use App\Models\Server;
+use Illuminate\Contracts\JsonSchema\JsonSchema;
+use Laravel\Mcp\Request;
+use Laravel\Mcp\Response;
+use Laravel\Mcp\Server\Attributes\Description;
+use Laravel\Mcp\Server\Attributes\Name;
+use Laravel\Mcp\Server\Tool;
+
+#[Name('list_servers')]
+#[Description('List servers visible to the authenticated team token. Returns summary (uuid, name, ip, reachability). Use get_server for full details.')]
+class ListServers extends Tool
+{
+    use BuildsResponse;
+    use ResolvesTeam;
+
+    public function handle(Request $request): Response
+    {
+        if ($error = $this->ensureAbility($request, 'read')) {
+            return $error;
+        }
+
+        $teamId = $this->resolveTeamId($request);
+        if (is_null($teamId)) {
+            return Response::error('Invalid token.');
+        }
+
+        $args = $this->paginationArgs($request);
+
+        $query = Server::whereTeamId($teamId)->with('settings:id,server_id,is_reachable,is_usable');
+        $total = (clone $query)->count();
+
+        $summaries = $query
+            ->orderBy('name')
+            ->skip($args['offset'])
+            ->take($args['per_page'])
+            ->get()
+            ->map(fn ($s) => [
+                'uuid' => $s->uuid,
+                'name' => $s->name,
+                'ip' => $s->ip,
+                'is_reachable' => $s->settings?->is_reachable,
+                'is_usable' => $s->settings?->is_usable,
+            ])
+            ->values()
+            ->all();
+
+        return $this->respond(
+            $summaries,
+            [],
+            $this->paginationMeta('list_servers', $args, $total),
+        );
+    }
+
+    public function schema(JsonSchema $schema): array
+    {
+        return [
+            'page' => $schema->integer()->description('Page number (default 1).'),
+            'per_page' => $schema->integer()->description('Items per page (default 50, max 100).'),
+        ];
+    }
+}
diff --git a/app/Mcp/Tools/ListServices.php b/app/Mcp/Tools/ListServices.php
new file mode 100644
index 000000000..4b33231ba
--- /dev/null
+++ b/app/Mcp/Tools/ListServices.php
@@ -0,0 +1,68 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use App\Mcp\Concerns\BuildsResponse;
+use App\Mcp\Concerns\ResolvesTeam;
+use App\Models\Project;
+use Illuminate\Contracts\JsonSchema\JsonSchema;
+use Laravel\Mcp\Request;
+use Laravel\Mcp\Response;
+use Laravel\Mcp\Server\Attributes\Description;
+use Laravel\Mcp\Server\Attributes\Name;
+use Laravel\Mcp\Server\Tool;
+
+#[Name('list_services')]
+#[Description('List services (multi-container stacks) owned by the authenticated team. Returns summary (uuid, name, status). Use get_service for full details.')]
+class ListServices extends Tool
+{
+    use BuildsResponse;
+    use ResolvesTeam;
+
+    public function handle(Request $request): Response
+    {
+        if ($error = $this->ensureAbility($request, 'read')) {
+            return $error;
+        }
+
+        $teamId = $this->resolveTeamId($request);
+        if (is_null($teamId)) {
+            return Response::error('Invalid token.');
+        }
+
+        $args = $this->paginationArgs($request);
+
+        $projects = Project::where('team_id', $teamId)->get();
+        $services = collect();
+        foreach ($projects as $project) {
+            $services = $services->merge($project->services()->get());
+        }
+
+        $total = $services->count();
+
+        $summaries = $services
+            ->sortBy('name')
+            ->slice($args['offset'], $args['per_page'])
+            ->map(fn ($svc) => [
+                'uuid' => $svc->uuid,
+                'name' => $svc->name,
+                'status' => $svc->status ?? null,
+            ])
+            ->values()
+            ->all();
+
+        return $this->respond(
+            $summaries,
+            [],
+            $this->paginationMeta('list_services', $args, $total),
+        );
+    }
+
+    public function schema(JsonSchema $schema): array
+    {
+        return [
+            'page' => $schema->integer()->description('Page number (default 1).'),
+            'per_page' => $schema->integer()->description('Items per page (default 50, max 100).'),
+        ];
+    }
+}
diff --git a/app/Models/InstanceSettings.php b/app/Models/InstanceSettings.php
index 6061bc863..d5c3bfa28 100644
--- a/app/Models/InstanceSettings.php
+++ b/app/Models/InstanceSettings.php
@@ -45,6 +45,7 @@ class InstanceSettings extends Model
         'is_sponsorship_popup_enabled',
         'dev_helper_version',
         'is_wire_navigate_enabled',
+        'is_mcp_server_enabled',
     ];
 
     protected $casts = [
@@ -67,6 +68,7 @@ class InstanceSettings extends Model
         'update_check_frequency' => 'string',
         'sentinel_token' => 'encrypted',
         'is_wire_navigate_enabled' => 'boolean',
+        'is_mcp_server_enabled' => 'boolean',
     ];
 
     protected static function booted(): void
diff --git a/composer.json b/composer.json
index e2b16b31b..9415aa624 100644
--- a/composer.json
+++ b/composer.json
@@ -18,6 +18,7 @@
         "laravel/fortify": "^1.34.0",
         "laravel/framework": "^12.49.0",
         "laravel/horizon": "^5.43.0",
+        "laravel/mcp": "^0.6.7",
         "laravel/nightwatch": "^1.24",
         "laravel/pail": "^1.2.4",
         "laravel/prompts": "^0.3.11|^0.3.11|^0.3.11",
diff --git a/composer.lock b/composer.lock
index 2f27235f5..36715d2c5 100644
--- a/composer.lock
+++ b/composer.lock
@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "40bddea995c1744e4aec517263109a2f",
+    "content-hash": "64b77285a7140ce68e83db2659e9a21d",
     "packages": [
         {
             "name": "aws/aws-crt-php",
@@ -2066,6 +2066,79 @@
             },
             "time": "2026-03-18T14:14:59+00:00"
         },
+        {
+            "name": "laravel/mcp",
+            "version": "v0.6.7",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/laravel/mcp.git",
+                "reference": "c3775e57b95d7eadb580d543689d9971ec8721f2"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/laravel/mcp/zipball/c3775e57b95d7eadb580d543689d9971ec8721f2",
+                "reference": "c3775e57b95d7eadb580d543689d9971ec8721f2",
+                "shasum": ""
+            },
+            "require": {
+                "ext-json": "*",
+                "ext-mbstring": "*",
+                "illuminate/console": "^11.45.3|^12.41.1|^13.0",
+                "illuminate/container": "^11.45.3|^12.41.1|^13.0",
+                "illuminate/contracts": "^11.45.3|^12.41.1|^13.0",
+                "illuminate/http": "^11.45.3|^12.41.1|^13.0",
+                "illuminate/json-schema": "^12.41.1|^13.0",
+                "illuminate/routing": "^11.45.3|^12.41.1|^13.0",
+                "illuminate/support": "^11.45.3|^12.41.1|^13.0",
+                "illuminate/validation": "^11.45.3|^12.41.1|^13.0",
+                "php": "^8.2"
+            },
+            "require-dev": {
+                "laravel/pint": "^1.20",
+                "orchestra/testbench": "^9.15|^10.8|^11.0",
+                "pestphp/pest": "^3.8.5|^4.3.2",
+                "phpstan/phpstan": "^2.1.27",
+                "rector/rector": "^2.2.4"
+            },
+            "type": "library",
+            "extra": {
+                "laravel": {
+                    "aliases": {
+                        "Mcp": "Laravel\\Mcp\\Server\\Facades\\Mcp"
+                    },
+                    "providers": [
+                        "Laravel\\Mcp\\Server\\McpServiceProvider"
+                    ]
+                }
+            },
+            "autoload": {
+                "psr-4": {
+                    "Laravel\\Mcp\\": "src/",
+                    "Laravel\\Mcp\\Server\\": "src/Server/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Taylor Otwell",
+                    "email": "taylor@laravel.com"
+                }
+            ],
+            "description": "Rapidly build MCP servers for your Laravel applications.",
+            "homepage": "https://github.com/laravel/mcp",
+            "keywords": [
+                "laravel",
+                "mcp"
+            ],
+            "support": {
+                "issues": "https://github.com/laravel/mcp/issues",
+                "source": "https://github.com/laravel/mcp"
+            },
+            "time": "2026-04-15T08:30:42+00:00"
+        },
         {
             "name": "laravel/nightwatch",
             "version": "v1.24.4",
@@ -13738,79 +13811,6 @@
             },
             "time": "2026-03-21T11:50:49+00:00"
         },
-        {
-            "name": "laravel/mcp",
-            "version": "v0.6.4",
-            "source": {
-                "type": "git",
-                "url": "https://github.com/laravel/mcp.git",
-                "reference": "f822c5eb5beed19adb2e5bfe2f46f8c977ecea42"
-            },
-            "dist": {
-                "type": "zip",
-                "url": "https://api.github.com/repos/laravel/mcp/zipball/f822c5eb5beed19adb2e5bfe2f46f8c977ecea42",
-                "reference": "f822c5eb5beed19adb2e5bfe2f46f8c977ecea42",
-                "shasum": ""
-            },
-            "require": {
-                "ext-json": "*",
-                "ext-mbstring": "*",
-                "illuminate/console": "^11.45.3|^12.41.1|^13.0",
-                "illuminate/container": "^11.45.3|^12.41.1|^13.0",
-                "illuminate/contracts": "^11.45.3|^12.41.1|^13.0",
-                "illuminate/http": "^11.45.3|^12.41.1|^13.0",
-                "illuminate/json-schema": "^12.41.1|^13.0",
-                "illuminate/routing": "^11.45.3|^12.41.1|^13.0",
-                "illuminate/support": "^11.45.3|^12.41.1|^13.0",
-                "illuminate/validation": "^11.45.3|^12.41.1|^13.0",
-                "php": "^8.2"
-            },
-            "require-dev": {
-                "laravel/pint": "^1.20",
-                "orchestra/testbench": "^9.15|^10.8|^11.0",
-                "pestphp/pest": "^3.8.5|^4.3.2",
-                "phpstan/phpstan": "^2.1.27",
-                "rector/rector": "^2.2.4"
-            },
-            "type": "library",
-            "extra": {
-                "laravel": {
-                    "aliases": {
-                        "Mcp": "Laravel\\Mcp\\Server\\Facades\\Mcp"
-                    },
-                    "providers": [
-                        "Laravel\\Mcp\\Server\\McpServiceProvider"
-                    ]
-                }
-            },
-            "autoload": {
-                "psr-4": {
-                    "Laravel\\Mcp\\": "src/",
-                    "Laravel\\Mcp\\Server\\": "src/Server/"
-                }
-            },
-            "notification-url": "https://packagist.org/downloads/",
-            "license": [
-                "MIT"
-            ],
-            "authors": [
-                {
-                    "name": "Taylor Otwell",
-                    "email": "taylor@laravel.com"
-                }
-            ],
-            "description": "Rapidly build MCP servers for your Laravel applications.",
-            "homepage": "https://github.com/laravel/mcp",
-            "keywords": [
-                "laravel",
-                "mcp"
-            ],
-            "support": {
-                "issues": "https://github.com/laravel/mcp/issues",
-                "source": "https://github.com/laravel/mcp"
-            },
-            "time": "2026-03-19T12:37:13+00:00"
-        },
         {
             "name": "laravel/pint",
             "version": "v1.29.0",
@@ -17311,5 +17311,5 @@
         "php": "^8.4"
     },
     "platform-dev": {},
-    "plugin-api-version": "2.9.0"
+    "plugin-api-version": "2.6.0"
 }
diff --git a/database/migrations/2026_04_22_183029_add_is_mcp_server_enabled_to_instance_settings_table.php b/database/migrations/2026_04_22_183029_add_is_mcp_server_enabled_to_instance_settings_table.php
new file mode 100644
index 000000000..f24548142
--- /dev/null
+++ b/database/migrations/2026_04_22_183029_add_is_mcp_server_enabled_to_instance_settings_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('instance_settings', function (Blueprint $table) {
+            $table->boolean('is_mcp_server_enabled')->default(false);
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('instance_settings', function (Blueprint $table) {
+            $table->dropColumn('is_mcp_server_enabled');
+        });
+    }
+};
diff --git a/openapi.json b/openapi.json
index 059b3d911..c35c0cdd6 100644
--- a/openapi.json
+++ b/openapi.json
@@ -8650,6 +8650,110 @@
                 ]
             }
         },
+        "\/mcp\/enable": {
+            "get": {
+                "summary": "Enable MCP Server",
+                "description": "Enable the MCP server endpoint at \/mcp (only with root permissions).",
+                "operationId": "enable-mcp",
+                "responses": {
+                    "200": {
+                        "description": "MCP server enabled.",
+                        "content": {
+                            "application\/json": {
+                                "schema": {
+                                    "properties": {
+                                        "message": {
+                                            "type": "string",
+                                            "example": "MCP server enabled."
+                                        }
+                                    },
+                                    "type": "object"
+                                }
+                            }
+                        }
+                    },
+                    "403": {
+                        "description": "You are not allowed to enable the MCP server.",
+                        "content": {
+                            "application\/json": {
+                                "schema": {
+                                    "properties": {
+                                        "message": {
+                                            "type": "string",
+                                            "example": "You are not allowed to enable the MCP server."
+                                        }
+                                    },
+                                    "type": "object"
+                                }
+                            }
+                        }
+                    },
+                    "401": {
+                        "$ref": "#\/components\/responses\/401"
+                    },
+                    "400": {
+                        "$ref": "#\/components\/responses\/400"
+                    }
+                },
+                "security": [
+                    {
+                        "bearerAuth": []
+                    }
+                ]
+            }
+        },
+        "\/mcp\/disable": {
+            "get": {
+                "summary": "Disable MCP Server",
+                "description": "Disable the MCP server endpoint at \/mcp (only with root permissions).",
+                "operationId": "disable-mcp",
+                "responses": {
+                    "200": {
+                        "description": "MCP server disabled.",
+                        "content": {
+                            "application\/json": {
+                                "schema": {
+                                    "properties": {
+                                        "message": {
+                                            "type": "string",
+                                            "example": "MCP server disabled."
+                                        }
+                                    },
+                                    "type": "object"
+                                }
+                            }
+                        }
+                    },
+                    "403": {
+                        "description": "You are not allowed to disable the MCP server.",
+                        "content": {
+                            "application\/json": {
+                                "schema": {
+                                    "properties": {
+                                        "message": {
+                                            "type": "string",
+                                            "example": "You are not allowed to disable the MCP server."
+                                        }
+                                    },
+                                    "type": "object"
+                                }
+                            }
+                        }
+                    },
+                    "401": {
+                        "$ref": "#\/components\/responses\/401"
+                    },
+                    "400": {
+                        "$ref": "#\/components\/responses\/400"
+                    }
+                },
+                "security": [
+                    {
+                        "bearerAuth": []
+                    }
+                ]
+            }
+        },
         "\/health": {
             "get": {
                 "summary": "Healthcheck",
diff --git a/openapi.yaml b/openapi.yaml
index 83aa30744..eab531674 100644
--- a/openapi.yaml
+++ b/openapi.yaml
@@ -5484,6 +5484,64 @@ paths:
       security:
         -
           bearerAuth: []
+  /mcp/enable:
+    get:
+      summary: 'Enable MCP Server'
+      description: 'Enable the MCP server endpoint at /mcp (only with root permissions).'
+      operationId: enable-mcp
+      responses:
+        '200':
+          description: 'MCP server enabled.'
+          content:
+            application/json:
+              schema:
+                properties:
+                  message: { type: string, example: 'MCP server enabled.' }
+                type: object
+        '403':
+          description: 'You are not allowed to enable the MCP server.'
+          content:
+            application/json:
+              schema:
+                properties:
+                  message: { type: string, example: 'You are not allowed to enable the MCP server.' }
+                type: object
+        '401':
+          $ref: '#/components/responses/401'
+        '400':
+          $ref: '#/components/responses/400'
+      security:
+        -
+          bearerAuth: []
+  /mcp/disable:
+    get:
+      summary: 'Disable MCP Server'
+      description: 'Disable the MCP server endpoint at /mcp (only with root permissions).'
+      operationId: disable-mcp
+      responses:
+        '200':
+          description: 'MCP server disabled.'
+          content:
+            application/json:
+              schema:
+                properties:
+                  message: { type: string, example: 'MCP server disabled.' }
+                type: object
+        '403':
+          description: 'You are not allowed to disable the MCP server.'
+          content:
+            application/json:
+              schema:
+                properties:
+                  message: { type: string, example: 'You are not allowed to disable the MCP server.' }
+                type: object
+        '401':
+          $ref: '#/components/responses/401'
+        '400':
+          $ref: '#/components/responses/400'
+      security:
+        -
+          bearerAuth: []
   /health:
     get:
       summary: Healthcheck
diff --git a/resources/views/livewire/settings/advanced.blade.php b/resources/views/livewire/settings/advanced.blade.php
index 6c26b453d..544ed7d4c 100644
--- a/resources/views/livewire/settings/advanced.blade.php
+++ b/resources/views/livewire/settings/advanced.blade.php
@@ -70,6 +70,17 @@ class="flex flex-col h-full gap-8 sm:flex-row">
                             environments!
                         </x-callout>
                     @endif
+                    <h4 class="pt-4">MCP Server</h4>
+                    <div class="md:w-96">
+                        <x-forms.checkbox instantSave id="is_mcp_server_enabled" label="Enable MCP Server"
+                            helper="Exposes a Streamable HTTP Model Context Protocol endpoint at /mcp for AI clients (Claude Desktop, Cursor, etc.). Authenticates via Sanctum API tokens (Security > API Tokens). Requires API Access to be enabled." />
+                    </div>
+                    @if ($is_mcp_server_enabled)
+                        <x-callout type="info" title="MCP Endpoint" class="mt-2">
+                            Endpoint: <code>{{ url('/mcp') }}</code><br>
+                            Authenticate with <code>Authorization: Bearer &lt;token&gt;</code> using a token created in Security &raquo; API Tokens.
+                        </x-callout>
+                    @endif
                     <h4 class="pt-4">UI Settings</h4>
                     <div class="md:w-96">
                         <x-forms.checkbox instantSave id="is_wire_navigate_enabled" label="SPA Navigation"
diff --git a/routes/ai.php b/routes/ai.php
new file mode 100644
index 000000000..7d3a858c5
--- /dev/null
+++ b/routes/ai.php
@@ -0,0 +1,7 @@
+<?php
+
+use App\Mcp\Servers\CoolifyServer;
+use Laravel\Mcp\Facades\Mcp;
+
+Mcp::web('/mcp', CoolifyServer::class)
+    ->middleware(['mcp.enabled', 'auth:sanctum']);
diff --git a/routes/api.php b/routes/api.php
index c944a6ebc..f38576d4d 100644
--- a/routes/api.php
+++ b/routes/api.php
@@ -35,6 +35,8 @@
 ], function () {
     Route::get('/enable', [OtherController::class, 'enable_api']);
     Route::get('/disable', [OtherController::class, 'disable_api']);
+    Route::get('/mcp/enable', [OtherController::class, 'enable_mcp']);
+    Route::get('/mcp/disable', [OtherController::class, 'disable_mcp']);
 });
 Route::group([
     'middleware' => ['auth:sanctum', ApiAllowed::class, 'api.sensitive'],
diff --git a/tests/Feature/Mcp/McpEndpointTest.php b/tests/Feature/Mcp/McpEndpointTest.php
new file mode 100644
index 000000000..34ae493cc
--- /dev/null
+++ b/tests/Feature/Mcp/McpEndpointTest.php
@@ -0,0 +1,194 @@
+<?php
+
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Once;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::query()->where('id', 0)->delete();
+    InstanceSettings::query()->delete();
+    $settings = new InstanceSettings(['is_mcp_server_enabled' => true]);
+    $settings->id = 0;
+    $settings->save();
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+    session(['currentTeam' => $this->team]);
+});
+
+function mcpPost(array $payload, ?string $token = null)
+{
+    $headers = [
+        'Content-Type' => 'application/json',
+        'Accept' => 'application/json, text/event-stream',
+    ];
+    if ($token) {
+        $headers['Authorization'] = 'Bearer '.$token;
+    }
+
+    return test()->withHeaders($headers)->postJson('/mcp', $payload);
+}
+
+function mcpListTools(string $token)
+{
+    return mcpPost([
+        'jsonrpc' => '2.0',
+        'id' => 1,
+        'method' => 'tools/list',
+        'params' => (object) [],
+    ], $token);
+}
+
+function mcpCallTool(string $token, string $name, array $arguments = [])
+{
+    return mcpPost([
+        'jsonrpc' => '2.0',
+        'id' => 1,
+        'method' => 'tools/call',
+        'params' => [
+            'name' => $name,
+            'arguments' => (object) $arguments,
+        ],
+    ], $token);
+}
+
+function mcpToolJson($response): array
+{
+    return json_decode($response->json('result.content.0.text'), true);
+}
+
+test('MCP endpoint returns 404 when the instance setting is disabled', function () {
+    InstanceSettings::query()->where('id', 0)->update(['is_mcp_server_enabled' => false]);
+    Once::flush();
+
+    $response = mcpPost(['jsonrpc' => '2.0', 'id' => 1, 'method' => 'tools/list']);
+    $response->assertStatus(404);
+});
+
+test('MCP endpoint rejects unauthenticated requests', function () {
+    $response = mcpPost(['jsonrpc' => '2.0', 'id' => 1, 'method' => 'tools/list']);
+    $response->assertStatus(401);
+});
+
+test('MCP endpoint lists tools for an authenticated token', function () {
+    $token = $this->user->createToken('mcp-read', ['read'])->plainTextToken;
+
+    $response = mcpListTools($token);
+    $response->assertOk();
+
+    $toolNames = collect($response->json('result.tools'))->pluck('name')->all();
+    expect($toolNames)->toContain(
+        'get_infrastructure_overview',
+        'list_servers',
+        'get_server',
+        'list_projects',
+        'list_applications',
+        'get_application',
+        'list_databases',
+        'get_database',
+        'list_services',
+        'get_service',
+    );
+    expect($toolNames)->not->toContain('get_resource_status');
+});
+
+test('list_projects returns summary + pagination scoped to the token team', function () {
+    $project = Project::create(['name' => 'Mine', 'team_id' => $this->team->id]);
+
+    $otherTeam = Team::factory()->create();
+    Project::create(['name' => 'Theirs', 'team_id' => $otherTeam->id]);
+
+    $token = $this->user->createToken('mcp-read', ['read'])->plainTextToken;
+
+    $response = mcpCallTool($token, 'list_projects');
+    $response->assertOk();
+
+    $body = mcpToolJson($response);
+
+    expect($body)->toHaveKey('data');
+    expect($body)->toHaveKey('_pagination');
+    expect($body['_pagination']['total'])->toBe(1);
+    expect($body['_pagination']['per_page'])->toBe(50);
+    expect($body['_pagination'])->not->toHaveKey('next');
+
+    $uuids = collect($body['data'])->pluck('uuid')->all();
+    $names = collect($body['data'])->pluck('name')->all();
+    expect($uuids)->toContain($project->uuid);
+    expect($names)->not->toContain('Theirs');
+    expect($body['data'][0])->toHaveKeys(['uuid', 'name', 'description']);
+});
+
+test('list_projects paginates with per_page cap at 100', function () {
+    for ($i = 0; $i < 3; $i++) {
+        Project::create(['name' => "P{$i}", 'team_id' => $this->team->id]);
+    }
+    $token = $this->user->createToken('mcp-read', ['read'])->plainTextToken;
+
+    $response = mcpCallTool($token, 'list_projects', ['per_page' => 2, 'page' => 1]);
+    $body = mcpToolJson($response);
+
+    expect($body['_pagination']['total'])->toBe(3);
+    expect($body['_pagination']['total_pages'])->toBe(2);
+    expect($body['_pagination']['next']['args'])->toMatchArray(['page' => 2, 'per_page' => 2]);
+    expect($body['data'])->toHaveCount(2);
+
+    // Verify max cap
+    $capped = mcpCallTool($token, 'list_projects', ['per_page' => 500]);
+    $cappedBody = mcpToolJson($capped);
+    expect($cappedBody['_pagination']['per_page'])->toBe(100);
+});
+
+test('get_infrastructure_overview returns counts', function () {
+    Project::create(['name' => 'One', 'team_id' => $this->team->id]);
+    Project::create(['name' => 'Two', 'team_id' => $this->team->id]);
+
+    $token = $this->user->createToken('mcp-read', ['read'])->plainTextToken;
+
+    $response = mcpCallTool($token, 'get_infrastructure_overview');
+    $response->assertOk();
+
+    $body = mcpToolJson($response);
+    expect($body)->toHaveKey('data');
+    expect($body['data'])->toHaveKeys(['coolify_version', 'servers', 'projects', 'counts']);
+    expect($body['data']['counts']['projects'])->toBe(2);
+    expect($body['data']['projects'])->toHaveCount(2);
+    expect($body['data']['projects'][0])->toHaveKey('counts');
+});
+
+test('get_server scrubs sensitive nested data and exposes connection_timeout', function () {
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    // creating hook auto-generates a sentinel_token; bump connection_timeout
+    // via saveQuietly to avoid triggering restartSentinel.
+    $server->settings->forceFill(['connection_timeout' => 42])->saveQuietly();
+
+    $token = $this->user->createToken('mcp-read', ['read'])->plainTextToken;
+
+    $response = mcpCallTool($token, 'get_server', ['uuid' => $server->uuid]);
+    $response->assertOk();
+
+    $body = mcpToolJson($response);
+    $raw = json_encode($body);
+
+    expect($raw)->not->toContain('sentinel_token');
+    expect($raw)->not->toContain('"team_id"');
+    expect($raw)->not->toContain('"private_key_id"');
+    expect($body['data']['connection_timeout'])->toBe(42);
+    expect($body['data']['uuid'])->toBe($server->uuid);
+});
+
+test('tool calls fail when the token lacks the read ability', function () {
+    $token = $this->user->createToken('mcp-no-abilities', [])->plainTextToken;
+
+    $response = mcpCallTool($token, 'list_projects');
+    $response->assertOk();
+
+    expect($response->json('result.isError'))->toBeTrue();
+    expect($response->json('result.content.0.text'))->toContain('Missing required permissions');
+});
diff --git a/tests/Feature/Mcp/McpToggleApiTest.php b/tests/Feature/Mcp/McpToggleApiTest.php
new file mode 100644
index 000000000..2700f9b7b
--- /dev/null
+++ b/tests/Feature/Mcp/McpToggleApiTest.php
@@ -0,0 +1,107 @@
+<?php
+
+use App\Models\InstanceSettings;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::query()->delete();
+    $settings = new InstanceSettings([
+        'is_mcp_server_enabled' => false,
+        'is_api_enabled' => true,
+    ]);
+    $settings->id = 0;
+    $settings->save();
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+    session(['currentTeam' => $this->team]);
+});
+
+function makeRootMcpToken(User $user): string
+{
+    $token = $user->createToken('mcp-root', ['root']);
+    DB::table('personal_access_tokens')
+        ->where('id', $token->accessToken->id)
+        ->update(['team_id' => '0']);
+
+    return $token->plainTextToken;
+}
+
+function makeNonRootMcpToken(User $user, Team $team, array $abilities = ['write']): string
+{
+    $token = $user->createToken('mcp-write', $abilities);
+    DB::table('personal_access_tokens')
+        ->where('id', $token->accessToken->id)
+        ->update(['team_id' => (string) $team->id]);
+
+    return $token->plainTextToken;
+}
+
+test('GET /api/v1/mcp/enable enables MCP server with root token', function () {
+    $token = makeRootMcpToken($this->user);
+
+    $response = test()->withHeaders([
+        'Authorization' => 'Bearer '.$token,
+    ])->getJson('/api/v1/mcp/enable');
+
+    $response->assertOk();
+    $response->assertJson(['message' => 'MCP server enabled.']);
+    expect(InstanceSettings::find(0)->is_mcp_server_enabled)->toBeTrue();
+});
+
+test('GET /api/v1/mcp/disable disables MCP server with root token', function () {
+    InstanceSettings::query()->where('id', 0)->update(['is_mcp_server_enabled' => true]);
+    $token = makeRootMcpToken($this->user);
+
+    $response = test()->withHeaders([
+        'Authorization' => 'Bearer '.$token,
+    ])->getJson('/api/v1/mcp/disable');
+
+    $response->assertOk();
+    $response->assertJson(['message' => 'MCP server disabled.']);
+    expect(InstanceSettings::find(0)->is_mcp_server_enabled)->toBeFalse();
+});
+
+test('non-root token cannot enable MCP server', function () {
+    $token = makeNonRootMcpToken($this->user, $this->team);
+
+    $response = test()->withHeaders([
+        'Authorization' => 'Bearer '.$token,
+    ])->getJson('/api/v1/mcp/enable');
+
+    $response->assertStatus(403);
+    expect(InstanceSettings::find(0)->is_mcp_server_enabled)->toBeFalse();
+});
+
+test('non-root token cannot disable MCP server', function () {
+    InstanceSettings::query()->where('id', 0)->update(['is_mcp_server_enabled' => true]);
+    $token = makeNonRootMcpToken($this->user, $this->team);
+
+    $response = test()->withHeaders([
+        'Authorization' => 'Bearer '.$token,
+    ])->getJson('/api/v1/mcp/disable');
+
+    $response->assertStatus(403);
+    expect(InstanceSettings::find(0)->is_mcp_server_enabled)->toBeTrue();
+});
+
+test('unauthenticated request to /api/v1/mcp/enable returns 401', function () {
+    $response = test()->getJson('/api/v1/mcp/enable');
+    $response->assertStatus(401);
+});
+
+test('read-only token cannot toggle MCP server (lacks write ability)', function () {
+    $token = makeNonRootMcpToken($this->user, $this->team, ['read']);
+
+    $response = test()->withHeaders([
+        'Authorization' => 'Bearer '.$token,
+    ])->getJson('/api/v1/mcp/enable');
+
+    $response->assertStatus(403);
+});

From 79174b749d8e59bf8cc5d3828ecc7ae051837705 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Thu, 30 Apr 2026 14:48:48 +0200
Subject: [PATCH 02/14] refactor(helpers): extract STANDALONE_DATABASE_MODELS
 registry, add tests
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replace 8× repeated per-type if-blocks in `queryDatabaseByUuidWithinTeam`
and `queryResourcesByUuid` with a single loop over the new
`STANDALONE_DATABASE_MODELS` constant.

Add unit tests to guard the registry against drift (keys mirror
`DATABASE_TYPES`, every entry is a valid Eloquent model with `team()`),
and feature tests covering team-ownership, wrong-team, and unknown-UUID
cases for `queryDatabaseByUuidWithinTeam`.
---
 bootstrap/helpers/constants.php               | 19 +++++
 bootstrap/helpers/shared.php                  | 75 +++----------------
 .../QueryDatabaseByUuidWithinTeamTest.php     | 70 +++++++++++++++++
 tests/Unit/StandaloneDatabaseRegistryTest.php | 45 +++++++++++
 4 files changed, 145 insertions(+), 64 deletions(-)
 create mode 100644 tests/Feature/QueryDatabaseByUuidWithinTeamTest.php
 create mode 100644 tests/Unit/StandaloneDatabaseRegistryTest.php

diff --git a/bootstrap/helpers/constants.php b/bootstrap/helpers/constants.php
index bae2573de..043a3346d 100644
--- a/bootstrap/helpers/constants.php
+++ b/bootstrap/helpers/constants.php
@@ -1,7 +1,26 @@
 <?php
 
+use App\Models\StandaloneClickhouse;
+use App\Models\StandaloneDragonfly;
+use App\Models\StandaloneKeydb;
+use App\Models\StandaloneMariadb;
+use App\Models\StandaloneMongodb;
+use App\Models\StandaloneMysql;
+use App\Models\StandalonePostgresql;
+use App\Models\StandaloneRedis;
+
 const REDACTED = '<REDACTED>';
 const DATABASE_TYPES = ['postgresql', 'redis', 'mongodb', 'mysql', 'mariadb', 'keydb', 'dragonfly', 'clickhouse'];
+const STANDALONE_DATABASE_MODELS = [
+    'postgresql' => StandalonePostgresql::class,
+    'redis' => StandaloneRedis::class,
+    'mongodb' => StandaloneMongodb::class,
+    'mysql' => StandaloneMysql::class,
+    'mariadb' => StandaloneMariadb::class,
+    'keydb' => StandaloneKeydb::class,
+    'dragonfly' => StandaloneDragonfly::class,
+    'clickhouse' => StandaloneClickhouse::class,
+];
 const VALID_CRON_STRINGS = [
     'every_minute' => '* * * * *',
     'hourly' => '0 * * * *',
diff --git a/bootstrap/helpers/shared.php b/bootstrap/helpers/shared.php
index 9f0f2cd73..f76995c6f 100644
--- a/bootstrap/helpers/shared.php
+++ b/bootstrap/helpers/shared.php
@@ -1058,44 +1058,17 @@ function getResourceByUuid(string $uuid, ?int $teamId = null)
 }
 function queryDatabaseByUuidWithinTeam(string $uuid, string $teamId)
 {
-    $postgresql = StandalonePostgresql::whereUuid($uuid)->first();
-    if ($postgresql && $postgresql->team()->id == $teamId) {
-        return $postgresql->unsetRelation('environment');
-    }
-    $redis = StandaloneRedis::whereUuid($uuid)->first();
-    if ($redis && $redis->team()->id == $teamId) {
-        return $redis->unsetRelation('environment');
-    }
-    $mongodb = StandaloneMongodb::whereUuid($uuid)->first();
-    if ($mongodb && $mongodb->team()->id == $teamId) {
-        return $mongodb->unsetRelation('environment');
-    }
-    $mysql = StandaloneMysql::whereUuid($uuid)->first();
-    if ($mysql && $mysql->team()->id == $teamId) {
-        return $mysql->unsetRelation('environment');
-    }
-    $mariadb = StandaloneMariadb::whereUuid($uuid)->first();
-    if ($mariadb && $mariadb->team()->id == $teamId) {
-        return $mariadb->unsetRelation('environment');
-    }
-    $keydb = StandaloneKeydb::whereUuid($uuid)->first();
-    if ($keydb && $keydb->team()->id == $teamId) {
-        return $keydb->unsetRelation('environment');
-    }
-    $dragonfly = StandaloneDragonfly::whereUuid($uuid)->first();
-    if ($dragonfly && $dragonfly->team()->id == $teamId) {
-        return $dragonfly->unsetRelation('environment');
-    }
-    $clickhouse = StandaloneClickhouse::whereUuid($uuid)->first();
-    if ($clickhouse && $clickhouse->team()->id == $teamId) {
-        return $clickhouse->unsetRelation('environment');
+    foreach (STANDALONE_DATABASE_MODELS as $modelClass) {
+        $database = $modelClass::whereUuid($uuid)->first();
+        if ($database && $database->team()->id == $teamId) {
+            return $database->unsetRelation('environment');
+        }
     }
 
     return null;
 }
 function queryResourcesByUuid(string $uuid)
 {
-    $resource = null;
     $application = Application::whereUuid($uuid)->first();
     if ($application) {
         return $application;
@@ -1104,37 +1077,11 @@ function queryResourcesByUuid(string $uuid)
     if ($service) {
         return $service;
     }
-    $postgresql = StandalonePostgresql::whereUuid($uuid)->first();
-    if ($postgresql) {
-        return $postgresql;
-    }
-    $redis = StandaloneRedis::whereUuid($uuid)->first();
-    if ($redis) {
-        return $redis;
-    }
-    $mongodb = StandaloneMongodb::whereUuid($uuid)->first();
-    if ($mongodb) {
-        return $mongodb;
-    }
-    $mysql = StandaloneMysql::whereUuid($uuid)->first();
-    if ($mysql) {
-        return $mysql;
-    }
-    $mariadb = StandaloneMariadb::whereUuid($uuid)->first();
-    if ($mariadb) {
-        return $mariadb;
-    }
-    $keydb = StandaloneKeydb::whereUuid($uuid)->first();
-    if ($keydb) {
-        return $keydb;
-    }
-    $dragonfly = StandaloneDragonfly::whereUuid($uuid)->first();
-    if ($dragonfly) {
-        return $dragonfly;
-    }
-    $clickhouse = StandaloneClickhouse::whereUuid($uuid)->first();
-    if ($clickhouse) {
-        return $clickhouse;
+    foreach (STANDALONE_DATABASE_MODELS as $modelClass) {
+        $database = $modelClass::whereUuid($uuid)->first();
+        if ($database) {
+            return $database;
+        }
     }
 
     // Check for ServiceDatabase by its own UUID
@@ -1143,7 +1090,7 @@ function queryResourcesByUuid(string $uuid)
         return $serviceDatabase;
     }
 
-    return $resource;
+    return null;
 }
 function generateTagDeployWebhook($tag_name)
 {
diff --git a/tests/Feature/QueryDatabaseByUuidWithinTeamTest.php b/tests/Feature/QueryDatabaseByUuidWithinTeamTest.php
new file mode 100644
index 000000000..db7eb16b2
--- /dev/null
+++ b/tests/Feature/QueryDatabaseByUuidWithinTeamTest.php
@@ -0,0 +1,70 @@
+<?php
+
+use App\Models\Environment;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\StandalonePostgresql;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->teamA = Team::factory()->create();
+    $this->teamB = Team::factory()->create();
+
+    $this->serverA = Server::factory()->create(['team_id' => $this->teamA->id]);
+    $this->destinationA = StandaloneDocker::where('server_id', $this->serverA->id)->first();
+    $this->projectA = Project::factory()->create(['team_id' => $this->teamA->id]);
+    $this->envA = Environment::factory()->create(['project_id' => $this->projectA->id]);
+});
+
+test('queryDatabaseByUuidWithinTeam returns database when team owns it', function () {
+    $database = StandalonePostgresql::create([
+        'name' => 'pg-team-a',
+        'image' => 'postgres:15-alpine',
+        'postgres_user' => 'postgres',
+        'postgres_password' => 'password',
+        'postgres_db' => 'postgres',
+        'environment_id' => $this->envA->id,
+        'destination_id' => $this->destinationA->id,
+        'destination_type' => $this->destinationA->getMorphClass(),
+    ]);
+
+    $found = queryDatabaseByUuidWithinTeam($database->uuid, (string) $this->teamA->id);
+
+    expect($found)->not->toBeNull();
+    expect($found->uuid)->toBe($database->uuid);
+    expect($found)->toBeInstanceOf(StandalonePostgresql::class);
+});
+
+test('queryDatabaseByUuidWithinTeam returns null when team does not own the database', function () {
+    $database = StandalonePostgresql::create([
+        'name' => 'pg-team-a',
+        'image' => 'postgres:15-alpine',
+        'postgres_user' => 'postgres',
+        'postgres_password' => 'password',
+        'postgres_db' => 'postgres',
+        'environment_id' => $this->envA->id,
+        'destination_id' => $this->destinationA->id,
+        'destination_type' => $this->destinationA->getMorphClass(),
+    ]);
+
+    $found = queryDatabaseByUuidWithinTeam($database->uuid, (string) $this->teamB->id);
+
+    expect($found)->toBeNull();
+});
+
+test('queryDatabaseByUuidWithinTeam returns null for unknown uuid', function () {
+    $found = queryDatabaseByUuidWithinTeam('does-not-exist', (string) $this->teamA->id);
+
+    expect($found)->toBeNull();
+});
+
+test('queryDatabaseByUuidWithinTeam can query every registered standalone database type without error', function () {
+    foreach (STANDALONE_DATABASE_MODELS as $slug => $modelClass) {
+        $count = $modelClass::query()->whereUuid('non-existent-uuid')->count();
+        expect($count)->toBe(0, "{$modelClass} ({$slug}) failed whereUuid() smoke query");
+    }
+});
diff --git a/tests/Unit/StandaloneDatabaseRegistryTest.php b/tests/Unit/StandaloneDatabaseRegistryTest.php
new file mode 100644
index 000000000..7c56d5f8d
--- /dev/null
+++ b/tests/Unit/StandaloneDatabaseRegistryTest.php
@@ -0,0 +1,45 @@
+<?php
+
+use App\Models\StandaloneDocker;
+use Illuminate\Database\Eloquent\Model;
+
+/**
+ * Guards STANDALONE_DATABASE_MODELS against drift.
+ *
+ * MCP and API endpoints rely on this registry for team-scoped UUID lookups.
+ * If a new App\Models\Standalone* model lands without a registry entry, the
+ * helpers in bootstrap/helpers/shared.php silently fail to resolve it.
+ */
+test('STANDALONE_DATABASE_MODELS contains every Standalone* model on disk', function () {
+    $files = glob(dirname(__DIR__, 2).'/app/Models/Standalone*.php');
+    expect($files)->not->toBeEmpty();
+
+    $onDisk = collect($files)
+        ->map(fn (string $path) => 'App\\Models\\'.basename($path, '.php'))
+        ->reject(fn (string $class) => $class === StandaloneDocker::class)
+        ->sort()
+        ->values()
+        ->all();
+
+    $registered = collect(STANDALONE_DATABASE_MODELS)->values()->sort()->values()->all();
+
+    expect($registered)->toBe(
+        $onDisk,
+        'STANDALONE_DATABASE_MODELS in bootstrap/helpers/constants.php is out of sync with the App\\Models\\Standalone* classes on disk. '
+        .'Add the missing model(s) to the registry (and to DATABASE_TYPES) so MCP/API helpers can resolve them.'
+    );
+});
+
+test('STANDALONE_DATABASE_MODELS keys mirror DATABASE_TYPES', function () {
+    expect(array_keys(STANDALONE_DATABASE_MODELS))->toEqualCanonicalizing(DATABASE_TYPES);
+});
+
+test('every STANDALONE_DATABASE_MODELS entry is an Eloquent model with whereUuid scope', function () {
+    foreach (STANDALONE_DATABASE_MODELS as $slug => $modelClass) {
+        expect(class_exists($modelClass))->toBeTrue("{$slug} maps to non-existent class {$modelClass}");
+        expect(is_subclass_of($modelClass, Model::class))
+            ->toBeTrue("{$modelClass} is not an Eloquent model");
+        expect(method_exists($modelClass, 'team'))
+            ->toBeTrue("{$modelClass} is missing team() accessor required by queryDatabaseByUuidWithinTeam()");
+    }
+});

From a51f114a70a1dc0493e797a6ecdc1a441101bc11 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Thu, 30 Apr 2026 15:01:48 +0200
Subject: [PATCH 03/14] fix(standalone-docker): include keydb, dragonfly,
 clickhouse in databases()

Add missing DB types to StandaloneDocker::databases() concat chain and
cover all 8 standalone database types with feature tests.
---
 app/Models/StandaloneDocker.php               |  5 +-
 .../Feature/StandaloneDockerDatabasesTest.php | 71 +++++++++++++++++++
 2 files changed, 75 insertions(+), 1 deletion(-)
 create mode 100644 tests/Feature/StandaloneDockerDatabasesTest.php

diff --git a/app/Models/StandaloneDocker.php b/app/Models/StandaloneDocker.php
index d6b4d1a1c..d12a15a7c 100644
--- a/app/Models/StandaloneDocker.php
+++ b/app/Models/StandaloneDocker.php
@@ -134,8 +134,11 @@ public function databases()
         $mongodbs = $this->mongodbs;
         $mysqls = $this->mysqls;
         $mariadbs = $this->mariadbs;
+        $keydbs = $this->keydbs;
+        $dragonflies = $this->dragonflies;
+        $clickhouses = $this->clickhouses;
 
-        return $postgresqls->concat($redis)->concat($mongodbs)->concat($mysqls)->concat($mariadbs);
+        return $postgresqls->concat($redis)->concat($mongodbs)->concat($mysqls)->concat($mariadbs)->concat($keydbs)->concat($dragonflies)->concat($clickhouses);
     }
 
     public function attachedTo()
diff --git a/tests/Feature/StandaloneDockerDatabasesTest.php b/tests/Feature/StandaloneDockerDatabasesTest.php
new file mode 100644
index 000000000..8d7889149
--- /dev/null
+++ b/tests/Feature/StandaloneDockerDatabasesTest.php
@@ -0,0 +1,71 @@
+<?php
+
+use App\Models\Environment;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneClickhouse;
+use App\Models\StandaloneDocker;
+use App\Models\StandaloneDragonfly;
+use App\Models\StandaloneKeydb;
+use App\Models\StandaloneMariadb;
+use App\Models\StandaloneMongodb;
+use App\Models\StandaloneMysql;
+use App\Models\StandalonePostgresql;
+use App\Models\StandaloneRedis;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->team = Team::factory()->create();
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+    $this->destination = StandaloneDocker::where('server_id', $this->server->id)->first();
+    $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+    $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
+});
+
+function attachDb(string $modelClass, array $extra, $destination, $environment)
+{
+    return $modelClass::create(array_merge([
+        'name' => 'test-'.strtolower(class_basename($modelClass)),
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ], $extra));
+}
+
+test('StandaloneDocker::databases() includes attached keydb', function () {
+    attachDb(StandaloneKeydb::class, ['keydb_password' => 'pw'], $this->destination, $this->environment);
+
+    expect($this->destination->databases()->count())->toBe(1);
+    expect($this->destination->attachedTo())->toBeTrue();
+});
+
+test('StandaloneDocker::databases() includes attached dragonfly', function () {
+    attachDb(StandaloneDragonfly::class, ['dragonfly_password' => 'pw'], $this->destination, $this->environment);
+
+    expect($this->destination->databases()->count())->toBe(1);
+    expect($this->destination->attachedTo())->toBeTrue();
+});
+
+test('StandaloneDocker::databases() includes attached clickhouse', function () {
+    attachDb(StandaloneClickhouse::class, ['clickhouse_admin_password' => 'pw'], $this->destination, $this->environment);
+
+    expect($this->destination->databases()->count())->toBe(1);
+    expect($this->destination->attachedTo())->toBeTrue();
+});
+
+test('StandaloneDocker::databases() includes all 8 standalone database types', function () {
+    attachDb(StandalonePostgresql::class, ['postgres_password' => 'pw'], $this->destination, $this->environment);
+    attachDb(StandaloneRedis::class, ['redis_password' => 'pw'], $this->destination, $this->environment);
+    attachDb(StandaloneMongodb::class, ['mongo_initdb_root_password' => 'pw'], $this->destination, $this->environment);
+    attachDb(StandaloneMysql::class, ['mysql_root_password' => 'pw', 'mysql_password' => 'pw'], $this->destination, $this->environment);
+    attachDb(StandaloneMariadb::class, ['mariadb_root_password' => 'pw', 'mariadb_password' => 'pw'], $this->destination, $this->environment);
+    attachDb(StandaloneKeydb::class, ['keydb_password' => 'pw'], $this->destination, $this->environment);
+    attachDb(StandaloneDragonfly::class, ['dragonfly_password' => 'pw'], $this->destination, $this->environment);
+    attachDb(StandaloneClickhouse::class, ['clickhouse_admin_password' => 'pw'], $this->destination, $this->environment);
+
+    expect($this->destination->databases()->count())->toBe(8);
+    expect($this->destination->attachedTo())->toBeTrue();
+});

From 1849b5903ec6e92b3f2b097a52be128aaa349d0e Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 4 May 2026 12:26:15 +0200
Subject: [PATCH 04/14] refactor(scheduled-task): simplify server() with
 nullsafe operators and add return type

Replace nested null checks with nullsafe operator chains, add ?Server
return type, drop unreachable database branch, and cover all paths with
feature tests.
---
 app/Models/ScheduledTask.php              | 18 +++----
 tests/Feature/ScheduledTaskServerTest.php | 66 +++++++++++++++++++++++
 2 files changed, 72 insertions(+), 12 deletions(-)
 create mode 100644 tests/Feature/ScheduledTaskServerTest.php

diff --git a/app/Models/ScheduledTask.php b/app/Models/ScheduledTask.php
index 40f8e1860..0a53395d3 100644
--- a/app/Models/ScheduledTask.php
+++ b/app/Models/ScheduledTask.php
@@ -76,20 +76,14 @@ public function executions(): HasMany
         return $this->hasMany(ScheduledTaskExecution::class)->orderBy('created_at', 'desc');
     }
 
-    public function server()
+    public function server(): ?Server
     {
         if ($this->application) {
-            if ($this->application->destination && $this->application->destination->server) {
-                return $this->application->destination->server;
-            }
-        } elseif ($this->service) {
-            if ($this->service->destination && $this->service->destination->server) {
-                return $this->service->destination->server;
-            }
-        } elseif ($this->database) {
-            if ($this->database->destination && $this->database->destination->server) {
-                return $this->database->destination->server;
-            }
+            return $this->application->destination?->server;
+        }
+
+        if ($this->service) {
+            return $this->service->destination?->server;
         }
 
         return null;
diff --git a/tests/Feature/ScheduledTaskServerTest.php b/tests/Feature/ScheduledTaskServerTest.php
new file mode 100644
index 000000000..68a9020d0
--- /dev/null
+++ b/tests/Feature/ScheduledTaskServerTest.php
@@ -0,0 +1,66 @@
+<?php
+
+use App\Models\Application;
+use App\Models\Project;
+use App\Models\ScheduledTask;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->team = Team::factory()->create();
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+    $this->destination = StandaloneDocker::where('server_id', $this->server->id)->first();
+    $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+    $this->environment = $this->project->environments()->first();
+});
+
+it('returns null when neither application nor service is set', function () {
+    $task = ScheduledTask::factory()->create([
+        'team_id' => $this->team->id,
+    ]);
+
+    expect($task->server())->toBeNull();
+});
+
+it('does not throw when accessing dynamic properties on a parentless task', function () {
+    $task = ScheduledTask::factory()->create([
+        'team_id' => $this->team->id,
+    ]);
+
+    expect(fn () => $task->server())->not->toThrow(Exception::class);
+});
+
+it('resolves server via application destination', function () {
+    $application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+
+    $task = ScheduledTask::factory()->create([
+        'application_id' => $application->id,
+        'team_id' => $this->team->id,
+    ]);
+
+    expect($task->server()?->id)->toBe($this->server->id);
+});
+
+it('resolves server via service destination', function () {
+    $service = Service::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+
+    $task = ScheduledTask::factory()->create([
+        'service_id' => $service->id,
+        'team_id' => $this->team->id,
+    ]);
+
+    expect($task->server()?->id)->toBe($this->server->id);
+});

From e89820b46552e848ec30825927c9c5a2d74ccde8 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 5 May 2026 15:30:32 +0200
Subject: [PATCH 05/14] refactor(deployment): move copyLogs to client-side and
 hide refund when ineligible

Move copyLogs from PHP Livewire method to Alpine.js to avoid
unnecessary server round-trips. Extract collectVisibleLogs()
helper shared by both copy and download actions.

Hide refund section entirely when not eligible instead of
rendering a permanently disabled button.
---
 .../Project/Application/Deployment/Show.php   | 13 -------
 .../application/deployment/show.blade.php     | 22 +++++++-----
 .../livewire/subscription/actions.blade.php   | 34 +++++++++----------
 3 files changed, 31 insertions(+), 38 deletions(-)

diff --git a/app/Livewire/Project/Application/Deployment/Show.php b/app/Livewire/Project/Application/Deployment/Show.php
index 954670582..c9f818e2c 100644
--- a/app/Livewire/Project/Application/Deployment/Show.php
+++ b/app/Livewire/Project/Application/Deployment/Show.php
@@ -108,19 +108,6 @@ public function getLogLinesProperty()
         return decode_remote_command_output($this->application_deployment_queue);
     }
 
-    public function copyLogs(): string
-    {
-        $logs = decode_remote_command_output($this->application_deployment_queue)
-            ->map(function ($line) {
-                return $line['timestamp'].' '.
-                       (isset($line['command']) && $line['command'] ? '[CMD]: ' : '').
-                       trim($line['line']);
-            })
-            ->join("\n");
-
-        return sanitizeLogsForExport($logs);
-    }
-
     public function downloadAllLogs(): string
     {
         $logs = decode_remote_command_output($this->application_deployment_queue, includeAll: true)
diff --git a/resources/views/livewire/project/application/deployment/show.blade.php b/resources/views/livewire/project/application/deployment/show.blade.php
index 8618872f5..8ef2c3f51 100644
--- a/resources/views/livewire/project/application/deployment/show.blade.php
+++ b/resources/views/livewire/project/application/deployment/show.blade.php
@@ -155,9 +155,9 @@
 
             this.matchCount = query ? count : 0;
         },
-        downloadLogs() {
+        collectVisibleLogs() {
             const logs = document.getElementById('logs');
-            if (!logs) return;
+            if (!logs) return '';
             const visibleLines = logs.querySelectorAll('[data-log-line]:not(.hidden)');
             let content = '';
             visibleLines.forEach(line => {
@@ -166,6 +166,17 @@
                     content += text + String.fromCharCode(10);
                 }
             });
+            return content;
+        },
+        copyLogs() {
+            const content = this.collectVisibleLogs();
+            if (!content) return;
+            navigator.clipboard.writeText(content);
+            Livewire.dispatch('success', ['Logs copied to clipboard.']);
+        },
+        downloadLogs() {
+            const content = this.collectVisibleLogs();
+            if (!content) return;
             const blob = new Blob([content], { type: 'text/plain' });
             const url = URL.createObjectURL(blob);
             const a = document.createElement('a');
@@ -258,12 +269,7 @@ class="absolute right-2 top-1/2 -translate-y-1/2 text-gray-400 hover:text-gray-6
                             </div>
                             <div class="flex flex-wrap items-center gap-1">
                                 <button
-                                    x-on:click="
-                                    $wire.copyLogs().then(logs => {
-                                        navigator.clipboard.writeText(logs);
-                                        Livewire.dispatch('success', ['Logs copied to clipboard.']);
-                                    });
-                                "
+                                    x-on:click="copyLogs()"
                                 title="Copy Logs"
                                 class="p-1 text-gray-500 hover:text-gray-700 dark:text-gray-400 dark:hover:text-gray-200">
                                 <svg class="w-4 h-4" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24"
diff --git a/resources/views/livewire/subscription/actions.blade.php b/resources/views/livewire/subscription/actions.blade.php
index aa129043b..1b622285a 100644
--- a/resources/views/livewire/subscription/actions.blade.php
+++ b/resources/views/livewire/subscription/actions.blade.php
@@ -249,23 +249,23 @@ class="w-20 px-2 py-1 text-xl font-bold text-center rounded border dark:bg-coolg
         {{-- Refund --}}
         <section>
             <h3 class="pb-2">Refund</h3>
-            <div class="flex flex-wrap items-center gap-2">
-                @if ($refundCheckLoading)
-                    <x-forms.button disabled>Request Full Refund</x-forms.button>
-                @elseif ($isRefundEligible && !currentTeam()->subscription->stripe_cancel_at_period_end)
-                    <x-modal-confirmation title="Request Full Refund?" buttonTitle="Request Full Refund"
-                        isErrorButton submitAction="refundSubscription"
-                        :actions="[
-                            'Your latest payment will be fully refunded.',
-                            'Your subscription will be cancelled immediately.',
-                            'All servers will be deactivated.',
-                        ]" confirmationText="{{ currentTeam()->name }}"
-                        confirmationLabel="Enter your team name to confirm" shortConfirmationLabel="Team Name"
-                        step2ButtonText="Confirm Refund & Cancel" />
-                @else
-                    <x-forms.button disabled>Request Full Refund</x-forms.button>
-                @endif
-            </div>
+            @if ($refundCheckLoading || ($isRefundEligible && !currentTeam()->subscription->stripe_cancel_at_period_end))
+                <div class="flex flex-wrap items-center gap-2">
+                    @if ($refundCheckLoading)
+                        <x-forms.button disabled>Request Full Refund</x-forms.button>
+                    @else
+                        <x-modal-confirmation title="Request Full Refund?" buttonTitle="Request Full Refund"
+                            isErrorButton submitAction="refundSubscription"
+                            :actions="[
+                                'Your latest payment will be fully refunded.',
+                                'Your subscription will be cancelled immediately.',
+                                'All servers will be deactivated.',
+                            ]" confirmationText="{{ currentTeam()->name }}"
+                            confirmationLabel="Enter your team name to confirm" shortConfirmationLabel="Team Name"
+                            step2ButtonText="Confirm Refund & Cancel" />
+                    @endif
+                </div>
+            @endif
             <p class="mt-2 text-sm text-neutral-500">
                 @if ($refundCheckLoading)
                     Checking refund eligibility...

From d1a416f256e16d838866b2a948269c97cb28d04f Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 5 May 2026 20:52:17 +0200
Subject: [PATCH 06/14] docs(sponsors): add LumaDock as big sponsor

---
 README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/README.md b/README.md
index 7a3f2a65e..7712ec952 100644
--- a/README.md
+++ b/README.md
@@ -87,6 +87,7 @@ ### Big Sponsors
 * [Juxtdigital](https://juxtdigital.com?ref=coolify.io) - Digital PR & AI Authority Building Agency
 * [LiquidWeb](https://liquidweb.com?ref=coolify.io) - Premium managed hosting solutions
 * [Logto](https://logto.io?ref=coolify.io) - The better identity infrastructure for developers
+* [LumaDock](https://lumadock.com/vps-hosting/coolify?utm_source=coolify&utm_medium=sponsorship&utm_campaign=coolify_oss_sponsor_2026&utm_content=github_readme) - Fast and reliable virtual server hosting
 * [Macarne](https://macarne.com?ref=coolify.io) - Best IP Transit & Carrier Ethernet Solutions for Simplified Network Connectivity
 * [Mobb](https://vibe.mobb.ai/?ref=coolify.io) - Secure Your AI-Generated Code to Unlock Dev Productivity
 * [PetroSky Cloud](https://petrosky.io?ref=coolify.io) - Open source cloud deployment solutions

From 2cbb449a0647abdb852defb1814b2a28a3f513ab Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 5 May 2026 21:04:25 +0200
Subject: [PATCH 07/14] docs(sponsors): add Capture.page as big sponsor

---
 README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/README.md b/README.md
index 7712ec952..28fc33d6f 100644
--- a/README.md
+++ b/README.md
@@ -69,6 +69,7 @@ ### Big Sponsors
 * [Arcjet](https://arcjet.com?ref=coolify.io) - Advanced web security and performance solutions
 * [BC Direct](https://bc.direct?ref=coolify.io) - Your trusted technology consulting partner
 * [Blacksmith](https://blacksmith.sh?ref=coolify.io) - Infrastructure automation platform
+* [Capture.page](https://capture.page/?ref=coolify.io) - Fast & Reliable Screenshot API for Developers
 * [Context.dev](https://context.dev?ref=coolify.io) - API to personalize your product with logos, colors, and company info from any domain
 * [ByteBase](https://www.bytebase.com?ref=coolify.io) - Database CI/CD and Security at Scale
 * [CodeRabbit](https://coderabbit.ai?ref=coolify.io) - Cut Code Review Time & Bugs in Half

From 45f65481e637713a5c55f4e72461ad5fe879f513 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 5 May 2026 22:07:58 +0200
Subject: [PATCH 08/14] fix(mcp): change enable/disable endpoints from GET to
 POST and fix service/app listing

- `/mcp/enable` and `/mcp/disable` now use POST (state-mutating ops)
- `ListServices` queries DB directly instead of loading all projects into memory
- `ListApplications` validates tag arg rejects empty string (not just falsy)
---
 app/Http/Controllers/Api/OtherController.php |  4 ++--
 app/Mcp/Tools/ListApplications.php           |  5 ++++-
 app/Mcp/Tools/ListServices.php               | 18 ++++++++----------
 openapi.json                                 |  4 ++--
 openapi.yaml                                 |  4 ++--
 routes/api.php                               |  4 ++--
 tests/Feature/Mcp/McpToggleApiTest.php       | 16 ++++++++--------
 7 files changed, 28 insertions(+), 27 deletions(-)

diff --git a/app/Http/Controllers/Api/OtherController.php b/app/Http/Controllers/Api/OtherController.php
index 17c5a884a..f17a4e46b 100644
--- a/app/Http/Controllers/Api/OtherController.php
+++ b/app/Http/Controllers/Api/OtherController.php
@@ -153,7 +153,7 @@ public function disable_api(Request $request)
         return response()->json(['message' => 'API disabled.'], 200);
     }
 
-    #[OA\Get(
+    #[OA\Post(
         summary: 'Enable MCP Server',
         description: 'Enable the MCP server endpoint at /mcp (only with root permissions).',
         path: '/mcp/enable',
@@ -209,7 +209,7 @@ public function enable_mcp(Request $request)
         return response()->json(['message' => 'MCP server enabled.'], 200);
     }
 
-    #[OA\Get(
+    #[OA\Post(
         summary: 'Disable MCP Server',
         description: 'Disable the MCP server endpoint at /mcp (only with root permissions).',
         path: '/mcp/disable',
diff --git a/app/Mcp/Tools/ListApplications.php b/app/Mcp/Tools/ListApplications.php
index 947d49ed1..815edd61a 100644
--- a/app/Mcp/Tools/ListApplications.php
+++ b/app/Mcp/Tools/ListApplications.php
@@ -31,10 +31,13 @@ public function handle(Request $request): Response
         }
 
         $tagName = $request->get('tag');
+        if ($tagName !== null && (! is_string($tagName) || trim($tagName) === '')) {
+            return Response::error('tag argument must be a non-empty string.');
+        }
         $args = $this->paginationArgs($request);
 
         $query = Application::ownedByCurrentTeamAPI($teamId)
-            ->when($tagName, function ($query, $tagName) {
+            ->when($tagName !== null, function ($query) use ($tagName) {
                 $query->whereHas('tags', fn ($q) => $q->where('name', $tagName));
             });
 
diff --git a/app/Mcp/Tools/ListServices.php b/app/Mcp/Tools/ListServices.php
index 4b33231ba..b0bff4fad 100644
--- a/app/Mcp/Tools/ListServices.php
+++ b/app/Mcp/Tools/ListServices.php
@@ -4,7 +4,7 @@
 
 use App\Mcp\Concerns\BuildsResponse;
 use App\Mcp\Concerns\ResolvesTeam;
-use App\Models\Project;
+use App\Models\Service;
 use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
@@ -32,17 +32,15 @@ public function handle(Request $request): Response
 
         $args = $this->paginationArgs($request);
 
-        $projects = Project::where('team_id', $teamId)->get();
-        $services = collect();
-        foreach ($projects as $project) {
-            $services = $services->merge($project->services()->get());
-        }
+        $query = Service::whereHas('environment.project', fn ($q) => $q->where('team_id', $teamId));
 
-        $total = $services->count();
+        $total = (clone $query)->count();
 
-        $summaries = $services
-            ->sortBy('name')
-            ->slice($args['offset'], $args['per_page'])
+        $summaries = $query
+            ->orderBy('name')
+            ->skip($args['offset'])
+            ->take($args['per_page'])
+            ->get()
             ->map(fn ($svc) => [
                 'uuid' => $svc->uuid,
                 'name' => $svc->name,
diff --git a/openapi.json b/openapi.json
index c35c0cdd6..711c7d8f3 100644
--- a/openapi.json
+++ b/openapi.json
@@ -8651,7 +8651,7 @@
             }
         },
         "\/mcp\/enable": {
-            "get": {
+            "post": {
                 "summary": "Enable MCP Server",
                 "description": "Enable the MCP server endpoint at \/mcp (only with root permissions).",
                 "operationId": "enable-mcp",
@@ -8703,7 +8703,7 @@
             }
         },
         "\/mcp\/disable": {
-            "get": {
+            "post": {
                 "summary": "Disable MCP Server",
                 "description": "Disable the MCP server endpoint at \/mcp (only with root permissions).",
                 "operationId": "disable-mcp",
diff --git a/openapi.yaml b/openapi.yaml
index eab531674..fef77f5a7 100644
--- a/openapi.yaml
+++ b/openapi.yaml
@@ -5485,7 +5485,7 @@ paths:
         -
           bearerAuth: []
   /mcp/enable:
-    get:
+    post:
       summary: 'Enable MCP Server'
       description: 'Enable the MCP server endpoint at /mcp (only with root permissions).'
       operationId: enable-mcp
@@ -5514,7 +5514,7 @@ paths:
         -
           bearerAuth: []
   /mcp/disable:
-    get:
+    post:
       summary: 'Disable MCP Server'
       description: 'Disable the MCP server endpoint at /mcp (only with root permissions).'
       operationId: disable-mcp
diff --git a/routes/api.php b/routes/api.php
index f38576d4d..38ded350a 100644
--- a/routes/api.php
+++ b/routes/api.php
@@ -35,8 +35,8 @@
 ], function () {
     Route::get('/enable', [OtherController::class, 'enable_api']);
     Route::get('/disable', [OtherController::class, 'disable_api']);
-    Route::get('/mcp/enable', [OtherController::class, 'enable_mcp']);
-    Route::get('/mcp/disable', [OtherController::class, 'disable_mcp']);
+    Route::post('/mcp/enable', [OtherController::class, 'enable_mcp']);
+    Route::post('/mcp/disable', [OtherController::class, 'disable_mcp']);
 });
 Route::group([
     'middleware' => ['auth:sanctum', ApiAllowed::class, 'api.sensitive'],
diff --git a/tests/Feature/Mcp/McpToggleApiTest.php b/tests/Feature/Mcp/McpToggleApiTest.php
index 2700f9b7b..68d5d335a 100644
--- a/tests/Feature/Mcp/McpToggleApiTest.php
+++ b/tests/Feature/Mcp/McpToggleApiTest.php
@@ -43,25 +43,25 @@ function makeNonRootMcpToken(User $user, Team $team, array $abilities = ['write'
     return $token->plainTextToken;
 }
 
-test('GET /api/v1/mcp/enable enables MCP server with root token', function () {
+test('POST /api/v1/mcp/enable enables MCP server with root token', function () {
     $token = makeRootMcpToken($this->user);
 
     $response = test()->withHeaders([
         'Authorization' => 'Bearer '.$token,
-    ])->getJson('/api/v1/mcp/enable');
+    ])->postJson('/api/v1/mcp/enable');
 
     $response->assertOk();
     $response->assertJson(['message' => 'MCP server enabled.']);
     expect(InstanceSettings::find(0)->is_mcp_server_enabled)->toBeTrue();
 });
 
-test('GET /api/v1/mcp/disable disables MCP server with root token', function () {
+test('POST /api/v1/mcp/disable disables MCP server with root token', function () {
     InstanceSettings::query()->where('id', 0)->update(['is_mcp_server_enabled' => true]);
     $token = makeRootMcpToken($this->user);
 
     $response = test()->withHeaders([
         'Authorization' => 'Bearer '.$token,
-    ])->getJson('/api/v1/mcp/disable');
+    ])->postJson('/api/v1/mcp/disable');
 
     $response->assertOk();
     $response->assertJson(['message' => 'MCP server disabled.']);
@@ -73,7 +73,7 @@ function makeNonRootMcpToken(User $user, Team $team, array $abilities = ['write'
 
     $response = test()->withHeaders([
         'Authorization' => 'Bearer '.$token,
-    ])->getJson('/api/v1/mcp/enable');
+    ])->postJson('/api/v1/mcp/enable');
 
     $response->assertStatus(403);
     expect(InstanceSettings::find(0)->is_mcp_server_enabled)->toBeFalse();
@@ -85,14 +85,14 @@ function makeNonRootMcpToken(User $user, Team $team, array $abilities = ['write'
 
     $response = test()->withHeaders([
         'Authorization' => 'Bearer '.$token,
-    ])->getJson('/api/v1/mcp/disable');
+    ])->postJson('/api/v1/mcp/disable');
 
     $response->assertStatus(403);
     expect(InstanceSettings::find(0)->is_mcp_server_enabled)->toBeTrue();
 });
 
 test('unauthenticated request to /api/v1/mcp/enable returns 401', function () {
-    $response = test()->getJson('/api/v1/mcp/enable');
+    $response = test()->postJson('/api/v1/mcp/enable');
     $response->assertStatus(401);
 });
 
@@ -101,7 +101,7 @@ function makeNonRootMcpToken(User $user, Team $team, array $abilities = ['write'
 
     $response = test()->withHeaders([
         'Authorization' => 'Bearer '.$token,
-    ])->getJson('/api/v1/mcp/enable');
+    ])->postJson('/api/v1/mcp/enable');
 
     $response->assertStatus(403);
 });

From 02dd8093a3a384296a31880cbdf2b15e6d2d5b18 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Wed, 6 May 2026 14:56:13 +0200
Subject: [PATCH 09/14] feat(ui): add collapsible sidebar with tooltip and team
 menu

Sidebar collapses to icon-only mode on lg breakpoint. State persists
in localStorage. Collapsed state shows logo icon, team initial button
with flyout menu, and hover tooltips for nav items.
---
 resources/css/utilities.css                   |  9 ++
 resources/views/components/navbar.blade.php   | 87 +++++++++++++------
 resources/views/layouts/app.blade.php         | 21 ++++-
 .../views/livewire/switch-team.blade.php      | 55 ++++++++++--
 4 files changed, 137 insertions(+), 35 deletions(-)

diff --git a/resources/css/utilities.css b/resources/css/utilities.css
index a8e807041..7eb926a36 100644
--- a/resources/css/utilities.css
+++ b/resources/css/utilities.css
@@ -343,3 +343,12 @@ @utility log-debug {
 @utility log-info {
     @apply bg-blue-500/10 dark:bg-blue-500/15;
 }
+
+@media (min-width: 1024px) {
+    .sidebar-collapsed .menu-item {
+        justify-content: center;
+        padding-left: 0;
+        padding-right: 0;
+        gap: 0;
+    }
+}
diff --git a/resources/views/components/navbar.blade.php b/resources/views/components/navbar.blade.php
index da9a112f8..74b32564c 100644
--- a/resources/views/components/navbar.blade.php
+++ b/resources/views/components/navbar.blade.php
@@ -1,5 +1,20 @@
-<nav class="flex flex-col flex-1 px-2 bg-white border-r dark:border-coolgray-200 border-neutral-300 dark:bg-base"
+<nav class="flex flex-col flex-1 bg-white border-r dark:border-coolgray-200 border-neutral-300 dark:bg-base"
+    :class="collapsed ? 'lg:px-1 px-2 sidebar-collapsed' : 'px-2'"
+    @mouseover="
+        if (!collapsed) return;
+        const el = $event.target.closest('.menu-item');
+        if (!el) { tooltip.show = false; return; }
+        const text = el.getAttribute('title') || el.getAttribute('aria-label') || '';
+        if (!text) return;
+        const rect = el.getBoundingClientRect();
+        tooltip.text = text;
+        tooltip.x = rect.right + 8;
+        tooltip.y = rect.top + rect.height / 2;
+        tooltip.show = true;
+    "
+    @mouseleave="tooltip.show = false"
     x-data="{
+        tooltip: { text: '', x: 0, y: 0, show: false },
         switchWidth() {
                 if (this.full === 'full') {
                     localStorage.setItem('pageWidth', 'center');
@@ -77,12 +92,22 @@
                 }
             }
     }">
-    <div class="flex lg:pt-6 pt-4 pb-4 pl-2">
-        <div class="flex flex-col w-full">
+    <div class="flex lg:pt-6 pt-4 pb-4 pl-2 items-start gap-2"
+        :class="collapsed ? 'lg:flex-col lg:items-center lg:pl-0 lg:gap-3' : ''">
+        <div class="flex flex-col w-full" :class="collapsed && 'lg:hidden'">
             <a href="/" {{ wireNavigate() }} class="text-2xl font-bold tracking-tight dark:text-white hover:opacity-80 transition-opacity">Coolify</a>
             <x-version />
         </div>
-        <div>
+        <div class="hidden flex-col items-center w-full gap-1"
+            :class="collapsed && 'lg:flex'">
+            <a href="/" {{ wireNavigate() }}
+                class="hover:opacity-80 transition-opacity"
+                title="Coolify">
+                <img src="/coolify-logo.svg" alt="Coolify" class="w-6 h-6" />
+            </a>
+            <x-version class="text-[10px]" />
+        </div>
+        <div :class="collapsed && 'lg:hidden'">
             <!-- Search button that triggers global search modal -->
             <button @click="$dispatch('open-global-search')" type="button" title="Search (Press / or ⌘K)"
                 class="flex items-center gap-1.5 px-2.5 py-1.5 bg-neutral-100 dark:bg-coolgray-100 border border-neutral-300 dark:border-coolgray-200 rounded-md hover:bg-neutral-200 dark:hover:bg-coolgray-200 transition-colors">
@@ -95,9 +120,11 @@ class="flex items-center gap-1.5 px-2.5 py-1.5 bg-neutral-100 dark:bg-coolgray-1
                     class="px-1 py-0.5 text-xs font-semibold text-neutral-500 dark:text-neutral-400 bg-neutral-200 dark:bg-coolgray-200 rounded">/</kbd>
             </button>
         </div>
-        <livewire:settings-dropdown />
+        <div :class="collapsed && 'lg:hidden'">
+            <livewire:settings-dropdown />
+        </div>
     </div>
-    <div class="px-2 pt-2 pb-7">
+    <div class="px-2 pt-2 pb-7" :class="collapsed && 'lg:px-0 lg:pt-0 lg:pb-4 lg:flex lg:justify-center'">
         <livewire:switch-team />
     </div>
     <ul role="list" class="flex flex-col flex-1 gap-y-7">
@@ -112,7 +139,7 @@ class="{{ request()->is('/') ? 'menu-item-active menu-item' : 'menu-item' }}">
                                 <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2"
                                     d="M3 12l2-2m0 0l7-7 7 7M5 10v10a1 1 0 001 1h3m10-11l2 2m-2-2v10a1 1 0 01-1 1h-3m-6 0a1 1 0 001-1v-4a1 1 0 011-1h2a1 1 0 011 1v4a1 1 0 001 1m-6 0h6" />
                             </svg>
-                            <span class="menu-item-label">Dashboard</span>
+                            <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Dashboard</span>
                         </a>
                     </li>
                     <li>
@@ -127,7 +154,7 @@ class="{{ request()->is('project/*') || request()->is('projects') ? 'menu-item m
                                 <path d="M4 12l8 4l8 -4" />
                                 <path d="M4 16l8 4l8 -4" />
                             </svg>
-                            <span class="menu-item-label">Projects</span>
+                            <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Projects</span>
                         </a>
                     </li>
                     <li>
@@ -145,7 +172,7 @@ class="{{ request()->is('server/*') || request()->is('servers') ? 'menu-item men
                                 <path d="M7 16v.01" />
                                 <path d="M20 15l-2 3h3l-2 3" />
                             </svg>
-                            <span class="menu-item-label">Servers</span>
+                            <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Servers</span>
                         </a>
                     </li>
 
@@ -157,7 +184,7 @@ class="{{ request()->is('source*') ? 'menu-item-active menu-item' : 'menu-item'
                                 <path fill="currentColor"
                                     d="m6.793 1.207l.353.354l-.353-.354ZM1.207 6.793l-.353-.354l.353.354Zm0 1.414l.354-.353l-.354.353Zm5.586 5.586l-.354.353l.354-.353Zm1.414 0l-.353-.354l.353.354Zm5.586-5.586l.353.354l-.353-.354Zm0-1.414l-.354.353l.354-.353ZM8.207 1.207l.354-.353l-.354.353ZM6.44.854L.854 6.439l.707.707l5.585-5.585L6.44.854ZM.854 8.56l5.585 5.585l.707-.707l-5.585-5.585l-.707.707Zm7.707 5.585l5.585-5.585l-.707-.707l-5.585 5.585l.707.707Zm5.585-7.707L8.561.854l-.707.707l5.585 5.585l.707-.707Zm0 2.122a1.5 1.5 0 0 0 0-2.122l-.707.707a.5.5 0 0 1 0 .708l.707.707ZM6.44 14.146a1.5 1.5 0 0 0 2.122 0l-.707-.707a.5.5 0 0 1-.708 0l-.707.707ZM.854 6.44a1.5 1.5 0 0 0 0 2.122l.707-.707a.5.5 0 0 1 0-.708L.854 6.44Zm6.292-4.878a.5.5 0 0 1 .708 0L8.56.854a1.5 1.5 0 0 0-2.122 0l.707.707Zm-2 1.293l1 1l.708-.708l-1-1l-.708.708ZM7.5 5a.5.5 0 0 1-.5-.5H6A1.5 1.5 0 0 0 7.5 6V5Zm.5-.5a.5.5 0 0 1-.5.5v1A1.5 1.5 0 0 0 9 4.5H8ZM7.5 4a.5.5 0 0 1 .5.5h1A1.5 1.5 0 0 0 7.5 3v1Zm0-1A1.5 1.5 0 0 0 6 4.5h1a.5.5 0 0 1 .5-.5V3Zm.646 2.854l1.5 1.5l.707-.708l-1.5-1.5l-.707.708ZM10.5 8a.5.5 0 0 1-.5-.5H9A1.5 1.5 0 0 0 10.5 9V8Zm.5-.5a.5.5 0 0 1-.5.5v1A1.5 1.5 0 0 0 12 7.5h-1Zm-.5-.5a.5.5 0 0 1 .5.5h1A1.5 1.5 0 0 0 10.5 6v1Zm0-1A1.5 1.5 0 0 0 9 7.5h1a.5.5 0 0 1 .5-.5V6ZM7 5.5v4h1v-4H7Zm.5 5.5a.5.5 0 0 1-.5-.5H6A1.5 1.5 0 0 0 7.5 12v-1Zm.5-.5a.5.5 0 0 1-.5.5v1A1.5 1.5 0 0 0 9 10.5H8Zm-.5-.5a.5.5 0 0 1 .5.5h1A1.5 1.5 0 0 0 7.5 9v1Zm0-1A1.5 1.5 0 0 0 6 10.5h1a.5.5 0 0 1 .5-.5V9Z" />
                             </svg>
-                            <span class="menu-item-label">Sources</span>
+                            <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Sources</span>
                         </a>
                     </li>
                     <li>
@@ -170,7 +197,7 @@ class="{{ request()->is('destination*') ? 'menu-item-active menu-item' : 'menu-i
                                     stroke-linejoin="round" stroke-width="2"
                                     d="M9 4L3 8v12l6-3l6 3l6-4V4l-6 3l-6-3zm-2 8.001V12m4 .001V12m3-2l2 2m2 2l-2-2m0 0l2-2m-2 2l-2 2" />
                             </svg>
-                            <span class="menu-item-label">Destinations</span>
+                            <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Destinations</span>
                         </a>
                     </li>
                     <li>
@@ -185,7 +212,7 @@ class="{{ request()->is('storages*') ? 'menu-item-active menu-item' : 'menu-item
                                     <path d="M4 12v6a8 3 0 0 0 16 0v-6" />
                                 </g>
                             </svg>
-                            <span class="menu-item-label">S3 Storages</span>
+                            <span class="menu-item-label" :class="collapsed && 'lg:hidden'">S3 Storages</span>
                         </a>
                     </li>
                     <li>
@@ -200,7 +227,7 @@ class="{{ request()->is('shared-variables*') ? 'menu-item-active menu-item' : 'm
                                     <path d="M8 16c1.5 0 3-2 4-3.5S14.5 9 16 9" />
                                 </g>
                             </svg>
-                            <span class="menu-item-label">Shared Variables</span>
+                            <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Shared Variables</span>
                         </a>
                     </li>
                     <li>
@@ -212,7 +239,7 @@ class="{{ request()->is('notifications*') ? 'menu-item-active menu-item' : 'menu
                                     stroke-linejoin="round" stroke-width="2"
                                     d="M10 5a2 2 0 1 1 4 0a7 7 0 0 1 4 6v3a4 4 0 0 0 2 3H4a4 4 0 0 0 2-3v-3a7 7 0 0 1 4-6M9 17v1a3 3 0 0 0 6 0v-1" />
                             </svg>
-                            <span class="menu-item-label">Notifications</span>
+                            <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Notifications</span>
                         </a>
                     </li>
                     <li>
@@ -224,7 +251,7 @@ class="{{ request()->is('security*') ? 'menu-item-active menu-item' : 'menu-item
                                     stroke-linejoin="round" stroke-width="2"
                                     d="m16.555 3.843l3.602 3.602a2.877 2.877 0 0 1 0 4.069l-2.643 2.643a2.877 2.877 0 0 1-4.069 0l-.301-.301l-6.558 6.558a2 2 0 0 1-1.239.578L5.172 21H4a1 1 0 0 1-.993-.883L3 20v-1.172a2 2 0 0 1 .467-1.284l.119-.13L4 17h2v-2h2v-2l2.144-2.144l-.301-.301a2.877 2.877 0 0 1 0-4.069l2.643-2.643a2.877 2.877 0 0 1 4.069 0zM15 9h.01" />
                             </svg>
-                            <span class="menu-item-label">Keys & Tokens</span>
+                            <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Keys & Tokens</span>
                         </a>
                     </li>
                     <li>
@@ -239,7 +266,7 @@ class="{{ request()->is('tags*') ? 'menu-item-active menu-item' : 'menu-item' }}
                                     <path d="m18 19l1.592-1.592a4.82 4.82 0 0 0 0-6.816L15 6m-8 4h-.01" />
                                 </g>
                             </svg>
-                            <span class="menu-item-label">Tags</span>
+                            <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Tags</span>
                         </a>
                     </li>
                     @can('canAccessTerminal')
@@ -254,7 +281,7 @@ class="{{ request()->is('terminal*') ? 'menu-item-active menu-item' : 'menu-item
                                     <path d="M5 7l5 5l-5 5" />
                                     <path d="M12 19l7 0" />
                                 </svg>
-                                <span class="menu-item-label">Terminal</span>
+                                <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Terminal</span>
                             </a>
                         </li>
                     @endcan
@@ -270,7 +297,7 @@ class="{{ request()->is('profile*') ? 'menu-item-active menu-item' : 'menu-item'
                                 <path d="M12 10m-3 0a3 3 0 1 0 6 0a3 3 0 1 0 -6 0" />
                                 <path d="M6.168 18.849a4 4 0 0 1 3.832 -2.849h4a4 4 0 0 1 3.834 2.855" />
                             </svg>
-                            <span class="menu-item-label">Profile</span>
+                            <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Profile</span>
                         </a>
                     </li>
                     <li>
@@ -288,7 +315,7 @@ class="{{ request()->is('team*') ? 'menu-item-active menu-item' : 'menu-item' }}
                                 <path d="M5 5a2 2 0 1 0 4 0a2 2 0 0 0 -4 0" />
                                 <path d="M3 13v-1a2 2 0 0 1 2 -2h2" />
                             </svg>
-                            <span class="menu-item-label">Teams</span>
+                            <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Teams</span>
                         </a>
                     </li>
                     @if (isCloud() && auth()->user()->isAdmin())
@@ -301,7 +328,7 @@ class="{{ request()->is('subscription*') ? 'menu-item-active menu-item' : 'menu-
                                         stroke-linejoin="round" stroke-width="2"
                                         d="M3 8a3 3 0 0 1 3-3h12a3 3 0 0 1 3 3v8a3 3 0 0 1-3 3H6a3 3 0 0 1-3-3zm0 2h18M7 15h.01M11 15h2" />
                                 </svg>
-                                <span class="menu-item-label">Subscription</span>
+                                <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Subscription</span>
                             </a>
                         </li>
                     @endif
@@ -319,7 +346,7 @@ class="{{ request()->is('settings*') ? 'menu-item-active menu-item' : 'menu-item
                                         d="M10.325 4.317c.426 -1.756 2.924 -1.756 3.35 0a1.724 1.724 0 0 0 2.573 1.066c1.543 -.94 3.31 .826 2.37 2.37a1.724 1.724 0 0 0 1.065 2.572c1.756 .426 1.756 2.924 0 3.35a1.724 1.724 0 0 0 -1.066 2.573c.94 1.543 -.826 3.31 -2.37 2.37a1.724 1.724 0 0 0 -2.572 1.065c-.426 1.756 -2.924 1.756 -3.35 0a1.724 1.724 0 0 0 -2.573 -1.066c-1.543 .94 -3.31 -.826 -2.37 -2.37a1.724 1.724 0 0 0 -1.065 -2.572c-1.756 -.426 -1.756 -2.924 0 -3.35a1.724 1.724 0 0 0 1.066 -2.573c-.94 -1.543 .826 -3.31 2.37 -2.37c1 .608 2.296 .07 2.572 -1.065z" />
                                     <path d="M9 12a3 3 0 1 0 6 0a3 3 0 0 0 -6 0" />
                                 </svg>
-                                <span class="menu-item-label">Settings</span>
+                                <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Settings</span>
                             </a>
                         </li>
                     @endif
@@ -333,7 +360,7 @@ class="{{ request()->is('settings*') ? 'menu-item-active menu-item' : 'menu-item
                                         <path fill="currentColor"
                                             d="M177.62 159.6a52 52 0 0 1-34 34a12.2 12.2 0 0 1-3.6.55a12 12 0 0 1-3.6-23.45a28 28 0 0 0 18.32-18.32a12 12 0 0 1 22.9 7.2ZM220 144a92 92 0 0 1-184 0c0-28.81 11.27-58.18 33.48-87.28a12 12 0 0 1 17.9-1.33l19.69 19.11L127 19.89a12 12 0 0 1 18.94-5.12C168.2 33.25 220 82.85 220 144m-24 0c0-41.71-30.61-78.39-52.52-99.29l-20.21 55.4a12 12 0 0 1-19.63 4.5L80.71 82.36C67 103.38 60 124.06 60 144a68 68 0 0 0 136 0" />
                                     </svg>
-                                    <span class="menu-item-label">Admin</span>
+                                    <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Admin</span>
                                 </a>
                             </li>
                         @endif
@@ -341,7 +368,7 @@ class="{{ request()->is('settings*') ? 'menu-item-active menu-item' : 'menu-item
                     <div class="flex-1"></div>
                     @if (isInstanceAdmin() && !isCloud())
                         @persist('upgrade')
-                            <li>
+                            <li :class="collapsed && 'lg:hidden'">
                                 <livewire:upgrade />
                             </li>
                         @endpersist
@@ -368,7 +395,7 @@ class="{{ request()->is('onboarding*') ? 'menu-item-active menu-item' : 'menu-it
                                         d="M12 6L8.707 9.293a1 1 0 0 0 0 1.414l.543.543c.69.69 1.81.69 2.5 0l1-1a3.182 3.182 0 0 1 4.5 0l2.25 2.25m-7 3l2 2M15 13l2 2" />
                                 </g>
                             </svg>
-                            <span class="menu-item-label">Sponsor us</span>
+                            <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Sponsor us</span>
                         </a>
                     </li>
                 @endif
@@ -384,7 +411,7 @@ class="{{ request()->is('onboarding*') ? 'menu-item-active menu-item' : 'menu-it
                                     <path fill="currentColor"
                                         d="M140 180a12 12 0 1 1-12-12a12 12 0 0 1 12 12M128 72c-22.06 0-40 16.15-40 36v4a8 8 0 0 0 16 0v-4c0-11 10.77-20 24-20s24 9 24 20s-10.77 20-24 20a8 8 0 0 0-8 8v8a8 8 0 0 0 16 0v-.72c18.24-3.35 32-17.9 32-35.28c0-19.85-17.94-36-40-36m104 56A104 104 0 1 1 128 24a104.11 104.11 0 0 1 104 104m-16 0a88 88 0 1 0-88 88a88.1 88.1 0 0 0 88-88" />
                                 </svg>
-                                <span class="menu-item-label">Feedback</span>
+                                <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Feedback</span>
                             </div>
                         </x-slot:content>
                         <livewire:help />
@@ -394,15 +421,21 @@ class="{{ request()->is('onboarding*') ? 'menu-item-active menu-item' : 'menu-it
                     <form action="/logout" method="POST">
                         @csrf
                         <button title="Logout" type="submit" class="gap-2 mb-6 menu-item">
-                            <svg class="menu-item-icon mr-1" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
+                            <svg class="menu-item-icon" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
                                 <path fill="currentColor"
                                     d="M12 22C6.477 22 2 17.523 2 12S6.477 2 12 2a9.985 9.985 0 0 1 8 4h-2.71a8 8 0 1 0 .001 12h2.71A9.985 9.985 0 0 1 12 22m7-6v-3h-8v-2h8V8l5 4z" />
                             </svg>
-                            <span>Logout</span>
+                            <span :class="collapsed && 'lg:hidden'">Logout</span>
                         </button>
                     </form>
                 </li>
             </ul>
         </li>
     </ul>
+    <div x-show="collapsed && tooltip.show"
+        x-cloak
+        x-transition.opacity.duration.100ms
+        :style="`left: ${tooltip.x}px; top: ${tooltip.y}px;`"
+        class="fixed z-[100] -translate-y-1/2 px-2 py-1 text-xs font-medium rounded-md bg-neutral-900 dark:bg-coolgray-300 text-white whitespace-nowrap pointer-events-none shadow-lg border border-neutral-700 dark:border-coolgray-200"
+        x-text="tooltip.text"></div>
 </nav>
diff --git a/resources/views/layouts/app.blade.php b/resources/views/layouts/app.blade.php
index 93d6fe413..04cda7d63 100644
--- a/resources/views/layouts/app.blade.php
+++ b/resources/views/layouts/app.blade.php
@@ -10,12 +10,19 @@
         <livewire:deployments-indicator />
         <div x-data="{
             open: false,
+            collapsed: false,
+            pageWidth: 'full',
             init() {
                 this.pageWidth = localStorage.getItem('pageWidth');
                 if (!this.pageWidth) {
                     this.pageWidth = 'full';
                     localStorage.setItem('pageWidth', 'full');
                 }
+                this.collapsed = localStorage.getItem('sidebarCollapsed') === 'true';
+            },
+            toggleSidebar() {
+                this.collapsed = !this.collapsed;
+                localStorage.setItem('sidebarCollapsed', this.collapsed);
             }
         }" x-cloak class="mx-auto dark:text-inherit text-black"
             :class="pageWidth === 'full' ? '' : 'max-w-7xl'">
@@ -40,10 +47,20 @@
                 </div>
             </div>
 
-            <div class="hidden lg:fixed lg:inset-y-0 lg:z-50 lg:flex lg:w-56 lg:flex-col min-w-0">
+            <div class="hidden lg:fixed lg:inset-y-0 lg:z-50 lg:flex lg:flex-col min-w-0 transition-[width] duration-200"
+                :class="collapsed ? 'lg:w-16' : 'lg:w-56'">
                 <div class="flex flex-col overflow-y-auto grow gap-y-5 scrollbar min-w-0">
                     <x-navbar />
                 </div>
+                <button type="button" @click="toggleSidebar()"
+                    :title="collapsed ? 'Expand sidebar' : 'Collapse sidebar'"
+                    class="absolute top-8 -right-3 z-50 hidden lg:flex items-center justify-center w-6 h-6 rounded-full border bg-white dark:bg-coolgray-100 dark:border-coolgray-200 border-neutral-300 hover:bg-neutral-100 dark:hover:bg-coolgray-200 transition-colors shadow-sm">
+                    <svg xmlns="http://www.w3.org/2000/svg" class="w-3.5 h-3.5 text-neutral-600 dark:text-neutral-300 transition-transform"
+                        :class="collapsed ? '' : 'rotate-180'"
+                        fill="none" viewBox="0 0 24 24" stroke-width="2.5" stroke="currentColor">
+                        <path stroke-linecap="round" stroke-linejoin="round" d="M9 5l7 7-7 7" />
+                    </svg>
+                </button>
             </div>
 
             <div
@@ -62,7 +79,7 @@ class="text-xl font-bold tracking-wide dark:text-white hover:opacity-80 transiti
                 </button>
             </div>
 
-            <main class="lg:pl-56">
+            <main class="transition-[padding] duration-200" :class="collapsed ? 'lg:pl-16' : 'lg:pl-56'">
                 <div class="p-4 sm:px-6 lg:px-8 lg:py-6">
                     {{ $slot }}
                 </div>
diff --git a/resources/views/livewire/switch-team.blade.php b/resources/views/livewire/switch-team.blade.php
index b46c1ecf6..6a0705efc 100644
--- a/resources/views/livewire/switch-team.blade.php
+++ b/resources/views/livewire/switch-team.blade.php
@@ -1,6 +1,49 @@
-<x-forms.select wire:model.live="selectedTeamId">
-    <option value="default" disabled selected>Switch team</option>
-    @foreach (auth()->user()->teams as $team)
-        <option value="{{ $team->id }}">{{ $team->name }}</option>
-    @endforeach
-</x-forms.select>
+@php
+    $currentTeam = auth()->user()->currentTeam();
+    $teamInitial = strtoupper(mb_substr($currentTeam->name, 0, 1));
+@endphp
+<div>
+    <div :class="collapsed && 'lg:hidden'">
+        <x-forms.select wire:model.live="selectedTeamId">
+            <option value="default" disabled selected>Switch team</option>
+            @foreach (auth()->user()->teams as $team)
+                <option value="{{ $team->id }}">{{ $team->name }}</option>
+            @endforeach
+        </x-forms.select>
+    </div>
+    <div class="hidden"
+        :class="collapsed && 'lg:block'"
+        x-data="{
+            teamOpen: false,
+            teamX: 0,
+            teamY: 0,
+            openTeamMenu(ev) {
+                const rect = ev.currentTarget.getBoundingClientRect();
+                this.teamX = rect.right + 8;
+                this.teamY = rect.top;
+                this.teamOpen = !this.teamOpen;
+            }
+        }">
+        <button @click="openTeamMenu($event)" type="button"
+            title="Team: {{ $currentTeam->name }}"
+            class="flex items-center justify-center w-8 h-8 text-sm font-semibold rounded-md bg-coollabs hover:opacity-80 transition-opacity text-white cursor-pointer">
+            {{ $teamInitial }}
+        </button>
+        <div x-show="teamOpen"
+            @click.outside="teamOpen = false"
+            x-transition.opacity.duration.100ms
+            x-cloak
+            :style="`left: ${teamX}px; top: ${teamY}px;`"
+            class="fixed z-[100] min-w-48 max-h-72 overflow-y-auto bg-white dark:bg-coolgray-100 border border-neutral-300 dark:border-coolgray-200 rounded-md shadow-lg py-1">
+            <div class="px-3 py-1.5 text-xs font-semibold text-neutral-500 dark:text-neutral-400 border-b border-neutral-200 dark:border-coolgray-200">Switch team</div>
+            @foreach (auth()->user()->teams as $team)
+                <button type="button"
+                    wire:click="switch_to({{ $team->id }})"
+                    @click="teamOpen = false"
+                    class="w-full px-3 py-1.5 text-left text-sm hover:bg-neutral-100 dark:hover:bg-coolgray-200 dark:text-white {{ $team->id === $currentTeam->id ? 'font-semibold text-coollabs dark:text-warning' : '' }}">
+                    {{ $team->name }}
+                </button>
+            @endforeach
+        </div>
+    </div>
+</div>

From b623c9e5bebf0de1f1b7cdd48ed30f63c12109a2 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Wed, 6 May 2026 15:01:12 +0200
Subject: [PATCH 10/14] fix(ui): move top padding to collapsed/expanded states
 in navbar

Padding `lg:pt-6` moved from static class to expanded-state Alpine binding,
and `lg:pt-8` added for collapsed state, so top spacing responds correctly
to sidebar collapse toggle.
---
 resources/views/components/navbar.blade.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/resources/views/components/navbar.blade.php b/resources/views/components/navbar.blade.php
index 74b32564c..9e0e34b07 100644
--- a/resources/views/components/navbar.blade.php
+++ b/resources/views/components/navbar.blade.php
@@ -92,8 +92,8 @@
                 }
             }
     }">
-    <div class="flex lg:pt-6 pt-4 pb-4 pl-2 items-start gap-2"
-        :class="collapsed ? 'lg:flex-col lg:items-center lg:pl-0 lg:gap-3' : ''">
+    <div class="flex pt-4 pb-4 pl-2 items-start gap-2"
+        :class="collapsed ? 'lg:flex-col lg:items-center lg:pl-0 lg:gap-3 lg:pt-8' : 'lg:pt-6'">
         <div class="flex flex-col w-full" :class="collapsed && 'lg:hidden'">
             <a href="/" {{ wireNavigate() }} class="text-2xl font-bold tracking-tight dark:text-white hover:opacity-80 transition-opacity">Coolify</a>
             <x-version />

From 635b9732b6193469f873c3e7ba296c13a073f7c2 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Thu, 7 May 2026 12:22:59 +0200
Subject: [PATCH 11/14] chore: remove DESIGN.md design specification file

---
 DESIGN.md | 752 ------------------------------------------------------
 1 file changed, 752 deletions(-)
 delete mode 100644 DESIGN.md

diff --git a/DESIGN.md b/DESIGN.md
deleted file mode 100644
index 9520fdf23..000000000
--- a/DESIGN.md
+++ /dev/null
@@ -1,752 +0,0 @@
----
-version: alpha
-name: Coolify
-description: Self-hosted PaaS. Dark-first utilitarian UI. Purple (light) / yellow (dark) accent swap. Sharp 2px radii. Inset box-shadow inputs with 4px dirty-bar indicator.
-colors:
-  # Brand
-  coollabs: "#6b16ed"
-  coollabs-50: "#f5f0ff"
-  coollabs-100: "#7317ff"
-  coollabs-200: "#5a12c7"
-  coollabs-300: "#4a0fa3"
-  # Dark-mode accent (warning scale)
-  warning: "#fcd452"
-  warning-50: "#fefce8"
-  warning-100: "#fef9c3"
-  warning-200: "#fef08a"
-  warning-300: "#fde047"
-  warning-400: "#fcd452"
-  warning-500: "#facc15"
-  warning-600: "#ca8a04"
-  warning-700: "#a16207"
-  warning-800: "#854d0e"
-  warning-900: "#713f12"
-  # Dark surfaces
-  base: "#101010"
-  coolgray-100: "#181818"
-  coolgray-200: "#202020"
-  coolgray-300: "#242424"
-  coolgray-400: "#282828"
-  coolgray-500: "#323232"
-  # Light surfaces (Tailwind neutrals)
-  surface: "#ffffff"
-  background: "#f9fafb"
-  border: "#e5e5e5"
-  text: "#000000"
-  text-muted: "#737373"
-  text-placeholder: "#d4d4d4"
-  # Semantic
-  success: "#22C55E"
-  error: "#dc2626"
-  primary: "{colors.coollabs}"
-typography:
-  h1:
-    fontFamily: "'Geist Sans', Inter, sans-serif"
-    fontSize: 1.875rem
-    fontWeight: 700
-    lineHeight: 1.2
-  h2:
-    fontFamily: "'Geist Sans', Inter, sans-serif"
-    fontSize: 1.25rem
-    fontWeight: 700
-  h3:
-    fontFamily: "'Geist Sans', Inter, sans-serif"
-    fontSize: 1.125rem
-    fontWeight: 700
-  h4:
-    fontFamily: "'Geist Sans', Inter, sans-serif"
-    fontSize: 1rem
-    fontWeight: 700
-  body-md:
-    fontFamily: "'Geist Sans', Inter, sans-serif"
-    fontSize: 0.875rem
-    fontWeight: 400
-    lineHeight: 1.25rem
-  label-md:
-    fontFamily: "'Geist Sans', Inter, sans-serif"
-    fontSize: 0.875rem
-    fontWeight: 500
-  label-sm:
-    fontFamily: "'Geist Sans', Inter, sans-serif"
-    fontSize: 0.75rem
-    fontWeight: 700
-    lineHeight: 1rem
-  mono:
-    fontFamily: "'Geist Mono', SFMono-Regular, Consolas, 'Liberation Mono', Menlo, monospace"
-    fontSize: 0.875rem
-    fontWeight: 400
-rounded:
-  sm: 0.125rem   # default — inputs, buttons, cards, modals
-  md: 0.25rem    # coolbox
-  lg: 0.5rem     # callouts
-  full: 9999px   # badges, pills
-spacing:
-  xs: 0.25rem
-  sm: 0.5rem
-  md: 1rem
-  lg: 1.5rem
-  xl: 2rem
-  section: 3rem
-  sidebar-width: 14rem
-  button-height: 2rem
-  card-min-height: 4rem
-  input-py: 0.375rem
-components:
-  button:
-    backgroundColor: "{colors.surface}"
-    textColor: "{colors.text}"
-    rounded: "{rounded.sm}"
-    height: "{spacing.button-height}"
-    padding: 0 0.5rem
-  button-dark:
-    backgroundColor: "{colors.coolgray-100}"
-    textColor: "#ffffff"
-  button-hover:
-    backgroundColor: "#f5f5f5"
-  button-hover-dark:
-    backgroundColor: "{colors.coolgray-200}"
-  button-highlighted:
-    backgroundColor: "{colors.coollabs-50}"
-    textColor: "{colors.coollabs-200}"
-  button-highlighted-hover:
-    backgroundColor: "{colors.coollabs}"
-    textColor: "#ffffff"
-  button-error:
-    backgroundColor: "#fef2f2"
-    textColor: "#991b1b"
-  button-error-hover:
-    backgroundColor: "#fca5a5"
-    textColor: "#ffffff"
-  input:
-    backgroundColor: "{colors.surface}"
-    textColor: "{colors.text}"
-    rounded: "{rounded.sm}"
-    padding: 0.375rem 0.5rem
-  input-dark:
-    backgroundColor: "{colors.coolgray-100}"
-    textColor: "#ffffff"
-  textarea:
-    typography: "{typography.mono}"
-    backgroundColor: "{colors.surface}"
-    rounded: "{rounded.sm}"
-  box:
-    backgroundColor: "{colors.surface}"
-    textColor: "{colors.text}"
-    rounded: "{rounded.sm}"
-    padding: "{spacing.sm}"
-    height: "{spacing.card-min-height}"
-  box-dark:
-    backgroundColor: "{colors.coolgray-100}"
-    textColor: "#ffffff"
-  box-hover:
-    backgroundColor: "#f5f5f5"
-  box-hover-dark:
-    backgroundColor: "{colors.coollabs-100}"
-    textColor: "#ffffff"
-  coolbox:
-    backgroundColor: "{colors.surface}"
-    rounded: "{rounded.md}"
-    padding: "{spacing.sm}"
-    height: "{spacing.card-min-height}"
-  badge-success:
-    backgroundColor: "{colors.success}"
-    size: 0.75rem
-    rounded: "{rounded.full}"
-  badge-warning:
-    backgroundColor: "{colors.warning}"
-    size: 0.75rem
-    rounded: "{rounded.full}"
-  badge-error:
-    backgroundColor: "{colors.error}"
-    size: 0.75rem
-    rounded: "{rounded.full}"
-  deprecated-badge:
-    backgroundColor: "rgba(252, 212, 82, 0.15)"
-    textColor: "{colors.warning}"
-    rounded: "{rounded.full}"
-    padding: 0.125rem 0.5rem
-  callout-warning:
-    backgroundColor: "{colors.warning-50}"
-    textColor: "{colors.warning-800}"
-    rounded: "{rounded.lg}"
-    padding: "{spacing.md}"
-  callout-danger:
-    backgroundColor: "#fef2f2"
-    textColor: "#991b1b"
-    rounded: "{rounded.lg}"
-    padding: "{spacing.md}"
-  callout-info:
-    backgroundColor: "#eff6ff"
-    textColor: "#1e40af"
-    rounded: "{rounded.lg}"
-    padding: "{spacing.md}"
-  callout-success:
-    backgroundColor: "#f0fdf4"
-    textColor: "#166534"
-    rounded: "{rounded.lg}"
-    padding: "{spacing.md}"
-  dropdown:
-    backgroundColor: "{colors.surface}"
-    rounded: "{rounded.sm}"
-    padding: "{spacing.xs}"
-  dropdown-dark:
-    backgroundColor: "{colors.coolgray-200}"
-  dropdown-item-hover:
-    backgroundColor: "#f5f5f5"
-  dropdown-item-hover-dark:
-    backgroundColor: "{colors.coollabs}"
-    textColor: "#ffffff"
-  menu-item-active:
-    backgroundColor: "#e5e5e5"
-    textColor: "{colors.text}"
-    rounded: "{rounded.sm}"
-  menu-item-active-dark:
-    backgroundColor: "{colors.coolgray-200}"
-    textColor: "{colors.warning}"
-  tag:
-    backgroundColor: "#f5f5f5"
-    textColor: "{colors.text-muted}"
-    padding: 0.25rem 0.5rem
-  kbd:
-    rounded: "{rounded.sm}"
-    padding: 0 0.5rem
-  toast:
-    backgroundColor: "{colors.surface}"
-    rounded: "{rounded.sm}"
-    padding: "{spacing.md}"
-    width: 20rem
-  modal-input:
-    backgroundColor: "{colors.surface}"
-    rounded: "{rounded.sm}"
-  modal-input-dark:
-    backgroundColor: "{colors.base}"
-  modal-confirmation:
-    backgroundColor: "#f5f5f5"
-    rounded: "{rounded.sm}"
-  modal-confirmation-dark:
-    backgroundColor: "{colors.base}"
----
-
-# Coolify Design System
-
-## Overview
-
-Coolify is a self-hosted PaaS (Heroku/Netlify/Vercel alternative) built with Laravel 12, Livewire 3, and Tailwind CSS v4. UI is **dark-first, dense, utilitarian** — operators want information density over whitespace.
-
-Brand personality: precise, engineered, no-nonsense. No flourish. No gradients outside a single branded upsell. Flat surfaces differentiated by tonal depth, not shadow.
-
-Two signature traits define the system:
-
-1. **Purple/Yellow accent swap.** Light mode uses `coollabs` purple `#6b16ed`. Dark mode swaps to `warning` yellow `#fcd452` for focus rings, active nav items, helper icons, loading spinners, highlighted text, helper links. Never use purple as an accent in dark mode.
-2. **Inset box-shadow inputs with a 4px "dirty bar".** Inputs and selects have no border — they use `box-shadow: inset 4px 0 0 transparent, inset 0 0 0 2px <border>`. When the field is focused or has unsaved changes (`wire:dirty`), the left 4px becomes the accent color — a live visual indicator of modified state. This is the single most distinctive UI detail in Coolify.
-
-Sharp geometry everywhere: 2px corner radius by default (`rounded-sm`). 8px only on callouts. Shadows used sparingly — one `shadow-sm` on boxes, one drop-shadow on toasts. The rest is flat tonal layers.
-
-## Colors
-
-Source of truth: `resources/css/app.css` `@theme` block (Tailwind v4).
-
-### Palettes
-
-- **Primary / Coollabs (`#6b16ed`)** — brand purple. Light-mode accent. Used for focus rings, active states, highlighted buttons, spinners, scrollbar thumb. Scale: `coollabs-50 #f5f0ff` (backgrounds), `coollabs #6b16ed` (base), `coollabs-100 #7317ff` (dark-mode button hover), `coollabs-200 #5a12c7` (light-mode text), `coollabs-300 #4a0fa3` (deepest).
-- **Warning (`#fcd452`)** — dark-mode accent + callout palette. Full yellow scale `warning-50` through `warning-900`. Swaps in for coollabs under `.dark`.
-- **Coolgray (dark surface ladder)** — five shades building dark-mode depth: `base #101010` (page) → `coolgray-100 #181818` (components) → `-200 #202020` (elevated / active nav) → `-300 #242424` (input borders, button borders) → `-400 #282828` (tooltips) → `-500 #323232` (subtle overlays).
-- **Semantic** — `success #22C55E` for running/healthy, `error #dc2626` for stopped/danger.
-- **Light surfaces** — `gray-50 #f9fafb` (page), `white` (components), `neutral-200 #e5e5e5` (borders), `neutral-500 #737373` (muted text), `neutral-300 #d4d4d4` (placeholders).
-
-### Dark-mode heading rule (critical)
-
-Body default text in dark mode is `neutral-400 #a3a3a3`. Headings and card titles MUST explicitly force `text-white` — otherwise they render near-invisible on `coolgray-100 #181818`. This is enforced globally: `h1–h4` all have `dark:text-white` in `app.css`.
-
-### Default border override
-
-Tailwind v4 defaults `border-color` to `currentcolor`. Coolify overrides it in `@layer base`:
-
-```css
-*, ::after, ::before, ::backdrop, ::file-selector-button {
-  border-color: var(--color-coolgray-200, currentcolor);
-}
-```
-
-So any `border` utility without an explicit color gets `coolgray-200 #202020` in dark mode.
-
-## Typography
-
-Fonts loaded in `resources/css/fonts.css` (all `woff2`, `font-display: swap`):
-
-- **Geist Sans** — primary UI font. Variable weight `100 900`. Inter as fallback (static weights 100–900).
-- **Geist Mono** — monospace for code, logs, textareas. Variable weight `100 900`.
-
-Applied via `@theme`:
-
-```css
---font-sans: 'Geist Sans', Inter, sans-serif;
---font-mono: 'Geist Mono', 'SFMono-Regular', Consolas, 'Liberation Mono', Menlo, monospace;
---font-logs: 'Geist Mono', 'SFMono-Regular', Consolas, 'Liberation Mono', Menlo, monospace;
-```
-
-### Heading hierarchy (Tailwind utilities)
-
-| Element | Utility |
-|---|---|
-| `h1` | `text-3xl font-bold dark:text-white` |
-| `h2` | `text-xl font-bold dark:text-white` |
-| `h3` | `text-lg font-bold dark:text-white` |
-| `h4` | `text-base font-bold dark:text-white` |
-
-### Body
-
-| Context | Utility |
-|---|---|
-| Body default | `text-sm font-sans antialiased` |
-| Label | `text-sm font-medium` |
-| Badge / status text | `text-xs font-bold` |
-| Box description | `text-xs font-bold text-neutral-500` |
-| Caption / kbd | `text-xs` |
-
-## Layout
-
-Fixed left sidebar layout on desktop. Mobile collapses to a sticky top bar with hamburger menu overlay.
-
-### Structure
-
-- **Sidebar** — fixed, `w-56` (14rem / 224px), `hidden lg:flex`. Inner `flex flex-col overflow-y-auto gap-y-5 scrollbar`. Nav `bg-white dark:bg-base border-r`.
-- **Main content** — `lg:pl-56` offset. Inner padding `p-4 sm:px-6 lg:px-8 lg:py-6`.
-- **Mobile top bar** — `sticky top-0 z-40 lg:hidden` with `bg-white/95 dark:bg-base/95 backdrop-blur-sm`.
-
-### Spacing scale
-
-| Token | Value | Use |
-|---|---|---|
-| `p-2` | 0.5rem | Component internal padding |
-| `p-4` | 1rem | Callout padding |
-| `py-1.5` | 0.375rem | Input vertical padding |
-| `h-8` | 2rem | Button height |
-| `px-2` | 0.5rem | Button horizontal padding |
-| `gap-2` | 0.5rem | Button gap |
-| `px-2 py-1` | 0.25rem / 0.5rem | Menu item padding |
-| `gap-3` | 0.75rem | Menu item gap |
-| `mb-12` | 3rem | Section margin |
-| `min-h-[4rem]` | 4rem | Card min-height |
-
-No grid system — flex layouts everywhere.
-
-## Elevation & Depth
-
-**Flat + tonal.** Hierarchy comes from background color, not shadows.
-
-### Dark tonal ladder
-
-```
-#101010 (base)          page background
-  #181818 (coolgray-100) cards, inputs, components
-    #202020 (coolgray-200) elevated surfaces, borders, nav active
-      #242424 (coolgray-300) input borders, button borders
-        #282828 (coolgray-400) tooltips, hover states
-          #323232 (coolgray-500) subtle overlays
-```
-
-### Light tonal ladder
-
-```
-#f9fafb (gray-50)       page background
-  #ffffff (white)        cards, inputs, components
-    #e5e5e5 (neutral-200) borders
-      #f5f5f5 (neutral-100) hover backgrounds
-        #d4d4d4 (neutral-300) deeper hover, nav active
-```
-
-### Shadows (used sparingly)
-
-- Boxes: `shadow-sm` (`0 1px 2px 0 rgba(0,0,0,0.05)`)
-- Toasts: `shadow-[0_5px_15px_-3px_rgb(0_0_0_/_0.08)]`
-- Slide-over: `shadow-lg`
-- Modal-input: `drop-shadow-sm`
-
-### Input inset box-shadow system (distinctive)
-
-Inputs and selects use `box-shadow` instead of `border` — this enables the 4px left dirty-bar indicator:
-
-```css
-/* default */  box-shadow: inset 4px 0 0 transparent, inset 0 0 0 2px #e5e5e5;
-/* default dark */  inset 4px 0 0 transparent, inset 0 0 0 2px #242424;
-/* focus light */  inset 4px 0 0 #6b16ed, inset 0 0 0 2px #e5e5e5;
-/* focus dark */  inset 4px 0 0 #fcd452, inset 0 0 0 2px #242424;
-/* dirty (same as focus) — set via wire:dirty.class */
-/* disabled / readonly */  box-shadow: none;
-```
-
-Variant `input-sticky` uses `1px` outer shadow instead of `2px`.
-
-### Focus ring (buttons, links, checkboxes, non-input)
-
-`focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-coollabs dark:focus-visible:ring-warning focus-visible:ring-offset-2 dark:focus-visible:ring-offset-base`
-
-## Shapes
-
-- **Default** — `rounded-sm` (2px). Everything: inputs, buttons, cards, modals, toasts, dropdowns.
-- **Coolbox** — `rounded` (4px). Alternate card style with ring-hover.
-- **Callouts** — `rounded-lg` (8px). Only exception to the sharp rule.
-- **Badges / deprecated badge / pills / avatars** — `rounded-full`.
-
-Never mix radii within the same view.
-
-## Components
-
-All component classes live in `resources/css/utilities.css` as `@utility` blocks, consumed by Blade components under `resources/views/components/`.
-
-### Forms
-
-#### Button
-
-Utility `.button` (`resources/css/utilities.css`):
-
-```
-flex gap-2 justify-center items-center px-2 h-8 text-sm text-black normal-case rounded-sm border-2 outline-0 cursor-pointer font-medium bg-white border-neutral-200 hover:bg-neutral-100 dark:bg-coolgray-100 dark:text-white dark:hover:text-white dark:hover:bg-coolgray-200 dark:border-coolgray-300 hover:text-black disabled:cursor-not-allowed min-w-fit dark:disabled:text-neutral-600 disabled:border-transparent disabled:hover:bg-transparent disabled:bg-transparent disabled:text-neutral-300 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-coollabs dark:focus-visible:ring-warning focus-visible:ring-offset-2 dark:focus-visible:ring-offset-base
-```
-
-Attribute variants (in `app.css`):
-
-- `button[isHighlighted]` → `text-coollabs-200 dark:text-white bg-coollabs-50 dark:bg-coollabs/20 border-coollabs dark:border-coollabs-100 hover:bg-coollabs hover:text-white dark:hover:bg-coollabs-100 dark:hover:text-white`
-- `button[isError]` → `text-red-800 dark:text-red-300 bg-red-50 dark:bg-red-900/30 border-red-300 dark:border-red-800 hover:bg-red-300 hover:text-white dark:hover:bg-red-800 dark:hover:text-white`
-
-Loading: `<x-loading-on-button>` — inline `w-4 h-4 dark:text-warning animate-spin` SVG.
-
-#### Input
-
-Utility chain `.input-select` → `.input`:
-
-```
-block py-1.5 w-full text-sm text-black rounded-sm border-0 dark:bg-coolgray-100 dark:text-white disabled:bg-neutral-200 disabled:text-neutral-500 dark:disabled:bg-coolgray-100/40 placeholder:text-neutral-300 dark:placeholder:text-neutral-700 read-only:text-neutral-500 read-only:bg-neutral-200 dark:read-only:text-neutral-500 dark:read-only:bg-coolgray-100/40 focus-visible:outline-none
-```
-
-Plus the inset box-shadow system (see Elevation). Password variant: `.input[type="password"]` gets `pr-[2.4rem]` for the eye icon.
-
-**Dirty indicator.** Livewire sets the focus-colored shadow via `wire:dirty.class`:
-
-```blade
-wire:dirty.class="[box-shadow:inset_4px_0_0_#6b16ed,inset_0_0_0_2px_#e5e5e5] dark:[box-shadow:inset_4px_0_0_#fcd452,inset_0_0_0_2px_#242424]"
-```
-
-Variant `.input-sticky` — same shape, `1px` outer shadow (thinner border).
-
-#### Select
-
-Extends `.input-select` + custom SVG dropdown arrow:
-
-```css
-background-image: url("data:image/svg+xml,...stroke='%23000000'...");
-padding-right: 2.5rem;
-```
-
-Dark mode swaps the SVG stroke to `%23ffffff`.
-
-#### Checkbox
-
-Input class:
-```
-dark:border-neutral-700 text-coolgray-400 dark:bg-coolgray-100 rounded-sm cursor-pointer dark:disabled:bg-base dark:disabled:cursor-not-allowed focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-coollabs dark:focus-visible:ring-warning focus-visible:ring-offset-2 dark:focus-visible:ring-offset-base
-```
-
-Container:
-```
-form-control flex max-w-full flex-row items-center gap-4 py-1 pr-2 dark:hover:bg-coolgray-100 cursor-pointer
-```
-
-#### Textarea
-
-Uses the same `input` utility + `font-mono` + dirty-bar via `wire:dirty.class` (identical to input). Optional `@keydown.tab=handleKeydown` inserts 2 spaces on Tab.
-
-#### Copy-Button
-
-`resources/views/components/forms/copy-button.blade.php` — readonly `.input` with an absolute-positioned copy icon right-side. Copied state shows a green check (`text-green-500`) for 1 second. Only renders in secure contexts (`window.isSecureContext`).
-
-### Containers
-
-#### Box
-
-Utility `.box`:
-```
-relative flex lg:flex-row flex-col p-2 transition-colors cursor-pointer min-h-[4rem] dark:bg-coolgray-100 shadow-sm bg-white border text-black dark:text-white hover:text-black border-neutral-200 dark:border-coolgray-300 hover:bg-neutral-100 dark:hover:bg-coollabs-100 dark:hover:text-white hover:no-underline rounded-sm
-```
-
-**Critical child text rule.** On dark hover, background becomes purple `#7317ff` — description text `#737373` disappears. Utilities `.box-title` and `.box-description` include `dark:group-hover:text-white group-hover:text-black` to flip text contrast.
-
-Variants: `.box-boarding`, `.box-without-bg`, `.box-without-bg-without-border`.
-
-#### Coolbox
-
-Utility `.coolbox`:
-```
-relative flex transition-all duration-150 dark:bg-coolgray-100 bg-white p-2 rounded border border-neutral-200 dark:border-coolgray-400 hover:ring-2 dark:hover:ring-warning hover:ring-coollabs cursor-pointer min-h-[4rem]
-```
-
-Distinguished by `rounded` (4px, not 2px) and **ring-hover** instead of background change.
-
-### Status & Badges
-
-#### Badge base
-
-```
-inline-block w-3 h-3 text-xs font-bold rounded-full leading-none border border-neutral-200 dark:border-black
-```
-
-Fill utilities: `.badge-success` (`bg-success`), `.badge-warning` (`bg-warning`), `.badge-error` (`bg-error`). Dashboard variant `.badge-dashboard` is `absolute top-1 right-1 w-2.5 h-2.5`.
-
-#### Status indicator pattern
-
-Badge + label side-by-side. Components in `resources/views/components/status/`:
-
-| Component | Badge | Text color | Loading? |
-|---|---|---|---|
-| `status/running` | `badge-success` | `text-success` (`#22C55E`) | Swaps to `badge-warning` while checking proxy |
-| `status/degraded` | `badge-warning` | `dark:text-warning` (`#fcd452`) | `<x-loading>` + `wire:loading.delay.longer` |
-| `status/restarting` | `badge-warning` | `dark:text-warning` | `<x-loading>` |
-| `status/stopped` | `badge-error` | `text-error` (`#dc2626`) | `<x-loading>` |
-
-Layout: `<div class="flex items-center">` → badge → `<div class="pl-2 pr-1 text-xs font-bold {color}">{label}</div>` → optional `({health})` in same color.
-
-#### Deprecated Badge
-
-`resources/views/components/deprecated-badge.blade.php`:
-```
-px-2 py-0.5 text-xs font-medium leading-normal rounded-full bg-warning/15 text-warning border border-warning/30
-```
-
-#### Tag
-
-Utility `.tag`:
-```
-px-2 py-1 cursor-pointer box-description dark:bg-coolgray-100 dark:hover:bg-coolgray-300 bg-neutral-100 hover:bg-neutral-200
-```
-
-### Overlays
-
-#### Callout
-
-Four types (`warning`, `danger`, `info`, `success`). Base: `relative p-4 border rounded-lg`.
-
-| Type | Background | Border | Title text | Body text |
-|---|---|---|---|---|
-| warning | `bg-warning-50 dark:bg-warning-900/30` | `border-warning-300 dark:border-warning-800` | `text-warning-800 dark:text-warning-300` | `text-warning-700 dark:text-warning-200` |
-| danger | `bg-red-50 dark:bg-red-900/30` | `border-red-300 dark:border-red-800` | `text-red-800 dark:text-red-300` | `text-red-700 dark:text-red-200` |
-| info | `bg-blue-50 dark:bg-blue-900/30` | `border-blue-300 dark:border-blue-800` | `text-blue-800 dark:text-blue-300` | `text-blue-700 dark:text-blue-200` |
-| success | `bg-green-50 dark:bg-green-900/30` | `border-green-300 dark:border-green-800` | `text-green-800 dark:text-green-300` | `text-green-700 dark:text-green-200` |
-
-Icon colors (600 light / 400 dark) match type.
-
-#### Modal (input variant)
-
-`resources/views/components/modal.blade.php`:
-```
-relative w-full lg:w-auto lg:min-w-2xl lg:max-w-4xl border rounded-sm drop-shadow-sm bg-white border-neutral-200 dark:bg-base dark:border-coolgray-300 flex flex-col
-```
-
-Backdrop: `bg-black/20 backdrop-blur-xs`. Close button: `w-8 h-8 rounded-full hover:bg-neutral-100 dark:hover:bg-coolgray-300` top-right, 24px `stroke-width=1.5` X icon.
-
-#### Modal Confirmation
-
-`resources/views/components/modal-confirmation.blade.php` — destructive-action 2-or-3-step wizard (checkboxes → confirm text → password):
-```
-relative w-full border rounded-none sm:rounded-sm min-w-full lg:min-w-[36rem] max-w-full sm:max-w-[48rem] h-screen sm:h-auto max-h-screen sm:max-h-[calc(100vh-2rem)] bg-neutral-100 border-neutral-400 dark:bg-base dark:border-coolgray-300 flex flex-col
-```
-
-Uses `<x-callout type="danger">` for warning. Password step hidden for OAuth users.
-
-#### Confirm Modal
-
-`resources/views/components/confirm-modal.blade.php` — Livewire-bound simpler confirm dialog.
-
-#### Popup / Popup-Small
-
-Fixed bottom-right notification card with title / description / action button. `bg-white dark:bg-coolgray-100 border dark:border-coolgray-300 shadow-lg sm:rounded-sm`. Popup is responsive max-w-4xl, Popup-Small is `max-w-[46rem]`.
-
-#### Slide-Over
-
-`resources/views/components/slide-over.blade.php`:
-
-Outer: `fixed inset-y-0 right-0 flex max-w-full pl-10`
-
-Panel: `max-w-xl w-screen flex flex-col h-full py-6 overflow-hidden border-l shadow-lg bg-neutral-50 dark:bg-base dark:border-neutral-800 border-neutral-200`
-
-#### Toast
-
-`resources/views/components/toast.blade.php` — Alpine-powered stacked toast system.
-
-- Container: `fixed ... sm:max-w-xs z-9999`, positioned via `position` param (`top-right` / `top-left` / `top-center` / `bottom-right` / `bottom-left` / `bottom-center`).
-- Toast shell: `relative flex flex-col items-start shadow-[0_5px_15px_-3px_rgb(0_0_0_/_0.08)] w-full dark:bg-coolgray-100 bg-white dark:border dark:border-coolgray-200 rounded-sm sm:max-w-xs`.
-- Stacks up to 4 (oldest gets scale 82% then burns).
-- Auto-dismiss after 4 s. Hover on container pauses dismissal and expands stack.
-- HTML payload sanitized via `window.sanitizeHTML` (XSS guard).
-- Per-toast copy-to-clipboard + close buttons.
-
-Icon colors:
-
-| Type | Class |
-|---|---|
-| success | `text-green-500` |
-| info | `text-blue-500` |
-| warning | `text-orange-400` |
-| danger | `text-red-500` |
-| default | `text-gray-800` |
-
-#### Helper / Tooltip
-
-`resources/views/components/helper.blade.php`. Icon utility `.info-helper`:
-```
-cursor-pointer text-coollabs dark:text-warning
-```
-
-Popup utility `.info-helper-popup`:
-```
-hidden absolute z-40 text-xs rounded-sm text-neutral-700 group-hover:block dark:border-coolgray-500 border-neutral-900 dark:bg-coolgray-400 bg-neutral-200 dark:text-neutral-300 max-w-sm whitespace-normal break-words
-```
-
-Shown on parent `.group:hover`. Supports rich HTML (links colored `text-coollabs dark:text-warning underline`).
-
-### Navigation
-
-#### Sidebar / Navbar
-
-Component: `resources/views/components/navbar.blade.php`.
-
-Root nav: `flex flex-col flex-1 px-2 bg-white border-r dark:border-coolgray-200 border-neutral-300 dark:bg-base`
-
-Menu list: `flex flex-col flex-1 gap-y-7` → inner `flex flex-col h-full space-y-1.5`.
-
-Utility `.menu-item`:
-```
-flex gap-3 items-center px-2 py-1 w-full text-sm dark:hover:bg-coolgray-100 dark:hover:text-white hover:bg-neutral-300 rounded-sm truncate min-w-0
-```
-
-Utility `.menu-item-active`:
-```
-text-black rounded-sm dark:bg-coolgray-200 dark:text-warning bg-neutral-200 overflow-hidden
-```
-
-Icon `.menu-item-icon`: `flex-shrink-0 w-6 h-6 dark:hover:text-white`. Sub-items use `gap-2` + `w-4 h-4` icons.
-
-#### Breadcrumbs
-
-`resources/views/components/resources/breadcrumbs.blade.php` — project → environment → resource trail. Desktop: `<ol class="hidden flex-wrap items-center gap-y-1 md:flex">`. Each link `text-xs lg:text-sm hover:text-warning`. Chevron buttons `text-warning`. Dropdowns `absolute ... bg-white dark:bg-coolgray-100 rounded-md shadow-lg border`. Active item `dark:text-warning font-semibold`.
-
-#### External-Link
-
-Mini icon — `inline-flex w-3 h-3 dark:text-neutral-400 text-black` with arrow-out-of-box SVG. Appended to external anchors.
-
-#### Internal-Link
-
-Arrow SVG — `inline-flex w-4 h-4 text-black dark:text-white`. Used in CTA links ("go to deployment" etc).
-
-#### Banner
-
-`resources/views/components/banner.blade.php` — dismissible top bar:
-```
-relative z-999 w-full py-2 mx-auto duration-100 ease-out shadow-xs bg-coolgray-100 sm:py-0 sm:h-14
-```
-
-Close button: `w-6 h-6 rounded-full hover:bg-coolgray-500 text-neutral-200`. Reveals via Alpine `x-transition` after 100ms delay.
-
-### Feedback
-
-#### Loading Spinner
-
-`resources/views/components/loading.blade.php` — inline flex with optional text + spinning SVG:
-```
-w-4 h-4 mx-1 ml-3 text-coollabs dark:text-warning animate-spin
-```
-
-SVG has two paths at `opacity-25` (track) + `opacity-75` (arc).
-
-Utility `.loading`: `w-4 dark:text-warning text-coollabs`.
-
-#### Loading-On-Button
-
-`resources/views/components/loading-on-button.blade.php` — same SVG but **no light-mode color** (`w-4 h-4 mx-1 ml-3 dark:text-warning animate-spin`), meant to inherit button text color.
-
-#### Page-Loading
-
-Full-page loader overlay (variant of `loading` component, fills viewport).
-
-### Text
-
-#### Highlighted text
-
-`resources/views/components/highlighted.blade.php` / utility `.text-helper`:
-```
-inline-block font-bold text-coollabs dark:text-warning
-```
-
-Also used for required-field asterisks via `<x-highlighted text="*" />`.
-
-#### Kbd
-
-Utility `.kbd-custom`:
-```
-px-2 text-xs rounded-sm border border-dashed border-neutral-700 dark:text-warning
-```
-
-### Chrome
-
-#### Scrollbar
-
-Utility `.scrollbar` (uses `tailwind-scrollbar` plugin):
-```
-scrollbar-thumb-coollabs-100 scrollbar-track-neutral-200 dark:scrollbar-track-coolgray-200 scrollbar-thin
-```
-
-Applied globally to `<body>` in `app.css`.
-
-#### Table
-
-Styled via base element rules in `app.css` (not a reusable component):
-
-```css
-table       { @apply min-w-full divide-y dark:divide-coolgray-200 divide-neutral-300; }
-thead       { @apply uppercase; }
-tbody       { @apply divide-y dark:divide-coolgray-200 divide-neutral-300; }
-tr          { @apply text-black dark:text-neutral-400 dark:hover:bg-coolgray-300 hover:bg-neutral-100; }
-tr th       { @apply px-3 py-3.5 text-left text-black dark:text-white; }
-tr th:first-child { @apply py-3.5 pr-3 pl-4 sm:pl-6; }
-tr td       { @apply px-3 py-4 whitespace-nowrap; }
-tr td:first-child { @apply pr-3 pl-4 font-bold sm:pl-6; }
-```
-
-#### Dropdown
-
-`resources/views/components/dropdown.blade.php`. Container:
-```
-border border-neutral-300 bg-white p-1 shadow-sm dark:border-coolgray-300 dark:bg-coolgray-200
-```
-
-Utility `.dropdown-item`:
-```
-flex relative gap-2 justify-start items-center py-1 pr-4 pl-2 w-full text-xs transition-colors cursor-pointer select-none dark:text-white hover:bg-neutral-100 dark:hover:bg-coollabs outline-none data-disabled:pointer-events-none data-disabled:opacity-50 focus-visible:bg-neutral-100 dark:focus-visible:bg-coollabs
-```
-
-Touch variant adds `min-h-10 px-3 py-2 text-sm`.
-
-## Do's and Don'ts
-
-- **Do** force `dark:text-white` on h1–h4 and card titles. Default body text `#a3a3a3` is unreadable on `coolgray-100`.
-- **Do** swap the accent: `coollabs` in light, `warning` in dark. For focus rings, active nav, helpers, spinners, highlighted text, scrollbar thumb, helper links.
-- **Do** use the inset box-shadow system on inputs, selects, and textareas — not a border. It enables the 4px left dirty-bar.
-- **Do** wire the dirty indicator via `wire:dirty.class` so Livewire flips the bar color on modified state.
-- **Do** flip `.box-title` and `.box-description` to the contrast color on hover. On dark hover the card goes purple `#7317ff`; `text-neutral-500` description becomes invisible.
-- **Do** maintain WCAG AA contrast (4.5:1 for normal text).
-- **Do** sanitize HTML passed into toasts via `window.sanitizeHTML`.
-- **Do** use `<x-loading>` for in-button spinners and as `wire:loading.delay.longer` indicators in status components.
-- **Don't** use purple `coollabs` as the dark-mode accent. Always use yellow `warning` in dark.
-- **Don't** mix corner radii — 2px everywhere except callouts (8px) and pills (full).
-- **Don't** use shadows for elevation in dark mode. Use tonal layers from the coolgray ladder.
-- **Don't** set `border` utilities without expecting `coolgray-200` in dark (default override in base layer).
-- **Don't** add gradients. The one exception is the `.bg-coollabs-gradient` upsell strip.
-- **Don't** use more than two font weights on a single screen (typically 400 body + 700 bold).
-
----
-
-Source files:
-- Theme tokens: `resources/css/app.css` (`@theme` block)
-- Fonts: `resources/css/fonts.css`
-- Component utilities: `resources/css/utilities.css`
-- Blade components: `resources/views/components/**/*.blade.php`

From ac6f05c003e7527b97ade4dd350631d8b716df0d Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Thu, 7 May 2026 12:25:17 +0200
Subject: [PATCH 12/14] chore: remove conductor.json configuration file

---
 conductor.json | 7 -------
 1 file changed, 7 deletions(-)
 delete mode 100644 conductor.json

diff --git a/conductor.json b/conductor.json
deleted file mode 100644
index 688de3a90..000000000
--- a/conductor.json
+++ /dev/null
@@ -1,7 +0,0 @@
-{
-    "scripts": {
-        "setup": "./scripts/conductor-setup.sh",
-        "run": "docker rm -f coolify coolify-minio-init coolify-realtime coolify-minio coolify-testing-host coolify-redis coolify-db coolify-mail coolify-vite; spin up; spin down"
-    },
-    "runScriptMode": "nonconcurrent"
-}
\ No newline at end of file

From df87a4938181bf6fafdd3d34674320294030f7e9 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Thu, 7 May 2026 12:26:15 +0200
Subject: [PATCH 13/14] docs: add design reference to AGENTS.md and CLAUDE.md

Point agents and Claude to DESIGN.md in the coollabsio/architecture
repo for UI/UX specs, principles, and visual standards.
---
 AGENTS.md | 4 ++++
 CLAUDE.md | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/AGENTS.md b/AGENTS.md
index 3fff0074e..2c403efe8 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -1,3 +1,7 @@
+## Design Reference
+
+For UI/UX design specifications, principles, and visual standards, consult `DESIGN.md` in the [coollabsio/architecture](https://github.com/coollabsio/architecture) repo.
+
 <laravel-boost-guidelines>
 === foundation rules ===
 
diff --git a/CLAUDE.md b/CLAUDE.md
index bb65da405..188889954 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -6,6 +6,10 @@ ## Project Overview
 
 Coolify is an open-source, self-hostable PaaS (alternative to Heroku/Netlify/Vercel). It manages servers, applications, databases, and services via SSH. Built with Laravel 12 (using Laravel 10 file structure), Livewire 3, and Tailwind CSS v4.
 
+## Design Reference
+
+For UI/UX design specifications, principles, and visual standards, consult `DESIGN.md` in the [coollabsio/architecture](https://github.com/coollabsio/architecture) repo.
+
 ## Development Environment
 
 Docker Compose-based dev setup with services: coolify (app), postgres, redis, soketi (WebSockets), vite, testing-host, mailpit, minio.

From 8044045f13939e6f8b37b9a81f10ceffc0e47c7d Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Thu, 7 May 2026 13:46:11 +0200
Subject: [PATCH 14/14] fix(ui): replace border-l dirty indicator with
 box-shadow

Use inset box-shadow instead of left border to show unsaved env var
state, avoiding layout shift and border-radius interference.
---
 resources/views/components/forms/env-var-input.blade.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/resources/views/components/forms/env-var-input.blade.php b/resources/views/components/forms/env-var-input.blade.php
index 642bbcfb0..f637425c1 100644
--- a/resources/views/components/forms/env-var-input.blade.php
+++ b/resources/views/components/forms/env-var-input.blade.php
@@ -229,7 +229,7 @@ class="flex absolute inset-y-0 right-0 z-10 items-center pr-2 cursor-pointer dar
             @readonly($readonly)
             @if ($modelBinding !== 'null')
                 wire:model="{{ $modelBinding }}"
-                wire:dirty.class="dark:border-l-warning border-l-coollabs border-l-4"
+                wire:dirty.class="[box-shadow:inset_4px_0_0_#6b16ed,inset_0_0_0_2px_#e5e5e5] dark:[box-shadow:inset_4px_0_0_#fcd452,inset_0_0_0_2px_#242424]"
             @endif
             wire:loading.attr="disabled"
             @disabled($disabled)