目次
Debugging a production incident across multiple apps usually means jumping between Coolify deployment logs, n8n workflow executions, and GitHub Actions runs. Handing raw master API tokens for those services to an AI assistant is a major security risk. We built Ops Hub MCP (`packages/ops-hub`) and Ops Proxy (`packages/ops-proxy`) to give AI assistants a read-only, secret-redacted view of our entire infrastructure.
The Six-Stage Policy Pipeline
Every tool call in ops-hub passes through createPolicy: strict Zod validation, deepFreeze argument cloning, friendly-name allowlist resolution (never raw UUIDs), sliding-window rate limits, out-of-band Telegram approval for action tools (with a 5-minute lockout after two denials), and automatic secret redaction capped at 20 KB.
Learn how we build secure infrastructure and AI tooling on our services page.