Heroku MCP Server: Tools, Setup and Security

The Heroku Platform MCP Server lets an AI agent read, manage and operate Heroku resources: apps, dynos, add-ons, pipelines and Heroku Postgres. Heroku publishes it as an open-source project that runs locally through the Heroku CLI.

Checked against: Heroku Dev Center: Heroku MCP Server on 28 October 2026. eSEOspace did not install or test this server.

At a glance

The Heroku MCP Server README says the server works on Common Runtime, Cedar Private and Shield Spaces, and Fir Private Spaces. The Dev Center article we checked was last updated on 24 July 2025, so confirm details in the repository too.

What it can do

The README lists these tools:

Application management: list_apps, get_app_info, create_app, rename_app, transfer_app, deploy_to_heroku, deploy_one_off_dyno.

Process and dyno management: ps_list, ps_scale, ps_restart.

Add-ons: list_addons, get_addon_info, create_addon.

Maintenance and logs: maintenance_on, maintenance_off, get_app_logs.

Pipelines: pipelines_create, pipelines_promote, pipelines_list, pipelines_info.

Teams and spaces: list_teams, list_private_spaces.

PostgreSQL: pg_psql, pg_info, pg_ps, pg_locks, pg_outliers, pg_credentials, pg_kill, pg_maintenance, pg_backups, pg_upgrade.

Two tools stand out. deploy_one_off_dyno runs code or commands "in a sandboxed environment on a Heroku one-off dyno." pg_psql executes SQL against your Heroku Postgres database.

How to connect it

Install the Heroku CLI at version 10.8.1 or higher. Then add the server to your client.

Recommended: heroku mcp:start. The README's config for Claude Desktop, Cursor, Windsurf (now Devin Desktop), Cline and Trae:

{
  "mcpServers": {
    "heroku": {
      "command": "heroku mcp:start"
    }
  }
}

For VS Code, the README uses:

{
  "mcp": {
    "servers": {
      "heroku": {
        "type": "stdio",
        "command": "heroku",
        "args": ["mcp:start"]
      }
    }
  }
}

Alternative: npm with an API key. Run npx -y @heroku/mcp-server and set HEROKU_API_KEY to a Heroku authorization token. You can create one with heroku authorizations:create or view the current one with heroku auth:token.

An optional MCP_SERVER_REQUEST_TIMEOUT variable sets command timeouts. The default is 15 seconds.

Security notes

• Prefer the CLI session. Heroku lists "No need to manage or expose your Heroku API key" as a benefit of heroku mcp:start.
• No built-in read-only mode is documented. The Dev Center page makes no statement about approvals or safeguards for destructive actions.
• High-impact tools. transfer_app moves app ownership. ps_scale changes dyno counts and size, which affects cost. pg_kill terminates database processes. pg_upgrade upgrades Postgres. pg_credentials manages database credentials.
• Arbitrary SQL. pg_psql runs any query the database user allows. Point the agent at a staging app first.
• Token storage. If you must use HEROKU_API_KEY, keep it out of committed config files. See secret leakage in MCP.

Because nothing in the server limits writes, your MCP client's approval prompts are the main brake. Read tool annotations and the MCP security hub before you connect a production team.

Alternatives

• Render MCP Server, a hosted option for web services and Postgres.
• DigitalOcean MCP Server for App Platform and managed databases.
• Vercel MCP for front-end deployments.

Next step

Run the server against a non-production Heroku team first and watch which tools the agent reaches for. If you need custom guardrails, such as a read-only wrapper, our MCP development team can build one. More options are in the server directory.

Frequently asked questions