modal-mcp-op

# modal-mcp A read-only MCP server that exposes [Modal](https://modal.com) to LLM agents for debugging and observing deployed applications: logs, app and function state, container lifecycle, failures, deployment history, and cost. **Read-only by construction, permanently.** No tool in this server can create, change, stop, restart or delete anything in a Modal workspace. That is not a flag, a toolset toggle, or a refusal at the edge — the mutating RPCs are unreachable as attributes on the object the tool layer holds. See [The read-only boundary](#the-read-only-boundary). Status: **alpha.** Every tool has been exercised against a real Modal workspace; the gaps are listed honestly in [What this cannot see](#what-this-cannot-see). Published to PyPI as **`modal-mcp-op`**. The obvious name `modal-mcp` was already taken by an unrelated project with similar positioning. ## Install and run ```bash uvx modal-mcp-op stdio # or: uv tool install modal-mcp-op export MODAL_TOKEN_ID=... export MODAL_TOKEN_SECRET=... modal-observe stdio ``` Credentials come from the **process environment only**. The server does not read a `.env` file; `.env.example` is a template you source yourself: ```bash cp .env.example .env && set -a && . .env && set +a ``` There is no interactive login, no linked-project state, and no config file — so this runs headless in a container or a CI job. MCP client configuration: ```json { "mcpServers": { "modal": { "command": "modal-observe", "args": ["stdio"], "env": { "MODAL_TOKEN_ID": "...", "MODAL_TOKEN_SECRET": "..." } } } } ``` **Use a service-user token with a Viewer role** rather than a personal user token. This server only ever reads, so it needs nothing more, and a user token inherits a human's full workspace access. `modal_status` reports which kind it holds so a mismatch is visible. ## Driving it without an MCP client Everything is reachable from a shell, because that is the only way to debug it…