The whole arc — discover, pay, provision, SSH in, run, extend, destroy — exists as tool calls, with payment signed rather than typed into a checkout form. The bounded exec (timeout and output cap) and the SSH-lockout guard on firewall changes are the parts that make that safe to hand over.
The MCP server for AgentMetal, which provisions and manages VPS instances. Paid tools sign USDC payments over x402 v2 (card payment is also available); the rest are plain HTTP.
- The catalogue of plans, locations and add-on pricing for bandwidth and storage, callable before anything is paid for
- A server provisioned for a chosen plan and number of days, returning id, IPv4 and SSH access — with `managed_key:true` generating and authorizing a keypair and returning the private key once
- Shell commands run as root over SSH on a managed-key server, returning exit code, stdout and stderr, bounded by a timeout and an output-size cap
- Fleet visibility and per-server status: IPv4, expiry, bandwidth and storage
- Lease extension by N days, and destruction or soft reboot when you are done or stuck
- Hypervisor-level diagnostics without logging in — status, recent provider actions, a VNC console URL and live CPU, disk and network metrics
- Edge firewall rules read and changed by protocol, port and source IPs, with SSH-lockout guarded
- Account claim by emailed one-time code, redeemed for an API key, optionally linked to a wallet
No human signup for discovery or provisioning — paid calls sign a USDC payment over x402. Account-gated tools (destroy, reboot, logs, exec) need an API key in the `am_live_…` form and ownership of the server. Running commands over SSH requires that the server was provisioned with a managed key.
Build from source — clone the repository and build it, then point your client at the binary