Coolify + Memtro

Only when you ask, and only what it has been granted: create a project in Coolify; rename a Coolify project or replace its description; delete an empty Coolify project; deploy an application, service or database in Coolify, or every resource with a tag (queues a build and rollout); start a stopped application in Coolify; restart an application in Coolify (brief downtime); stop an application in Coolify (it goes offline); cancel a deployment that is queued or running in Coolify; add an environment variable to a Coolify application (takes effect on next deploy); replace the value of a Coolify application's environment variables (old values are lost); delete an environment variable from a Coolify application; start a stopped service in Coolify; restart a service in Coolify (brief downtime); stop a service in Coolify (it goes offline); start a stopped database in Coolify; restart a database in Coolify (connections drop); stop a database in Coolify (apps using it fail); change a Coolify application's name, domains, branch, commands or other settings (takes effect on next deploy); roll a Coolify application back to an earlier image or commit (queues a deployment); delete a Coolify application; delete a Coolify service; create a Coolify application from a Docker image; rename a Coolify service or replace its description; run one of a Coolify application's scheduled tasks now; run Docker clean-up on a Coolify server; create an environment in a Coolify project. Every other tool reads, searches or lists. The Connections page labels the tools that act, an administrator grants each one by name to the teams that may use it, and a personal connection acts only after its owner allows it.

A personal connection serves only your own requests. A shared connection serves the organisation: everyone, or only the teams an admin chooses. Admins can always add shared connections; other members need the permission.

Credentials are encrypted at rest. Tool results are cached briefly so agent loops do not repeat identical calls, and the facts the model extracts are saved to your organisation's memory with provenance (system, record and link) so they can be checked and superseded.

API token. On a self-hosted Coolify an administrator turns on Settings → Advanced → API Access, and any IP allowlist there must let Memtro in.

Yes. Turn events on in the connection's Events tab on the Connections page, then add the address it shows as a webhook in Coolify, choosing the same kinds; the tab shows Coolify's own steps. A job set to start "When an event arrives" then runs once for each matching event, with the event as its input. The run treats the event as outside data, never as instructions, and anything the run remembers is kept as unverified.