Image: GitHub
Why it mattersA team moving off Vercel or Heroku now has an agent-usable control plane. The same release tightens who can run the dangerous API calls.
Coolify released v4.5.0 on 23 October 2026. The project is a self-hostable Platform-as-a-Service. Teams run it on their own servers as an alternative to Vercel, Heroku and Netlify. The repository ranked 20th on Trendshift's daily list, with 64,352 stars at the time of writing. The release notes are published on GitHub by the coollabs.io team.
MCP for Coolify
The headline change for a team using an AI coding agent is a new MCP server. The release adds MCP tools that let an agent manage resources. The change closes two older issues (#11281 and #11881). The release also adds the controls that make a public MCP endpoint safe. The MCP endpoint now enforces an allowed IPs list. API token creation for MCP works even when the REST API is disabled.
A new deploy ability tightens token scoping. API tokens now need this ability for scheduled tasks and for changing the proxy. They also need it for custom log drains and any server-side effect. The release notes list resource deletion, storage access, provider operations and database imports as side effects. A read-only token can no longer save credentials from client input.
Security and secrets
Plaintext secrets are now encrypted at rest. Secret redaction in logs got stronger, with admin controls. URL redaction no longer spans multiple log lines. The release disables PHP-based service templates for CVE-2026-109618 and CVE-2026-109619, then re-enables them with patched images. System-wide Git sources are now restricted to instance admins. S3-compatible avatars and icons no longer use unauthenticated public URLs. Deployment queries are now scoped to the applications of the team that runs them.
Features for a working team
The release adds passkey sign-in. Server patching in beta installs automatic security updates per server. The server list shows reboot warnings, risky-package warnings and patch status. A new fleet Metrics page shows server and container tables, trend charts, and a one-click enable button. The server metrics page gains disk, network and load charts.
A Canvas view on the dashboard shows interactive resource views, active deployments and team avatars. A file browser for applications, services and databases arrives with the release. Custom proxy error pages and maintenance mode land for applications and services. Coolify now supports a configurable Traefik certificate resolver per server, with an override per resource. Server creation on Hostinger VPS and Cloudflare tunnel setup with stored API tokens round out the list.
Breaking changes to read first
Four breaking changes are listed. API tokens that trigger server-side effects now need the new deploy ability. API backup execution messages are hidden unless the token has the read:sensitive or root ability. The POST /api/v1/enable endpoint is removed. Docker Compose files with a scale or replicas value greater than one are now rejected.
The release carries roughly 60 feature entries, around 90 fixes and a dozen improvements. Service templates for Appwrite, Forgejo, Hatchet, Langfuse, Odoo, Supabase and Weblate are updated, with a dozen more fixed. Nixpacks is now marked deprecated. The release notes recommend Railpack.
Source
This item was written by an AI system from the linked source. Reveneau is responsible for what it publishes.
Get AI News in your inbox
New developer tools, model and agent releases, and how teams are actually using them to release software. Short, and only when there is something worth reading.
