Deploy with Claude Code: letting an AI agent ship safely

Coding agents are good at writing code. Increasingly, people want them to ship it too: set up the server, create the database, deploy, read the logs, fix the error and deploy again.

That is also where nervous people stop. An agent that can deploy can, in principle, also delete. This post explains how agents reach deployment tools through MCP, what can go wrong, and how Aria puts guard rails around every action.

What MCP is, in one paragraph

The Model Context Protocol (MCP) is an open standard that lets an AI assistant call tools exposed by another service. A hosting platform can run an MCP server that offers actions such as “read the logs” or “deploy this service”, and an agent like Claude Code can connect to it. The protocol is described in the Model Context Protocol documentation.

Several hosting tools now offer MCP access. They differ a lot in how they handle permissions, which is the part that matters most.

The risk is not the model, it is the permissions

When people worry about an agent deploying, the worry is usually one of these:

• It deploys something half-finished to production.
• It runs a destructive command, such as dropping a database or deleting a server.
• It is tricked by text in a file or a log into doing something the user did not intend.
• It does things you cannot easily see or undo.

Telling the model “please be careful” does not solve any of these, because a prompt is a suggestion. The reliable fix is to put the rules outside the model, in the system that actually performs the action.

Other guides make the same point in different ways, for example by recommending a separate, revocable access token for the agent and explicit confirmation for destructive steps.

How Aria handles it: three safety levels

Every action in Aria has a safety level. Aria enforces it, not the AI.

Level	What it means	Examples
SAFE	Runs straight away	Reading status, reading logs
CONTROLLED	Needs a human to approve	Actions that change things and need a person’s sign-off
DESTRUCTIVE	You must type the name to confirm	The most serious actions, where a mistake is hard to undo

The details of which action sits at which level are in Aria’s own documentation. The principle is simple. An agent can look around freely, it has to ask before changing things that matter, and for the most serious actions a human has to type the name of the thing being affected, which makes accidental confirmation unlikely.

Because the check lives in Aria, it does not matter how the request arrived. A prompt-injected agent, a buggy agent and a perfectly behaved agent all meet the same gate.

The workflow, step by step

Here is how a typical project goes.

1. The agent reads your repository

Claude Code, Cursor or any other agent looks at your code and works out what it contains: a web app, an API, a worker, a Postgres database, perhaps Redis or Supabase.

2. It writes one aria.yaml

This single stack file lists your services, databases and environment variables. It is a plain file in your repository, so you can read it, review it and commit it.

3. Aria validates and sizes it

Aria checks the file, estimates the memory the stack needs and suggests the smallest plan that fits. You see what you are about to buy before any server exists.

4. Aria provisions and deploys

Aria sets up and hardens a dedicated server, creates the databases, wires environment variables (database URLs, generated secrets), configures domains with automatic HTTPS, and deploys. Builds use Railpack or your Dockerfile.

5. The agent watches and fixes

Over MCP the agent can read status and logs. That is a SAFE action, so it can do it continuously. If a build fails, it reads the log, edits the code and tries again. Rollback takes about two seconds if a release goes wrong, and with GitOps only the services a commit touches are redeployed.

What this does not do

It is worth being clear about the limits.

• Aria does not make an agent’s code correct. You should still review what it writes.
• Approval prompts only help if someone reads them. Treat a CONTROLLED request like a pull request: look before you click.
• Some parts of the product are still being rolled out, such as the GitHub App connection and real-domain features that need a server on the internet.

Tips for using any agent with deployment tools

These apply whichever platform you use:

1. Give the agent its own credentials, never your personal login, so you can revoke it without touching anything else.
2. Start read-only. Let it read logs and status for a while before it can change anything.
3. Keep production approval with a human. Convenience on staging is fine. On production, a person confirms.
4. Keep the stack file in version control, so every change is reviewable and reversible.
5. Treat text from outside as untrusted. Logs, issues and web pages can contain instructions aimed at the agent.
6. Check backups before you need them.

Comparison: ways to let an agent deploy

Approach	Setup effort	Agent can do	Guard rails
Agent runs shell commands on your server	Low	Anything the shell allows	Only what you configure
Agent uses a platform CLI with your token	Low	Whatever the token allows	The token’s scope
Agent uses a platform’s MCP server	Medium	The tools the server exposes	Depends on the platform
Agent uses Aria over MCP	Low	Reads and deploys, with approval levels	SAFE, CONTROLLED, DESTRUCTIVE, enforced by Aria

The first rows are not wrong, just less safe by default. The rules in them live in your head or your token scope. In the last row they are built in.

FAQ

Can Claude Code deploy to my own server?

With Aria, yes. Claude Code (or Cursor, or another agent) reads your repository and writes an aria.yaml, and Aria provisions a dedicated server and deploys. Agents can also read status and logs and deploy over MCP.

Can the agent delete my database?

Not on its own. Destructive actions need you to type the name to confirm, and Aria enforces this rather than relying on the AI to behave.

What is the difference between SAFE and CONTROLLED?

SAFE actions run straight away. CONTROLLED actions need a human to approve before they run.

Do I need Claude Code specifically?

No. Aria works with Claude Code, Cursor and other agents. The stack file is a normal file in your repository.

How much does Aria cost?

One flat monthly price per server, with draft prices from £8 a month ex VAT. There are no charges per seat, per app, per database or per request.

Try it with your own agent

Read how Aria enforces MCP human approval gates on the server, compare Aria with other clouds, see pricing, or get started.