Reads app and machine state, validates configs before a deploy, sets up health checks, and grants or revokes WireGuard and SSH access on request.
45actions available
Every action runs live through MCP. Nothing to build, nothing to maintain.
Ayro retrieves detailed Fly.io app information on demand. Support teams diagnose deployment issues without SSH access.
Ayro issues SSH certificates for Fly.io infrastructure instantly. Agents grant secure access without manual key generation.
Ayro adds WireGuard peers to your Fly.io organization. Your team establishes private network links without configuration work.
Each card is one request a support team gets, and the Fly actions Ayro runs to close it.
Ayro pulls the current state of an app and the machines behind it across the whole organization, so a question about what is running where gets a live answer rather than a screenshot from whoever has dashboard access.
When a service needs watching, Ayro creates a health check job against the URL, picks from the global check locations Fly.io offers, and triggers a first run so the result is confirmed before the request is closed.
Ayro adds a WireGuard peer for someone joining the team, validates the peer IPs against the organization, and removes that peer again when the access should end.
Before a new app goes out, Ayro validates the fly.toml, confirms the app name is still available, and returns placement recommendations for the regions its machines should land in.
How it works
Connect once, then just ask. There is no workflow builder to learn and nothing to maintain — Ayro reads the Fly actions it has and picks the ones a request needs.
Authorize the Fly account your team already uses — one consent screen, no API keys, no mapping tables. Ayro can only do what you granted that account, and you can disconnect it at any time.
Describe the job the way you would hand it to a teammate. Ayro maps it to the Fly actions that close it and chains as many as the request needs.
The agent runs the actions inside the conversation the customer is already in, so nobody copies data between tabs and your team can take over at any point.
Get started freeFly · Ayro
What can you do in Fly without me setting anything up?
These, right away:
Great, let's start with the first one.
FAQ
Setup, permissions, and the limits of what Ayro can do inside Fly.
Yes, within whatever the connected token allows. Get Organization, List Apps, and List Organization Machines all take an organization slug, and Check User Only Token reports whether the token you connected is limited to a single user or reaches organization resources, so you can confirm the blast radius before relying on it.
All 45 actions your agent can call on Fly, straight from the live MCP connection.
Add a WireGuard peer connection to a Fly.io organization for private network access.
Validate an app name for Fly.io app creation.
Execute GraphQL queries against the Fly.io checkJobs endpoint.
Check whether the authentication token only allows user access.
Create a health check job for monitoring application endpoints in Fly.io.
Triggers a run of an existing health check job on Fly.io.
Create a delegated WireGuard token for peer management in a Fly.io organization.
Create a third-party service configuration for discharging macaroon caveats.
Delete a delegated WireGuard token from a Fly.io organization.
Delete a Fly.io organization and all its associated resources using the GraphQL API.
Delete a remote builder configuration for a Fly.io organization.
Delete a third-party service configuration from Fly.io.
Detach a Postgres cluster from a Fly.io application, revoking access credentials.
Establish an SSH key for a Fly.io organization.
Fetches a list of node objects from Fly.io given a list of IDs using the GraphQL nodes query.
Find a Fly.io add-on by ID, name, or provider.
Query information about a specific Fly.io add-on provider (extension) by name.
Retrieve detailed information about a specific Fly.io application.
Retrieve a certificate by its ID from Fly.io.
Get information about the current authentication token.
Retrieve the latest available tag details for a given image repository from Fly.io's registry.
Retrieve the latest available image tag for a Fly.io Docker repository.
Get a single machine by ID from Fly.io.
Retrieve the nearest Fly.io region to the requesting client based on network location.
Fetch an object by its globally unique ID using Fly.io's GraphQL node query.
Find a Fly.io organization by slug using the GraphQL API.
Retrieve the user's personal organization details from Fly.io.
Get placement recommendations for Machines in Fly.io regions.
Retrieve Fly.io platform information including available regions, VM sizes, and flyctl version.
Retrieve Fly.io product and price information via GraphQL.
Same connection, same setup. Pick the next one your team already uses.
Queries app tables, registers users and starts password recovery, reorganises file storage, and schedules server-side timers and channel messages.
Spins up a Python sandbox, uploads files into it, runs code or shell commands, and returns the file that comes out.
Verifies an address the moment it is given, pushes a full list through as one batch, and follows the job until its results are ready.
Checks ingestion status, builds filtered views and preset alerts, writes exclusion rules to hold down index cost, and rotates API keys and member roles.
Reports occurrence counts and resolution times, maps team-to-project ownership, confirms who belongs where, and lists the projects on an account.
Runs workspace SQL and reads the rows back, triggers Flowpipe pipelines and returns their logs, tests cloud connections, and pulls the workspace audit trail.

Authorize the account and your agent has all 45 actions from the first conversation.
