Three ways to work with StackShip outside the dashboard:
| Interface | Use it for | Sign in with |
|---|---|---|
| OpenTofu CLI | Running tofu plan and tofu apply against a StackShip workspace, from your machine or CI |
tofu login stackship.run, or a workspace token in CI |
| REST API | Reading and managing projects, workspaces, runs, variables, policies, and the module registry | An OAuth access token for your StackShip account |
| MCP server | Letting an AI agent inspect runs, review plans, and make scoped changes | OAuth from your agent’s MCP client |
Access is limited to your organization and to the credential’s permissions: your role when you sign in, or the scope of a workspace token. Changes appear in the audit log.
Which one should I use?
- To plan and apply infrastructure, use the OpenTofu CLI. Runs go through the same plan, policy, approval, and apply steps as runs started from GitHub.
- To connect an AI assistant, use the MCP server. The agent can only read unless it’s also granted write access.
- To build your own integration, use the REST API and generate a client from its OpenAPI document.
There’s no separate stackship command-line tool. Use tofu for
infrastructure operations and the dashboard for everything else.