DigitalOcean connector for AI agents

Tools your infrastructure agent reaches for on DigitalOcean, scoped per user.

CALL ANY TOOL

120 tools for cloud infrastructure on DigitalOcean: create and act on Droplets, deploy App Platform apps, manage databases, Kubernetes, load balancers, firewalls, DNS, and volumes, and read billing and monitoring data.

digitalocean_account_get

Get account

Get the DigitalOcean account that the connection is authorized for. Returns the account's email, UUID, status, email verification flag, team, and limits such as droplet_limit, floating_ip_limit and volume_limit. Use digitalocean_account_get to check who is connected and what limits apply. Use digitalocean_billing_balance_get for the account balance.

Parameters

Name

Type

Required

Description

—

No parameters required

digitalocean_actions_list

List actions

digitalocean_app_create

Create app

digitalocean_app_delete

Delete app

digitalocean_app_deployment_cancel

Cancel app deployment

digitalocean_app_get

Get app

digitalocean_app_restart

App restart

digitalocean_app_update

Update app

digitalocean_database_cluster_get

Get database cluster

digitalocean_database_clusters_list

List database clusters

digitalocean_database_create

Create database

digitalocean_domain_delete

Delete domain

digitalocean_domain_record_get

Get domain record

digitalocean_domain_records_list

List domain records

digitalocean_droplet_action_run

Run droplet action

digitalocean_droplet_create

Create droplet

Create a new Droplet (virtual machine) from an image, size and region. Returns the new Droplet with its id and status `new`, plus links.actions with the create action ID; creation finishes asynchronously. Use digitalocean_droplet_create to launch one Droplet. Use digitalocean_action_get with the returned action ID to check progress, then digitalocean_droplet_get for its IP address. Get valid region, size and image slugs from digitalocean_regions_list, digitalocean_sizes_list and digitalocean_images_list.

Parameters

Name

Type

Required

Description

image

string

Required

Image to build the Droplet from: a public image slug such as ubuntu-24-04-x64, or the numeric ID of a private image or snapshot (as a string). Get options from digitalocean_images_list.

name

string

Required

Name for the Droplet. If it is a domain managed in DigitalOcean DNS, a PTR record is created. Example: web-01.

size

string

Required

Size slug that sets CPU, memory and disk. Get options from digitalocean_sizes_list. Example: s-1vcpu-1gb.

backups

boolean

Optional

Set to true to enable automated backups (extra cost). Defaults to false.

ipv6

boolean

Optional

Set to true to enable IPv6 on the Droplet. Defaults to false.

monitoring

boolean

Optional

Set to true to install the DigitalOcean monitoring agent, needed for memory, disk and load metrics. Defaults to false.

region

string

Optional

Region slug to create the Droplet in. A prefix such as `nyc` picks any datacenter in that region. Get options from digitalocean_regions_list. Example: nyc3.

ssh_keys

array

Optional

SSH key IDs or fingerprints to add to the root account. Keys must already be in the account (digitalocean_ssh_keys_list). Example: [289794] or ["3b:16:e4:bf:8b:00:8b:b8:59:8c:a9:d3:f0:19:fa:45"].

tags

array

Optional

Tag names to apply. New tag names are created automatically. Example: ["env:prod", "web"].

user_data

string

Optional

Cloud-init user data (cloud-config or a shell script) run on first boot, plain text up to 64 KiB. Example: #cloud-config\nruncmd:\n - touch /test.txt

volumes

array

Optional

IDs of block storage volumes to attach. Volumes must be in the same region and not attached elsewhere. Example: ["12e97116-7280-11ed-b3d0-0a58ac146812"].

vpc_uuid

string

Optional

UUID of the VPC to place the Droplet in. Leave empty for the region's default VPC. Get it from digitalocean_vpcs_list.

with_droplet_agent

boolean

Optional

Set to false to skip installing the agent used for the web console. Leave empty for the default (installed).

digitalocean_droplets_list

List droplets

digitalocean_firewall_droplets_add

Add firewall droplets

digitalocean_firewall_droplets_remove

Remove firewall droplets

digitalocean_firewall_get

Get firewall

digitalocean_kubernetes_cluster_delete

Delete kubernetes cluster

digitalocean_kubernetes_cluster_update

Update kubernetes cluster

digitalocean_kubernetes_node_pool_get

Get kubernetes node pool

digitalocean_kubernetes_node_pools_list

List kubernetes node pools

digitalocean_load_balancer_create

Create load balancer

digitalocean_projects_list

List projects

digitalocean_reserved_ip_delete

Delete reserved ip

digitalocean_reserved_ip_get

Get reserved ip

digitalocean_ssh_keys_list

List ssh keys

digitalocean_tag_create

Create tag

For more tools, view docs.

Build your Agent

Same auth pattern across LangChain, OpenAI, Anthropic, and Google ADK.

import { ScalekitClient } from "@scalekit-sdk/node";
import { createReactAgent } from "@langchain/langgraph/prebuilt";

const sk = new ScalekitClient(env.SCALEKIT_ENV_URL, env.SCALEKIT_CLIENT_ID, env.SCALEKIT_CLIENT_SECRET);

// DigitalOcean tools scoped to this user
const { tools } = await sk.tools.listScopedTools("user_123", {
  filter: { connectionNames: ["digitalocean"], toolNames: [
    "digitalocean_droplets_list",
    "digitalocean_app_health_get",
    "digitalocean_droplet_action_run"] },
  pageSize: 100,
});

const agent = createReactAgent({ llm, tools });
await agent.invoke({ messages: [{ role: "user", content: "Check whether the checkout-api app is healthy" }] });

import OpenAI from "openai";
import { ScalekitClient } from "@scalekit-sdk/node";

const sk = new ScalekitClient(env.SCALEKIT_ENV_URL, env.SCALEKIT_CLIENT_ID, env.SCALEKIT_CLIENT_SECRET);
const openai = new OpenAI();

const { tools } = await sk.tools.listScopedTools("user_123", {
  filter: { connectionNames: ["digitalocean"] }, pageSize: 100,
});

const res = await openai.chat.completions.create({
  model: "gpt-5",
  messages: [{ role: "user", content: "Check whether the checkout-api app is healthy" }],
  tools,
});

// Execute the tool call with the user's vaulted DigitalOcean OAuth token
await sk.tools.executeTool(res.choices[0].message.tool_calls[0], "user_123");

import Anthropic from "@anthropic-ai/sdk";
import { ScalekitClient } from "@scalekit-sdk/node";

const sk = new ScalekitClient(env.SCALEKIT_ENV_URL, env.SCALEKIT_CLIENT_ID, env.SCALEKIT_CLIENT_SECRET);
const anthropic = new Anthropic();

const { tools } = await sk.tools.listScopedTools("user_123", {
  filter: { connectionNames: ["digitalocean"] }, pageSize: 100,
});

const msg = await anthropic.messages.create({
  model: "claude-sonnet-5",
  max_tokens: 1024,
  messages: [{ role: "user", content: "Check whether the checkout-api app is healthy" }],
  tools,
});

// Tool call runs with the user's vaulted DigitalOcean OAuth token
await sk.tools.executeTool(msg.content, "user_123");

import { Agent } from "@google/adk/agents";
import { ScalekitClient } from "@scalekit-sdk/node";

const sk = new ScalekitClient(env.SCALEKIT_ENV_URL, env.SCALEKIT_CLIENT_ID, env.SCALEKIT_CLIENT_SECRET);

const { tools } = await sk.tools.listScopedTools("user_123", {
  filter: { connectionNames: ["digitalocean"] }, pageSize: 100,
});

const agent = new Agent({
  name: "infrastructure_agent",
  model: "gemini-2.5-pro",
  instruction: "DigitalOcean tools scoped to this user",
  tools,
});

await agent.run("Check whether the checkout-api app is healthy");

Try these prompts

Copy any prompt into your agent. Each maps directly to a DigitalOcean tool. Click to copy, paste into your agent, done.

Droplets and apps

Copy the prompt

Copied

List Droplets tagged production and their status.

Copy the prompt

Copied

Reboot the staging-worker Droplet.

Copy the prompt

Copied

Start a new deployment of the checkout-api app.

Data and networking

Copy the prompt

Copied

List our managed database clusters and their engines.

Copy the prompt

Copied

Add an A record for api.acme.com pointing to 203.0.113.10.

Copy the prompt

Copied

Show the inbound rules on the web-firewall.

Billing and monitoring

Copy the prompt

Copied

What is our month-to-date balance?

Copy the prompt

Copied

Show CPU usage for the prod-proxy Droplet over the last 24 hours.

Copy the prompt

Copied

List our invoices from the last 3 months.

SEE HOW AUTH WORKS

Each user signs in to DigitalOcean once, and Scalekit stores and refreshes their tokens. Credentials stay vaulted, every call is scope checked, and every action is logged.

Authorize

Your user connects

DigitalOcean

once. We tie it to their identity and the meetings they approved — no shared bot account, no org-wide access

Who:

user ‘A’

when:

Once per user

access:

Limited to user

Store

Their

DigitalOcean

token lives in a vault scoped to them. User A's meetings are never reachable by an agent acting for user B, even on the same connection

vault:

encrypted

scope:

per-user

tokens:

auto-refreshed

Resolve

When your agent calls a

DigitalOcean

tool, we fetch the right token server-side. It never touches your agent, never appears in the LLM context, never shows up in your logs

speed:

~40ms

check:

before every call

seen by:

nobody

Audit

Every

DigitalOcean

tool call is logged — who triggered it, which meeting was fetched, what came back. 90 days of history, tied to the user who authorized it

history:

90 days

export:

SIEM-ready

logged:

every call

Test other agents

See the same per-user auth pattern across other developer tools and cloud connectors.

Engineering Teams

DevOps assistant agent

Polls GitHub for failing checks and stale PRs, opens Linear issues for the ones that need work, and posts a daily digest to Slack. It acts as the engineer, not a shared service account.

Why Scalekit

Secure your agent's access. Connectors ship in minutes

01.

Shared tokens break per-user analytics

A shared DigitalOcean token looks fine in a demo. In production every Droplet reboot looks like one service account, and you cannot tell which user triggered it. Scalekit resolves the credential of the actual user who triggered the agent, never a shared bot.

// shared token
audit → bot_service_account

// scalekit
audit → user_abc ✓

02.

Authentication is not authorization

03.

Multi-tenancy is architectural

04.

DigitalOcean today. Ten connectors tomorrow.

“Our agents act across Salesforce, Gong, Google Drive, and more, on behalf of every customer. Scalekit behind the scenes meant we can keep adding tools without ever rebuilding how credentials or tool calling work.”

Venu Madhav Kattagoni

Head of Engineering / Von

FAQs

Frequently Asked Questions

Does the agent access DigitalOcean as the user or through a shared service account?

As the user. Each user signs in to DigitalOcean once, and Scalekit stores and refreshes their tokens. Droplet actions, deployments, and DNS changes the agent makes are attributed to that user in your audit trail, not a shared service account.

Where is the DigitalOcean OAuth token stored?

In Scalekit's managed AES-256 token vault, namespaced per tenant. Refresh is automatic. Revocation is a single dashboard action. Credentials never appear in prompts, logs, or LLM context.

Can I limit what the agent does in DigitalOcean?

Yes. Filter by tool name in listScopedTools to expose only what you want, for example read and list tools without digitalocean_droplet_delete and digitalocean_database_cluster_delete, which destroy resources and their data. Scalekit also enforces scope checks before every API call.

What happens when a user revokes DigitalOcean access?

The connection is invalidated on the next tool call. Subsequent requests for that user fail closed with a clear error. Other users in the tenant remain unaffected. The event is logged for audit.

Which DigitalOcean account does the agent act on?

The account the user authorized when signing in. digitalocean_account_get returns that account's email, team, and limits, and every Droplet, app, database, and DNS tool acts on resources in it.