Let your coding agent deploy to Hubfly, not delete your data: 1 skill, 3 permission lists

Originally published on the Hubfly blog.

TL;DR

• What you get: a coding agent that can inspect, plan and deploy your app on Hubfly, but has to ask before it deploys, and is blocked from the usual commands that delete volumes or read your token (a fence, not a vault: see the limits below).
• Who it's for: solo devs and small teams already using Claude Code, Codex or Cursor who are tired of copy-pasting deploy commands.
• Time: about 15 minutes. Cost: the skill is free; you pay only for what gets deployed (≈ $3.71/month for one always-on 1 vCPU / 512 MB container, math below).

The problem

Your agent wrote the feature, ran the tests and opened the PR. Then it stops and hands you a list of deploy commands to paste. So you give it shell access to your cloud CLI, and now the same agent that once deleted your node_modules "to clean up" can also run stack down --volumes.

The question isn't "should the agent deploy?" It's "which commands can it run alone, which need a yes, and which should never run at all?"

What Hubfly gives the agent

Hubfly publishes a CLI skill for coding agents at hubfly.space/ai. It's a plain SKILL.md in the portable Agent Skills format, plus three reference files (API, networking, diagnostics). Hubfly says it contains no credentials or executable scripts.

The skill teaches the agent a 5-step loop:

1. Inspect: read the app, the hubfly.build.json manifest, ports, volumes and env var names.
2. Reconcile: compare local settings with the container already running in the cloud.
3. Plan: review the server-side plan and any destructive operations before rolling out.
4. Authorize: ask you when a new cost, a new target or a destructive action needs a decision.
5. Follow: track the deployment session and report the real final state or the exact phase that failed.

Three rules in the skill do most of the safety work:

• --yes only suppresses a CLI prompt. It is not permission. Your request decides what the agent may do.
• hubfly stack down --volumes deletes durable data and needs a separate confirmation that names the volumes.
• Never print secret values or tokens; avoid printenv. A local build or upload is not "deployed" until the Dashboard says so.

That's the agent's conscience. Now give it a fence, because a conscience is just a prompt.

Walkthrough: Claude Code + Hubfly in 4 steps

1. Install the CLI and log in yourself

curl -fsSL https://raw.githubusercontent.com/hubfly-space/hubfly-cli/main/install.sh | bash
hubfly version
hubfly login      # get a token at dashboard.hubfly.space/cli/auth and paste it
hubfly whoami

Log in yourself, in your own terminal. The token lands in ~/.hubfly/config.json. Don't paste it into the chat and don't commit it.

2. Add the skill to your repo

mkdir -p .claude/skills/hubfly-cli/references
curl -fsSL https://hubfly.space/skills/hubfly-cli/SKILL.md \
  -o .claude/skills/hubfly-cli/SKILL.md
for ref in api networking diagnostics; do
  curl -fsSL https://hubfly.space/skills/hubfly-cli/references/$ref.md \
    -o .claude/skills/hubfly-cli/references/$ref.md
done

For Codex use .codex/skills/hubfly-cli/, for Cursor .cursor/skills/hubfly-cli/, or the portable .agents/skills/hubfly-cli/. Read the file before you commit it. It's short, and you should know what your agent was told.

The skill also asks agents to re-fetch the live SKILL.md for each task and to add a small hubfly block to CLAUDE.md or AGENTS.md. We prefer committing your reviewed copy and re-pulling it when Hubfly updates it, so a change to the live file never reaches your agent unread.

3. Write the fence: .claude/settings.json

{
  "permissions": {
    "allow": [
      "Bash(hubfly whoami)",
      "Bash(hubfly version)",
      "Bash(hubfly stack status *)",
      "Bash(hubfly stack plan *)",
      "Bash(hubfly build validate *)",
      "Bash(hubfly build explain *)",
      "Bash(hubfly logs *)",
      "Bash(hubfly stack logs *)"
    ],
    "ask": [
      "Bash(hubfly deploy *)",
      "Bash(hubfly stack up *)",
      "Bash(hubfly exec *)",
      "Bash(hubfly ssh *)",
      "Bash(hubfly tunnel *)",
      "Bash(hubfly stack exec *)",
      "Bash(hubfly stack ssh *)",
      "Bash(hubfly container *)",
      "Bash(hubfly compose *)"
    ],
    "deny": [
      "Bash(hubfly stack down *)",
      "Bash(hubfly stack down --volumes *)",
      "Bash(hubfly compose down *)",
      "Bash(hubfly logout *)",
      "Bash(hubfly login *)",
      "Bash(printenv *)",
      "Read(~/.hubfly/**)"
    ]
  }
}

The skill also lists a hubfly compose alias and container subcommands, so we fence those too. login is denied: you log in, never the agent. This file is Claude Code's format. Codex and Cursor have their own approval settings; the same allow/ask/deny split applies.

How Claude Code reads this, per its permissions docs:

• Rules are checked deny, then ask, then allow. The first match wins, and specificity doesn't change the order.
• So hubfly deploy plan will also prompt, because it matches the ask rule first. That's on purpose: the skill warns deploy plan isn't guaranteed read-only (it can bind or create a remote project), and it isn't in the CLI docs yet. Read it before you approve.
• Bash(hubfly logs *) also matches the bare hubfly logs. The space before * matters.
• Read(~/.hubfly/**) keeps the token file out of the agent's context, and also blocks edits to it.
• Allow rules in a committed .claude/settings.json only apply after you accept the workspace trust prompt. Deny and ask rules apply right away.

stack down is denied, not asked. If a stack needs tearing down, that's one command worth typing yourself.

4. Ask for a deploy

Start Claude Code in the repo and try one of the prompts Hubfly suggests:

Deploy my web app with HTTPS and keep Postgres private with tunnel access.

What you should see, if the skill is doing its job:

• the allow-listed commands (whoami, stack plan, build explain) run without prompts once you've trusted the workspace;
• a plan that lists services, ports and volumes, with the database not exposed publicly;
• a permission prompt on hubfly stack up or hubfly deploy, which is your moment to read the plan;
• a final report that names the Dashboard's terminal state, not just "image uploaded".

For a Compose app, the reviewed plan is hubfly stack plan --json. If you want to see how a multi-service deploy gates on a migration job, we tested that end to end in our migration-job tutorial.

Add a money fence on the Hubfly side

Permission rules match the command text the agent writes. Claude Code's own docs say a deny rule isn't a security boundary: sh -c 'hubfly stack down ...' or a full path can slip past it. So put a second fence where the agent can't edit it:

• Project budget limit. When you create a project, Advanced options offer a monthly budget limit with presets of $10, $50 and $100. Pick the smallest one that fits. Hubfly's pricing page says a budget cap stops workloads when it's hit (the billing docs don't cover it yet). We haven't yet measured how quickly, so treat it as a ceiling, not a real-time alarm.
• One project for agent work. Point the agent at it with --project and say so in your prompt. The skill treats a new target as something to ask about.
• Audit log. Hubfly logs redeploys, env var changes, member role updates and API key generations, with UTC timestamp, IP, actor email and session, the resource changed, and a before/after diff. Check it after the agent's first few runs.

What can go wrong

1. The agent adds --yes and you assume it skipped your approval. It didn't. --yes skips the CLI's prompt. Claude Code's ask rule still fires on hubfly deploy *. If you never see a prompt, check that you're not in bypass-permissions mode and that /permissions still shows the ask rule. An allow rule can't override an ask rule.
2. Secrets end up in the transcript. An agent debugging env vars loves printenv. The deny rule and the skill both block the obvious form, but hubfly exec web -- env is another. That's why exec is in ask: read the command before you approve it.
3. The agent "succeeds" at the wrong layer. A local build or upload isn't a deploy. If the report doesn't mention the Dashboard's final state or a health check, ask for hubfly stack status before you trust it.

Limits and pricing, honestly

What it costs. The skill and CLI are free. You pay Hubfly's normal rates for what the agent deploys: $0.004 per vCPU-hour, $0.002 per GB-hour of RAM, $0.00001536 per GB-hour of storage. One always-on dedicated container (1 vCPU, 512 MB, 5 GB) over 730 hours:

Item	Math	Monthly
CPU	1 × $0.004 × 730	$2.92
RAM	0.5 GB × $0.002 × 730	$0.73
Storage	5 GB × $0.00001536 × 730	$0.06
Total		≈ $3.71

A shared-tier container auto-sleeps when idle and is free within the 360 compute hours included each month, which is plenty for preview deploys.

What it doesn't do (yet):

• The CLI docs don't describe token scopes. A personal access token acts as you, so the fences above matter.
• There's no documented approval queue on Hubfly's side. The approval step lives in your agent's permission settings.
• We haven't seen documented backups, snapshots or an SLA. Keep your own database backups before letting anything automated near production.

Who this is NOT for

• Teams that need per-project, least-privilege API tokens today. Wait for documented scopes, or keep the agent on a non-production project.
• Production databases with no backup. Fix that first. No permissions file replaces a restore you've tested.
• Fully unattended CI deploys. This setup assumes a human answers the ask prompt. For CI, use HUBFLY_TOKEN as a secret and a normal pipeline.

Takeaway

Let the agent read everything, make it ask before it deploys, and block the commands that delete. The Hubfly skill gives it the right habits. .claude/settings.json gives you the prompt. A project budget limit gives you a ceiling the agent can't argue with.

Read next: Gate your app on a Postgres migration job · Deploy Odoo with PostgreSQL and persistent storage · Hubfly CLI docs

Start free, 360 hours included. Install the skill, point your agent at a fresh project with a $10 budget limit, and let it ship your next preview. Create your Hubfly account →