railway-mcp — rgate

Manage multiple Railway CLI logins on one machine. Switch accounts instead of logging out.

The Railway CLI holds exactly one login, in ~/.railway/config.json. railway logout throws it away, and there is no way back except a fresh browser login. If you work across a personal account and a client account, that is a login every time you change context.

rgate snapshots each login after you create it, and swaps them back in on demand. There is no rgate logout — that omission is the point.

$ railway login          # personal
$ rgate sync
synced michaelle.lubich@gmail.com (workspaces: Misha Lubich's Projects)

$ railway login          # client
$ rgate sync
synced ops@client.com (workspaces: Client Inc)

$ rgate ls
  #  email                        name          workspaces  token
  1  michaelle.lubich@gmail.com   Misha Lubich           1  valid
  2  ops@client.com               Ops                    1  valid   active

$ rgate switch 1
switched to michaelle.lubich@gmail.com

Install

uv tool install railway-mcp    # or: pipx install railway-mcp

Needs the Railway CLI on PATH.

Commands

Run rgate sync after every railway login — that is what makes an account switchable later.

Project links move with the account

Railway keeps per-directory project links in the same file as the login. A link created by one account is meaningless to another: it points at a project the other account cannot see. So rgate switch carries each account's links with it, saving the outgoing set and restoring the incoming one. Everything else in config.json — editor, sandboxes, keys Railway adds later — is left exactly as it was, and the file is backed up to config.json.bak first.

"refreshable" is normal, not broken

Railway access tokens last about an hour. The CLI renews them from the refresh token silently, so a stored credential whose expiry has passed is usually fine — rgate labels that refreshable and switches to it without complaint. Only a past expiry with no refresh token is expired, and only that needs railway login again (or rgate switch --force to write it anyway).

RAILWAY_API_TOKEN beats all of this

If RAILWAY_API_TOKEN or RAILWAY_TOKEN is set in your environment, the Railway CLI uses it and ignores config.json entirely — so rgate switch will appear to do nothing. rgate doctor checks for this.

MCP

rgate-mcp exposes the same operations to AI agents: railway_sync, railway_list_accounts, railway_switch, railway_whoami, railway_doctor.

{ "mcpServers": { "rgate": { "command": "rgate-mcp" } } }

Where things live

Tokens are stored in plain JSON readable only by your user — the same protection the Railway CLI gives its own config file, no more.

Development

uv venv && uv pip install -e ".[dev]"
.venv/bin/pytest

See CONTRACT.md for the behavioural spec the tests enforce.

MIT.