Skip to main content

cloider mcp command reference

View as MarkdownOpen in ClaudeOpen in ChatGPT

cloider mcp turns the CLI into a Model Context Protocol (MCP) server, so AI agents such as Claude Code, Claude Desktop, Cursor and VS Code can manage your Cloider resources. The agent's MCP client starts the command and talks to it over stdin and stdout. Every tool runs a cloider command as the profile and token the CLI uses, so log in first.

cloider mcp [flags]

This page is the command reference. Setting it up in each AI client is covered in MCP setup, the full tool list in MCP tools, and how to keep an agent safe in Safety and permissions.

At a glance​

Transportstdio (the client starts cloider mcp and talks over stdin and stdout)
AuthenticationThe CLI's own login: the current profile, --profile, CLOIDER_TOKEN or --token-file
Tools123 tools in 8 toolsets, 54 of them read only
Restrict--read-only for read only tools, --toolsets for some toolsets
Not offeredInteractive and local commands (shell, db connect, login, logout, profile, update, app open, app link, registry login), and managing members and API tokens

Flags​

FlagTypeDefaultDescription
--read-onlyboolfalseOffer only the tools that change nothing
--toolsetsstringsallOffer only these toolsets, comma separated: account, clusters, databases, buckets, registry, apps, domains, support

The global flags --profile, --api-url and --token-file given to cloider mcp are passed on to every tool, so the whole server acts as that profile or token. Put them before mcp:

cloider mcp
cloider mcp --read-only
cloider mcp --toolsets apps,databases,domains
cloider --profile acme mcp --read-only

An unknown toolset fails at start with unknown toolset "dns", pick from account, clusters, databases, buckets, registry, apps, domains, support (exit code 2).

Toolsets​

ToolsetToolsRead onlyCovers
account66whoami, usage, billing, pricing, members and API tokens (read only)
clusters94Kubernetes clusters, kubeconfig, services, cluster_exec
databases166Databases, passwords, certificates, backups, restore, resize, SSL, trusted sources, insights, database_exec
buckets2913Buckets, settings, static websites, policies, lifecycle, CORS, files, versions, access keys
registry238Registry projects, repositories, images, tokens, retention, immutability
apps2310Apps, deploys, logs, variables, builds, git connections, app_exec
domains124Domains, DNS records, targets
support53Support requests and attachments

Some clients work better with fewer tools; --toolsets keeps the list short. Every tool and its arguments are listed in MCP tools.

Add it to an AI client​

For Claude Code:

claude mcp add cloider -- cloider mcp
claude mcp add cloider-acme -- cloider --profile acme mcp --read-only    # another account, read only

Claude Desktop, Cursor and other clients take the same command in their configuration file:

MCP client configuration
{
  "mcpServers": {
    "cloider": {
      "command": "cloider",
      "args": ["mcp"]
    }
  }
}

Run in a terminal by hand, cloider mcp only prints a hint, because it waits for an MCP client on stdin:

Output
cloider mcp talks MCP on stdin and stdout, for an AI client to start. Add it to Claude Code with:
  claude mcp add cloider -- cloider mcp

Client by client instructions are in MCP setup.

How do the tools run?​

Each tool call runs the matching cloider command again as a child process, with --output=json, --yes and --no-color, automatic updates off, and the server's global flags. So a tool behaves exactly like the command in a script: the same name, label or id resolution, the same waits, uploads and error messages.

  • Answers are the command's JSON output (trimmed to 1 MiB), plus anything it printed to stderr as notes. A failed command answers with its error message, marked as an error.
  • Waiting: tools that create, pause, resume or delete take a wait argument, which waits up to 15 minutes. Without it they return while the change is under way.
  • exec tools (app_exec, cluster_exec, database_exec) answer {exit_code, stdout, stderr, timed_out} even when the command fails, take stdin (up to 2 MiB) and timeout_seconds (1 to 3600, default 600).
  • Concurrency: at most 4 commands run at once, to stay within the API's rate limit.
  • Tools that would ask for confirmation in a terminal run without asking, because the server passes --yes. Your MCP client is what asks you, see below.

Tool safety hints​

Every tool tells the client what it does, through the standard MCP annotations, so a client can run reads without asking and ask before anything destructive:

AnnotationSet on
readOnlyHint: trueTools that change nothing: list_*, get_*, whoami, downloads
destructiveHint: trueTools that delete or replace something, and the exec tools, since a command can change anything
idempotentHint: trueRead tools, and changes that do nothing more when repeated, such as pause_cluster
openWorldHint: falseEvery tool: they only reach your Cloider account

--read-only removes every tool that isn't readOnlyHint, including the exec tools. Pair it with a read only API token to be sure an agent can't change anything, whatever its client allows:

cloider login --profile agent --read-only
claude mcp add cloider-readonly -- cloider --profile agent mcp --read-only

See Safety and permissions.

Frequently asked questions

How do I connect an AI agent to Cloider?

Install the CLI, log in with cloider login, then add cloider mcp as an MCP server in your client, for example claude mcp add cloider -- cloider mcp for Claude Code.

How do I make the MCP server read only?

Start it with cloider mcp --read-only, which only offers tools that change nothing. For a hard guarantee, also log the profile it uses in with cloider login --read-only.

Which account does cloider mcp use?

The same as the CLI: the current profile, or the one passed with cloider --profile <name> mcp, or the token in CLOIDER_TOKEN. whoami tells the agent which account it is in.

Can the MCP server manage members or API tokens?

No. Like the CLI, it can list them, but adding members, changing roles and creating or revoking tokens stay in the dashboard.

How do I give an agent fewer tools?

Use --toolsets, for example cloider mcp --toolsets apps,databases,domains. The toolsets are account, clusters, databases, buckets, registry, apps, domains and support.

Last updated on