Developers

AI agents (MCP)

Let Claude, Cursor or VS Code read your infrastructure and make safe changes through the Model Context Protocol, with a limit set by your organization and a record of every tool call.

What it is

Every tenant has its own MCP server, at https://<your-tenant>/api/mcp. An AI assistant connected to it can look at your servers, networks, storage, Kubernetes clusters, databases, alerts and jobs, and — only if you allow it — make a short list of safe, reversible changes. It is off until you turn it on.

The agent goes through the same API as the console, with the permissions of the person who connected it. It can never do more than that person could.

Turn it on

Two switches decide what agents may do, and the stricter one wins:

  • Organization limit. An organization owner or admin sets the highest level for each tenant in the organization console, under Settings → AI agents on your tenants: Off, Read only, or Read and safe changes. Raising the limit turns agents on for that tenant at that level straight away.
  • Tenant setting. A tenant admin can lower it or turn it off in the tenant console, under Developers → AI agents (MCP), but never above the organization limit.

While the setting is Off, the MCP endpoint does not exist for that tenant. Turning it off disconnects every connected app at once.

Connect Claude.ai or Claude Desktop

Open Settings → Connectors → Add custom connector and paste your tenant's MCP URL — the tenant console shows it under Developers → AI agents (MCP). You sign in to CloudOps and approve the access; no token is needed. The app then appears under Connected apps on that page.

Connect Claude Code, Cursor or VS Code

These clients use a personal API token, created on the API tokens page of the tenant console. The agent acts with the token's role, so give it a viewer token if it should only read.

claude mcp add --transport http cloudops-<your-tenant> \
  https://<your-tenant>/api/mcp \
  --header "Authorization: Bearer cop_YOUR_TOKEN"

For Cursor (~/.cursor/mcp.json) and other clients that read an mcp.json file:

{
  "mcpServers": {
    "cloudops-<your-tenant>": {
      "type": "http",
      "url": "https://<your-tenant>/api/mcp",
      "headers": { "Authorization": "Bearer cop_YOUR_TOKEN" }
    }
  }
}

If your organization restricts API access by IP address, the machine running the agent must be on the API allowlist.

What agents can do

  • Read only: the tenant overview, servers with their metrics and jobs, networks, security groups, load balancers, volumes, object stores, Kubernetes clusters, databases, alerts and alert rules, regions and images.
  • Read and safe changes (member role or higher): start, stop and reboot VMs; start, stop and reboot managed databases; attach and detach volumes; add or remove Kubernetes nodes; tag servers; refresh a server's status.
  • Create and delete (an extra opt-in on the tenant's AI agents page): create Linux VMs and block volumes, and delete the ones the same connection created. These are billable, and agents are told to delete what they no longer need.

What agents can never do

  • See passwords, SSH keys, kubeconfigs, VPN secrets, object-store credentials or job logs.
  • Run commands on your machines, install packages or start automation jobs.
  • Change firewall rules, security groups, members, roles, API tokens or the AI agent settings themselves.
  • Delete anything a person created. An agent can delete only what its own connection created.

Ownership of what an agent creates

Each VM or volume an agent creates is marked with the connection that made it — an API token or a connected app. A delete is refused for anything without that mark, or with another connection's mark, so one agent cannot remove another agent's work, and no agent can remove yours.

Audit and revoking access

Every tool call is recorded with the token, the tool, the API route and the result, and listed under Recent agent activity on the tenant's AI agents page. The changes themselves run as ordinary automation jobs. To cut an agent off, disconnect the app under Connected apps, revoke its API token, or turn the setting off.

Organization endpoint

A second, read-only endpoint at https://cloud-ops.io/api/mcp answers questions about your organizations: members, tenants (with each tenant's MCP URL), billing summary and invoices, plan usage, and marketplace listings and rentals. It cannot reach a tenant's infrastructure or change anything. Add it in Claude.ai the same way as a tenant endpoint.