CloudBase AI ToolKit

@cloudbase/cloudbase-mcp

MCP Server for Tencent CloudBase. Part of CloudBase AI Toolkit.

Operate CloudBase from AI coding tools: login, databases, functions, storage, hosting, and logs—via the Model Context Protocol.

English · 简体中文 · Toolkit README · Docs · Changelog · Issues

What this package is

@cloudbase/cloudbase-mcp is the npm distribution of the CloudBase MCP Server. It is one piece of the Toolkit:

Prefer Plugin when your IDE supports it. Use this package alone when you only need MCP config.

Full Toolkit narrative, related repos, and IDE matrix: repository README.

Quick start

{
  "mcpServers": {
    "cloudbase": {
      "command": "npx",
      "args": ["@cloudbase/cloudbase-mcp@latest"]
    }
  }
}

First prompts:

Login to CloudBase

Use CloudBase Skills to build a todo app with login, database and permissions, then deploy

You need a CloudBase environment and should confirm sensitive actions the AI proposes.

Other install paths

Connection modes

Remote (recommended): your IDE connects over HTTP to Tencent Cloud MCP. No local Node, and interactive clients finish authorization in the browser.

Pick the endpoint matching the site your environment lives in—the two sites use separate accounts and credentials.

OAuth (interactive, recommended): the URL is the whole configuration—your IDE opens the browser for login and consent, and you pick the environment there. No keys land in config files, and there is nothing to rotate.

{
  "mcpServers": {
    "cloudbase": {
      "type": "http",
      "url": "https://tcb-api.cloud.tencent.com/mcp/v1"
    }
  }
}

Static credentials (for a client without OAuth, and for CI/CD): append env_id and a key pair created on the same site as the endpoint.

{
  "mcpServers": {
    "cloudbase": {
      "type": "http",
      "url": "https://tcb-api.cloud.tencent.com/mcp/v1?env_id=<env_id>",
      "headers": {
        "X-TencentCloud-SecretId": "<Tencent Cloud Secret ID>",
        "X-TencentCloud-SecretKey": "<Tencent Cloud Secret Key>"
      }
    }
  }
}

A static key pair stays valid until it is rotated or deleted; an OAuth session ends when you log out. Use the static form only where the browser flow is impossible—and keep it out of a repository.

Local: runs npx @cloudbase/cloudbase-mcp@latest on your machine—full features, including local filesystem upload and template download. Requires Node.js v18.15.0+.

Remote trade-off: local-filesystem features (upload, template download) are unavailable, and the international site does not yet expose NoSQL tools.

Remote URLs accept site for one case only—a China-site environment in ap-singapore, where the region is ambiguous—plus enable_plugins / disable_plugins (comma-separated). Canonical plugin names: see src/server.ts in this package (e.g. env, database, functions, hosting, storage, pg_database, cloudrun, logs, feedback).

Self-hosted Cloud Mode: set CLOUDBASE_MCP_CLOUD_MODE=true (or MCP_CLOUD_MODE=true) so local file and process tools are disabled for remote callers.

Site & region

Set TCB_SITE (domestic / intl) to select the login/credential site, and TCB_REGION for API routing. The domestic and international sites are separate account systems. ap-singapore exists on both, so domestic-site Singapore users must set TCB_SITE=domestic; otherwise it defaults to intl. Project-level .cloudbase/project.json ({ site, region, envId }) is also supported.

In remote mode the site is determined by the endpoint host itself—tcb-api.cloud.tencent.com is the China site, tcb-api.tencentcloud.com is the international site—and there is no site query parameter to set. This holds for a China-site environment in ap-singapore too: keep using the China-site endpoint. Self-hosted Cloud Mode deployments can still use the TCB_SITE environment variable.

Experimental: MCP Apps panels (off by default)

auth, queryEnv and the deploy tools can render MCP Apps panels (ui://cloudbase/*) in hosts that support them. This is experimental and switched off by default: with no environment variable set, no ui:// resource is registered and no tool carries _meta.ui, so a host sees an ordinary MCP server and results stay plain JSON text.

Turn it on with CLOUDBASE_MCP_UI=on (also accepts 1 / true / yes / enabled). Anything else — off, 0, false, no, disabled, or a typo — leaves it off. Tools behave identically either way; the flag only decides whether panels are offered.

Capabilities

Typical backend work in your environment (confirm critical steps):

• Database: PostgreSQL and document DB, data models, CRUD, permissions
• Compute: cloud functions / Cloud Run—author, deploy, invoke, debug
• Auth & storage: login methods, object storage, permission linkage
• Release & ops: static hosting / Mini Program publish; logs and redeploy

Tool catalog: MCP tools · tools.json

Confirmations before destructive calls

Deleting a cloud function, a collection, the documents in one, a stored file, a CloudRun service or a MySQL instance now pauses the call until you answer a dialog that names the target — "about to delete the cloud function hello (env env-abc)" — instead of asking a bare "are you sure?". The same deletes pause when they arrive as callCloudApi, but only for an explicit service + Action pair: DeleteFunction on tcb or scf, tcb.DeleteTable, tcb.DeleteItem, tcb.DestroyEnv, tcb.DestroyPlatformEnv, tcb.DestroyMySQL, tcbr.DeleteCloudRunServer, and tcbr.DeleteCloudRunVersions when IsDeleteServer is true. A Delete prefix does not confirm other cloud APIs. Cloud storage deletes do not go through callCloudApi. PostgreSQL execute / applyMigration pause only when the SQL itself is DELETE, DROP, TRUNCATE or ALTER … DROP; INSERT, UPDATE and CREATE TABLE do not. It is built on MCP form elicitation, so it can only appear where the client declares that capability and actually asks the user.

A declined call is not a failure: the tool returns "not executed" plus what to do instead. Two environment variables change the handling, and neither of them bypasses authentication, permissions or read-only limits — they only decide whether the question is asked:

A client's own tool-approval prompt is not this confirmation: it asks "may this tool run?", not "is this the resource you want to delete?".

Credential-shaped arguments: one real check before writing

When a call's arguments contain something shaped like a credential — a three-part JWT, or a cb_secret_… / cb_publishable_… key — the server asks the client for one check before writing: compare the value against your original source and confirm. The message deliberately carries no plaintext: only the total length, the segment lengths (for a JWT), and a fingerprint (the first 12 hex characters of sha256). That is enough to notice a value that was changed while being copied or transcribed, and nothing that would put the secret into the conversation or into the logs.

What this is not. We do not decide whether the credential is valid. There is no signature verification, no certs/JWKS lookup, no network request of any kind, and no server-side comparison — the server never sees the value you originally pasted, so the only side that can compare it is the client. This is a request for a real confirmation at write time, not a validity check.

Boundaries. It only applies when the arguments actually contain a credential-shaped string (otherwise the call is unchanged: one shallow scan, no network). It only applies when the client supports interactive form elicitation; a client that cannot ask proceeds as before, so an unattended client is not blocked. And a check that returns within a few hundred milliseconds counts as "nobody looked at it": unlike the deletion confirmation — where a client answering for itself is treated as "you were not asked" and the call proceeds — a credential write is not executed, because a value nobody compared is exactly the case this guards against. When the guard declines, the result says "not executed" without being marked as an error, so a model does not retry it blindly.

Get-started panel (MCP Apps)

Where the client declares the io.modelcontextprotocol/ui extension, auth also opens a small read-only panel (ui://cloudbase/get-started). It consumes the structured result that this auth call already returned and shows the connection status in plain words — location (site plus region, e.g. "Shanghai (China)"), access scope, and the environment ID — with a single primary action for the current state (sign in when signed out, pick an environment when not bound, wire up a sample project when ready). The only call the panel makes is the read-only auth(status), fired by "Re-check"; every other action just hands a sentence to the conversation, and the raw response is folded into "View raw response".

Clients that do not render MCP Apps are unaffected: auth keeps the same title, description, arguments and output, and resources/list stays empty, so nothing new appears in a resource browser.

IDE config snippets

{
  "mcpServers": {
    "cloudbase": {
      "command": "npx",
      "args": ["@cloudbase/cloudbase-mcp@latest"]
    }
  }
}

{
  "mcpServers": {
    "cloudbase": {
      "command": "npx",
      "args": ["@cloudbase/cloudbase-mcp@latest"]
    }
  }
}

Others: IDE setup.

Docs

• Toolkit README
• Getting started
• AI plugins
• FAQ
• Changelog

License

MIT · TencentCloudBase