MCP tools

Each tool maps to one endpoint of the API and needs the scope of that endpoint. Answers are the API's JSON; errors keep their code, their details and the request_id, with a hint on what to do next.

Catalogue, no key

Tool	Arguments	Returns
list_regions	none	Where machines can run.
list_plans	region	Plans, resources, hourly and monthly prices.
list_images	region, plan, category	Systems and application images; the slug is what create_vm expects.

Account

Tool	Arguments	Scope
get_account	none	billing.read

Balance, hourly burn rate and runway, quota, monthly budget.

Machines

Tool	Arguments	Scope
list_vms	status, region, billing, cursor, limit	vms.read
get_vm	vm	vms.read
get_vm_metrics	vm, timeframe	vms.read
estimate_vm	plan, region, image, hostname, billing, ssh_keys, options, ipv4, vpc, private_only	vms.create
create_vm	as estimate_vm, plus payment, password_delivery, idempotency_key	vms.create
power_vm	vm, type: start, shutdown, reboot, stop	vms.action
rename_vm	vm, hostname	vms.action
reinstall_vm	vm, image, confirm_hostname, ssh_keys, password_delivery	vms.action
destroy_vm	vm, confirm_hostname, when	vms.destroy

estimate_vm runs every check of an order and prices it without creating anything. create_vm derives its idempotency key from the order itself: an agent that retries the same call after a timeout gets the first answer back, not a second machine. reinstall_vm and destroy_vm erase the disk and refuse to act unless confirm_hostname is the machine's exact hostname.

Actions

Tool	Arguments	Scope
get_action	action	vms.read
list_vm_actions	vm	vms.read

Creation, reinstall and power changes run in the background and return an action: poll get_action until its status leaves running. A new machine is ready in under two minutes.

Network and SSH keys

Tool	Arguments	Scope
get_vm_network	vm	vms.read
set_reverse_dns	vm, address, hostname (null clears)	network.write
list_ssh_keys	none	sshkeys.write or vms.read
add_ssh_key	name, public_key	sshkeys.write
delete_ssh_key	key	sshkeys.write

Private networks

Tool	Arguments	Scope
list_vpcs	none	vms.read
get_vpc	vpc	vms.read
create_vpc	name, cidr, region	network.write
delete_vpc	vpc	network.write
connect_vpc	vpc, vm, ip	network.write
disconnect_vpc	vpc, vm	network.write
move_vpc	vpc, vm, to	network.write

A private network links your machines through a second card, isolated from other customers and outside the counted bandwidth. connect_vpc connects a running machine without a restart; create_vm takes vpc, and private_only for a machine with no public address at all. See Private networks.

Firewalls

Tool	Arguments	Scope
list_firewalls	none	vms.read
get_firewall	firewall	vms.read
create_firewall	name, rules	network.write
update_firewall	firewall, name, rules (replaces the list)	network.write
delete_firewall	firewall	network.write
attach_firewall	firewall, vm	network.write
detach_firewall	firewall, vm	network.write

A firewall is a reusable set of rules: a machine with at least one refuses inbound traffic no rule opens, a machine without any accepts everything. A rule with direction: out restricts what goes out (DNS stays allowed). update_firewall replaces the whole rule list, so an agent reads get_firewall first and keeps TCP 22 open, or it loses SSH to the machine. See Firewalls.

Load balancers

Tool	Arguments	Scope
list_load_balancers	none	vms.read
get_load_balancer	lb	vms.read
get_load_balancer_metrics	lb, range	vms.read
create_load_balancer	name, vpc	vms.create
delete_load_balancer	lb	vms.destroy
upsert_pool	lb, pool (to update), name, protocol, health check	network.write
delete_pool	lb, pool	network.write
set_targets	lb, pool, targets (replaces the list)	network.write
upsert_listener	lb, listener (to update), port, protocol, default_pool, sources	network.write
delete_listener	lb, listener	network.write
set_rules	lb, listener, rules (replaces the list)	network.write

An agent builds a load balancer in order: create_load_balancer, a pool, set_targets, a listener, then set_rules to route by hostname or path. It is billed by the hour, so the agent shows the price first. An HTTPS hostname only gets its certificate once its DNS points to the load balancer: the agent tells the user which records to create. See Load balancers.

Databases

Tool	Arguments	Scope
list_databases	none	vms.read
get_database_options	none	vms.read
get_database	database	vms.read
get_database_metrics	database, range	vms.read
get_slow_queries	database	vms.read
list_database_backups	database	vms.read
get_database_credentials	database	databases.write
create_database	name, vpc, engine, version, size_gb	vms.create
restore_database	database, at, name	vms.create
fork_database	database, name	vms.create
detach_database_fork	database	vms.action
resize_database	database, size_gb	vms.create
delete_database	database, confirm_name	vms.destroy
update_database	database, name, maintenance window, disk_cap_gb, eviction_policy (Valkey)	databases.write
set_database_public_access	database, enabled, sources	network.write
backup_database	database	backups.write
create_database_user	database, username, databases, read_only	databases.write
set_database_user_access	database, username, databases, read_only	databases.write
reset_database_password	database, username	databases.write
delete_database_user	database, username	databases.write
create_logical_database	database, name	databases.write
delete_logical_database	database, name	databases.write
enable_extension	database, name, extension	databases.write
disable_extension	database, name, extension	databases.write

Managed databases (PostgreSQL, MySQL, MariaDB and Valkey) are in beta, open to every account. The agent shows the price (get_database_options) before create_database, and asks the user before delete_database, which wants the exact name back. Passwords only come from get_database_credentials and create_database_user: the agent hands them to the application through an environment variable or a secret store, never into code or logs. Each application gets its own user, limited to its logical database (databases, and read_only for one that only reads); set_database_user_access changes that later and closes the user's connections where its access goes down. restore_database and fork_database create a new database and overwrite nothing. Before resize_database, the agent states the new price and the minute or two of downtime: there is no way back to a smaller size. See Databases.

GitHub runners

Tool	Arguments	Scope
get_runners	none	billing.read
list_runner_jobs	repository, status, limit, cursor	billing.read

GitHub Actions runners are in beta, open to every account. Linking a GitHub organization or account goes through GitHub in a browser, in the console, so there is no tool for it: the agent reads the labels and prices, and follows jobs, including why one waits (credit, budget, vCPU cap) or was refused. See GitHub Actions runners.

What the MCP server does not do

Restoring or deleting a machine backup, opening a console session and adding IPv6 addresses stay in the API and the console: they are rare, and a mistake there is expensive. Invoices, payment methods and tickets are reachable by no key at all.

API keys and OIDC bindings are managed in the console only: neither a key nor a token can create one or widen its scopes.