CloudBase

What this package is

@cloudbase/cloudbase-mcp is the npm distribution of the CloudBase MCP Server. It is one piece of the Toolkit:

Prefer Plugin when your IDE supports it. Use this package alone when you only need MCP config.

Full Toolkit narrative, related repos, and IDE matrix: repository README.

Quick start

{  "mcpServers": {    "cloudbase": {      "command": "npx",      "args": ["@cloudbase/cloudbase-mcp@latest"]    }  }}

First prompts:

Login to CloudBase

Use CloudBase Skills to build a todo app with login, database and permissions, then deploy

You need a CloudBase environment and should confirm sensitive actions the AI proposes.

Other install paths

Already using CloudBase CLI? tcb ai sets up MCP and Skills too (docs).

Connection modes

Remote (recommended): your IDE connects over HTTP to Tencent Cloud MCP. No local Node, and interactive clients finish authorization in the browser.

Pick the endpoint matching the site your environment lives in—the two sites use separate accounts and credentials.

OAuth (interactive, recommended): the URL is the whole configuration—your IDE opens the browser for login and consent, and you pick the environment there. No keys land in config files, and there is nothing to rotate.

{  "mcpServers": {    "cloudbase": {      "type": "http",      "url": "https://tcb-api.cloud.tencent.com/mcp/v1"    }  }}

Static credentials (for a client without OAuth, and for CI/CD): append env_id and a key pair created on the same site as the endpoint.

{  "mcpServers": {    "cloudbase": {      "type": "http",      "url": "https://tcb-api.cloud.tencent.com/mcp/v1?env_id=<env_id>",      "headers": {        "X-TencentCloud-SecretId": "<Tencent Cloud Secret ID>",        "X-TencentCloud-SecretKey": "<Tencent Cloud Secret Key>"      }    }  }}

A static key pair stays valid until it is rotated or deleted; an OAuth session ends when you log out. Use the static form only where the browser flow is impossible—and keep it out of a repository.

Local: runs npx @cloudbase/cloudbase-mcp@latest on your machine—full features, including local filesystem upload and template download. Requires Node.js v18.15.0+.

Remote trade-off: local-filesystem features (upload, template download) are unavailable, and the international site does not yet expose NoSQL tools.

Remote URLs accept site for one case only—a China-site environment in ap-singapore, where the region is ambiguous—plus enable_plugins / disable_plugins (comma-separated). Canonical plugin names: see src/server.ts in this package (e.g. env, database, functions, hosting, storage, pg_database, cloudrun, logs, feedback).

Self-hosted Cloud Mode: set CLOUDBASE_MCP_CLOUD_MODE=true (or MCP_CLOUD_MODE=true) so local file and process tools are disabled for remote callers.

Site & region

Set TCB_SITE (domestic / intl) to select the login/credential site, and TCB_REGION for API routing. The domestic and international sites are separate account systems. ap-singapore exists on both, so domestic-site Singapore users must set TCB_SITE=domestic; otherwise it defaults to intl. Project-level .cloudbase/project.json ({ site, region, envId }) is also supported.

In remote mode the site is determined by the endpoint host itself—tcb-api.cloud.tencent.com is the China site, tcb-api.tencentcloud.com is the international site—and there is no site query parameter to set. This holds for a China-site environment in ap-singapore too: keep using the China-site endpoint. Self-hosted Cloud Mode deployments can still use the TCB_SITE environment variable.

MCP Apps panels (on by default)

auth, queryEnv and the deploy tools can render MCP Apps panels (ui://cloudbase/*) in hosts that support them. Panels are on by default: the ui:// resources are registered and those tools carry _meta.ui.

Hosts that cannot render them are unaffected in practice — resources/list stays empty (the panels are ResourceTemplates without a list), so nothing new appears in a resource browser, and every tool keeps returning the same JSON text it did before. The flag only decides whether panels are offered.

Turn it off with CLOUDBASE_MCP_UI=off (also accepts 0 / false / no / disabled). Leaving it unset means on; a typo such as of also leaves it off, so a misspelled value never silently enables something you meant to disable. Tools behave identically either way.

Capabilities

Typical backend work in your environment (confirm critical steps):

• Database: PostgreSQL and document DB, data models, CRUD, permissions
• Compute: cloud functions / Cloud Run—author, deploy, invoke, debug
• Auth & storage: login methods, object storage, permission linkage
• Release & ops: static hosting / Mini Program publish; logs and redeploy

Tool catalog: MCP tools · tools.json

Confirmations before destructive calls

Deleting a cloud function, a collection, the documents in one, a stored file, a CloudRun service or a MySQL instance now pauses the call until you answer a dialog that names the target — "about to delete the cloud function hello (env env-abc)" — instead of asking a bare "are you sure?". The same deletes pause when they arrive as callCloudApi, but only for an explicit service + Action pair: DeleteFunction on tcb or scf, tcb.DeleteTable, tcb.DeleteItem, tcb.DestroyEnv, tcb.DestroyPlatformEnv, tcb.DestroyMySQL, tcbr.DeleteCloudRunServer, and tcbr.DeleteCloudRunVersions when IsDeleteServer is true. A Delete prefix does not confirm other cloud APIs. Cloud storage deletes do not go through callCloudApi. PostgreSQL execute / applyMigration pause only when the SQL itself is DELETE, DROP, TRUNCATE or ALTER … DROP; INSERT, UPDATE and CREATE TABLE do not. It is built on MCP form elicitation, so it can only appear where the client declares that capability and actually asks the user.

A declined call is not a failure: the tool returns "not executed" plus what to do instead. Two environment variables change the handling, and neither of them bypasses authentication, permissions or read-only limits — they only decide whether the question is asked:

A client's own tool-approval prompt is not this confirmation: it asks "may this tool run?", not "is this the resource you want to delete?".

Credential-shaped arguments: one real check before writing

When a call's arguments contain something shaped like a credential — a three-part JWT, or a cb_secret_… / cb_publishable_… key — the server asks the client for one check before writing: compare the value against your original source and confirm. The message deliberately carries no plaintext: only the total length, the segment lengths (for a JWT), and a fingerprint (the first 12 hex characters of sha256). That is enough to notice a value that was changed while being copied or transcribed, and nothing that would put the secret into the conversation or into the logs.

What this is not. We do not decide whether the credential is valid. There is no signature verification, no certs/JWKS lookup, no network request of any kind, and no server-side comparison — the server never sees the value you originally pasted, so the only side that can compare it is the client. This is a request for a real confirmation at write time, not a validity check.

Boundaries. It only applies when the arguments actually contain a credential-shaped string (otherwise the call is unchanged: one shallow scan, no network). It only applies when the client supports interactive form elicitation; a client that cannot ask proceeds as before, so an unattended client is not blocked. And a check that returns within a few hundred milliseconds counts as "nobody looked at it": unlike the deletion confirmation — where a client answering for itself is treated as "you were not asked" and the call proceeds — a credential write is not executed, because a value nobody compared is exactly the case this guards against. When the guard declines, the result says "not executed" without being marked as an error, so a model does not retry it blindly.

Environment panel (MCP Apps)

The panel is on by default. Set CLOUDBASE_MCP_UI=off to hide it. Where the client declares the io.modelcontextprotocol/ui extension, auth also opens a panel (ui://cloudbase/get-started). It consumes the structured result that this auth call already returned and shows the connection status: region, scope, and the environment ID. Signed-out users get a sign-in action. When no environment is bound, clicking a row binds it.

The panel does not touch cloud resources, but it is not a read-only surface. It makes two kinds of calls:

• auth(status) — read-only, fired by "Re-check".
• auth(set_env) — fired when you click an environment row. It only rebinds the local environment for this session (an environment-scoped API key still cannot reach another environment), but it changes which environment every subsequent tool call uses, so pick the row deliberately.

Every other action just hands a sentence to the conversation. A result that carries a credentials block (for example auth(get_temp_credentials) with reveal) does not open "View raw response", so that fold never shows the key.

Clients that do not render MCP Apps are unaffected: auth keeps the same title, description, arguments and output, and resources/list stays empty, so nothing new appears in a resource browser.

IDE config snippets

{  "mcpServers": {    "cloudbase": {      "command": "npx",      "args": ["@cloudbase/cloudbase-mcp@latest"]    }  }}

{  "mcpServers": {    "cloudbase": {      "command": "npx",      "args": ["@cloudbase/cloudbase-mcp@latest"]    }  }}

Others: IDE setup.

Docs

• Toolkit README
• Getting started
• AI plugins
• FAQ
• Changelog

License

MIT · TencentCloudBase