Vloud MCP

Operate a Vloud engine from Claude — list applications, read deploy and pipeline logs, query health, and (when you allow it) deploy and roll back.

Install

Point npm at this registry for the @vloud scope, once per machine:

npm config set @vloud:registry https://mcp.vloud.app

Then register the server with Claude Code:

claude mcp add vloud -- npx -y @vloud/mcp --engine prod

Or skip the config step and keep it to one line:

claude mcp add vloud -- npx -y --@vloud:registry=https://mcp.vloud.app \
  @vloud/mcp --engine prod

Point it at your engine

Create ~/.vloud/mcp.json:

{
  "defaultEngine": "prod",
  "engines": {
    "prod": { "url": "https://console.example.com",
              "tokenEnv": "VLOUD_MCP_TOKEN_PROD" }
  }
}

For a single engine you can skip the file and set VLOUD_ENGINE_URL and VLOUD_MCP_TOKEN instead.

The API key

Mint one in your Vloud console under API Keys. A read scope covers everything except writes.

The token is never stored in mcp.json. The server looks for it in this order:

OrderWhere
1VLOUD_MCP_TOKEN
2the engine's own tokenEnv variable
3OS keychain — service vloud-mcp, account vloud-mcp:<engine>
4~/.vloud/config.json, only if its serverUrl matches and the file is not world-readable

On macOS, to use the keychain:

security add-generic-password -U -s vloud-mcp \
  -a vloud-mcp:prod -w <your-key>

Read-only by default

27 read tools are exposed. Deploy, restart, rollback and pipeline re-run are not registered at all unless you add --allow-write — a model never sees a tool it cannot use.

The real boundary is the key, not the flag. Mint a read-scoped key and a misconfigured client still cannot deploy. DNS writes, SQL execution, table drops, backup restores and terminal access are not exposed at any setting.

Options

--engine <name>which engine, when a tool does not say
--namespace <a,b,c>engine, apps, deployments, pipelines, domains, databases, monitoring, logs, raw
--allow-writeenable deploy / restart / rollback / re-run
--allow-rawenable the generic API escape hatch
--read-onlyforce read-only; overrides the above