Back to Browse

Cloady MCP Server

by Cloady
Developer ToolsUse Caution4.2MCP RegistryLocalRemote
Free

Server data from the Official MCP Registry

Deploy apps and databases, inspect logs, and manage cloud resources on Cloady.

About

Deploy apps and databases, inspect logs, and manage cloud resources on Cloady.

Remote endpoints: streamable-http: https://cloady.com/api/mcp

Security Report

4.2
Use Caution4.2High Risk

The local stdio server is a thin wrapper that forwards tool calls to the Cloady API with a bearer token read from an environment variable, which fits its stated purpose. The main concern is that the exposed tools include high-impact operations (remote shell exec in containers, revealing secret variables and database credentials, writes and DDL via raw SQL, and app deletion) that an AI assistant can invoke without a local confirmation step. The provided source is truncated, so the remaining tool definitions and the request-handling implementation could not be fully reviewed. Supply chain analysis found 8 known vulnerabilities in dependencies (0 critical, 3 high severity).

3 files analyzed · 13 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

env_vars

Check that this permission is expected for this type of plugin.

File System Read

Reads files on your machine. Normal for tools that analyze or process local data.

How to Install & Connect

Available as Local & Remote

This plugin can run on your machine or connect to a hosted endpoint. during install.

Documentation

View on GitHub

From the project's GitHub README.

@cloady/mcp

Local MCP server for Cloady — gives AI assistants the whole Cloady API as tools: workspaces, apps, deploys, environment variables, domains, volumes, members, integrations, billing and support tickets.

Generated from Cloady's OpenAPI contract, so every REST operation is a tool named after its operation id (listVars, createVar, deployApp, execCommand). It runs over stdio and calls https://cloady.com with your API token.

Setup

For the OAuth-based Claude plugin, see Cloady for Claude. It connects to the hosted MCP endpoint without installing the npm server or copying an API token.

Gemini CLI extension

Install the extension from this repository:

gemini extensions install https://github.com/Cloady/cloady-mcp

Open Gemini CLI and run /mcp auth cloady to sign in to Cloady through OAuth. Complete any required account verification and choose the narrowest scope for your task: read, deploy, or full. No API key or local npm server is needed for this extension.

Try "List my Cloady workspaces and running apps", "Explain the latest deployment failure from my app's build logs", or "Show available database templates and pricing before creating anything."

The extension sends tool arguments to https://cloady.com/api/mcp and returns permitted results to Gemini. These can include account and workspace metadata, application configuration, code, logs, metrics, database content, and support messages, depending on the tools you request. Google handles received results under its own policies; Cloady's handling, retention, and deletion are described in the Privacy Policy. An account-level connection can cover all workspaces the account belongs to, subject to scope and workspace role. Revoke its token in Cloady Account → API tokens to stop future requests. Revocation does not delete hosted data or copies already received by Gemini.

Review the target workspace, app, environment, region, and any charges before authorizing changes. Write tools can change or delete resources. The extension is free; hosted resources follow Cloady pricing. Support and deletion requests: hello@cloady.com.

The Gemini extension and Claude plugin are versioned separately from the local npm package.

Qwen Code

Qwen Code supports Gemini CLI extensions and converts their manifest during installation:

qwen extensions install https://github.com/Cloady/cloady-mcp

Use Cloady's OAuth connection in your client. The same account permissions, data handling, and hosting charges described above apply. See Qwen Code's extension documentation.

Local stdio package

Create an API token in the dashboard under Account → API tokens.

Claude Code

claude mcp add cloady -e BEARER_TOKEN_CLOADY=cldy_… -- npx -y @cloady/mcp

Claude Desktop / Cursor / any MCP client

{
  "mcpServers": {
    "cloady": {
      "command": "npx",
      "args": ["-y", "@cloady/mcp"],
      "env": { "BEARER_TOKEN_CLOADY": "cldy_…" }
    }
  }
}

API_BASE_URL overrides the target if you run Cloady elsewhere.

Tools

One per API operation. Arguments are the operation's path parameters, query parameters and body fields flattened into one object, so createVar takes workspaceSlug, appSlug, env, region, key, value and isSecret.

The token's scope (read / deploy / full) and your workspace role are enforced by the API on every call, exactly as they are for the dashboard and the SDKs.

Docs

Full reference at cloady.com/docs.

Distribution

This repository contains the source and build already published as @cloady/mcp@0.5.0 on npm, plus directory packaging. Run npm install and npm start. The Cursor plugin uses the pinned npm release. MCPB bundles include production dependencies.

Privacy Policy

This local server forwards tool arguments to the Cloady API using your configured API token. See Cloady Privacy Policy for data handling and contact information. Use the minimum necessary token scope; write tools can change or delete resources.

The 0.5.1 desktop bundle adds tool titles and conservative read/write annotations to the 0.5.0 API implementation. The Cursor configuration continues to use the published npm 0.5.0 release.

Reviews

No reviews yet

Be the first to review this server!