Tools Reference

This page lists every tool the MCP Server exposes, grouped by the resource it operates on. Tool names are the exact identifiers the AI calls — you normally describe what you want in natural language and let the assistant pick the tool, but knowing what exists helps you prompt precisely and understand what an assistant is doing on your behalf.

You don’t call these tools directly. Describe the outcome you want — see Usage Examples for prompt patterns — and the assistant selects and chains the right tools.

Toolset profiles

The server advertises a different set of tools depending on the toolsets query parameter on the endpoint URL. A smaller set keeps the assistant focused and fits comfortably in its context window; the larger sets unlock specialized resource families.

Profile	Tools	Endpoint	Includes
`readonly`	34	`https://mcp.cpln.io/mcp?toolsets=readonly`	Investigation only: observability, runtime state, inventory, generic reads, and one-call workload diagnosis. Nothing that creates, updates, deletes, or executes, so an assistant on this profile cannot change a live resource.
`core`	71	`https://mcp.cpln.io/mcp`	The default. Job tools that do a whole task in one call (deploy an app, add a database, create or rotate a secret, and diagnose, restart, roll back, or promote a workload), plus workloads, GVCs, image builds (from a repository, or from source the assistant writes itself), domains, identities, policies, templates, volume sets, observability (logs, metrics, traces, audit), quotas, and Terraform export.
`mk8s`	73	`https://mcp.cpln.io/mcp?toolsets=mk8s`	Everything in `core` plus `create_mk8s` and `update_mk8s`, which provision and update managed Kubernetes clusters on every supported provider.
`full`	119	`https://mcp.cpln.io/mcp?toolsets=full`	Every tool, including agents, cloud accounts, IP sets, service accounts, groups, audit contexts, external logging, advanced workload configuration, and volume snapshots.

Connecting to https://mcp.cpln.io/mcp with no query parameter gives you the core profile. To switch profiles, point your client at the URL with the ?toolsets= parameter — see your tool’s setup page for where the endpoint URL is configured.

Reading the tables

Each tool is listed with its name, its label, and what it does. The Access column flags how the tool behaves:

Marker	Meaning
Read	Read-only. Fetches data without changing anything.
Write	Creates or modifies a resource.
Destructive	Deletes, removes, or overwrites data. Assistants present the impact and ask for your confirmation before running these.

Tools available only in a larger profile are marked mk8s or full next to the access marker; everything else is in core.

Docs & guidance

Tools the assistant uses to ground itself in accurate Control Plane facts, schemas, and documentation. The two documentation tools, search_control_plane and query_docs_filesystem_control_plane, are proxied from the standalone docs MCP at docs.controlplane.com/mcp; the rest are served by the MCP Server itself.

Name	Label	Description	Access
`get_cpln_rules`	Get Control Plane Operating Guide	The operating guide: approval for high-impact actions, the platform facts the tools do not check, Terraform ownership, targets, CLI use, and failure handling. Optional, since the core rules arrive with every connection.	Read
`get_cpln_skill`	Get a Control Plane Skill	The runbook for one task family: how to use a feature correctly, the constraints that are easy to miss, and when it’s the wrong tool. Not advertised when the AI Plugin supplies its own skills.	Read
`plan_app`	Plan an App	Before any code for an app that keeps anything (content, records, files, or sign-ins): how Control Plane keeps its files, records, secrets, and replicas, and the tools that do each. The assistant settles what your request leaves open with you first. Not in `readonly`.	Read
`get_resource_schema`	Get Resource Schema & API Endpoints	The exact object schema and REST endpoints for a resource kind, for authoring an accurate manifest or calling the API.	Read
`get_permissions`	Get Permissions for a Resource Kind	The grantable permissions for a resource kind, for building policies.	Read
`search_control_plane`	Search Control Plane Docs	Search the documentation: up to five hits, each with a short excerpt and its page path.	Read
`query_docs_filesystem_control_plane`	Query Control Plane Docs Filesystem	Read a whole docs page, or search the docs pages and OpenAPI specs, with read-only, shell-like commands.	Read

Generic resource tools

The single read and delete tools that work for every resource kind. Use these to list, inspect, or delete resources — pass the kind (workload, secret, gvc, and so on); secrets are read-only. All are in core.

Name	Label	Description	Access
`list_resources`	List Resources of a Kind	List resources of one kind as a summary table.	Read
`get_resource`	Get a Resource	Fetch one resource by kind and name, with its full JSON. Secrets return metadata only — the API never includes their data.	Read
`delete_resource`	Delete a Resource	Delete one resource by kind and name. The single delete tool for every deletable kind — secrets are not deletable.	Destructive

Jobs

Each job tool does a whole task in one call: it reads the state it needs, makes the change, waits up to about 40 seconds for the result, and returns the outcome. When the task needs longer, the result names the exact call that continues it. create_secret and rotate_secret under Secrets and create_domain under Custom domains work the same way. All are in core.

Name	Label	Description	Access
`deploy_app`	Deploy an App	Build and deploy an HTTP app: from the app files stored with `write_app_files`, a GitHub or GitLab repository, or an existing image. Creates or updates a standard workload with production defaults (health checks, and two replicas so a deploy never takes it offline), grants access to the secrets its env references, and returns the public URL once it is ready. `timeoutSeconds` raises the platform’s 5 second request limit for slow requests, and more replicas than the org’s quota allows are refused before anything is built. With no GVC named, it uses the GVC it created for apps, asks before using any other, and creates the org’s first one in the location you choose. It replaces a workload it didn’t create only after your explicit yes. Serverless, multi-container, cron, and non-HTTP workloads use `create_workload`.	Destructive
`add_database`	Add a Database	Install PostgreSQL, MySQL, MariaDB, MongoDB, or Redis from the Template Catalog with credentials Control Plane generates, let the named workloads connect, and return the host, port, and the env values an app uses as `cpln://secret` references. No credential passes through the chat. It starts one instance: Redis also has a failover tier, and PostgreSQL and MongoDB failover are separate templates. With no GVC named, it places the database the way `deploy_app` places an app.	Write
`diagnose_workload`	Diagnose a Workload	Find out why a workload is unhealthy: reads its deployments, events, and recent error logs, and returns each likely cause with its evidence and the fix. Also in `readonly`.	Read
`restart_workload`	Restart a Workload	Replace every replica with a fresh one on the same spec, so the workload rereads its secrets and env, then wait until it is ready.	Destructive
`rollback_workload`	Rollback a Workload	Put a workload back on its previous image, or on a given one, changing nothing else, then wait until it is ready.	Destructive
`promote_workload`	Promote a Workload	Run a workload in another GVC of the same org with its current spec, such as staging to production, with an optional image and env values for the target. Grants access to the secrets its env references and overwrites a workload of the same name there.	Destructive
`allow_workload_access`	Allow Workload Access	Let other workloads reach a workload through its internal firewall, keeping every other rule, and return the internal URL the callers use. Also takes callers back out.	Write
`grant_cloud_access`	Grant Cloud Access	Give a workload credential-free access to AWS, GCP, or Azure through an existing cloud account: sets up its identity, binds the access, and waits until the identity reports it usable.	Write

GVCs

Create and manage GVCs and the cloud locations they span.

Name	Label	Description	Access
`create_gvc`	Create a Control Plane GVC	Create a GVC with one or more cloud locations. If you leave the location to the assistant, it picks one and tells you which.	Write
`update_gvc`	Update a Control Plane GVC	Update a GVC’s settings, such as its description, tags, or pull secrets.	Destructive
`add_gvc_locations`	Add locations to a GVC	Add one or more cloud locations to an existing GVC.	Write · `full`
`remove_gvc_locations`	Remove locations from a GVC	Remove cloud locations from a GVC.	Destructive · `full`

Workloads

Create, update, run, and operate workloads. Deploying, restarting, rolling back, promoting, and diagnosing a workload each take one call with the job tools. The advanced configure_workload_* tools each manage one specialized block of the spec and live in the full profile.

Name	Label	Description	Access
`create_workload`	Create a Workload	Create a serverless, standard, stateful, or cron workload with its containers and exposure.	Write
`update_workload`	Update a Workload	Update an existing workload — image, resources, scaling, environment, and more.	Destructive
`grant_workload_secret_access`	Grant Workload Secret Access	Grant an existing workload access to a secret by wiring its identity and access policy. Never returns secret values.	Write
`workload_start_cron`	Workload — Start a Cron Run	Trigger an immediate run of a cron workload.	Destructive
`workload_stop_replica`	Workload — Stop a Replica	Terminate one running replica of a workload; the platform reschedules a replacement per the scaling settings.	Destructive
`configure_workload_load_balancer`	Configure Workload Load Balancer	Set or clear the direct per-location load balancer, geo headers, and replica-direct routing.	Destructive · `full`
`configure_workload_security`	Configure Workload Security Options	Set or clear the pod-level security context (filesystem group, run-as user).	Destructive · `full`
`configure_workload_rollout`	Configure Workload Rollout Options	Set or clear how updates roll out — surge, unavailability, and scaling policy.	Destructive · `full`
`configure_workload_retry`	Configure Workload Request Retry Policy	Set or clear the retry behavior for failed requests.	Destructive · `full`
`configure_workload_sidecar`	Configure Workload Envoy Sidecar	Set or clear the Envoy proxy filter chain. Advanced.	Destructive · `full`
`configure_workload_local_options`	Configure Workload Per-Location Options	Set or clear per-location overrides of the default options.	Destructive · `full`
`configure_workload_extras`	Configure Workload BYOK Extras	Set or clear BYOK-only Kubernetes customizations (affinity, tolerations, spread constraints).	Destructive · `full`

Images

Build container images on Control Plane and follow the build. An image record is created by pushing, so there is no create or update tool — list, inspect, and delete image records with the generic tools using kind: image.

Name	Label	Description	Access
`write_app_files`	Write App Files	Write or edit an app’s files (whole text files, appends for a large file in parts, exact-text edits, deletions, and moves or renames, uploaded files included) under an app name, for chats that cannot write files or agents without the `cpln` CLI (an agent with a filesystem and the CLI writes a local folder and builds it with the CLI instead). Files you have to provide yourself, such as pictures, come in through an upload link from `create_app_files_upload_link`; files attached to the chat cannot be forwarded. The files are stored on Control Plane between calls; the same name is the image name `build_image` produces. Limits match GitHub’s: 100 MB per file, 1 GB per app.	Write
`build_image`	Build an Image	Build an image from a GitHub or GitLab repository, or from the app files stored with `write_app_files`, and push it to the org’s private registry. Returns a build id; the build keeps running after the call returns. Building an existing `NAME:TAG` replaces that image.	Destructive
`get_image_build`	Get an Image Build Status and Log	Read a build’s status, progress events, and log by its build id.	Read
`create_app_files_upload_link`	Create an App Files Upload Link	Get an upload link for files you have to provide (pictures, fonts, PDFs, data). Open it in a browser and drop every file at once: the page sorts each one into place, such as the logo into its own spot and a set of photos into their folder, where order does not matter, and you can move any file before uploading. The link works for an hour, up to 100 MB per file.	Write
`get_app_files`	Get App Files	List an app’s stored files, read one (in slices for a large file), or get a short-lived download link (tar.gz) for all of them. Also reports where each of the app’s images was built from: stored files, a repository, a folder uploaded with the CLI, or a push outside a Control Plane build.	Read

No Docker daemon is involved: the build service clones the repository or assembles the stored app files, detects how to build it (using the Dockerfile when one is present, otherwise by auto-detecting the stack), and always produces a linux/amd64 image. Building an existing NAME:TAG replaces that image, so prefer a fresh tag. deploy_app under Jobs builds and deploys in one call.

The MCP server has no access to your filesystem, so a folder on your machine builds through the CLI instead: cpln image build --remote --dir PATH --name NAME:TAG uploads the folder and builds it the same way, also without Docker.

A private repository needs a one-time browser authorization per organization. The first build that needs it returns an authorization link instead of starting a build; open the link, approve access, then ask the assistant to build again. The link is single-use and expires shortly. Later builds in that organization run without prompting.

Secrets

Secret values never pass through the chat. list_resources and get_resource show a secret’s metadata, never its data. create_secret fills a new secret with values Control Plane generates, or hands you a Console link where you type values only you have; rotate_secret replaces the values and restarts the workloads that use them. No tool accepts, reveals, or deletes a secret value, and deleting a secret stays in the Console, the CLI, Terraform, Pulumi, or the API. To let a workload read a secret, use grant_workload_secret_access under Workloads; deploy_app and promote_workload grant it for the secrets their env references.

Name	Label	Description	Access
`create_secret`	Create a Secret	Create a secret with random values Control Plane generates now, or get a Console link prefilled with its name, type, and keys where you type the values. No input accepts a value and no result contains one.	Write
`rotate_secret`	Rotate a Secret	Replace a secret’s values, generated again or entered by you through a Console link, and restart the workloads that use it. Anything outside Control Plane that holds the old values stops working.	Destructive

Custom domains

Configure custom domains, their port listeners, routes, TLS, and CORS. Port, route, TLS, and CORS tools operate on an existing domain.

Name	Label	Description	Access
`create_domain`	Create a Domain	Put a domain in front of a workload: from the domain, workload, and GVC it derives the 443 listener, the route, and `cname` mode, and returns the DNS records to add. A custom setup (other listeners, `ns` mode, several routes) passes the ports and DNS mode instead.	Write
`update_domain`	Update a Domain	Update a domain’s metadata, host/subdomain acceptance flags, and GVC or workload binding.	Destructive
`add_domain_port`	Add a Domain Port Listener	Add a port listener (for example, 443/http2) to a domain.	Write
`remove_domain_port`	Remove a Domain Port Listener	Remove a port listener from a domain.	Destructive
`add_domain_route`	Add a Route to a Domain Listener	Add a route mapping a path or prefix to a workload.	Write
`update_domain_route`	Update a Route on a Domain Listener	Update an existing route on a domain listener.	Destructive
`remove_domain_route`	Remove a Route from a Domain Listener	Remove a route from a domain listener.	Destructive
`set_domain_tls`	Set TLS on a Domain Listener	Set the TLS configuration on a domain listener.	Destructive
`clear_domain_tls`	Clear TLS on a Domain Listener	Clear the TLS configuration from a domain listener.	Destructive
`set_domain_cors`	Set CORS on a Domain Listener	Set the CORS policy on a domain listener.	Destructive · `full`
`clear_domain_cors`	Clear CORS on a Domain Listener	Clear the CORS policy from a domain listener.	Destructive · `full`

Identity & access

Manage identities, policies, groups, service accounts, and the private-network resources attached to an identity. Groups, service accounts, network resources, and user invitations are in full. Credential-free cloud access for a workload takes one call with grant_cloud_access under Jobs.

Name	Label	Description	Access
`create_identity`	Create an Identity	Create a GVC-scoped identity for workload access to secrets, cloud resources, and private networks.	Write
`update_identity`	Update an Identity	Update an identity’s settings and bound credentials.	Destructive
`create_policy`	Create a Policy	Create a policy that grants permissions on resources to principals.	Write
`update_policy`	Update a Policy	Update a policy’s bindings, targets, or permissions.	Destructive
`create_group`	Create a Group	Create a group of users and service accounts, with optional tag-based membership.	Write · `full`
`edit_group`	Edit a Group	Update a group’s membership or membership query.	Destructive · `full`
`create_service_account`	Create a Service Account	Create a service account for programmatic access.	Write · `full`
`update_service_account`	Update a Service Account	Update a service account’s description or tags, or revoke its keys by name.	Destructive · `full`
`add_key_to_service_account`	Add Key to Service Account	Create the service account if needed, optionally add it to a group, and return the Console page where you add the key and see it once. The key never passes through the chat.	Write · `full`
`invite_user_to_org`	Invite User to Organization	Invite a user by email to join the organization.	Write · `full`
`add_identity_network_resource`	Add Agent-Based Network Resource	Add an agent-based (wormhole) network resource so a workload can reach a private endpoint.	Write · `full`
`add_identity_native_network_resource`	Add Cloud-Native Network Resource	Add an AWS PrivateLink or GCP Private Service Connect network resource to an identity.	Write · `full`
`list_identity_network_resources`	List Network Resources on an Identity	List the agent-based and cloud-native network resources attached to an identity.	Read · `full`
`remove_identity_network_resource`	Remove Network Resource from Identity	Remove a network resource from an identity.	Destructive · `full`

Template catalog

Browse and operate the Template Catalog: production-ready stacks you install instead of hand-authoring resources. For PostgreSQL, MySQL, MariaDB, MongoDB, or Redis, add_database under Jobs installs the template with generated credentials in one call.

Name	Label	Description	Access
`browse_templates`	Browse Template Catalog	List the catalog — name, category, latest version, and whether each template creates its own GVC.	Read
`get_template`	Get Template Detail & Example Values	Show a template’s versions, prerequisites, and example `values.yaml`.	Read
`install_template`	Install Template	Install a catalog template as a new release. With `dryRun: true`, it renders what the install would create and applies nothing.	Write
`upgrade_template`	Upgrade Template	Upgrade an installed release to a new version or updated values.	Destructive
`rollback_template`	Rollback a Template Release	Roll a release back to a prior revision.	Destructive · `full`
`uninstall_template`	Uninstall Template	Uninstall a release and remove the resources it created.	Destructive
`list_installed_templates`	List Installed Templates	List the template releases installed in an org.	Read
`get_installed_template`	Get Installed Template Resources	Show a release’s status, revision, and the resources it created.	Read

Volume sets & storage

Create volume sets, mount them to workloads, and manage their volumes and snapshots. Snapshot and per-volume operations are in full.

Name	Label	Description	Access
`create_volumeset`	Create a Volumeset	Create a volume set for persistent storage.	Write
`update_volumeset`	Update a Volumeset	Update a volume set’s settings. A new snapshot policy without a retention keeps the current one, so scheduled snapshots always expire.	Destructive
`mount_volumeset_to_workload`	Mount Volumeset to Workload	Mount a volume set to a workload at a path (ext4/xfs require a stateful or VM workload; shared mounts on any type).	Write
`expand_volumeset`	Expand Volumeset Volume	Increase a volume’s capacity with no downtime or data loss.	Write
`shrink_volumeset`	Shrink Volumeset Volume	Shrink a volume to a smaller capacity. Data is migrated, but if used bytes exceed the new size the excess is lost — snapshot first.	Destructive · `full`
`create_volumeset_snapshot`	Create Volumeset Snapshot	Create a point-in-time snapshot of a volume.	Write · `full`
`list_volumeset_snapshots`	List Volumeset Snapshots	List the snapshots of a volume set.	Read · `full`
`restore_volumeset_snapshot`	Restore Volumeset Snapshot	Restore a snapshot, discarding everything written since it was taken.	Destructive · `full`
`delete_volumeset_snapshot`	Delete Volumeset Snapshot	Delete a volume set snapshot.	Destructive · `full`
`delete_volumeset_volume`	Delete Volumeset Volume	Delete a single volume from a volume set.	Destructive · `full`

Observability

Inspect deployments, logs, events, replicas, metrics, traces, the audit trail, and the status of asynchronous operation commands. All are in core.

Name	Label	Description	Access
`list_deployments`	List Workload Deployments	A workload’s per-location rollout status — the primary readiness check after a deploy.	Read
`get_workload_logs`	Get Workload Logs	Query a workload’s logs by structured parameters or a raw LogQL query.	Read
`get_workload_events`	Get Workload Events	Fetch a workload’s event log to diagnose readiness, liveness, and deploy failures.	Read
`list_workload_replicas`	List Workload Replicas	List the running replicas of a workload in a location.	Read
`list_metrics`	List & Discover Metrics	Discover the metrics and labels you can query, each with a correct PromQL template.	Read
`query_metrics`	Query Workload Metrics (PromQL)	Run a PromQL query against Control Plane metrics.	Read
`query_audit_events`	Query Audit Events	Query the audit trail for mutations on resources of a kind.	Read
`query_traces`	Query Distributed Traces	Search distributed traces, newest first, by GVC, workload, HTTP method, request id, errors, or duration, or with TraceQL.	Read
`get_trace`	Get Trace	Fetch one trace by ID and summarize its span tree with each span’s duration, method, path, and status, its request ids, and its errors.	Read
`list_commands`	List Commands	List the asynchronous operation commands issued against a workload or volume set — cron runs, replica stops, and volume operations.	Read
`get_command`	Get a Command	Fetch one asynchronous command by ID to check a long-running operation’s status.	Read

Terraform & IaC

Convert manifests to Terraform and export existing resources as HCL for infrastructure as code. export_terraform exports one resource, or every resource under a path such as /org/ORG or /org/ORG/gvc/GVC/workload.

Name	Label	Description	Access
`convert_to_terraform`	Convert a manifest to Terraform	Convert a resource manifest to Terraform HCL, dry-run validated against the API first.	Read
`export_terraform`	Export an existing resource to Terraform	Generate Terraform HCL for existing resources from a self link, single or in bulk.	Read

Terraform and Pulumi tag every resource they manage with cpln/managedByTerraform: "true". When get_resource reads such a resource, or any tool changes one, the result tells the assistant to warn you: a change made through the MCP server drifts from your code, and the next apply can revert it unless your code gets the change too.

Cloud accounts, agents & networking

Onboard cloud accounts, create agents for private connectivity, and reserve IP sets. All are in full.

Name	Label	Description	Access
`how_to_create_cloud_account`	How to Create a Cloud Account	The setup a cloud account needs on the provider’s side, filled in with your values: the IAM role and policies for AWS, the service account roles for GCP, the connector steps for Azure, or the account secret for NATS NGS.	Read · `full`
`create_cloud_account`	Create a Cloud Account	Create a cloud account bridging Control Plane to AWS, GCP, Azure, or NGS.	Write · `full`
`update_cloud_account`	Update a Cloud Account	Update a cloud account’s settings.	Destructive · `full`
`create_agent`	Create an Agent	Start creating an agent for secure connectivity to a private network: returns a Console link with its name and description prefilled, where you finish and download the bootstrap config. The config never passes through the chat.	Read · `full`
`update_agent`	Update an Agent	Update an agent’s settings.	Destructive · `full`
`get_agent_info`	Get Agent Info	Fetch an agent’s real-time status — active state, last heartbeat, peer and service counts.	Read · `full`
`get_agent_eventlog`	Get Agent Event Log	Fetch an agent’s event log.	Read · `full`
`create_ipset`	Create an IP Set	Reserve static public IPs per location.	Write · `full`
`update_ipset`	Update an IP Set	Update an IP set’s settings.	Destructive · `full`
`add_ipset_location`	Add or update IP set locations	Add locations to an IP set or update their retention policy. Passing an existing location overwrites its entry, and retention policy `free` releases an allocated static IP.	Destructive · `full`
`remove_ipset_location`	Remove IP set locations	Remove locations from an IP set.	Destructive · `full`

Organization & operations

Find the orgs a connection can use, and manage org settings, quotas, audit contexts, and external logging. All are in full except list_orgs and list_quotas.

Name	Label	Description	Access
`list_orgs`	List Organizations	The orgs this connection can use (the ones you selected when you connected), each with its GVCs and their locations. With a single org selected, every tool uses it when no org is named. Also in `readonly`.	Read
`update_org`	Update Organization Settings	Update organization-wide settings.	Destructive · `full`
`list_quotas`	List Organization Quotas	List the org’s resource quotas with current usage — filter to those near their limit.	Read
`get_quota`	Get Quota Details	Fetch the details and current usage of one quota.	Read · `full`
`create_audit_context`	Create Audit Context	Create a custom audit context for tamper-proof external events.	Write · `full`
`edit_audit_context`	Edit an Audit Context	Update an audit context’s description and tags. Replaces the description and can clear existing tags.	Destructive · `full`
`get_external_logging`	Get External Logging Configuration	View the org’s primary and extra external logging providers.	Read · `full`
`configure_external_logging`	Configure External Logging	Configure log shipping to an external provider (S3, Datadog, Coralogix, and more).	Destructive · `full`
`remove_external_logging`	Remove External Logging Provider	Remove an external logging provider from the org.	Destructive · `full`

Managed Kubernetes

Provision and update managed Kubernetes clusters on every supported provider with two tools that take the provider and its settings. They are available in the mk8s and full profiles: connect to https://mcp.cpln.io/mcp?toolsets=mk8s to use them.

Name	Label	Description	Access
`create_mk8s`	Create an mk8s Cluster	Create a cluster on AWS, GCP, Azure, DigitalOcean, Hetzner, Linode, Lambda Labs, Oblivus, Paperspace, or Triton, or on hardware you own with `generic`. The provider’s credential secret must exist first; the tool names any required setting that is missing.	Write · `mk8s`
`update_mk8s`	Update an mk8s Cluster	Update a cluster by sending only what changes. Node pool changes provision or remove nodes, region and network settings cannot change, and the Kubernetes version moves one minor version at a time.	Destructive · `mk8s`

Next steps

MCP Server

Endpoint, authentication, and the compatible-tools list

Usage Examples

Practical prompts that put these tools to work

AI Plugin

Skills, agents, commands, and guardrails on top of the MCP server

Reference

The full configuration and behavior of every Control Plane resource

Getting Started

MCP Clients

Toolset profiles

Reading the tables

Docs & guidance

Generic resource tools

Jobs

GVCs

Workloads

Images

Secrets

Custom domains

Identity & access

Template catalog

Volume sets & storage

Observability

Terraform & IaC

Cloud accounts, agents & networking

Organization & operations

Managed Kubernetes

Next steps

MCP Server

Usage Examples

AI Plugin

Reference

​Toolset profiles

​Reading the tables

​Docs & guidance

​Generic resource tools

​Jobs

​GVCs

​Workloads

​Images

​Secrets

​Custom domains

​Identity & access

​Template catalog

​Volume sets & storage

​Observability

​Terraform & IaC

​Cloud accounts, agents & networking

​Organization & operations

​Managed Kubernetes

​Next steps

MCP Server

Usage Examples

AI Plugin

Reference

Toolset profiles

Reading the tables

Docs & guidance

Generic resource tools

Jobs

GVCs

Workloads

Images

Secrets

Custom domains

Identity & access

Template catalog

Volume sets & storage

Observability

Terraform & IaC

Cloud accounts, agents & networking

Organization & operations

Managed Kubernetes

Next steps