Tools Reference

This page lists every tool the MCP Server exposes, grouped by the resource it operates on. You don’t call these tools yourself: describe the outcome you want (see Usage Examples) and the assistant picks the tools. Knowing what exists helps you prompt precisely and follow what the assistant does on your behalf.

Toolset profiles

The server advertises a different set of tools depending on the toolsets query parameter on the endpoint URL. A smaller set keeps the assistant focused and fits comfortably in its context window; the larger sets unlock specialized resource families.

Profile	Tools	Endpoint	Includes
`readonly`	27	`https://mcp.cpln.io/mcp?toolsets=readonly`	Investigation only: observability, runtime state, inventory, generic reads, and one-call workload diagnosis. Nothing that creates, updates, deletes, or executes, so an assistant on this profile cannot change a live resource.
`core`	49	`https://mcp.cpln.io/mcp`	The default. Job tools that do a whole task in one call (deploy an app, add a database, create or rotate a secret, and diagnose, restart, or roll back a workload), plus workloads, GVCs, image builds (from a repository, or from source the assistant writes itself), domains, templates, volume sets with their snapshots and resizing, identities and policies, observability (logs, metrics, traces, audit), quota increase requests, and Terraform export.
`mk8s`	51	`https://mcp.cpln.io/mcp?toolsets=mk8s`	Everything in `core` plus `create_mk8s` and `update_mk8s`, which provision and update managed Kubernetes clusters on every supported provider.
`full`	95	`https://mcp.cpln.io/mcp?toolsets=full`	Every tool, including workload promotion, quota and event reads, replica stops, agents, cloud accounts, IP sets, service accounts, groups, audit contexts, external logging, and advanced workload configuration.

Connecting to https://mcp.cpln.io/mcp with no query parameter gives you the core profile. To switch profiles, point your client at the URL with the ?toolsets= parameter — see your tool’s setup page for where the endpoint URL is configured.

Reading the tables

Each tool is listed with its name, its label, and what it does. The Access column flags how the tool behaves:

Marker	Meaning
Read	Read-only. Fetches data without changing anything.
Write	Creates or modifies a resource.
Destructive	Deletes, removes, or overwrites data. The server instructs the assistant to tell you the impact and get your approval before running these.

Tools available only in a larger profile are marked mk8s or full next to the access marker; everything else is in core. The readonly profile has every Read tool except plan_app, browse_templates, create_agent, and how_to_create_cloud_account.

Docs & guidance

Tools the assistant uses to ground itself in accurate Control Plane facts and documentation. The two documentation tools, search_control_plane and query_docs_filesystem_control_plane, are proxied from the standalone docs MCP at docs.controlplane.com/mcp; the rest are served by the MCP Server itself.

Name	Label	Description	Access
`get_cpln_skill`	Get a Control Plane Skill	The runbook for one task family: how to use a feature correctly, the constraints that are easy to miss, and when it’s the wrong tool. The `operating-guide` skill covers what applies to every task. Not advertised when the AI Plugin supplies its own skills.	Read
`plan_app`	Plan an App	Before any code for an app that keeps anything (content, records, files, or sign-ins): how Control Plane keeps its files, records, secrets, and replicas, and the tools that do each. The assistant settles what your request leaves open with you first.	Read
`get_permissions`	Get Permissions for a Resource Kind	The grantable permissions for a resource kind, for building policies.	Read · `full`
`search_control_plane`	Search Control Plane Docs	Search the documentation: up to five hits, each with a short excerpt and its page path.	Read
`query_docs_filesystem_control_plane`	Query Control Plane Docs Filesystem	Read a whole docs page, or search the docs pages and OpenAPI specs, with read-only, shell-like commands.	Read · `full`

Generic resource tools

The single read and delete tools that work for every resource kind. Use these to list, inspect, or delete resources: pass the kind (workload, secret, gvc, and so on). All are in core.

Name	Label	Description	Access
`list_resources`	List Resources of a Kind	List resources of one kind as a summary table.	Read
`get_resource`	Get a Resource	Fetch one resource by kind and name, with its full JSON. Secrets return metadata only: the API never includes their data. A volume set also lists its snapshots, the newest 10 per location and volume. With `schema: true`, it returns the kind’s apply-ready schema and REST endpoints instead, for authoring an accurate manifest or calling the API.	Read
`delete_resource`	Delete a Resource	Delete one resource by kind and name. The single delete tool for every deletable kind, secrets included: deleting a secret breaks the workloads, GVC pull secrets, and domain TLS that use it.	Destructive

Jobs

Each job tool does a whole task in one call: it reads the state it needs, makes the change, and returns the outcome. deploy_app, add_database, restart_workload, rollback_workload, promote_workload, and grant_cloud_access then wait up to 40 seconds by default for the result; when the task needs longer, the result names the exact call that continues it. All are in core except promote_workload, which is in full.

Name	Label	Description	Access
`deploy_app`	Deploy an App	Build and deploy an HTTP app: from the app files stored with `write_app_files`, a GitHub or GitLab repository, or an existing image. Creates or updates a standard workload with production defaults (health checks, and two replicas so a deploy never takes it offline), or a stateful workload with one replica when the app gets block storage of its own instead of shared storage, grants access to the secrets its env references, and returns the public URL once it is ready. `timeoutSeconds` raises the platform’s 5 second request limit for slow requests, and a referenced secret that does not exist, or more replicas than the org’s quota allows, is refused before anything is built. With no GVC named, it uses the GVC it created for apps, asks before using any other, and creates the org’s first one in the location you choose. It replaces a workload it didn’t create only after your explicit yes. Serverless, multi-container, cron, and non-HTTP workloads use `create_workload`.	Destructive
`add_database`	Add a Database	Install PostgreSQL, MySQL, MariaDB, MongoDB, or Redis from the Template Catalog with credentials Control Plane generates, let the named workloads connect, and return the host, port, and the env values an app uses as `cpln://secret` references. No credential passes through the chat. It starts one instance: Redis also has a failover tier, and PostgreSQL and MongoDB failover are separate templates. With no GVC named, it places the database the way `deploy_app` places an app.	Destructive
`diagnose_workload`	Diagnose a Workload	Find out why a workload is unhealthy: reads its deployments, events, and recent error logs, and returns each likely cause with its evidence and the fix.	Read
`restart_workload`	Restart a Workload	Replace every replica with a fresh one on the same spec, so the workload rereads its secrets and env, then wait until it is ready.	Destructive
`rollback_workload`	Rollback a Workload	Put a workload back on its previous image, or on a given one, changing nothing else, then wait until it is ready.	Destructive
`promote_workload`	Promote a Workload	Run a workload in another GVC of the same org with its current spec, such as staging to production, with an optional image and env values for the target. Grants access to the secrets its env references, points its internal firewall links to workloads of its own GVC at the same names in the target, and creates or updates each volume set it mounts there with the source’s settings, never copying volume data. A missing secret is refused before anything is written. Overwrites a workload of the same name there.	Destructive · `full`
`allow_workload_access`	Allow Workload Access	Let other workloads reach a workload through its internal firewall, keeping every other rule, and return the internal URL the callers use. Also takes callers off its list; a `same-gvc` or `same-org` rule still admits them.	Destructive
`grant_cloud_access`	Grant Cloud Access	Give a workload credential-free access to AWS, GCP, or Azure through an existing cloud account: sets up its identity, binds the access, and waits until the identity reports it usable. With an existing AWS role or GCP service account it returns at once, since the identity reports no status for one. It replaces the identity’s existing binding for that provider, which can cut access for every workload that shares the identity.	Destructive

GVCs

Create and manage GVCs and the cloud locations they span.

Name	Label	Description	Access
`create_gvc`	Create a GVC	Create a GVC with one or more cloud locations. If you leave the location to the assistant, it picks one and tells you which.	Write
`update_gvc`	Update a GVC	Update a GVC’s settings, such as its description, tags, or pull secrets.	Destructive
`add_gvc_locations`	Add locations to a GVC	Add one or more cloud locations to an existing GVC.	Write · `full`
`remove_gvc_locations`	Remove locations from a GVC	Remove cloud locations from a GVC.	Destructive · `full`

Workloads

Create, update, run, and operate workloads. Deploying, restarting, rolling back, promoting, and diagnosing a workload each take one call with the job tools. The advanced configure_workload_* tools each manage one specialized block of the spec and live in the full profile.

Name	Label	Description	Access
`create_workload`	Create a Workload	Create a serverless, standard, stateful, or cron workload with its containers, exposure, per-location overrides, and rollout and security options.	Write
`update_workload`	Update a Workload	Update an existing workload: image, resources, scaling, environment, per-location overrides (`localOptions`), rollout and security options, and more. Per-location overrides merge by location, and rollout and security options merge field by field, so settings the call leaves out keep their values. `public: true` adds `0.0.0.0/0` to its external inbound and outbound allow lists, and `public: false` removes `0.0.0.0/0` and `::/0` from its external inbound; every other firewall rule stays.	Destructive
`grant_workload_secret_access`	Grant Workload Secret Access	Grant an existing workload access to a secret by wiring its identity and access policy. With `remove: true`, it revokes that access and keeps the identity. Never returns secret values.	Destructive
`start_workload_cron`	Start a Workload Cron Run	Trigger an immediate run of a cron workload. Returns a command ID that `get_command` follows.	Destructive
`stop_workload_replica`	Stop a Workload Replica	Terminate one running replica of a workload; the platform reschedules a replacement per the scaling settings.	Destructive · `full`
`configure_workload_load_balancer`	Configure Workload Load Balancer	Set or clear the direct per-location load balancer, geo headers, and replica-direct routing.	Destructive · `full`
`configure_workload_retry`	Configure Workload Request Retry Policy	Set or clear the retry behavior for failed requests.	Destructive · `full`
`configure_workload_sidecar`	Configure Workload Envoy Sidecar	Set or clear the Envoy proxy filter chain. Advanced.	Destructive · `full`
`configure_workload_extras`	Configure Workload BYOK Extras	Set or clear BYOK-only Kubernetes customizations (affinity, tolerations, spread constraints).	Destructive · `full`

Images

Build container images on Control Plane and follow the build. An image record is created by pushing, so there is no create or update tool — list, inspect, and delete image records with the generic tools using kind: image.

Name	Label	Description	Access
`write_app_files`	Write App Files	Write or edit an app’s files (whole text files, appends for a large file in parts, exact-text edits, deletions, and moves or renames, uploaded files included) under an app name. Files you have to provide yourself, such as pictures, come in through an upload link from `create_app_files_upload_link`; files attached to the chat cannot be forwarded. The files are stored on Control Plane between calls; the same name is the image name `build_image` produces. Limits: 100 MB per file, 1 GB per app.	Destructive
`build_image`	Build an Image	Build an image from a GitHub or GitLab repository, or from the app files stored with `write_app_files`, and push it to the org’s private registry. Returns a build id; the build keeps running after the call returns. Building an existing `NAME:TAG` replaces that image.	Destructive
`get_image_build`	Get an Image Build Status and Log	Read a build’s status, progress events, and log by its build id.	Read
`create_app_files_upload_link`	Create an App Files Upload Link	Get an upload link for files you have to provide (pictures, fonts, PDFs, data). Open it in a browser and drop the files in. The link works for an hour, up to 100 MB per file.	Write
`get_app_files`	Get App Files	List an app’s stored files, read one (in slices for a large file), or get a short-lived download link (tar.gz) for all of them. Also reports where each of the app’s images was built from: stored files, a repository, a folder uploaded with the CLI, or a push outside a Control Plane build. A file holding credentials is never shown.	Read

No Docker daemon is involved: the build service clones the repository or assembles the stored app files, detects how to build it (using the Dockerfile when one is present, otherwise by auto-detecting the stack), and always produces a linux/amd64 image. deploy_app under Jobs builds and deploys in one call.

The MCP server has no access to your filesystem, so a folder on your machine builds through the CLI instead: cpln image build --remote --dir PATH --name NAME:TAG uploads the folder and builds it the same way, also without Docker.

A private repository needs a one-time browser authorization per organization. The first build that needs it returns an authorization link instead of starting a build; open the link, approve access, then ask the assistant to build again. The link is single-use and expires in about 15 minutes. Later builds in that organization run without prompting.

Secrets

Secret values never pass through the chat. list_resources and get_resource show a secret’s metadata, never its data. create_secret fills a new secret with values Control Plane generates, or hands you a Console link where you type values only you have; rotate_secret replaces the values and restarts the workloads that use them. No tool accepts or reveals a secret value. delete_resource under Generic resource tools deletes a secret. To let a workload read a secret, use grant_workload_secret_access under Workloads; deploy_app and promote_workload grant it for the secrets their env references.

Name	Label	Description	Access
`create_secret`	Create a Secret	Create a secret with random values Control Plane generates now, or get a Console link prefilled with its name, type, and keys where you type the values. For a dictionary, the link can also fill in starting values for keys that are not secret, such as a host or port, which you can change before saving. No input accepts a value and no result contains one.	Write
`rotate_secret`	Rotate a Secret	Replace a secret’s values, generated again or entered by you through a Console link, and restart the workloads that use it, waiting up to 40 seconds by default for them to be ready. Anything outside Control Plane that holds the old values stops working.	Destructive

Custom domains

Configure custom domains, their port listeners, routes, TLS, and CORS. update_domain changes all of them on an existing domain.

Name	Label	Description	Access
`create_domain`	Create a Domain	Put a domain in front of a workload: from the domain, workload, and GVC it derives the 443 listener, the route, and `cname` mode, and returns the DNS records to add. A custom setup (other listeners, `ns` mode, several routes) passes the ports and DNS mode instead. A route can split traffic across workloads by weight (canaries) or mirror it.	Write
`update_domain`	Update a Domain	Update a domain’s metadata, host/subdomain acceptance flags, certificate challenge (not for `.internal` domains), GVC or workload binding, and listeners and routes. It adds a listener or changes its protocol, TLS, or CORS, adds a route or replaces the one with the same match, and removes listeners, routes, TLS, or CORS. Routes take the same canaries and mirroring as in `create_domain`.	Destructive

Identity & access

Manage identities, policies, groups, service accounts, and the private-network resources attached to an identity. Creating and updating identities and policies works in core; the rest are in full. For one workload, credential-free cloud access takes one call with grant_cloud_access under Jobs, and secret access with grant_workload_secret_access under Workloads.

Name	Label	Description	Access
`create_identity`	Create an Identity	Create a GVC-scoped identity for workload access to secrets, cloud resources, and private networks.	Write
`update_identity`	Update an Identity	Update an identity’s settings and bound credentials.	Destructive
`create_policy`	Create a Policy	Create a policy that grants permissions on resources to principals.	Write
`update_policy`	Update a Policy	Update a policy’s bindings, targets, or permissions.	Destructive
`create_group`	Create a Group	Create a group of users and service accounts, with optional tag-based membership.	Write · `full`
`edit_group`	Edit a Group	Update a group’s membership or membership query.	Destructive · `full`
`create_service_account`	Create a Service Account	Create a service account for programmatic access.	Write · `full`
`update_service_account`	Update a Service Account	Update a service account’s description or tags, or revoke its keys by name.	Destructive · `full`
`add_key_to_service_account`	Add Key to Service Account	Create the service account if needed, optionally add it to a group, and return the Console page where you add the key and see it once. The key never passes through the chat.	Write · `full`
`invite_user_to_org`	Invite User to Organization	Invite a user by email to join the organization.	Write · `full`
`add_identity_network_resource`	Add Agent-Based Network Resource	Add an agent-based (wormhole) network resource so a workload can reach a private endpoint.	Write · `full`
`add_identity_native_network_resource`	Add Cloud-Native Network Resource	Add an AWS PrivateLink or GCP Private Service Connect network resource to an identity.	Write · `full`
`list_identity_network_resources`	List Network Resources on an Identity	List the agent-based and cloud-native network resources attached to an identity.	Read · `full`
`remove_identity_network_resource`	Remove Network Resource from Identity	Remove a network resource from an identity.	Destructive · `full`

Template catalog

Browse and operate the Template Catalog: production-ready stacks you install instead of hand-authoring resources. For PostgreSQL, MySQL, MariaDB, MongoDB, or Redis, add_database under Jobs installs the template with generated credentials in one call; install_template takes them only for a setting add_database does not take, such as backups.

Name	Label	Description	Access
`browse_templates`	Browse Template Catalog	Find templates for the capability or product needed, named in plain words (`query`), with their prerequisites, and the template to pick instead for other needs. Without `query`, list the catalog and its categories, or one `category`. With `name`, show that template’s versions, what it deploys, its prerequisites, the README’s important notes, and example `values.yaml`; `readmeSection` returns one README section.	Read
`install_template`	Install Template	Install a catalog template as a new release. With `dryRun: true`, it renders what the install would create and applies nothing. It refuses, creating nothing, while the release would read a required secret that does not exist.	Write
`upgrade_template`	Upgrade Template	Upgrade an installed release to a new version with its complete values, which replace the current ones. It refuses, changing nothing, while the release would read a required secret that does not exist.	Destructive
`rollback_template`	Rollback a Template Release	Roll a release back to a prior revision.	Destructive · `full`
`uninstall_template`	Uninstall Template	Uninstall a release and remove the resources it created, including volume data.	Destructive
`get_installed_template`	Get Installed Templates	Show a release’s status, revision, and the resources it created. Without a release name, list the releases installed in the org, up to 50.	Read

Volume sets & storage

Create volume sets, mount them to workloads, and manage their volumes and snapshots. Per-volume operations and snapshot changes go through run_volumeset_command, and get_resource lists a volume set’s snapshots. Creating a volume set on its own is in full; mount_volumeset_to_workload creates a missing one.

Name	Label	Description	Access
`create_volumeset`	Create a Volumeset	Create a volume set for persistent storage.	Write · `full`
`update_volumeset`	Update a Volumeset	Update a volume set’s settings. A new snapshot policy without a retention keeps the current one, so scheduled snapshots always expire.	Destructive
`mount_volumeset_to_workload`	Mount Volumeset to Workload	Mount a volume set to a workload at a path (ext4/xfs require a stateful or VM workload; shared mounts on any type).	Write
`run_volumeset_command`	Run a Volume Set Command	Run one command on one volume of a volume set, picked by location and index: expand it live (at most 4 times per volume in a rolling 24 hours), shrink it (its data moves to a smaller volume, no smaller than the initial capacity or the used bytes plus 5%, and the replica restarts), create, restore, or delete a snapshot, delete the volume, or copy it to the same index in another location or volume set. Restoring discards everything written since the snapshot, deleting a volume loses its data for good, and a copy replaces the volume at the destination. Shrinking, creating or restoring a snapshot, deleting a volume, and copying it need ext4 or xfs. Returns a command ID that `get_command` follows.	Destructive

Observability

Inspect deployments, logs, events, replicas, metrics, traces, the audit trail, and the status of asynchronous operation commands. All are in core except the event, replica, and command lists, which are in full.

Name	Label	Description	Access
`list_deployments`	List Workload Deployments	A workload’s per-location rollout status, the primary readiness check after a deploy. Each location also names its running replicas.	Read
`get_workload_logs`	Get Workload Logs	Query the logs of a workload, or of an mk8s cluster with the logs add-on, by structured parameters or a raw LogQL query.	Read
`get_workload_events`	Get Workload Events	Fetch a workload’s event log to diagnose readiness, liveness, and deploy failures.	Read · `full`
`list_workload_replicas`	List Workload Replicas	List the running replicas of a workload in a location.	Read · `full`
`query_metrics`	Query Workload Metrics (PromQL)	Run a PromQL query against Control Plane metrics. Without a query, it lists the metrics you can query instead: the documented ones, each with a correct PromQL template, and every metric present in the org, including those mk8s clusters ship, or one metric’s live label values.	Read
`query_audit_events`	Query Audit Events	Query the audit trail for mutations on resources of a kind.	Read
`query_traces`	Query Distributed Traces	Search distributed traces, newest first, by GVC, workload, HTTP method, request id, errors, or duration, or with TraceQL. With a trace ID, it fetches that trace instead and summarizes its span tree with each span’s duration, method, path, and status, its request ids, and its errors.	Read
`list_commands`	List Commands	List the asynchronous operation commands issued against a workload or volume set: cron runs, replica stops, and volume operations.	Read · `full`
`get_command`	Get a Command	Fetch one asynchronous command by ID to check a long-running operation’s status.	Read

Terraform & IaC

Convert manifests to Terraform and export existing resources as HCL for infrastructure as code.

Name	Label	Description	Access
`export_terraform`	Export to Terraform	Generate Terraform HCL for one existing resource by self link, or for every resource under a path such as `/org/ORG` or `/org/ORG/gvc/GVC/workload`, or convert a resource manifest, dry-run validated against the API first. Secrets are never exported or converted: an export that would include a secret is refused, so narrow the path to leave secrets out.	Read

Terraform and Pulumi tag every resource they manage with cpln/managedByTerraform: "true". When get_resource reads such a resource, or a tool updates one, the result tells the assistant to warn you: a change made through the MCP server drifts from your code, and the next apply can revert it unless your code gets the change too.

Cloud accounts, agents & networking

Onboard cloud accounts, create agents for private connectivity, and reserve IP sets. All are in full.

Name	Label	Description	Access
`how_to_create_cloud_account`	How to Create a Cloud Account	The setup a cloud account needs on the provider’s side, filled in with your values: the IAM role and policies for AWS, the service account roles for GCP, the connector steps for Azure, or the account secret for NATS NGS.	Read · `full`
`create_cloud_account`	Create a Cloud Account	Create a cloud account bridging Control Plane to AWS, GCP, Azure, or NGS.	Write · `full`
`update_cloud_account`	Update a Cloud Account	Update a cloud account’s settings.	Destructive · `full`
`create_agent`	Create an Agent	Start creating an agent for secure connectivity to a private network: returns a Console link with its name and description prefilled, where you finish and download the bootstrap config. The config never passes through the chat.	Read · `full`
`update_agent`	Update an Agent	Update an agent’s settings.	Destructive · `full`
`get_agent_info`	Get Agent Info	Fetch an agent’s real-time status: active state, last heartbeat, peer and service counts.	Read · `full`
`get_agent_eventlog`	Get Agent Event Log	Fetch an agent’s event log.	Read · `full`
`create_ipset`	Create an IP Set	Reserve static public IPs per location.	Write · `full`
`update_ipset`	Update an IP Set	Update an IP set’s settings.	Destructive · `full`
`add_ipset_location`	Add or update IP set locations	Add locations to an IP set or update their retention policy. Passing an existing location overwrites its entry, and retention policy `free` releases an allocated static IP.	Destructive · `full`
`remove_ipset_location`	Remove IP set locations	Remove locations from an IP set.	Destructive · `full`

Organization & operations

Find the orgs a connection can use, and manage org settings, quotas, audit contexts, and external logging. All are in full except list_orgs and request_quota_increase.

Name	Label	Description	Access
`list_orgs`	List Organizations	The orgs this connection can use (the ones you selected when you connected), each with its GVCs and their locations. With a single org selected, every tool uses it when no org is named.	Read
`update_org`	Update Organization Settings	Update organization-wide settings.	Destructive · `full`
`list_quotas`	List Organization Quotas	List the org’s resource quotas with current usage (optionally only those near their limit).	Read · `full`
`get_quota`	Get Quota Details	Fetch the details and current usage of one quota.	Read · `full`
`request_quota_increase`	Request a Quota Increase	Ask Control Plane to raise an org quota after an action fails on it. A per-GVC quota takes the GVC. Every call files a new request, which comes back approved (the new max applies now), pending (Control Plane reviews it), or denied with the reason. Lowering a max goes through Control Plane support.	Write
`create_audit_context`	Create Audit Context	Create a custom audit context for tamper-proof external events.	Write · `full`
`edit_audit_context`	Edit an Audit Context	Update an audit context’s description and tags. Replaces the description and can clear existing tags.	Destructive · `full`
`get_external_logging`	Get External Logging Configuration	View the org’s primary and extra external logging providers.	Read · `full`
`configure_external_logging`	Configure External Logging	Configure log shipping to an external provider (S3, Datadog, Coralogix, and more).	Destructive · `full`
`remove_external_logging`	Remove External Logging Provider	Remove an external logging provider from the org.	Destructive · `full`

Managed Kubernetes

Provision and update managed Kubernetes clusters on every supported provider with two tools that take the provider and its settings. They are available in the mk8s and full profiles: connect to https://mcp.cpln.io/mcp?toolsets=mk8s to use them.

Name	Label	Description	Access
`create_mk8s`	Create an mk8s Cluster	Create a cluster on AWS, GCP, Azure, DigitalOcean, Hetzner, Linode, Lambda Labs, Oblivus, Paperspace, or Triton, or on hardware you own with `generic`. The tool names any required setting that is missing.	Write · `mk8s`
`update_mk8s`	Update an mk8s Cluster	Update a cluster by sending only what changes. Node pool changes provision or remove nodes, region and network settings cannot change, and the Kubernetes version moves one minor version at a time.	Destructive · `mk8s`

Next steps

MCP Server

Endpoint, authentication, and the compatible-tools list

Usage Examples

Practical prompts that put these tools to work

AI Plugin

Skills, agents, commands, and guardrails on top of the MCP server

Reference

The full configuration and behavior of every Control Plane resource

Getting Started

MCP Clients

Toolset profiles

Reading the tables

Docs & guidance

Generic resource tools

Jobs

GVCs

Workloads

Images

Secrets

Custom domains

Identity & access

Template catalog

Volume sets & storage

Observability

Terraform & IaC

Cloud accounts, agents & networking

Organization & operations

Managed Kubernetes

Next steps

MCP Server

Usage Examples

AI Plugin

Reference

​Toolset profiles

​Reading the tables

​Docs & guidance

​Generic resource tools

​Jobs

​GVCs

​Workloads

​Images

​Secrets

​Custom domains

​Identity & access

​Template catalog

​Volume sets & storage

​Observability

​Terraform & IaC

​Cloud accounts, agents & networking

​Organization & operations

​Managed Kubernetes

​Next steps

MCP Server

Usage Examples

AI Plugin

Reference

Toolset profiles

Reading the tables

Docs & guidance

Generic resource tools

Jobs

GVCs

Workloads

Images

Secrets

Custom domains

Identity & access

Template catalog

Volume sets & storage

Observability

Terraform & IaC

Cloud accounts, agents & networking

Organization & operations

Managed Kubernetes

Next steps