As an MCP server

The server acts with the address, the token and the organization kcloud itself would use, so sign in with kcloud login first. The server reads them on each call of a tool, so signing in again takes effect without a restart of the client.

In Claude Code add the server with claude mcp add kcloud -- kcloud mcp. Add a server for another organization or platform with the options, as in claude mcp add kcloud-acme -- kcloud mcp --org acme.

An MCP client that reads its configuration from a JSON file needs the entry {"mcpServers": {"kcloud": {"command": "kcloud", "args": ["mcp"]}}}. The client then starts kcloud mcp itself and talks to it over stdin and stdout.

Usage: kcloud mcp [--url <origin>] [--org <organization>]

Serve the work of kcloud to an MCP client over stdio.

Options:
    an MCP client starts it, as in: claude mcp add kcloud -- kcloud mcp
    each tool call reads the token and the organization of that moment

The tools of the server group the commands by resource and name projects and agents as the commands do. Each tool is marked as read-only, changing or destructive, so a client can require your approval for a whole class.

Secrets stay out of the context of a model. The server has no tool for signing in and out, for the commands that print a new secret (tokens create, orgs members add, orgs members reset-password, nodes create, nodes token), nor for those that take one, such as auth password, credentials add, claude-accounts add or providers add. Run those commands in a terminal.