RunCloud MCP by usefulapi

by usefulapi.io · remote · no sign-in to list tools · v1.3.3 · published by io.usefulapi

Read RunCloud servers, web apps, databases and logs; deploy, restart services, renew SSL.

Deletes · 7

Compare Registry entry

36 tools: 7 can delete or cancel things and 29 only read.

Scanned Oct 21, 2026

Deletes or cancels7Claude Code: deny: see these tools
Can't be undone0Claude Code: ask
Changes things0Claude Code: ask
Only reads29Claude Code: allow: see these tools

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http runcloud https://runcloud.usefulapi.io/mcp

Findings

Matches of fixed checks, with the text they matched.

1 info

Inforuncloud_list_databases
The description mentions "credentials".
Matched text
description: "...es on a server: id, name, collation. No credentials. GET /servers/{id}/databases."
What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

36 tools

Deletes or cancels 7Removes, cancels or revokes something.Claude Code: deny

runcloud_control_serviceWRITE: run systemctl start, restart or reload on one service of a server (for example nginx-rc or php81rc-fpm).No findings
Why it is in this group
- The description's first verb is "write": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
WRITE: run systemctl start, restart or reload on one service of a server (for example nginx-rc or php81rc-fpm). A restart briefly interrupts that service and the sites behind it. 'stop' is deliberately not offered. Get the realName from runcloud_list_services. PATCH /servers/{id}/services.
Annotations the server declares
- title: Start, restart or reload a service
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: true
runcloud_deploy_gitWRITE: force a Git deployment of a web application now: RunCloud pulls the configured branch and runs the deployment script, which changes the live site's files.No findings
Why it is in this group
- The name "runcloud_deploy_git" says "deploy": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
WRITE: force a Git deployment of a web application now: RunCloud pulls the configured branch and runs the deployment script, which changes the live site's files. Get git_id from runcloud_get_git_deployment (its id). PUT /servers/{id}/webapps/{webapp}/git/{git}/script.
Annotations the server declares
- title: Force a Git deployment
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: true
runcloud_force_deploy_atomicWRITE: start an atomic deployment of a project now (builds a new release and switches the live symlink when it succeeds).No findings
Why it is in this group
- The name "runcloud_force_deploy_atomic" says "deploy": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
WRITE: start an atomic deployment of a project now (builds a new release and switches the live symlink when it succeeds). PUT /atomic/{project}/forcedeploy.
Annotations the server declares
- title: Force an atomic deployment
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: true
runcloud_install_letsencrypt_sslWRITE: issue and install a free Let's Encrypt certificate for a web application (basic SSL) or for one domain of it (advanced SSL, pass domain_id; this requires advanced SSL mode, …No findings
Why it is in this group
- The name "runcloud_install_letsencrypt_ssl" says "install": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
WRITE: issue and install a free Let's Encrypt certificate for a web application (basic SSL) or for one domain of it (advanced SSL, pass domain_id; this requires advanced SSL mode, see runcloud_get_ssl_method). The web server is reloaded; the domain's DNS must already point at the server. Custom certificates are not supported here. POST /servers/{id}/webapps/{webapp}/ssl or /domains/{domain}/ssl.
Annotations the server declares
- title: Issue a Let's Encrypt certificate
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: true
runcloud_reload_supervisorWRITE: reload one supervisor job so its worker processes restart (running processes are interrupted).No findings
Why it is in this group
- The description's first verb is "write": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
WRITE: reload one supervisor job so its worker processes restart (running processes are interrupted). Get the id from runcloud_list_supervisors. POST /servers/{id}/supervisors/{job}/reload.
Annotations the server declares
- title: Reload a supervisor job
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: true
runcloud_renew_sslWRITE: redeploy (renew) the Let's Encrypt certificate of a web application, which re-issues it and reloads the web server.No findings
Why it is in this group
- The description's first verb is "write": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
WRITE: redeploy (renew) the Let's Encrypt certificate of a web application, which re-issues it and reloads the web server. Let's Encrypt certificates only. For basic SSL pass the ssl_id from runcloud_get_webapp_ssl; for advanced (per-domain) SSL, which requires advanced SSL mode (check runcloud_get_ssl_method), also pass domain_id. PUT /servers/{id}/webapps/{webapp}/ssl/{ssl} or /domains/{domain}/ssl/{ssl}.
Annotations the server declares
- title: Renew a Let's Encrypt certificate
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: true
runcloud_run_cronjobWRITE: force-run one cron job of a server once, right now, outside its schedule.No findings
Why it is in this group
- The name "runcloud_run_cronjob" says "run": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
WRITE: force-run one cron job of a server once, right now, outside its schedule. The job's command runs on the server with its configured user. Get the id from runcloud_list_cronjobs. POST /servers/{id}/cronjobs/{job}/run.
Annotations the server declares
- title: Run a cron job now
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: true

Only reads 29Looks things up and changes nothing.Claude Code: allow

runcloud_get_domain_dnsThe DNS records (A, CNAME...) a domain name needs to point at the server.No findings
Why it is in this group
- The name "runcloud_get_domain_dns" says "get": a word for reading.
Description, as the server wrote it
The DNS records (A, CNAME...) a domain name needs to point at the server. GET /servers/{id}/webapps/{webapp}/domains/{domain}/dns.
Annotations the server declares
- title: Get domain DNS setup instructions
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
runcloud_get_git_deploymentThe Git deployment configured on a web application: provider, branch, repository URL, auto-deploy flag, deployment script and whether it is an atomic deployment.No findings
Why it is in this group
- The name "runcloud_get_git_deployment" says "get": a word for reading.
Description, as the server wrote it
The Git deployment configured on a web application: provider, branch, repository URL, auto-deploy flag, deployment script and whether it is an atomic deployment. The deployment webhook keys are not returned. The id of the result is the git_id for runcloud_deploy_git. GET /servers/{id}/webapps/{webapp}/git.
Annotations the server declares
- title: Get Git deployment
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
runcloud_get_serverOne server by id: provider, IP, OS and version, stack, online state, agent version, update settings, tags.No findings
Why it is in this group
- The name "runcloud_get_server" says "get": a word for reading.
Description, as the server wrote it
One server by id: provider, IP, OS and version, stack, online state, agent version, update settings, tags. GET /servers/{id}.
Annotations the server declares
- title: Get server
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
runcloud_get_server_hardwareKernel version, CPU model and cores, memory and disk totals/free, load average and uptime of a server.No findings
Why it is in this group
- The name "runcloud_get_server_hardware" says "get": a word for reading.
Description, as the server wrote it
Kernel version, CPU model and cores, memory and disk totals/free, load average and uptime of a server. GET /servers/{id}/hardwareinfo.
Annotations the server declares
- title: Get server hardware info
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
runcloud_get_server_healthThe latest health sample of a server: total/available/used memory and disk space (MB) and load average.No findings
Why it is in this group
- The name "runcloud_get_server_health" says "get": a word for reading.
Description, as the server wrote it
The latest health sample of a server: total/available/used memory and disk space (MB) and load average. GET /servers/{id}/health/latest.
Annotations the server declares
- title: Get latest server health
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
runcloud_get_server_statsHow many web applications, databases, cron jobs and supervisor jobs a server has, and its country.No findings
Why it is in this group
- The name "runcloud_get_server_stats" says "get": a word for reading.
Description, as the server wrote it
How many web applications, databases, cron jobs and supervisor jobs a server has, and its country. GET /servers/{id}/stats.
Annotations the server declares
- title: Get server counts
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
runcloud_get_ssl_methodWhether the web application uses basic (one certificate for the app) or advanced (one per domain) SSL, and its AutoSSL status.No findings
Why it is in this group
- The name "runcloud_get_ssl_method" says "get": a word for reading.
Description, as the server wrote it
Whether the web application uses basic (one certificate for the app) or advanced (one per domain) SSL, and its AutoSSL status. Advanced SSL is a Business/Enterprise feature. GET /servers/{id}/webapps/{webapp}/ssl/advanced.
Annotations the server declares
- title: Check SSL method and AutoSSL status
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
runcloud_get_supervisor_statusThe live status (RUNNING, FATAL, BACKOFF...), pid and uptime of every supervisor process, by job label.No findings
Why it is in this group
- The name "runcloud_get_supervisor_status" says "get": a word for reading.
Description, as the server wrote it
The live status (RUNNING, FATAL, BACKOFF...), pid and uptime of every supervisor process, by job label. GET /servers/{id}/supervisors/status.
Annotations the server declares
- title: Get supervisor job status
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
runcloud_get_webappOne web application by id (path, PHP version, stack, type, default flag).No findings
Why it is in this group
- The name "runcloud_get_webapp" says "get": a word for reading.
Description, as the server wrote it
One web application by id (path, PHP version, stack, type, default flag). GET /servers/{id}/webapps/{webapp}.
Annotations the server declares
- title: Get web application
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
runcloud_get_webapp_settingsPHP and FPM/Nginx settings of a web application (disabled functions, timezone, memory and upload limits, process manager...).No findings
Why it is in this group
- The name "runcloud_get_webapp_settings" says "get": a word for reading.
Description, as the server wrote it
PHP and FPM/Nginx settings of a web application (disabled functions, timezone, memory and upload limits, process manager...). GET /servers/{id}/webapps/{webapp}/settings.
Annotations the server declares
- title: Get web application settings
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
runcloud_get_webapp_sslThe web application's SSL certificate (basic / web-app-level SSL): provider, validity, HTTPS settings.No findings
Why it is in this group
- The name "runcloud_get_webapp_ssl" says "get": a word for reading.
Description, as the server wrote it
The web application's SSL certificate (basic / web-app-level SSL): provider, validity, HTTPS settings. Private keys are never returned. GET /servers/{id}/webapps/{webapp}/ssl.
Annotations the server declares
- title: Get web application SSL
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
runcloud_list_atomic_deploymentsThe deployments of an atomic project: commit hash, branch, message, committer, release name, status (DEPLOYING, COMPLETED, FAILED), start and end time.No findings
Why it is in this group
- The name "runcloud_list_atomic_deployments" says "list": a word for reading.
Description, as the server wrote it
The deployments of an atomic project: commit hash, branch, message, committer, release name, status (DEPLOYING, COMPLETED, FAILED), start and end time. GET /atomic/{project}/deployments.
Annotations the server declares
- title: List atomic deployments
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
runcloud_list_atomic_projectsThe atomic Git deployment projects of the workspace: name, provider, repository, branch, auto-deploy, success/failure counts and the latest deployment.No findings
Why it is in this group
- The name "runcloud_list_atomic_projects" says "list": a word for reading.
Description, as the server wrote it
The atomic Git deployment projects of the workspace: name, provider, repository, branch, auto-deploy, success/failure counts and the latest deployment. Webhook keys are not returned. GET /atomic.
Annotations the server declares
- title: List atomic deployment projects
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
runcloud_list_backup_snapshotsThe snapshots of one backup instance: run date, status, type and size.No findings
Why it is in this group
- The name "runcloud_list_backup_snapshots" says "list": a word for reading.
Description, as the server wrote it
The snapshots of one backup instance: run date, status, type and size. GET /backups/{id}/snapshots.
Annotations the server declares
- title: List backup snapshots
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
runcloud_list_backupsThe backup instances of the workspace: label, what they cover (web app / database), storage, type, frequency, size, status.No findings
Why it is in this group
- The name "runcloud_list_backups" says "list": a word for reading.
Description, as the server wrote it
The backup instances of the workspace: label, what they cover (web app / database), storage, type, frequency, size, status. Filter by server, storage, status or name. GET /backups.
Annotations the server declares
- title: List backups
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
runcloud_list_blocked_ipsThe IP addresses Fail2Ban currently blocks on a server.No findings
Why it is in this group
- The name "runcloud_list_blocked_ips" says "list": a word for reading.
Description, as the server wrote it
The IP addresses Fail2Ban currently blocks on a server. GET /servers/{id}/security/fail2ban/blockedip.
Annotations the server declares
- title: List Fail2Ban blocked IPs
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
runcloud_list_cronjobsThe cron jobs of a server: id, label, user, schedule, command, enabled flag.No findings
Why it is in this group
- The name "runcloud_list_cronjobs" says "list": a word for reading.
Description, as the server wrote it
The cron jobs of a server: id, label, user, schedule, command, enabled flag. The id is what runcloud_run_cronjob needs. GET /servers/{id}/cronjobs.
Annotations the server declares
- title: List cron jobs
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
runcloud_list_database_usersThe database users on a server (id, username).No findings
Why it is in this group
- The name "runcloud_list_database_users" says "list": a word for reading.
Description, as the server wrote it
The database users on a server (id, username). Passwords are never returned. GET /servers/{id}/databaseusers.
Annotations the server declares
- title: List database users
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
runcloud_list_databasesThe databases on a server: id, name, collation.1 finding
Why it is in this group
- The name "runcloud_list_databases" says "list": a word for reading.
Findings
- Info
  The description mentions "credentials".
  Matched text
  description: "...es on a server: id, name, collation. No credentials. GET /servers/{id}/databases."
  What this check looks for
Description, as the server wrote it
The databases on a server: id, name, collation. No credentials. GET /servers/{id}/databases.
Annotations the server declares
- title: List databases
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
runcloud_list_domainsThe domain names of a web application: id, name, type (primary/alias), www, redirection, wildcard, DNS integration, status.No findings
Why it is in this group
- The name "runcloud_list_domains" says "list": a word for reading.
Description, as the server wrote it
The domain names of a web application: id, name, type (primary/alias), www, redirection, wildcard, DNS integration, status. GET /servers/{id}/webapps/{webapp}/domains.
Annotations the server declares
- title: List domain names
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
runcloud_list_firewall_rulesThe firewall rules of a server: type (global/rich), port, protocol, IP address, action.No findings
Why it is in this group
- The name "runcloud_list_firewall_rules" says "list": a word for reading.
Description, as the server wrote it
The firewall rules of a server: type (global/rich), port, protocol, IP address, action. GET /servers/{id}/security/firewalls.
Annotations the server declares
- title: List firewall rules
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
runcloud_list_server_logsThe server's activity log (what was changed in RunCloud and when), newest first.No findings
Why it is in this group
- The name "runcloud_list_server_logs" says "list": a word for reading.
Description, as the server wrote it
The server's activity log (what was changed in RunCloud and when), newest first. GET /servers/{id}/logs.
Annotations the server declares
- title: List server activity logs
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
runcloud_list_serversList the servers connected to the workspace: id, name, provider, IP address, OS, stack, online/connected state, agent and PHP CLI version, auto-update settings and tags.No findings
Why it is in this group
- The name "runcloud_list_servers" says "list": a word for reading.
Description, as the server wrote it
List the servers connected to the workspace: id, name, provider, IP address, OS, stack, online/connected state, agent and PHP CLI version, auto-update settings and tags. GET /servers.
Annotations the server declares
- title: List servers
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
runcloud_list_servicesThe services on a server (nginx, php-fpm, mariadb, redis, supervisor...) with real name, running state, CPU, memory and version.No findings
Why it is in this group
- The name "runcloud_list_services" says "list": a word for reading.
Description, as the server wrote it
The services on a server (nginx, php-fpm, mariadb, redis, supervisor...) with real name, running state, CPU, memory and version. The realName is what runcloud_control_service needs. GET /servers/{id}/services.
Annotations the server declares
- title: List server services
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
runcloud_list_supervisorsThe supervisor (background worker) jobs of a server: id, label, user, process count, auto start/restart, directory, command.No findings
Why it is in this group
- The name "runcloud_list_supervisors" says "list": a word for reading.
Description, as the server wrote it
The supervisor (background worker) jobs of a server: id, label, user, process count, auto start/restart, directory, command. GET /servers/{id}/supervisors.
Annotations the server declares
- title: List supervisor jobs
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
runcloud_list_system_usersThe system (Linux) users on a server: id, username, whether deletable.No findings
Why it is in this group
- The name "runcloud_list_system_users" says "list": a word for reading.
Description, as the server wrote it
The system (Linux) users on a server: id, username, whether deletable. Deployment keys and passwords are never returned. GET /servers/{id}/users.
Annotations the server declares
- title: List system users
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
runcloud_list_webapp_logsThe activity log of a web application (settings changes, PHP version changes, deployments), newest first.No findings
Why it is in this group
- The name "runcloud_list_webapp_logs" says "list": a word for reading.
Description, as the server wrote it
The activity log of a web application (settings changes, PHP version changes, deployments), newest first. GET /servers/{id}/webapps/{webapp}/log.
Annotations the server declares
- title: List web application activity logs
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
runcloud_list_webappsList the web applications on a server: id, name, root/public path, PHP version, stack, type (wordpress, custom...), default flag, alias.No findings
Why it is in this group
- The name "runcloud_list_webapps" says "list": a word for reading.
Description, as the server wrote it
List the web applications on a server: id, name, root/public path, PHP version, stack, type (wordpress, custom...), default flag, alias. Deployment webhook keys are not returned. GET /servers/{id}/webapps.
Annotations the server declares
- title: List web applications
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
runcloud_pingCheck that the API key works: RunCloud answers with a message ('pong').No findings
Why it is in this group
- The name "runcloud_ping" says "ping": a word for reading.
Description, as the server wrote it
Check that the API key works: RunCloud answers with a message ('pong'). GET /ping.
Annotations the server declares
- title: Check API connection
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.3.3. Values in angle brackets are yours to fill in.

claude mcp add --transport http runcloud https://runcloud.usefulapi.io/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__runcloud__runcloud_ping",
      "mcp__runcloud__runcloud_list_servers",
      "mcp__runcloud__runcloud_get_server",
      "mcp__runcloud__runcloud_get_server_stats",
      "mcp__runcloud__runcloud_get_server_hardware",
      "mcp__runcloud__runcloud_get_server_health",
      "mcp__runcloud__runcloud_list_server_logs",
      "mcp__runcloud__runcloud_list_services",
      "mcp__runcloud__runcloud_list_system_users",
      "mcp__runcloud__runcloud_list_webapps",
      "mcp__runcloud__runcloud_get_webapp",
      "mcp__runcloud__runcloud_get_webapp_settings",
      "mcp__runcloud__runcloud_list_webapp_logs",
      "mcp__runcloud__runcloud_list_domains",
      "mcp__runcloud__runcloud_get_domain_dns",
      "mcp__runcloud__runcloud_get_webapp_ssl",
      "mcp__runcloud__runcloud_get_ssl_method",
      "mcp__runcloud__runcloud_get_git_deployment",
      "mcp__runcloud__runcloud_list_databases",
      "mcp__runcloud__runcloud_list_database_users",
      "mcp__runcloud__runcloud_list_cronjobs",
      "mcp__runcloud__runcloud_list_supervisors",
      "mcp__runcloud__runcloud_get_supervisor_status",
      "mcp__runcloud__runcloud_list_firewall_rules",
      "mcp__runcloud__runcloud_list_blocked_ips",
      "mcp__runcloud__runcloud_list_backups",
      "mcp__runcloud__runcloud_list_backup_snapshots",
      "mcp__runcloud__runcloud_list_atomic_projects",
      "mcp__runcloud__runcloud_list_atomic_deployments"
    ],
    "ask": [],
    "deny": [
      "mcp__runcloud__runcloud_control_service",
      "mcp__runcloud__runcloud_deploy_git",
      "mcp__runcloud__runcloud_force_deploy_atomic",
      "mcp__runcloud__runcloud_run_cronjob",
      "mcp__runcloud__runcloud_reload_supervisor",
      "mcp__runcloud__runcloud_renew_ssl",
      "mcp__runcloud__runcloud_install_letsencrypt_ssl"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as runcloud. Review it before you use it.

Keep track

Get told when this server's tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.usefulapi/runcloud/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Anlyon alternative

7 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Compare with other servers for the same product.

Source: MCP Registry · repository. Synced Oct 21, 2026, 19:23 UTC.

For agents: Markdown · JSON · report this listing