cloudg MCP layer¶
cloudg 0.6.0 ships a Model Context Protocol (MCP) layer in cloudg/mcp/. It exposes the
inventory, the relationship graph, findings, compliance mappings and the RDF ontology to AI
agents as MCP tools, resources and prompts, with an access and data-transformation policy
applied to every request.
This guide is for programmers who want to run the layer, plug it into an MCP server they already operate, or call it from Python. Three companion documents cover the rest:
- MCP_TOOLS.md: the catalog, every tool, resource, template and prompt with its arguments and result shape.
- MCP_PRIVACY.md: policies, profiles, roles, detectors, transforms and the pseudonym vault.
- MCP_INTERNALS.md: how the package is built, for contributors.
Every example output below was produced by running the command or script shown against the
synthetic estate in tests/mcp/fixtures/sample_estate.py. Long JSON is trimmed and marked
with ..., and absolute paths are shortened to .../docest.
Sections¶
-
The center of the package is one class, cloudg.mcp.CloudGMCPLayer. It owns four things:
-
Python 3.11 or newer is required. Importing cloudg.mcp imports nothing outside cloudg's own dependencies; mcp and fastmcp are imported lazily, inside the...
-
3. Quick start with a desktop client
Before wiring a client, check that the layer loads your data. --dataset takes NAME=PATH or a bare PATH, where the path is an inventory-map.json, its...
-
This is what happens to a tools/call, from the transport to the bytes that go back. Resource reads, prompts and completions follow the same path with the...
-
All seven commands live in the click group cloudg.mcp.cli.mcp_group. Under cloudg mcp ... the root cloudg command prints its banner to stderr and loads...
-
6. Transports and protocol versions
With --transport stdio the client launches the server and talks newline-delimited JSON-RPC over its stdin and stdout. stdout carries protocol messages and...
-
--flavor (and build_server(layer, flavor)) chooses which implementation speaks MCP. The layer, the policy and the results are identical across flavors; what...
-
8. Mounting into an existing MCP server
The server kind is detected by cloudg.mcp.adapters.detect_server_kind(server), which returns native, fastmcp, sdk-highlevel or lowlevel, falls back to duck...
-
For gateways, agent frameworks or custom servers that do not use an MCP SDK, export_definitions returns the wire definitions as one principal sees them,...
-
CloudGMCPLayer( config=None, *, workspace=None, policy=None, registry=None, include_categories=None, exclude_categories=None, include_tools=None,...
-
cloudg.mcp.state.Workspace is the in-memory state every request shares: named datasets, which one is active, the directories tools may touch, and change...
-
There are two independent kinds of paging.
-
MCP has two channels for failure. A JSON-RPC error means the request itself was wrong; an isError: true tool result means the tool ran and failed, which the...
-
CallInfo fields: kind (tool, resource, prompt, completion), name (tool or prompt name, the URI for resources, the prompt name or template string for...
-
15. Live tools and the credential preflight
The live category has five tools. Four touch cloud APIs: map_inventory (deep inventory mapping, timeout 3600 s), collect_assets (the standard collection,...
-
The details are in MCP_PRIVACY.md. The parts that touch this guide:
-
Run the exact command from the client config in a terminal; if it exits, the error is on stderr. Common causes: the command path is wrong for the client's...