What the layer is¶
The center of the package is one class, cloudg.mcp.CloudGMCPLayer. It owns four things:
| Part | Class | What it holds |
|---|---|---|
| Registry | cloudg.mcp.core.Registry |
Tool, resource, resource-template and prompt specs |
| Workspace | cloudg.mcp.state.Workspace |
Loaded datasets, the active one, allowed directories |
| Policy | cloudg.mcp.policy.Policy |
Who may call what, rate limits, input and output transforms |
| Middleware | list of async (info, call_next) callables |
Audit, metrics, caching, concurrency, your own |
Whatever server or transport a request arrives through, it ends up in one of four layer
methods: call_tool, read_resource, get_prompt or complete. That is why a policy
written once applies the same way to Claude Desktop over stdio, to a web client over HTTP, to
an MCP server you mounted cloudg into, and to a Python script.
There are three ways to use it.
| Mode | Entry point | Use it when |
|---|---|---|
| Standalone server | cloudg mcp serve (stdio, streamable HTTP, legacy SSE) |
You want cloudg as its own MCP server for a desktop client or a gateway |
| Mounted | layer.register_into(server) |
You already run an MCP server (official mcp SDK 1.x or 2.x, or fastmcp 2/3/4) and want cloudg's primitives inside it |
| In-process | await layer.call_tool(...) and friends |
You are writing Python (an agent framework, a test, a batch job) and do not need MCP on the wire |
The default catalog, as listed under the open profile, has 74 tools, 13 resources,
11 resource templates and 11 prompts. The CLI adds a 14th resource, cloudg://metrics
(section 14.3). The default standard profile hides one tool (reveal_token), so
cloudg mcp tools shows 73 there. The categories are:
| Category | What its tools do |
|---|---|
workspace |
Load, select, snapshot, diff and unload datasets |
inventory |
Search, inspect and aggregate assets, accounts, regions, tags, coverage, org |
graph |
Neighbors, paths, exposure, attack and lateral paths, dependencies, blast radius, centrality, sub-graphs |
findings |
Browse, summarize, prioritize, suppress and ingest security findings |
compliance |
Framework posture, controls and compliance gaps |
ontology |
RDF ontology, read-only SPARQL, semantic neighbourhoods, RAG chunks |
export |
Terraform recreation and report files |
live |
Collect from cloud APIs, run scanners, report the live rate-limit state |
meta |
Server capabilities and cloudg's vocabulary |
privacy |
Policy, pseudonym vault and data-handling controls |
prompts |
Packaged analysis workflows |
The per-tool reference is in MCP_TOOLS.md.