cloudg MCP catalog reference¶
This is the programmer's reference for everything the cloudg MCP layer exposes: 74 tools, 13 resources, 11 resource templates and 11 prompts in cloudg 0.6.0. Each tool entry lists its arguments, return fields, annotations and policy metadata, followed by a real call and its real result.
Other MCP documents cover the rest of the layer. MCP.md explains installation, the cloudg mcp CLI, transports and client setup. MCP_INTERNALS.md covers the layer, adapters and middleware. MCP_PRIVACY.md covers policies, transforms and the pseudonym vault. Policies come up here only where they change what a tool returns.
Sections¶
-
How the examples were produced
Every JSON example below was captured by a script, not typed by hand. The script wrote the synthetic estate from tests/mcp/fixtures/sample_estate.py (an AWS...
-
Resources and resource templates are listed in Resources and resource templates, prompts in Prompts.
-
Each module in cloudg/mcp/catalog/ registers its primitives through a register(registry) function. cloudg.mcp.catalog.default_registry() calls all of them...
-
Conventions shared by every tool
A tool returns a JSON object. The layer sends it twice: as structuredContent, and as pretty-printed JSON text in content[0] for clients without structured...
-
The workspace holds named datasets in memory. A dataset is one loaded inventory map, findings report or scanner output, or the result of a live collection....
-
These tools answer "what do we have". find_assets and count_assets share one filter implementation (filter_assets in cloudg/mcp/catalog/_inventory.py).
-
The graph tools read three views of the same edges, each built lazily and cached per dataset:
-
Findings come from scanners (Prowler, ScoutSuite, Checkov, Trivy, the IAM linter), from cloudg's reachability analysis, or from a loaded findings.json. Each...
-
Two sources feed these tools. The rulesets shipped in cloudg/rules (CIS for each cloud, NIST 800-53, PCI DSS, ISO 27001, SOC 2, HIPAA, GDPR, AWS...
-
cloudg builds an RDF/OWL ontology from a dataset (cloudg.graph.ontology.CloudOntology): one individual per asset (cmr:), per finding (cmr:finding_) and per...
-
Every export writes under the workspace output directory (workspace_status.output_dir). subdir must match ^[A-Za-z0-9_.-/]{0,200}$ and must stay inside the...
-
map_inventory, collect_assets, run_scanners and run_pipeline are the only tools that reach outside the server (openWorldHint: true). The fifth tool in this...
-
Static answers with no tenant data. They are public, need no capability and no dataset, so even the most restrictive policy keeps them.
-
The privacy tools let a caller see what the active policy does to its data. MCP_PRIVACY.md explains the profiles, transforms and the vault; this section...
-
Resources and resource templates
Resources are addressable, read-only views of the workspace. Tool results link to them instead of inlining large payloads, and clients can subscribe to them...
-
completion/complete is served for every template variable in the table above and for prompt arguments (dataset, ref, finding_id, framework, severity, base,...
-
Each prompt returns user messages only. The first holds the task and the exact tool calls to make. The task text never contains values from the workspace...
-
Multi-step workflows an agent (or a script) can follow. Each step names the tool and the arguments; the numbers quoted come from the captured runs on the...
-
These are properties of the current code (0.6.0) that callers should know about; each was checked against the capture run and is described in more detail in...