Control Plane MCP connector

• Get Get cpln rules The operating guide: approval for high-impact actions, the platform facts the tools do not check, Terraform ownership, targets, CLI use, and failure handling. Optional, since the core rules arrive with every connection.
• Get Get cpln skill The runbook for one task family: how to use a feature correctly, the constraints that are easy to miss, and when it's the wrong tool. Not advertised when the AI Plugin supplies its own skills.
• Action Plan app Before any code for an app that keeps anything (content, records, files, or sign-ins): how Control Plane keeps its files, records, secrets, and replicas, and the tools that do each. The assistant settles what your request leaves open with you first. Not in `readonly`.
• Get Get resource schema The exact object schema and REST endpoints for a resource kind, for authoring an accurate manifest or calling the API.
• Get Get permissions The grantable permissions for a resource kind, for building policies.
• Search Search control plane Search the documentation: up to five hits, each with a short excerpt and its page path.
• Search Query docs filesystem control plane Read a whole docs page, or search the docs pages and OpenAPI specs, with read-only, shell-like commands.
• List List resources List resources of one kind as a summary table.
• Get Get resource Fetch one resource by kind and name, with its full JSON. Secrets return metadata only — the API never includes their data.
• Delete Delete resource Delete one resource by kind and name. The single delete tool for every deletable kind — secrets are not deletable.
• Action Deploy app Build and deploy an HTTP app: from the app files stored with `write_app_files`, a GitHub or GitLab repository, or an existing image. Creates or updates a standard workload with production defaults (health checks, and two replicas so a deploy never takes it offline), grants…
• Add Add database Install PostgreSQL, MySQL, MariaDB, MongoDB, or Redis from the Template Catalog with credentials Control Plane generates, let the named workloads connect, and return the host, port, and the env values an app uses as `cpln://secret` references. No credential passes through the…
• Action Diagnose workload Find out why a workload is unhealthy: reads its deployments, events, and recent error logs, and returns each likely cause with its evidence and the fix. Also in `readonly`.
• Restart Restart workload Replace every replica with a fresh one on the same spec, so the workload rereads its secrets and env, then wait until it is ready.
• Action Rollback workload Put a workload back on its previous image, or on a given one, changing nothing else, then wait until it is ready.
• Action Promote workload Run a workload in another GVC of the same org with its current spec, such as staging to production, with an optional image and env values for the target. Grants access to the secrets its env references and overwrites a workload of the same name there.
• Action Allow workload access Let other workloads reach a workload through its internal firewall, keeping every other rule, and return the internal URL the callers use. Also takes callers back out.
• Action Grant cloud access Give a workload credential-free access to AWS, GCP, or Azure through an existing cloud account: sets up its identity, binds the access, and waits until the identity reports it usable.
• Create Create gvc Create a GVC with one or more cloud locations. If you leave the location to the assistant, it picks one and tells you which.
• Update Update gvc Update a GVC's settings, such as its description, tags, or pull secrets.
• Add Add gvc locations Add one or more cloud locations to an existing GVC.
• Delete Remove gvc locations Remove cloud locations from a GVC.
• Create Create workload Create a serverless, standard, stateful, or cron workload with its containers and exposure.
• Update Update workload Update an existing workload — image, resources, scaling, environment, and more.
• Action Grant workload secret access Grant an existing workload access to a secret by wiring its identity and access policy. Never returns secret values.
• Start Workload start cron Trigger an immediate run of a cron workload.
• Stop Workload stop replica Terminate one running replica of a workload; the platform reschedules a replacement per the scaling settings.
• Action Configure workload load balancer Set or clear the direct per-location load balancer, geo headers, and replica-direct routing.
• Action Configure workload security Set or clear the pod-level security context (filesystem group, run-as user).
• Action Configure workload rollout Set or clear how updates roll out — surge, unavailability, and scaling policy.
• Action Configure workload retry Set or clear the retry behavior for failed requests.
• Action Configure workload sidecar Set or clear the Envoy proxy filter chain. Advanced.
• Action Configure workload local options Set or clear per-location overrides of the default options.
• Action Configure workload extras Set or clear BYOK-only Kubernetes customizations (affinity, tolerations, spread constraints).
• Action Write app files Write or edit an app's files (whole text files, appends for a large file in parts, exact-text edits, deletions, and moves or renames, uploaded files included) under an app name, for chats that cannot write files or agents without the `cpln` CLI (an agent with a filesystem and…
• Action Build image Build an image from a GitHub or GitLab repository, or from the app files stored with `write_app_files`, and push it to the org's private registry. Returns a build id; the build keeps running after the call returns. Building an existing `NAME:TAG` replaces that image.
• Get Get image build Read a build's status, progress events, and log by its build id.
• Create Create app files upload link Get an upload link for files you have to provide (pictures, fonts, PDFs, data). Open it in a browser and drop every file at once: the page sorts each one into place, such as the logo into its own spot and a set of photos into their folder, where order does not matter, and you…
• Get Get app files List an app's stored files, read one (in slices for a large file), or get a short-lived download link (tar.gz) for all of them. Also reports where each of the app's images was built from: stored files, a repository, a folder uploaded with the CLI, or a push outside a Control…
• Create Create secret Create a secret with random values Control Plane generates now, or get a Console link prefilled with its name, type, and keys where you type the values. No input accepts a value and no result contains one.
• Rotate Rotate secret Replace a secret's values, generated again or entered by you through a Console link, and restart the workloads that use it. Anything outside Control Plane that holds the old values stops working.
• Create Create domain Put a domain in front of a workload: from the domain, workload, and GVC it derives the 443 listener, the route, and `cname` mode, and returns the DNS records to add. A custom setup (other listeners, `ns` mode, several routes) passes the ports and DNS mode instead.
• Update Update domain Update a domain's metadata, host/subdomain acceptance flags, and GVC or workload binding.
• Add Add domain port Add a port listener (for example, 443/http2) to a domain.
• Delete Remove domain port Remove a port listener from a domain.
• Add Add domain route Add a route mapping a path or prefix to a workload.
• Update Update domain route Update an existing route on a domain listener.
• Delete Remove domain route Remove a route from a domain listener.
• Set Set domain tls Set the TLS configuration on a domain listener.
• Clear Clear domain tls Clear the TLS configuration from a domain listener.
• Set Set domain cors Set the CORS policy on a domain listener.
• Clear Clear domain cors Clear the CORS policy from a domain listener.
• Create Create identity Create a GVC-scoped identity for workload access to secrets, cloud resources, and private networks.
• Update Update identity Update an identity's settings and bound credentials.
• Create Create policy Create a policy that grants permissions on resources to principals.
• Update Update policy Update a policy's bindings, targets, or permissions.
• Create Create group Create a group of users and service accounts, with optional tag-based membership.
• Action Edit group Update a group's membership or membership query.
• Create Create service account Create a service account for programmatic access.
• Update Update service account Update a service account's description or tags, or revoke its keys by name.
• Add Add key to service account Create the service account if needed, optionally add it to a group, and return the Console page where you add the key and see it once. The key never passes through the chat.
• Invite Invite user to org Invite a user by email to join the organization.
• Add Add identity network resource Add an agent-based (wormhole) network resource so a workload can reach a private endpoint.
• Add Add identity native network resource Add an AWS PrivateLink or GCP Private Service Connect network resource to an identity.
• List List identity network resources List the agent-based and cloud-native network resources attached to an identity.
• Delete Remove identity network resource Remove a network resource from an identity.
• Action Browse templates List the catalog — name, category, latest version, and whether each template creates its own GVC.
• Get Get template Show a template's versions, prerequisites, and example `values.yaml`.
• Action Install template Install a catalog template as a new release. With `dryRun: true`, it renders what the install would create and applies nothing.
• Action Upgrade template Upgrade an installed release to a new version or updated values.
• Action Rollback template Roll a release back to a prior revision.
• Action Uninstall template Uninstall a release and remove the resources it created.
• List List installed templates List the template releases installed in an org.
• Get Get installed template Show a release's status, revision, and the resources it created.
• Create Create volumeset Create a volume set for persistent storage.
• Update Update volumeset Update a volume set's settings. A new snapshot policy without a retention keeps the current one, so scheduled snapshots always expire.
• Action Mount volumeset to workload Mount a volume set to a workload at a path (ext4/xfs require a stateful or VM workload; shared mounts on any type).
• Action Expand volumeset Increase a volume's capacity with no downtime or data loss.
• Action Shrink volumeset Shrink a volume to a smaller capacity. Data is migrated, but if used bytes exceed the new size the excess is lost — snapshot first.
• Create Create volumeset snapshot Create a point-in-time snapshot of a volume.
• List List volumeset snapshots List the snapshots of a volume set.
• Restore Restore volumeset snapshot Restore a snapshot, discarding everything written since it was taken.
• Delete Delete volumeset snapshot Delete a volume set snapshot.
• Delete Delete volumeset volume Delete a single volume from a volume set.
• List List deployments A workload's per-location rollout status — the primary readiness check after a deploy.
• Get Get workload logs Query a workload's logs by structured parameters or a raw LogQL query.
• Get Get workload events Fetch a workload's event log to diagnose readiness, liveness, and deploy failures.
• List List workload replicas List the running replicas of a workload in a location.
• List List metrics Discover the metrics and labels you can query, each with a correct PromQL template.
• Search Query metrics Run a PromQL query against Control Plane metrics.
• Search Query audit events Query the audit trail for mutations on resources of a kind.
• Search Query traces Search distributed traces, newest first, by GVC, workload, HTTP method, request id, errors, or duration, or with TraceQL.
• Get Get trace Fetch one trace by ID and summarize its span tree with each span's duration, method, path, and status, its request ids, and its errors.
• List List commands List the asynchronous operation commands issued against a workload or volume set — cron runs, replica stops, and volume operations.
• Get Get command Fetch one asynchronous command by ID to check a long-running operation's status.
• Convert Convert to terraform Convert a resource manifest to Terraform HCL, dry-run validated against the API first.
• Export Export terraform Generate Terraform HCL for existing resources from a self link, single or in bulk.
• Create How to create cloud account The setup a cloud account needs on the provider's side, filled in with your values: the IAM role and policies for AWS, the service account roles for GCP, the connector steps for Azure, or the account secret for NATS NGS.
• Create Create cloud account Create a cloud account bridging Control Plane to AWS, GCP, Azure, or NGS.
• Update Update cloud account Update a cloud account's settings.
• Create Create agent Start creating an agent for secure connectivity to a private network: returns a Console link with its name and description prefilled, where you finish and download the bootstrap config. The config never passes through the chat.
• Update Update agent Update an agent's settings.
• Get Get agent info Fetch an agent's real-time status — active state, last heartbeat, peer and service counts.
• Get Get agent eventlog Fetch an agent's event log.
• Create Create ipset Reserve static public IPs per location.
• Update Update ipset Update an IP set's settings.
• Add Add ipset location Add locations to an IP set or update their retention policy. Passing an existing location overwrites its entry, and retention policy `free` releases an allocated static IP.
• Delete Remove ipset location Remove locations from an IP set.
• List List orgs The orgs this connection can use (the ones you selected when you connected), each with its GVCs and their locations. With a single org selected, every tool uses it when no org is named. Also in `readonly`.
• Update Update org Update organization-wide settings.
• List List quotas List the org's resource quotas with current usage — filter to those near their limit.
• Get Get quota Fetch the details and current usage of one quota.
• Create Create audit context Create a custom audit context for tamper-proof external events.
• Action Edit audit context Update an audit context's description and tags. Replaces the description and can clear existing tags.
• Get Get external logging View the org's primary and extra external logging providers.
• Action Configure external logging Configure log shipping to an external provider (S3, Datadog, Coralogix, and more).
• Delete Remove external logging Remove an external logging provider from the org.
• Create Create mk8s Create a cluster on AWS, GCP, Azure, DigitalOcean, Hetzner, Linode, Lambda Labs, Oblivus, Paperspace, or Triton, or on hardware you own with `generic`. The provider's credential secret must exist first; the tool names any required setting that is missing.
• Update Update mk8s Update a cluster by sending only what changes. Node pool changes provision or remove nodes, region and network settings cannot change, and the Kubernetes version moves one minor version at a time.

No tools match your search.