@huaweidevtools/mcp-huaweicloud-ops-deploy

What changed

Changed 2026-10-22 11:55 UTC

18 schema or annotation changes with the description left byte-identical.

--- pinned/apiexplorer
+++ observed/apiexplorer
  {
+   "annotations": {
+     "destructiveHint": false,
+     "idempotentHint": true,
+     "openWorldHint": true,
+     "readOnlyHint": true
+   },
    "description": "Discover HuaweiCloud API definitions via APIExplorer. Five levels: (1) no args → list all cloud services (productshort + api_count); (2) productshort → list that service's APIs (name + summary, paginated); (3) productshort + api_name → API contract; pass compact=true for a minimal contract (method/path/required_params/optional_params, ~500B) instead of the full swagger (5-10KB). compact is recommended — it has every field needed to call openapi_request and is easier to scan. (4) regions=true → regions where the service/API is available (region_id + project_id); (5) endpoints=true → per-region endpoint hosts for the service (domain_url). Use these to find correct endpoints and parameters before calling openapi_request.",
    "inputSchema": {
      "$schema": "https://json-schema.org/draft/2020-12/schema",
-   "title": "查询华为云 API 定义"
+   "title": "Query HuaweiCloud API definitions"
  }

--- pinned/auth
+++ observed/auth
  {
+   "annotations": {
+     "destructiveHint": false,
+     "idempotentHint": true,
+     "openWorldHint": true,
+     "readOnlyHint": true
+   },
    "description": "Authenticate with HuaweiCloud. Takes NO parameters — AK/SK/region are collected via MCP elicitation (a form pops up for the user), so credentials never enter the tool-call context. Verifies via GET /v3/projects (signed). Persists to OS keychain (or machine-fingerprint-bound file fallback). STS (security_token) not persisted. Subsequent tools read credentials automatically. If elicitation is unsupported, falls back to HW_ACCESS_KEY/HW_SECRET_KEY/HW_REGION_NAME env vars.",
    "inputSchema": {
      "$schema": "https://json-schema.org/draft/2020-12/schema",
-   "title": "HuaweiCloud 认证"
+   "title": "Authenticate with HuaweiCloud"
  }

--- pinned/create_deployment
+++ observed/create_deployment
  {
+   "annotations": {
+     "destructiveHint": false,
+     "idempotentHint": true,
+     "openWorldHint": false,
+     "readOnlyHint": false
+   },
    "description": "Create or reuse a deployment workspace directory. If the directory does not exist, create it and write .deployment.json (state snapshot). Does NOT create networking.json/cost.json placeholders. If the directory exists but is not a deployment (non-empty, no .deployment.json), return an error.",
    "inputSchema": {
      "$schema": "https://json-schema.org/draft/2020-12/schema",
-   "title": "创建部署工作区"
+   "title": "Create deployment"
  }

--- pinned/delete_deployment
+++ observed/delete_deployment
  {
+   "annotations": {
+     "destructiveHint": true,
+     "idempotentHint": true,
+     "openWorldHint": false,
+     "readOnlyHint": false
+   },
    "description": "Delete a deployment workspace directory. Refuses if the deployment still has live cloud resources — checks terraform.tfstate; if resources exist, run terraform_destroy first. If no resources, removes the directory.",
    "inputSchema": {
      "$schema": "https://json-schema.org/draft/2020-12/schema",
-   "title": "删除部署工作区"
+   "title": "Delete deployment"
  }

--- pinned/list_existing_resources
+++ observed/list_existing_resources
  {
+   "annotations": {
+     "destructiveHint": false,
+     "idempotentHint": true,
+     "openWorldHint": true,
+     "readOnlyHint": true
+   },
    "description": "List HuaweiCloud resources the user already owns (for reuse in a deployment) via RMS (Resource Management Service). Two stages: by default returns a SUMMARY (provider→type→region→count, cheap, cross-region) so you see what exists before drilling in. Pass service, region, or detail=true to get the full resource list (id/name/properties — use after the summary to narrow down). Detail mode is paginated: if the response has next_marker, pass it back as marker to fetch the next page. Also returns balance_summary (balances + coupons). Call AFTER update_networking and BEFORE update_cost. Reuse eligibility is a judgment call, not decided here. NOTE: RMS data may lag — resources recently created or destroyed may not reflect immediately. When timing matters (e.g. verifying cleanup after destroy), be aware this data source is not real-time.",
    "inputSchema": {
      "$schema": "https://json-schema.org/draft/2020-12/schema",
-   "title": "盘点已有云资源"
+   "title": "List existing cloud resources"
  }

--- pinned/openapi_request
+++ observed/openapi_request
  {
+   "annotations": {
+     "destructiveHint": true,
+     "idempotentHint": false,
+     "openWorldHint": true,
+     "readOnlyHint": false
+   },
    "description": "Send a signed HTTP request to a HuaweiCloud API endpoint. Credentials are read from secure storage and used to sign the request — AK/SK are never exposed in arguments. GET requests are safe; POST/PUT/DELETE execute but the response includes a warning to inform the user of consequences.",
    "inputSchema": {
      "$schema": "https://json-schema.org/draft/2020-12/schema",
-   "title": "调用华为云 API"
+   "title": "Call HuaweiCloud API"
  }

--- pinned/provider_schema
+++ observed/provider_schema
  {
+   "annotations": {
+     "destructiveHint": false,
+     "idempotentHint": true,
+     "openWorldHint": false,
+     "readOnlyHint": true
+   },
    "description": "Extract the schema of the locally installed huaweicloud terraform provider by running `terraform providers schema -json` in the deployment directory. Without resource_type: return the list of all resource and data-source type names (the full schema is ~6MB, too large to return whole). Use the `filter` arg to narrow by substring (e.g. filter=\"vpc\" returns huaweicloud_vpc, huaweicloud_vpc_route, ...). With resource_type: return that type's full schema (attributes, types, required-ness, nested blocks). Call AFTER terraform_init.",
    "inputSchema": {
      "$schema": "https://json-schema.org/draft/2020-12/schema",
-   "title": "提取 provider schema"
+   "title": "Extract provider schema"
  }

--- pinned/terraform_apply
+++ observed/terraform_apply
  {
+   "annotations": {
+     "destructiveHint": true,
+     "idempotentHint": true,
+     "openWorldHint": true,
+     "readOnlyHint": false
+   },
    "description": "Run `terraform apply`. Enforces four safety gates: networking.json exists, cost.json exists, tf_hash state machine, no plaintext credentials.",
    "inputSchema": {
      "$schema": "https://json-schema.org/draft/2020-12/schema",
-   "title": "terraform apply"
+   "title": "Terraform apply"
  }

--- pinned/terraform_destroy
+++ observed/terraform_destroy
  {
+   "annotations": {
+     "destructiveHint": true,
+     "idempotentHint": true,
+     "openWorldHint": true,
+     "readOnlyHint": false
+   },
    "description": "Run `terraform destroy`. Permanently deletes cloud resources managed by this deployment — irreversible. MUST confirm with the user before calling. Safety gate: refuses if tfstate is empty (nothing to destroy) or if .tf files contain plaintext credentials (same scan as init/apply). By default destroys ALL resources in the deployment. Pass `target` to destroy only specific resources by address — use this to spare imported (reuse) resources: destroy only the newly-created resources, leaving imported ones in state. Call terraform_state first to list resource addresses. A future enhancement will return a structured plan -destroy preview for the user to review before the actual destroy.",
    "inputSchema": {
      "$schema": "https://json-schema.org/draft/2020-12/schema",
-   "title": "terraform destroy"
+   "title": "Terraform destroy"
  }

--- pinned/terraform_examples_export
+++ observed/terraform_examples_export
  {
+   "annotations": {
+     "destructiveHint": false,
+     "idempotentHint": true,
+     "openWorldHint": false,
+     "readOnlyHint": false
+   },
    "description": "Export HuaweiCloud terraform provider examples (.tf reference files) to a target directory. Organized by cloud service category (ecs, vpc, rds, ...). Serve as cross-resource assembly templates. Note: example providers.tf may contain access_key lines from upstream docs — IGNORE those (credentials go via env vars, never in .tf).",
    "inputSchema": {
      "$schema": "https://json-schema.org/draft/2020-12/schema",
-   "title": "导出 terraform 编排示例"
+   "title": "Export terraform examples"
  }

--- pinned/terraform_import
+++ observed/terraform_import
  {
+   "annotations": {
+     "destructiveHint": false,
+     "idempotentHint": true,
+     "openWorldHint": true,
+     "readOnlyHint": true
+   },
    "description": "Run `terraform import` to bring an existing cloud resource into tfstate without creating it. Use after list_existing_resources to reuse an existing resource: write the resource block in .tf (with the same address), then import to populate its state. The resource address and ID format depend on the provider type — check provider docs or apiexplorer for the import syntax (e.g. huaweicloud_compute_instance.myvm <instance-id>).",
    "inputSchema": {
      "$schema": "https://json-schema.org/draft/2020-12/schema",
-   "title": "terraform import"
+   "title": "Terraform import"
  }

--- pinned/terraform_init
+++ observed/terraform_init
  {
+   "annotations": {
+     "destructiveHint": false,
+     "idempotentHint": true,
+     "openWorldHint": true,
+     "readOnlyHint": false
+   },
    "description": "Run `terraform init`. Generates <deployment>/.terraformrc with provider mirror config (if not user-provided), sets TF_PLUGIN_CACHE_DIR, pulls provider plugins. Credential env injected from keychain.",
    "inputSchema": {
      "$schema": "https://json-schema.org/draft/2020-12/schema",
-   "title": "terraform init"
+   "title": "Terraform init"
  }

--- pinned/terraform_install
+++ observed/terraform_install
  {
+   "annotations": {
+     "destructiveHint": false,
+     "idempotentHint": true,
+     "openWorldHint": true,
+     "readOnlyHint": false
+   },
    "description": "Ensure a terraform binary is available. Only installs the binary — provider plugins are pulled by terraform_init. Priority: terraform_path param > PATH > global cache (~/.huaweicloud-ops-deploy/bin/) > download from binary_mirrors. Download falls back to <deployment>/.terraform/bin/ when HOME is not writable.",
    "inputSchema": {
      "$schema": "https://json-schema.org/draft/2020-12/schema",
-   "title": "安装 terraform"
+   "title": "Install terraform"
  }

--- pinned/terraform_plan
+++ observed/terraform_plan
  {
+   "annotations": {
+     "destructiveHint": false,
+     "idempotentHint": true,
+     "openWorldHint": true,
+     "readOnlyHint": true
+   },
    "description": "Run `terraform plan`. Returns a STRUCTURED plan (terraform show -json) to parse and reorganize into human-readable form for the user.",
    "inputSchema": {
      "$schema": "https://json-schema.org/draft/2020-12/schema",
-   "title": "terraform plan"
+   "title": "Terraform plan"
  }

--- pinned/terraform_refresh
+++ observed/terraform_refresh
  {
+   "annotations": {
+     "destructiveHint": false,
+     "idempotentHint": true,
+     "openWorldHint": true,
+     "readOnlyHint": true
+   },
    "description": "Run `terraform apply -refresh-only`. Updates tfstate to reflect real cloud state.",
    "inputSchema": {
      "$schema": "https://json-schema.org/draft/2020-12/schema",
-   "title": "terraform refresh"
+   "title": "Terraform refresh"
  }

--- pinned/terraform_state
+++ observed/terraform_state
  {
+   "annotations": {
+     "destructiveHint": false,
+     "idempotentHint": true,
+     "openWorldHint": false,
+     "readOnlyHint": true
+   },
    "description": "Read terraform state via `terraform show -json`. Returns structured state. Uses terraform's stable show -json interface (not direct tfstate parse).",
    "inputSchema": {
      "$schema": "https://json-schema.org/draft/2020-12/schema",
-   "title": "读取 tfstate"
+   "title": "Read tfstate"
  }

--- pinned/update_cost
+++ observed/update_cost
  {
+   "annotations": {
+     "destructiveHint": false,
+     "idempotentHint": true,
+     "openWorldHint": false,
+     "readOnlyHint": false
+   },
    "description": "Write or update cost.json for a deployment. Records spec + charging + price + source (reuse/new) per component. Server validates structure + A-layer refs (resource → networking components), auto-computes total_monthly (sum of new items only), sets tf_hash=null, writes estimated_at. Called BEFORE writing .tf (cost.json precedes .tf).",
    "inputSchema": {
      "$schema": "https://json-schema.org/draft/2020-12/schema",
-   "title": "规格计费落盘"
+   "title": "Write cost estimate"
  }

--- pinned/update_networking
+++ observed/update_networking
  {
+   "annotations": {
+     "destructiveHint": false,
+     "idempotentHint": true,
+     "openWorldHint": false,
+     "readOnlyHint": false
+   },
    "description": "Write or update networking.json for a deployment. Three layers: topology (VPC/subnets/route_tables/security_groups), network_objects (eips/nat_gateways/loadbalancers), components (resource identity + optional network attach). Design this before writing .tf — it is the physical networking contract. Validates structure and A-layer reference consistency (id uniqueness, subnet/sg/eip/nat refs).",
    "inputSchema": {
      "$schema": "https://json-schema.org/draft/2020-12/schema",
-   "title": "组网设计落盘"
+   "title": "Write networking design"
  }

Current tools

Watch this server yourself

If you run this server, put the proxy in front of it. It pins these exact fingerprints on first connect and stops the session if they move.

npx -y mcp-pin@0.2.3 -- <your @huaweidevtools/mcp-huaweicloud-ops-deploy command>

Or subscribe to this page's RSS feed to be told when it changes.

Badge

The badge states one fact about time and nothing else. It never claims a server is safe.

[![mcp-pin](https://mcp-pin.gautamkhosla.com/badge/d9d21057edd31199.svg)](https://mcp-pin.gautamkhosla.com/servers/d9d21057edd31199.html)