/alibabacloud-agent-toolkit-install

name: alibabacloud-agent-toolkit-install
description: >
  Install Alibaba Cloud Agent Toolkit end-to-end: verify and set up prerequisites
  (uv, Alibaba Cloud CLI, authentication, CLI plugins, MCP Server Core, bearer
  token exchange), then install the toolkit via openplugin. Use when: alibabacloud
  agent toolkit install, environment check, prerequisite check, setup alibabacloud,
  plugin install, toolkit setup, mcp core setup, aliyun CLI setup.
license: Apache-2.0
metadata:
  domain: environment-setup
  owner: sdk-team

Alibaba Cloud Agent Toolkit — Installation

This skill sets up all prerequisites and installs the Alibaba Cloud Agent Toolkit. Execute each step **in order** — later steps depend on earlier ones.

Safety Policy

Each step is classified by risk level. Follow these rules strictly:

| Classification | Agent behavior | |----------------|----------------| | **Auto** (read-only check) | Execute without asking. | | **Confirm** (local install / CLI plugin install) | Show the user the exact command, explain what it does, and **wait for explicit approval** before executing. Never pipe-to-shell silently. | | **User-only** (interactive / browser-based) | Display instructions for the user to run in a **separate terminal**. Do not attempt to execute. | | **Confirm-cloud** (cloud-side write) | Explain the cloud resource that will be created, then **wait for explicit approval** before executing. |

---

Checklist Overview

Run through these steps sequentially. **Skip any step whose check already passes.**

1. [Check / Install `uv`](#step-1-uv) — Confirm 2. [Check / Install Alibaba Cloud CLI (`aliyun`)](#step-2-aliyun-cli) — Confirm 3. [Check CLI authentication](#step-3-cli-authentication) — Auto (check) / User-only (login) 4. [Check / Install CLI plugins](#step-4-cli-plugins) — Confirm 5. [Check / Create MCP Server Core](#step-5-mcp-server-core) — Auto (check) / Confirm-cloud (create) 6. [Check Bearer token exchange](#step-6-bearer-token-exchange) — Auto (check) 7. [Install Alibaba Cloud Agent Toolkit](#step-7-install-toolkit) — Confirm

---

Observability

All `aliyun` CLI business API commands in this skill **must** include the `--user-agent` flag for attribution tracking:

--user-agent AlibabaCloud-Agent-Skills/alibabacloud-agent-toolkit-install/{session-id}

**`{session-id}` generation rules:**

• Generate a UUID v4 once at the **start** of the skill run.
• Reuse the same `{session-id}` value for **every** `aliyun` command within the same

skill invocation.

• Do **not** replace `{session-id}` with a literal — it is a template variable resolved

at runtime.

---

Step 1: `uv` {#step-1-uv}

`uv` is the Python package manager required to start MCP servers.

Check (Auto)

uv --version

• **Pass** → output shows a version string (e.g. `uv 0.6.x`). Proceed to Step 2.
• **Fail** → `command not found`. Install below.

Install (Confirm — ask user before executing)

Present the appropriate command to the user and **wait for approval**:

| Platform | Command | |-----------------|---------| | macOS / Linux | `curl -LsSf https://astral.sh/uv/install.sh \| sh` | | Windows (PowerShell) | `powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 \| iex"` |

> **Security note:** These are pipe-to-shell commands. Show the command to the user > and let them decide whether to run it. Do not execute without explicit consent.

After installation, verify with `uv --version`. If the shell cannot find `uv`, instruct the user to restart their terminal or source their shell profile (`source ~/.bashrc`, `source ~/.zshrc`, etc.) so the PATH update takes effect.

---

Step 2: Alibaba Cloud CLI (`aliyun`) {#step-2-aliyun-cli}

Check (Auto)

aliyun version

• **Pass** → outputs a version string (e.g. `3.x.x`). Proceed to Step 3.
• **Fail** → `command not found`. Install below.

Install (Confirm — ask user before executing)

Present the appropriate command to the user and **wait for approval**:

macOS / Linux

/bin/bash -c "$(curl -fsSL https://aliyuncli.alicdn.com/install.sh)"

> **Security note:** This is a pipe-to-shell command. Show the command and let the > user decide. Do not execute without explicit consent.

Windows (PowerShell)

The installer script is located at [`scripts/install-aliyun-cli-windows.ps1`](scripts/install-aliyun-cli-windows.ps1).

Instruct the user to download or copy the script, then run:

powershell.exe -ExecutionPolicy Bypass -File .\install-aliyun-cli-windows.ps1

After installation, verify with `aliyun version`. If the command is not found, instruct the user to open a new terminal session so the updated PATH takes effect.

---

Step 3: CLI Authentication {#step-3-cli-authentication}

Check (Auto)

aliyun sts get-caller-identity --user-agent AlibabaCloud-Agent-Skills/alibabacloud-agent-toolkit-install/{session-id}

• **Pass** → returns JSON containing `AccountId`, `Arn`, and `UserId`. **Record the

authentication mode** (AK vs OAuth) — it affects Step 6. Proceed to Step 4.

• **Fail** → error response (e.g. `InvalidAccessKeyId`, `ERROR: ...`,

or similar). Guide the user through OAuth login below.

> **Note:** The output of `aliyun sts get-caller-identity` tells you who the current > user is. Share this with the user so they can confirm the correct identity is in use.

OAuth Login (User-only — user must run in a separate terminal)

The OAuth login flow is **interactive** — it opens a browser. The agent **must not** attempt to execute this. Display the following instructions for the user:

Please run this command in a separate terminal:

    aliyun configure --mode OAuth --profile <ProfileName>

Replace <ProfileName> with a name of your choice (e.g. "default", "myprofile").
This will open a browser for Alibaba Cloud login. Follow the prompts to complete authentication.

After the user confirms they have completed t