/alibabacloud-mcp-connector

name: alibabacloud-mcp-connector
description: Operate, run O&M for, and manage Alibaba Cloud through local commands, with no MCP configuration needed. CallCLI runs Alibaba Cloud CLI/API commands to create, read, update and delete resources of any product; RunScript runs Python batch scripts; RunIaC runs Terraform orchestration; plus API retrieval and official-document retrieval to follow the best-practice path. Use this whenever the user needs to do anything with Alibaba Cloud — inspect or change ECS, OSS, VPC, RDS, SLS resources, run batch operations, provision infrastructure, or look up official Alibaba Cloud product documentation. Triggers include "阿里云", "aliyun", "ECS", "OSS", "阿里云 API", "阿里云文档", "官方文档", "产品文档", "云资源", "运维", "Terraform", "documentation".
triggers:
  - "阿里云"
  - "aliyun"
  - "ECS"
  - "OSS"
  - "阿里云 API"
  - "阿里云文档"
  - "云资源"
  - "运维"
  - "Terraform"

Operate, O&M, and Manage Alibaba Cloud

Observability (MUST follow for every aliyun command)

Before any cloud API invocation, read `references/manifest.json` from this skill's root and use only its top-level non-empty string `version` as `{skill-version}`. If missing or invalid, STOP. NEVER invent, guess, or reuse a version from another skill.

Bind version and session to the current skill name and skill root. Before this skill's first cloud API invocation in a conversation, generate a fresh random 32-character lowercase hexadecimal session ID. Reuse that session ID for this skill throughout the conversation; each skill MUST use a distinct session ID. NEVER copy one from documentation, examples, another skill, or a previous conversation, and NEVER send the literal `{session-id}` placeholder. On a skill switch or return, reread that skill's manifest; never cross-skill reuse either value.

**Rule: Every `aliyun` CLI command that calls a cloud API MUST include the `--user-agent` flag.**

Markdown examples may omit the flag for brevity. The Agent MUST append the exact flag to every actual execution, including commands generated or extended at runtime.

**Attach the User-Agent at the remote cloud-call boundary:**

• `CallCLI`: put `--user-agent "..."` inside the JSON `command` field, as part of its Alibaba Cloud CLI string. NEVER pass `--user-agent` as an argument to `mcpx.py`; that is a local usage error (exit code 2).
• `RunScript`: define the complete UA in the submitted Python script and pass `user_agent=UA` to EVERY `call_cli(...)` invocation. Environment variables supplied to the local `mcpx.py` process are not automatically available inside the remotely executed script.
• `RunIaC`: put the complete UA directly in `configuration_source` inside every submitted `provider "alicloud"` block. Local `TF_VAR_*` environment variables do not reach the remote Terraform process, so resolve the real session ID and manifest version into the submitted HCL. An `apply` or `destroy` using `previousProcessId` reuses that planned code.

Local utility commands (e.g. `configure`, `plugin`, `version`) do not support this flag and should be excluded.

--user-agent "AlibabaCloud-Agent-Skills/alibabacloud-mcp-connector/{session-id} skill-version/{skill-version}"

**Runtime templates:**

mcpx call CallCLI '{"command":"aliyun ecs describe-regions --region cn-hangzhou --user-agent \"AlibabaCloud-Agent-Skills/alibabacloud-mcp-connector/{session-id} skill-version/{skill-version}\""}'

UA = "AlibabaCloud-Agent-Skills/alibabacloud-mcp-connector/{session-id} skill-version/{skill-version}"
result = await call_cli(product="Ecs", action="DescribeRegions", params={}, user_agent=UA)

provider "alicloud" {
  region               = "cn-hangzhou"
  configuration_source = "AlibabaCloud-Agent-Skills/alibabacloud-mcp-connector/{session-id} skill-version/{skill-version}"
}

SKILL_SESSION_ID={session-id} SKILL_VERSION={skill-version} uv run --python 3.11 scripts/mcpx.py doctor

Confirm with the user before changing anything

Read-only work needs no permission: queries, doc lookups and API discovery run straight away. But before any call that creates, modifies, deletes or costs money, state in plain language what is about to change — product, region, resource identifiers, action — and wait for the user's explicit go-ahead. A general request such as "clean up the idle machines" is not approval for a specific deletion; `RunIaC` `apply` / `destroy` and every mutating `CallCLI` or `RunScript` still need one. If the user has not answered yet, do not proceed.

When to use

Use this whenever you need to do anything with Alibaba Cloud. The 15 tools cover the full path from "figure out how" to "verify it is done":

| Goal | Main tools | What they do | |---|---|---| | **Operate** — perform a concrete action | `CallCLI` | **First choice.** Run Alibaba Cloud CLI/API commands to create, read, update, delete resources of any product | | **O&M** — batch and multi-step | `RunScript` + `GetTask` | One Python script handles many resources / multi-step flows; poll async tasks to a terminal state | | **Manage** — infrastructure orchestration | `RunIaC` + `GetTask` | Terraform HCL, plan → apply → destroy, with state management | | Find the right API | `SearchApis` `ListApis` `GetApiDefinition` `GenerateCLICommand` `ListProducts` `ListProductRegions` | Unsure which API, how to pass parameters, which regions are available | | Look up authoritative docs | `SearchDocuments` `GetDocument` `GetDocumentTree` `GrepDocuments` | Official doc search, per-product retrieval, full text | | Transfer files | `GetPresignedUrl` | OSS presigned URL, to pass large files into `RunScript` / `RunIaC` |

**What "best-practice path" means:**

• If unsure, confirm parameters with `GetApiDefinition` or the docs first, then run `CallCLI` — do not guess-and-try
• Do batch operations in one `RunScript` run, not by looping `CallCLI`
• Do infrastructure changes via `RunIaC` plan-then-apply (see the diff before landing), not scattered commands