/alibabacloud-mcp-core-script-generate

name: alibabacloud-mcp-core-script-generate
description: >
  Generate Alibaba Cloud MCP Core RunScript-compatible Python scripts
  from natural-language cloud operation requests. Use when the user explicitly asks for
  RunScript scripts, MCP Core scripts, or sandbox-compatible cloud automation code.
  For standard SDK Python code with imports and credentials, use `alibabacloud-sdk-usage` instead.
license: Apache-2.0
metadata:
  domain: aliyun-runscript
  owner: sdk-team
  contact: sdk-team@alibabacloud.com
  triggers: >
    RunScript, RunScript脚本, MCP脚本, 沙箱脚本,
    generate RunScript, MCP Core script, script recommend
allowed-tools: "mcp__plugin_alibabacloud-core_alibabacloud-core__AlibabaCloud___SearchApis,mcp__plugin_alibabacloud-core_alibabacloud-core__AlibabaCloud___GetApiDefinition,mcp__plugin_alibabacloud-core_alibabacloud-core__AlibabaCloud___ListApis,mcp__plugin_alibabacloud-core_alibabacloud-core__AlibabaCloud___ListProducts"

Alibaba Cloud Script Generator

Turn a natural-language Alibaba Cloud request into one RunScript-compatible Python script. The script must use `await call_cli(...)`, assign the final value to `result`, and pass `check_sandbox.py` validation before output. Do not execute the script unless the user asks.

Scope Check Before You Start

• **RunScript sandbox scripts** (this skill): generates `call_cli()`-based Python for the

RunScript sandbox — no SDK imports, no credentials, no local execution.

• **SDK project code** → `alibabacloud-sdk-usage`: generates typed/generic SDK code with

imports, credential providers, and dependency management for user projects.

• **Operational patterns** (batch ops, audits, rotations) → `alibabacloud-find-skills` first.

Workflow

1. Split the request into atomic cloud operations. For each operation, you must call at least one of the following methods to discover API parameters before writing any code:

**Method A — MCP tools** (preferred): call `AlibabaCloud___SearchApis` with a natural language description, then `AlibabaCloud___GetApiDefinition` with the confirmed product, action, and version. Batch search calls in one parallel round.

**Method B — HTTP metadata** (when MCP tools return errors): The endpoint `https://next.api.aliyun.com/meta/v1/products/{product}/versions/{version}/api-docs.json` contains all API definitions for a product. If `WebFetch` cannot extract the target API (response too large), download the full JSON with `curl` and extract the target API's `parameters` array locally — use any method that works (e.g. `python3 -c`, `grep`, `jq`).

You must actually execute one of these methods — reading about them is not sufficient. Only if your tool call returns an error may you fall back to best-known parameter names, adding: `# WARNING: API parameters not verified — confirm before use`.

1. Generate one Python script body following the Sandbox Contract and Script Patterns below. Only whitelisted modules may be imported. When multiple tool calls are needed, batch them in parallel. Never repeat the same tool call with the same arguments.

1. Write to `/tmp/aliyun-runscript.py` and validate with the local sandbox checker (`<SKILL_DIR>/scripts/check_sandbox.py`):

   cat > /tmp/aliyun-runscript.py <<'PYEOF'
   <script body here>
   PYEOF
   python3 <SKILL_DIR>/scripts/check_sandbox.py /tmp/aliyun-runscript.py

1. If validation fails, read the `→ fix` suggestion for each violation, fix ONLY the listed issues, and re-validate. Maximum 3 rounds. If violations persist, show them to the user.

1. After validation passes, output only the Python script body — no Markdown fences, headings, or explanatory text unless the user asks.

Sandbox Contract

All rules below are enforced by `scripts/check_sandbox.py` (local pre-check) and remote validation. See `references/runscript-contract.md` for full definitions with examples.

| Category | Rule | |----------|------| | **Imports** | Only whitelisted modules may be imported: `asyncio`, `collections`, `csv`, `dataclasses`, `datetime`, `decimal`, `enum`, `fractions`, `functools`, `itertools`, `json`, `math`, `re`, `statistics`, `string`, `time`, `typing`, `uuid`. Do NOT import `random`, `os`, `subprocess`, `requests`, or any module not in this list. `call_cli` is pre-injected — do NOT import or define it. | | **API calls** | Use ONLY `call_cli(product, version, action, params)`. Pre-injected. No SDK clients, no HTTP requests, no subprocess. Parameter values must be plain strings/numbers — do NOT pass `aliyun ...` CLI command strings as parameter values. | | **Param values** | Parameter values must NOT contain lowercase `aliyun` (triggers BLK-4001). E.g. use `"1.28.3"` not `"1.28.3-aliyun.1"`. Query APIs to fetch exact values when unsure. | | **Output** | Assign final data to `result` (dict or list). No `print()`. | | **Concurrency** | Parallel API calls must use `asyncio.gather(return_exceptions=True)`. Thread/process-based concurrency (`threading`, `multiprocessing`, `concurrent.futures`) is not in the whitelist and will fail validation. | | **Forbidden** | `os`, `subprocess`, `socket`, `requests`, `eval`, `exec`, `compile`, `getattr`, `setattr`, `globals`, `input`, `breakpoint`, `__import__`, `threading`, `multiprocessing`, `concurrent.futures`, dunder chains. | | **Blocked APIs** | Credential-returning APIs (`ram.ListAccessKeys`, `sts.AssumeRole`, `kms.GetSecretValue`). CLI meta products (`configure`, `plugin`, `ossutil`). | | **Structure** | `call_cli` must be reachable from module-level execution. Do NOT wrap all calls in an uninvoked `async def` — either write `await call_cli(...)` at top level, or define a function and call it: `async def main(): ... \n await main()`. | | **Numbers** | Do NOT use leading zeros in numeric literals (e.g., `01`, `010`). Write `1`, `10` instead. IP addresses and CIDR blocks must be strings: `"10.0.0.0/8"`, not bare numbers. | | **Strings** | Use f-strings or