Which cloud providers have an MCP server?

As of October 18, 2026, nine clouds publish their own MCP server for cloud infrastructure: American Cloud, AWS, Microsoft Azure, Google Cloud, DigitalOcean, Cloudflare, Vultr, Akamai (Linode) and Oracle. We found none from Hetzner. They differ on where the server runs, how it signs in, and what an AI agent can change the moment you connect it.

That last difference is the one to check before you point an agent at production. Most servers here can be fenced in with a narrow credential: an IAM policy, an RBAC role, a scoped token. What differs is the default, meaning what the agent can do if you connect it and change nothing. Ours is read-only until you turn writes on, because you should decide the blast radius before the model does.

How do the cloud MCP servers compare?

Here they are side by side, plus Hetzner. Each cell is the default the provider's own docs describe.

American Cloud

Our server is @americancloud/mcp, open source under Apache-2.0. It runs on your machine through npx (Node 20 or newer), so your API key goes from your environment straight to the American Cloud API with nothing hosted in between. It has 175 tools in seven service groups. Compute, storage, networking and Kubernetes load by default; --services adds databases, managed WordPress and DNS. It's built for developers and small teams who want Claude Code, Cursor or Codex to audit their account on day one, and to manage it once they say so. The same API also ships as official TypeScript, Go and Python SDKs and a Terraform provider.

AWS

The AWS MCP Server went generally available on May 6, 2026, as part of the Agent Toolkit for AWS. AWS hosts it, agents sign in with your existing IAM credentials, and CloudTrail logs the API calls. There's no extra charge; you pay for the resources your agents use. At launch it ran in two regions, US East (N. Virginia) and Europe (Frankfurt). The older awslabs/mcp repo of separate local servers still works, and AWS calls the Agent Toolkit its successor.

Microsoft Azure

Azure MCP Server 2.0 is generally available and open source (MIT). It covers more than 45 Azure service areas, virtual machines and AKS among them. You run it locally (npx -y @azure/mcp@latest server start), and it signs in through Entra ID, with access governed by Azure role-based access control. If your client needs an HTTP endpoint, you host the server yourself on Azure Container Apps; we found no endpoint hosted by Microsoft.

Google Cloud

Google runs remote MCP servers on its own infrastructure, one HTTP endpoint per product: Compute Engine at compute.googleapis.com/mcp, GKE at container.googleapis.com/mcp, and others. Some, including Cloud Billing and the Google Cloud CLI server, are labeled Preview. You control access with IAM allow and deny policies. Google also has a local, open-source gcloud MCP server, but its repo says it's in preview and "not an officially supported Google product."

DigitalOcean

DigitalOcean publishes its server under the digitalocean-labs GitHub org (MIT). Each service gets its own hosted endpoint, such as droplets.mcp.digitalocean.com/mcp, or you run it locally and pick services with --services. It covers Droplets, App Platform, Kubernetes, databases, networking and DNS, Spaces and volumes. You sign in with OAuth or a personal access token. We found no read-only mode in its README, so the token's scopes are the limit.

Cloudflare

Cloudflare's recommended server is the Cloudflare API MCP Server at mcp.cloudflare.com/mcp, so there's nothing to install. It reaches the whole Cloudflare API, about 2,500 endpoints, through a few code-mode tools: the agent writes JavaScript to search the API and call it. You sign in with OAuth and pick permissions, or pass an API token. Cloudflare has deprecated 10 of its older single-product servers in favor of this one.

Vultr

Vultr hosts its server at mcp.vultr.com/mcp and calls it "the official Model Context Protocol server for Vultr." It's labeled Preview and signs in with OAuth. It's read-only by design: in Vultr's words, "it has no tools that create, change or delete anything, and none that spend money." More than 180 tools cover compute, networking, databases, Kubernetes and billing, split across per-area endpoints.

Akamai (Linode)

Akamai Developers publishes the Akamai Cloud MCP Server (Apache-2.0). You run it with uvx akamai-cloud-mcp or host it yourself over HTTP. Its README calls it "read-only by construction," built on a client that only sends GET requests. It has 37 tools plus one read-only escape hatch for the rest of the Linode API.

Oracle Cloud

Oracle's oracle/mcp repo recommends oci-cloud-mcp-server as the starting point. You can run it locally or over HTTP. It acts with your OCI account's permissions, and its invoke_oci_api tool can call any OCI SDK operation. The repo describes its servers as reference implementations "not intended for production use."

Hetzner

We found no MCP server published by Hetzner. Its hetznercloud GitHub org had no MCP repository on October 18, 2026. Community-built servers exist; none of them is Hetzner's.

Which cloud MCP servers are read-only by default?

Sort the servers by what an agent can change the moment you connect it. They fall into three groups.

No write tools at all: Vultr and Akamai. The agent can look at everything its credential can see and change nothing. That's a safe thing to connect, and it also means the server can't make the change when you finally want one.

Read-only until you opt in: American Cloud. Only read tools (list, get, cost estimates) load until you add --allow-writes. Pair the server with a read-only API key and writes are impossible at the account level, whatever the flag says. Tools that delete, release or reinstall are flagged as destructive, so clients that support confirmations ask you first.

Writes on unless you restrict them: AWS, Azure, Google Cloud, DigitalOcean, Cloudflare and Oracle. The agent gets whatever your credential allows. Each gives you a way to narrow it. On AWS you write an IAM policy on the aws:ViaAWSMCPService key that allows only read actions through MCP. Azure has a read-only option that's off by default. Google documents an IAM deny policy that blocks any tool not marked read-only. DigitalOcean and Cloudflare go by token scopes or the permissions you grant at sign-in. AWS's own advice for its server: "Begin with restrictive IAM policies and relax them as you understand your AI agents' requirements."

We stress the default because the MCP spec says "Tools represent arbitrary code execution and must be treated with appropriate caution," and that hosts must get your consent before running any tool. It also says the protocol can't enforce that on its own. What an agent can actually do comes down to the tools the server loads and the credential you hand it.

That's not hypothetical. In April 2026, PocketOS founder Jeremy Crane said a Cursor agent deleted the company's production database and its volume backups in one API call to Railway, in nine seconds. Railway founder Jake Cooper said the company recovered the data about 30 minutes after he connected with Crane, and that the call used a fully permissioned API token. A read-only key is the cheapest fix for that whole class of mistake.

Does it matter whether the MCP server is local or hosted?

It changes who holds your key and who keeps the server current. A local server runs over stdio on your machine and, per the MCP spec, takes its credentials from your environment. Your key never passes through anyone else's service, and you decide when to update. A hosted server is a remote HTTP endpoint you sign in to, so there's nothing to install and the provider keeps it up to date.

Do you need an MCP server to manage your cloud with AI?

No. An agent with a CLI, an SDK or Terraform and a scoped key can do a lot of the same work, and some teams prefer it. Tool lists also use up the model's context window: Anthropic's engineers note that most MCP clients load every tool definition up front. That's why our server loads four service groups by default and lets --services trim the list further.

What an MCP server adds is discovery. The assistant can see which tools exist and what inputs they need, so you can ask "what's running, and what does each piece cost?" without writing a script first. We ship both routes from one API, so you can start with the MCP server and move a workflow to Terraform once it settles.

To try ours, create a read-only API key in the console and follow the MCP server overview: one config block, then ask your assistant what's running in your account. When you want it to change things too, our post on giving an AI assistant safe access to your cloud walks through turning on writes one layer at a time.

Set up the MCP server

Frequently asked questions