MCP Tools

Currently includes 44 tools, grouped by function as follows.

Source data: tools.json

---

Tool Overview

Authentication & Login

• auth

Environment Management

• queryEnv
• envDomainManagement

Others

• manageEnv
• deployBuild
• deployPlan
• deployApply
• queryApps
• manageApps
• prepareFeedback

NoSQL Database

• readNoSqlDatabaseStructure
• writeNoSqlDatabaseStructure
• readNoSqlDatabaseContent
• writeNoSqlDatabaseContent

Data Models

• manageDataModel
• modifyDataModel

PostgreSQL Database

• queryPgDatabase
• managePgDatabase

PostgreSQL Cloud Storage

• queryPgStorage

MySQL Database

• queryMysqlDatabase
• manageMysqlDatabase

Cloud Functions

• queryFunctions
• manageFunctions

Static Hosting

• queryHosting
• manageHosting

Cloud Storage

• queryStorage
• manageStorage

Templates & Files

• downloadTemplate

Search & Knowledge Base

• searchKnowledgeBase

CloudRun

• queryCloudRun
• manageCloudRun

Gateway

• queryGateway
• manageGateway

App Authentication

• queryAppAuth
• manageAppAuth

Permissions

• queryPermissions
• managePermissions

Logs

• queryLogs
• manageLogs

AI Agent

• queryAgents
• manageAgents

Cloud API

• callCloudApi

Message Push

• queryMessagePush
• manageMessagePush

---

Remote MCP Configuration

Environment Variable Configuration

Using Remote Mode requires configuring the following environment variables:

Environment Variable	Description	How to Obtain
TENCENTCLOUD_SECRETID	Tencent Cloud SecretId	Get Tencent Cloud API Key
TENCENTCLOUD_SECRETKEY	Tencent Cloud SecretKey	Get Tencent Cloud API Key
TENCENTCLOUD_SESSIONTOKEN	Optional, Tencent Cloud temporary key Token	Only needed when using temporary keys, can be obtained via STS Service
CLOUDBASE_ENV_ID	CloudBase Environment ID	Get CloudBase Environment ID

Detailed Specs

auth

CloudBase (Tencent Cloud Development) development stage login and environment binding. Not sure where to start? Call auth(status) once (read-only, no parameters) to confirm the login state and current environment. After logging in, you can access cloud resources; an environment (env) is an isolation unit for cloud functions, databases, static hosting and other resources. After binding the environment, other MCP tools can operate on that environment. No environment yet: new users on the China site can enable a free trial environment, then bind it with set_env. Supports: query status, initiate login, API Key login, bind environment (set_env), logout. auth(status) returns credential_scope (account=account-level / single_env=environment-level API Key) and the current region; environment-level API Keys can only see the bound envId, not being able to query other regions' environments is a permission boundary, not that the environment doesn't exist. Optional site/region/lang parameters: site=site (domestic/intl), region=region, lang=output language (zh/en).

Parameters

Parameter	Type	Required	Description
action	string		Action: status=query status, start_auth=initiate login, login_by_api_key=API Key login, set_env=bind environment (pass envId), logout=logout. Allowed values: "status", "start_auth", "set_env", "logout", "get_temp_credentials", "login_by_api_key"
authMode	string		Authentication mode: device=device code authorization, web=browser callback authorization. Allowed values: "device", "web"
oauthEndpoint	string		Advanced optional: Custom device-code login endpoint. When configured, oauthCustom defaults to true
clientId	string		Advanced optional: Custom device-code login client_id, uses default value if not provided
oauthCustom	boolean		Advanced optional: Custom endpoint return format switch. Defaults to false when endpoint not configured; defaults to true when endpoint is configured. Endpoints using the standard {code,result} wrapper format (e.g. the international site tcb-api.tencentcloud.com) should explicitly pass false
site	string		Site: domestic=China site, intl=international site. When the environment is provisioned on the Tencent Cloud international site, login (start_auth/login_by_api_key) must explicitly pass intl, otherwise the China-site flow is used and international-site environments are invisible. An explicitly passed value takes precedence over the TCB_SITE environment variable / the region mapping table / project config, and affects the login endpoint, the authorization page and the API Key exchange gateway. Allowed values: "domestic", "intl"
envId	string		Environment ID (CloudBase environment unique identifier), after binding the tool will operate on this environment. Required when action=set_env
region	string		Region (e.g. ap-shanghai / ap-guangzhou / ap-singapore). Used for region→site inference and API Key exchange gateway selection; an explicit site takes precedence
lang	string		Output language: zh=Chinese (default), en=English. Overrides the instance-level language (createCloudBaseMcpServer lang option / TCB_LANG / project.json). Allowed values: "zh", "en"
apiKey	string		CloudBase API Key, required when action=login_by_api_key
apiKeyEnvId	string		CloudBase environment ID (EnvId), required when action=login_by_api_key, used to specify the environment the API Key belongs to
confirm	string		Confirm operation when action=logout, pass yes. Allowed values: const "yes"
reveal	boolean		Optional when action=get_temp_credentials. true=return plaintext temporary credentials; defaults to false returning masked results only

---

queryEnv

Query CloudBase environment related information, supports querying the environment list, details of a specific environment, security domains, resource usage, and monitoring metrics. (Former names: envQuery, listEnvs, getEnvInfo, getEnvAuthDomains) When action=list, it filters/lists per DescribeEnvs semantics, returning standard fields EnvId, Alias, Status, EnvType, Region, PackageId, PackageName, IsDefault, and supports trimming these fields via the fields whitelist; aliasExact=true filters by exact alias match to avoid mistaking environments with similar prefixes as candidates; even when envId is passed, action=list only returns the summary, not full resource details or expiry. Account-level login can pass region (ap-shanghai/ap-guangzhou/ap-singapore) to query corresponding regions, aligned with CLI tcb env list -r <region>; environment-level credentials (API Key / hosted authorization token) can only see the bound envId, returning credential_scope=single_env; in that case region is not applied and is truthfully reported in ignored_params (AppliedFilters.region is null) — do not misjudge this as the environment not existing or region filtering being broken. To query the detailed information of a known EnvId environment (including resource fields and billing info), use action=info with the target envId. action=info supplements BillingInfo (e.g. ExpireTime, PayMode, IsAutoRenew) when available.

📊 action=usage aligns with tcb env usage/info: passes through Manager SDK describeEnvAccountCircle + describeCreditsUsageDetail, returning billing cycle and resource credit usage by module (FLEXDB/SCF/COS etc.). envId required; type optionally filters modules; when startDate/endDate are not passed, the current billing cycle is used automatically.

📈 action=metrics aligns with TCB DescribeCurveData (manager.monitor.describeCurveData, not Cloud Monitor GetMonitorData): queries environment/gateway QPS, cloud function invocations and errors, database CPU/memory/disk, CloudRun CPU/QPS time series. envId and metricName required; startTime/endTime format YYYY-MM-DD HH:mm:ss, must be passed as a pair, defaults to last 24 hours when omitted; period only supports 300/3600/86400. When GatewayTraceEnvQPS is called without resourceID, environment-level all|:|all|:|all|:|all is auto-filled; CloudRun Tke* metrics must pass service name as resourceID. Do not use callCloudApi to guess monitoring Actions.

🔍 action=info also derives three fields for backend selection:

• EnvInfo.RuntimeMode: 'postgresql' or 'nosql', indicating the recommended default backend for new services (postgresql when PG is enabled, otherwise nosql).
• EnvInfo.RuntimeBackends: three booleans \{postgresql, nosql, mysql\} describing which backends currently coexist in the environment.
• EnvInfo.RuntimeModeHints: API/tool/skill hints for each backend.
• EnvInfo.PostgreSQL[].TenantType: PG instance type — SHARED (SDK / gateway access only) or DEDICATED (private network host / direct TCP).

🌐 action=info also projects gateway route Enable status without overwriting StaticStorages[].StaticDomain (cloud API nominal domain): StaticStorages[].staticDomainRouteEnabled and EnvInfo.staticDomainRouteEnabled (same source as queryHosting websiteConfig). false means the default static domain root route is disabled (access returns GATEWAY_ROUTE_DISABLED), do not treat the nominal domain as a reachable URL.

AI must check these three items before writing business/permission/storage code: In PG mode, new services should use app.rdb() + RLS (managePgDatabase action=execute to run CREATE POLICY) + pgstore; existing NoSQL collections / old storage / managePermissions(resourceType="noSqlDatabase") remain valid in PG environments. What is truly inapplicable is MySQL and the data model tools: when RuntimeBackends.mysql === false, manageMysqlDatabase / queryMysqlDatabase / relational-database-mcp-cloudbase skill should not be used; manageDataModel / modifyDataModel only work in classic mode and have no PG counterpart.

Parameters

Parameter	Type	Required	Description
action	string	yes	Query type: list=environment list/summary filter (filters per DescribeEnvs semantics, supports filtering by envId/region, returns EnvId, Alias, Status, EnvType, Region, PackageId, PackageName, IsDefault, no expiry), info=detailed info of the specified environment (envId required, returns resource fields and billing info), domains=security domain list, usage=environment resource usage (envId required, aligned with tcb env usage/info), metrics=environment monitoring time series (envId and metricName required, aligned with CloudBase DescribeCurveData). Allowed values: "list", "info", "domains", "usage", "metrics"
alias	string		Filter by environment alias. Optional when action=list
aliasExact	boolean		Filter by exact environment alias. Optional when action=list; used with alias
envId	string		Environment ID. Optional when action=list (only filters per DescribeEnvs semantics, still returns the summary); required when action=info / action=usage / action=metrics; optional when action=domains (queries the currently bound environment when omitted, or that environment's security domains when provided).
region	string		Query region. Only effective when action=list. Account-level credentials pass this value through to DescribeEnvs (X-TC-Region), e.g. ap-singapore. Equivalent CLI: tcb env list -r <region> --json. Environment-level credentials (API Key / hosted authorization token) are single-environment scoped and this parameter is ignored: the result is always the bound environment, the response has AppliedFilters.region = null, query_region takes that environment's own Region, and ignored_params explains why it was ignored — do not conclude from this that the region has no environments. ⚠️ ap-singapore belongs to both the China site and the international site; when no site is explicitly specified it is treated as the international site (site=intl): if you have logged in to both sites, passing this region silently queries the international-site account, so call auth(site="domestic") or set TCB_SITE=domestic first to pin the site. Allowed values: "ap-shanghai", "ap-guangzhou", "ap-singapore"
limit	integer		Max number of results. Optional when action=list
offset	integer		Pagination offset. Optional when action=list
fields	array of string		Return field whitelist. Only supports EnvId, Alias, Status, EnvType, Region, PackageId, PackageName, IsDefault. Optional when action=list
type	array of string		Usage module filter. Only effective when action=usage; queries all modules when omitted. Available values aligned with tcb CLI: FLEXDB, TDSQL, SCF, EKS, COS, AI, HOSTING, Auth, APIInvocation, HTTPInvocation, VM, Workflow, Other.
startDate	string		Usage start date (YYYY-MM-DD). Only effective when action=usage; passed as a pair with endDate. Uses current billing cycle when omitted.
endDate	string		Usage end date (YYYY-MM-DD). Only effective when action=usage; passed as a pair with startDate. Uses current billing cycle when omitted.
needUsageDetails	boolean		Whether to return daily usage details. Only effective when action=usage; defaults to true.
metricName	string		Monitoring metric name. Only effective and required when action=metrics. GatewayTraceEnvQPS/EnvQPSAll=environment and gateway QPS; FunctionInvocation/FunctionError/FunctionTimeout/FunctionThrottle=cloud function invocations, errors, timeouts, throttling; DbRead/DbWrite/DbSizepkg=document database reads, writes, and capacity; MysqlCpuUsageRate/MysqlMemoryUse/MysqlStorageUsage=SQL database CPU/memory/disk; TkeCpuUsedService/TkeQPSService/TkeHttpErrorService=CloudRun CPU/QPS/errors. Allowed values: "GatewayTraceEnvQPS", "EnvQPSAll", "FunctionInvocation", "FunctionError", "FunctionTimeout", "FunctionThrottle", "FunctionDuration", "FunctionConcurrentExecutions", "DbRead", "DbWrite", "DbSizepkg", "MysqlCpuUsageRate", "MysqlMemoryUse", "MysqlStorageUsage", "MysqlQps", "MysqlSlowQueries", "MysqlDbConnections", "TkeCpuUsedService", "TkeMemUsedService", "TkeQPSService", "TkeHttpErrorService", "TkeInvokeNumService"
startTime	string		Monitoring start time (YYYY-MM-DD HH:mm:ss). Only effective when action=metrics; passed as a pair with endTime. Defaults to last 24 hours when omitted. End time must be at least five minutes after start time.
endTime	string		Monitoring end time (YYYY-MM-DD HH:mm:ss). Only effective when action=metrics; passed as a pair with startTime. Defaults to last 24 hours when omitted.
period	number		Statistics period (seconds). Only effective when action=metrics; only supports 300, 3600, 86400. Auto-selected by backend based on time range when omitted. Time range ≤1 day cannot use 86400; >3 days cannot use 300. Allowed values: 300, 3600, 86400
resourceID	string		Resource ID. Only effective when action=metrics. Cloud functions pass function name, document database passes collection name, CloudRun must pass service name; GatewayTraceEnvQPS auto-fills environment-level all|:|all|:|all|:|all when omitted.
subresourceID	string		Sub-resource ID. Only effective when action=metrics; pass version name when querying CloudRun version monitoring.

---

envDomainManagement

⚠️ DEPRECATED: This tool has been folded into manageEnv. Use manageEnv(action="addSecurityDomain") / manageEnv(action="removeSecurityDomain") instead; the domains parameter is identical. This alias will be removed in the next version.

It manages environment security domains, which are browser CORS allowlists controlling which web origins (host:port) may call CloudBase resources directly. It does not provide an access domain or manage HTTPS certificates. Gateway custom domains are managed by manageGateway and are unrelated. Before adding or removing a domain, use queryEnv(action="domains") to inspect the actual browser origin; after the change, poll queryEnv(action="domains") about every 10 seconds until the state converges.

Parameters

Parameter	Type	Required	Description
action	string	Yes	Operation type: create=add domain, delete=delete domain. Allowed values: "create", "delete"
domains	array of string	Yes	Security domain array

---

manageEnv

Manage CloudBase environments, supports: listPackages=query available plan list, create=create a new environment (requires confirmation), modifyPlan=change plan (scale up/down, requires confirmation), renew=renew environment (requires confirmation).

⚠️ All fee-incurring operations (create/modifyPlan/renew) must show a configuration summary and wait for the user to confirm via confirm="yes" before execution.

Parameters

Parameter	Type	Required	Description
action	string	yes	Operation type: listPackages=query available plans, create=create environment, modifyPlan=change plan, renew=renew. Allowed values: "listPackages", "create", "modifyPlan", "renew"
alias	string		Environment alias (required when action=create). Requirements: lowercase letters/numbers/hyphens, cannot start or end with a hyphen, max 20 characters
packageId	string		Plan ID (required when action=create/modifyPlan). Take the PackageName returned by manageEnv(action="listPackages") — those are the plans selectable in the purchase / create menus (Personal baas_personal, Standard baas_pf_standard, Enterprise baas_pf_enterprise, Enterprise Premium baas_pf_enterprise_senior, Trial baas_trial, Integration baas_integration). Other valid packageIds are still accepted (legacy plan families, whitelisted plans); the actual creation result is authoritative. The plans on sale differ per site, so do not fill this in from memory
resources	array of string		Enabled resource types (optional when action=create). Available values: storage, function (cloud function), postgresql; defaults to all three when omitted. CreateEnv requires a non-empty Resources field; MCP always sends it. flexdb (document database) is no longer included: newly created environments do not create a NoSQL instance, and its availability is determined by EnvInfo.RuntimeBackends returned by queryEnv(action="info")
duration	integer		Purchase or renewal duration (months), optional when action=create/renew, default 1
externalStorage	object		Shared Cloud Storage bucket configuration, optional for action=create. Providing this object prevents automatic allocation of a dedicated COS bucket and uses the specified bucket instead, isolating this environment from others through basePath. It affects Cloud Storage only; Static Hosting receives its bucket when hosting is enabled. All three child fields are required. ⚠️ As with region, the confirmation call (confirm="yes") reads only parameters sent in that call; omitting this object creates an environment with a dedicated bucket without reporting an error.
externalStorage.bucketName	string	yes	Shared bucket name (COS bucket name)
externalStorage.region	string	yes	Region of the shared bucket, for example ap-shanghai
externalStorage.basePath	string	yes	Base path prefix. It must be unique within the shared bucket and isolates this environment from other environments using the same bucket
region	string		Creation region (only effective when action=create). Passed through with X-TC-Region semantics and determines where the new environment lives; equivalent CLI: tcb env create --region ap-shanghai. When omitted, the current session region is used (cloudBaseOptions.region → TCB_REGION → project config / rc binding → site default region: ap-shanghai for the China site, ap-singapore for the international site). Note: region is not written into the CreateEnv request body but takes effect through the request-level region context — consistent with the callCloudApi rule "do not put Region into params". ⚠️ ap-singapore belongs to both the China site and the international site; when no site is explicitly specified it is treated as the international site (site=intl). To create in that region on the China site, call auth(site="domestic") or set TCB_SITE=domestic first. Allowed values: "ap-shanghai", "ap-guangzhou", "ap-singapore"
envId	string		Environment ID (required when action=modifyPlan/renew)
confirm	string		Confirmation. All paid operations (create/modifyPlan/renew) must pass "yes". Allowed values: const "yes"

---

readNoSqlDatabaseStructure

Read NoSQL database collection and index structure, supports listing collections, viewing collection details, listing indexes, and checking if an index exists.

Parameters

Parameter	Type	Required	Description
action	string	Yes	listCollections: List collection list describeCollection: Describe collection details (returns index summary) checkCollection: Check if collection exists listIndexes: List indexes of specified collection checkIndex: Check if specified index exists. Allowed values: "listCollections", "describeCollection", "checkCollection", "listIndexes", "checkIndex"
limit	number		Return count limit (optional for listCollections operation)
offset	number		Offset (optional for listCollections operation)
collectionName	string		Collection name (required for describeCollection, listIndexes, checkIndex operations)
indexName	string		Index name (required for checkIndex operation)

---

writeNoSqlDatabaseStructure

Modify NoSQL database structure, supports creating/deleting collections, and adding/deleting indexes via updateCollection's updateOptions.CreateIndexes / updateOptions.DropIndexes.

Parameters

Parameter	Type	Required	Description
action	string	Yes	createCollection: Create collection updateCollection: Update collection configuration; pass updateOptions.CreateIndexes to add indexes, pass updateOptions.DropIndexes to delete indexes deleteCollection: Delete collection. Allowed values: "createCollection", "updateCollection", "deleteCollection"
collectionName	string	Yes	Collection name
updateOptions	object		Update options (used for updateCollection). CreateIndexes for adding indexes, DropIndexes for deleting indexes.
updateOptions.CreateIndexes	array of object		List of indexes to add
updateOptions.CreateIndexes[].IndexName	string	Yes	Index name to create
updateOptions.CreateIndexes[].MgoKeySchema	object	Yes	Field and constraint configuration for index to be created
updateOptions.CreateIndexes[].MgoKeySchema.MgoIsUnique	boolean	Yes	Whether unique index
updateOptions.CreateIndexes[].MgoKeySchema.MgoIndexKeys	array of object	Yes	Index field list, supports single field or compound indexes
updateOptions.CreateIndexes[].MgoKeySchema.MgoIndexKeys[].Name	string	Yes	Index field name
updateOptions.CreateIndexes[].MgoKeySchema.MgoIndexKeys[].Direction	string	Yes	Index direction, typically 1 for ascending, -1 for descending
updateOptions.DropIndexes	array of object		List of indexes to delete
updateOptions.DropIndexes[].IndexName	string	Yes	Index name to delete

---

readNoSqlDatabaseContent

Query and get NoSQL database data records

Parameters

Parameter	Type	Required	Description
collectionName	string	Yes	Collection name
instanceId	string		Optional: Explicitly specify database instance ID; will be automatically resolved and cached if not provided
query	object | string		Query conditions (object or string, object recommended)
projection	object | string		Return field projection (object or string, object recommended)
sort	array of object | string		Sort conditions, only supports array [{"key":"createdAt","direction":-1}] or corresponding JSON string.
limit	number		Return count limit
offset	number		Number of records to skip

---

writeNoSqlDatabaseContent

Modify NoSQL database data records. Can be understood using MongoDB updateOne/updateMany mental model: partial updates must use update operators like $set/$inc/$push; if you directly pass a plain object like { field: value }, the underlying layer treats it as replacement content, risking overwriting the entire document. When updating a field in a nested object, you must use dot notation path (e.g., { "$set": { "address.city": "shenzhen" } }); if written as { "$set": { "address": { "city": "shenzhen" } } }, the entire address object will be replaced and other sibling fields will be lost. If role/profile documents in a collection are read on the frontend via db.collection(...).doc(uid), ensure the document _id is that uid; do not use query={"uid":"..."} + upsert=true to update users / profiles, otherwise it often generates a different _id, causing subsequent doc(uid) reads to miss.

Parameters

Parameter	Type	Required	Description
action	string	Yes	insert: Insert data (add document) update: Update data delete: Delete data. Allowed values: "insert", "update", "delete"
collectionName	string	Yes	Collection name
instanceId	string		Optional: Explicitly specify database instance ID; will be automatically resolved and cached if not provided
documents	array of object		Array of document objects to insert, each document is an object (required for insert operation)
query	object | string		Query conditions (object or string, object recommended) (required for update/delete operations)
update	object | string		Update content (object or string, object recommended) (required for update operation). Pass MgoUpdate using MongoDB update semantics: for partial updates use $set/$inc/$unset/$push operators, e.g., { "$set": { "status": "pending" } }; do not directly pass { "status": "pending" }, otherwise the entire document may be replaced. When updating nested fields, use dot notation path, e.g., { "$set": { "address.city": "shenzhen" } }, do not write { "$set": { "address": { "city": "shenzhen" } } } (will replace entire address object).
isMulti	boolean		Whether to update multiple records (optional for update/delete operations)
upsert	boolean		Whether to insert if not exists (optional for update operation)

---

queryPgDatabase

Query CloudBase PostgreSQL databases. Supports getting the current PG context, listing schema-qualified database objects, reading lightweight metadata, inspecting a single object structure, and executing read-only SQL.

Parameters

Parameter	Type	Required	Description
action	string	yes	Operation type: context=get current PostgreSQL context; objects=list schema-qualified database objects; metadata=get lightweight table metadata; schema=inspect a single schema-qualified object structure; sql=execute read-only SQL. Allowed values: "context", "objects", "metadata", "schema", "sql"
sql	string		Read-only SQL used when action=sql
objectName	string		Schema-qualified PostgreSQL object name used when action=schema, e.g. public.users
schema	string		Optional schema filter, used for action=objects or action=metadata
limit	integer		Optional cap on summary rows for objects, metadata, or SQL results. Default 20, max 200

---

managePgDatabase

Manage CloudBase PostgreSQL: execute confirmed write SQL, SQL risk preflight, and migration management. Schema changes such as CREATE/ALTER/DROP MUST use applyMigration (explicit migrationVersion; before success, it automatically writes or validates the local cloudbase/migrations/<version>_<name>.sql file, consistent with the CLI tcb db pg migration). Do not default to execute. execute is mainly for DML and operational SQL like GRANT/RLS.

Parameters

Parameter	Type	Required	Description
action	string	yes	Operation type: execute=execute confirmed write SQL (DML/GRANT/RLS; schema DDL is rejected by default, requires allowDdlViaExecute=true); dryRun=only analyze SQL risk without executing; planMigration=preview migration plan (requires migrationName + migrationVersion + sql; optional includeAll=true allows out-of-order, aligned with CLI --include-all); applyMigration=apply migration, preferred for CREATE/ALTER schema (requires migrationName + migrationVersion + sql + confirm=true; optional includeAll; if the local SQL is missing it is automatically written to cloudbase/migrations/, if content mismatches it fails closed with LOCAL_MIGRATION_FILE_MISMATCH; before returning success it polls DescribeTaskResult (default max 10 minutes, adjustable via taskPollTimeoutMs / waitForTask) and verifies the migrationVersion has landed in remote history; on timeout returns MIGRATION_TASK_TIMEOUT, must first describeMigrationTask then listMigrations, do NOT immediately re-push the same version; if not applied returns success=false with errorCode=MIGRATION_NOT_APPLIED); listMigrations=query the applied Migration list (supports limit/offset paging); migrationDetail=view a single Migration detail (requires migrationVersion); describeMigrationTask=query the Push async task status by TaskId (DescribeTaskResult: Status/Phase/Reason; requires taskId; used for waitForTask=false / MIGRATION_TASK_TIMEOUT / failure diagnosis, listMigrations cannot see Reason); fetchMigration=pull SQL from remote history and write to local cloudbase/migrations/ (aligned with CLI tcb db pg migration fetch; optional migrationVersion pulls a single entry, omitted pulls all; force=true overwrites existing files, default skips); repairMigration=repair Migration history (requires migrationVersion + migrationName + repairStatus + repairReason). Allowed values: "execute", "dryRun", "planMigration", "applyMigration", "listMigrations", "migrationDetail", "describeMigrationTask", "fetchMigration", "repairMigration"
sql	string		SQL statement used by action=execute, dryRun, planMigration, applyMigration, or repairMigration(applied)
confirm	boolean		Must be explicitly set to true before executing any write SQL
envId	string		Optional CloudBase environment ID; uses the current MCP environment when omitted
instanceId	string		Optional PostgreSQL logical instance identifier, default cloudbase-pg
defaultSchema	string		Optional default schema, default public
role	string		Optional PostgreSQL role, passed to Manager SDK executePGSql; e.g. pass postgres when managing policies
objectName	string		Optional object name, currently only used for non-migration scenarios. For migration operations use migrationName / migrationVersion
migrationName	string		Required for plan/apply/repair: migration name, starts with a lowercase letter, only lowercase letters, digits, and underscores allowed
migrationVersion	string		14-digit timestamp YYYYMMDDHHMMSS. Required for plan/apply/detail/repair; optional for fetchMigration (pass to pull that entry only, omit to pull all remote history); must not be silently generated server-side, to avoid diverging from local cloudbase/migrations/<version>_<name>.sql. applyMigration is not incremental: always pass the complete SQL; when a run ends in a failed final state and listMigrations has not recorded it, the version number is not consumed — just resend the full SQL under a new migrationVersion (the same name with a different version does not conflict)
rollbackSql	string		Optional for plan/apply: rollback SQL statement
limit	integer		Optional for list: max number of results, 1-500, default 100
offset	integer		Optional for list: pagination offset, default 0
lockTimeoutMs	integer		Optional for apply: max time to acquire the database lock (ms), default 5000
statementTimeoutMs	integer		Optional for apply: max execution time per SQL statement (ms), default 300000
taskPollTimeoutMs	integer		Optional for apply: max wait for polling DescribeTaskResult (ms). Default 600000 (aligned with CLI tcb db pg migration up 10-minute wait). Range 5000-600000. On timeout, first describeMigrationTask(taskId) then listMigrations, do NOT immediately re-push the same version
waitForTask	boolean		Optional for apply, default true. When false, Push returns the TaskId immediately (errorCode=MIGRATION_TASK_PENDING) and the caller polls the task final state with describeMigrationTask, then confirms persistence with listMigrations; suitable for MCP host tool calls with short timeout. Default true waits synchronously for the task final state
taskId	string		Required for describeMigrationTask: the TaskId returned by PushPGUserMigrations / applyMigration. Used for a one-shot DescribeTaskResult (Status/Phase/Reason) query, no polling
repairStatus	string		Required for repair: applied=mark as applied (can backfill Query), reverted=delete history record. Allowed values: "applied", "reverted"
repairReason	string		Required for repair: repair reason
force	boolean		Optional for fetchMigration, default false. true=overwrite an existing local SQL file with the same name (aligned with CLI tcb db pg migration fetch --force); false=skip existing files. Used to realign Git checksums from remote history
includeAll	boolean		Optional for planMigration / applyMigration, default false. true=allow out-of-order (version lower than remote LatestVersion) Preview/Push, aligned with CLI tcb db pg migration up --include-all; only use when intentionally backfilling history/out-of-order migrations, otherwise choose a larger migrationVersion
allowDdlViaExecute	boolean		Optional, default false. Only set true when deliberately bypassing migration history to allow schema DDL via execute; normal CREATE/ALTER schema must use applyMigration

---

queryPgStorage

Query cloud storage capabilities in the CloudBase PostgreSQL environment. Returns bucket/config capability summaries, object info query plans, and upload implementation plans based on HTTP API or SDK; does not read local files and does not output large numbers of signed URLs by default.

Parameters

Parameter	Type	Required	Description
action	string	yes	Operation type: buckets/config=query storage capability summary; createBucket=generate bucket creation plan (SQL/HTTP API/CLI); uploadPlan=generate HTTP API/SDK upload plan; objectInfo=generate object metadata query plan; signUpload/signDownload=explicit one-time signed URL request placeholders. Allowed values: "buckets", "config", "uploadPlan", "objectInfo", "signUpload", "signDownload", "createBucket"
bucket	string		Cloud storage bucket name
objectKey	string		Single object key
objectKeys	array of string		Multiple object keys, used for object metadata query planning
objects	array of object		Metadata of objects to upload. File byte content is not passed through MCP
expiresIn	integer		Signed URL validity period in seconds, range 60 to 86400

---

queryMysqlDatabase

Query CloudBase MySQL database information. Supports read-only SQL execution, instance-create task result lookup (tasks started from the console), MySQL task status lookup, current instance context discovery, and instance slow-query / error-log retrieval (aligned with Manager SDK describeInstanceSlowQueries / describeInstanceErrorLogs).

Parameters

Parameter	Type	Required	Description
action	string	Yes	runQuery=execute read-only SQL; describeCreateResult=query instance-create task results (tasks started from the console); describeTaskStatus=query MySQL task status; getInstanceInfo=get current SQL instance context; describeInstance=alias of getInstanceInfo; describeInstanceSlowQueries=query instance slow-query logs; describeInstanceErrorLogs=query instance error logs. Allowed values: "runQuery", "describeCreateResult", "describeTaskStatus", "getInstanceInfo", "describeInstance", "getConnectionInfo", "describeInstanceSlowQueries", "describeInstanceErrorLogs"
sql	string		Read-only SQL used by action=runQuery
request	object		Official request payload used by describeCreateResult/describeTaskStatus/describeInstanceSlowQueries/describeInstanceErrorLogs (may include InstanceId and similar)
dbInstance	object		Optional SQL database instance context for runQuery / slow-query / error logs
dbInstance.instanceId	string
dbInstance.schema	string
startTime	string		Slow-query / error-log query start time (YYYY-MM-DD HH:mm:ss)
endTime	string		Slow-query / error-log query end time (YYYY-MM-DD HH:mm:ss)
limit	number		Maximum number of slow-query / error-log rows to return
offset	number		Pagination offset for slow-query / error logs
username	string		Slow-query filter: user name
host	string		Slow-query filter: client host
database	string		Slow-query filter: database name
orderBy	string		Sort field. Slow queries support QueryTime/LockTime/RowsExamined/RowsSent; error logs support Timestamp. Allowed values: "QueryTime", "LockTime", "RowsExamined", "RowsSent", "Timestamp"
orderByType	string		Sort direction: asc/desc (either case). Allowed values: "asc", "desc", "ASC", "DESC"
sqlText	string		Slow-query filter: SQL text fragment
logLevels	array of string		Error-log level filter; available values: error / warning / note
keyWords	array of string		Fuzzy keyword search list for error logs

---

manageMysqlDatabase

Manage an existing CloudBase MySQL instance: destroy the instance, execute write SQL/DDL, and initialize the database schema. MySQL provisioning has been retired from the MCP tool surface, so this tool no longer creates instances — create one in the CloudBase console instead. When the environment has no instance, the tool returns MYSQL_NOT_CREATED together with the console entry point instead of provisioning guidance. Prefer CloudBase PostgreSQL for new environments (managePgDatabase / queryPgDatabase).

Parameters

Parameter	Type	Required	Description
action	string	Yes	destroyMySQL=destroy the MySQL instance; runStatement=execute write SQL or DDL; initializeSchema=run ordered schema initialization statements. Allowed values: "destroyMySQL", "runStatement", "initializeSchema"
confirm	boolean		Explicit confirmation required for action=destroyMySQL
sql	string		SQL statement used by action=runStatement
request	object		Official request payload used by action=destroyMySQL
statements	array of string		Ordered schema initialization SQL statements used by action=initializeSchema
requireReady	boolean		Whether initializeSchema should block until MySQL is confirmed ready. Defaults to true.
statusContext	object		Optional instance status requests used to confirm readiness before initializeSchema (for provisioning/destruction tasks started from the console)
statusContext.createResultRequest	object
statusContext.taskStatusRequest	object
dbInstance	object		Optional SQL database instance context for runStatement/initializeSchema
dbInstance.instanceId	string
dbInstance.schema	string

---

manageDataModel

Data model query tool, supports querying and listing data models (read-only operations). Use the action parameter to distinguish operation types: list=get model list (without Schema, optional names parameter for filtering), get=query single model details (with Schema field list, format, relationships, etc., requires name parameter), docs=generate SDK usage documentation (requires name parameter)

Parameters

Parameter	Type	Required	Description
action	string	Yes	Operation type: get=query single model (with Schema field list, format, relationships, requires name parameter), list=get model list (without Schema, optional names parameter for filtering), docs=generate SDK usage documentation (requires name parameter). Allowed values: "get", "list", "docs"
name	string		Data model name to query. When action='get' or action='docs', this parameter is required and must provide an existing data model name. Available model names can be obtained via action='list' operation
names	array of string		Model name array (optional for list operation, for filtering)

---

modifyDataModel

Create or update data model based on Mermaid classDiagram. Supports creating new models and updating existing model structures. Built-in async task monitoring, automatically polls until completion or timeout.

Parameters

Parameter	Type	Required	Description
mermaidDiagram	string	Yes	Mermaid classDiagram code describing the data model structure.
action	string		Operation type: create=create new model. Allowed values: "create"; Default: "create"
publish	boolean		Whether to publish the model immediately. Default: false
dbInstanceType	string		Database instance type. Default: "MYSQL"

Example

classDiagram
    class Student {
        name: string <<Name>>
        age: number = 18 <<Age>>
        gender: x-enum = "Male" <<Gender>>
        classId: string <<Class ID>>
        identityId: string <<Identity ID>>
        course: Course[] <<Courses>>
        required() ["name"]
        unique() ["name"]
        enum_gender() ["Male", "Female"]
        display_field() "name"
    }
    class Class {
        className: string <<Class Name>>
        display_field() "className"
    }
    class Course {
        name: string <<Course Name>>
        students: Student[] <<Students>>
        display_field() "name"
    }
    class Identity {
        number: string <<ID Number>>
        display_field() "number"
    }

    %% Relationships
    Student "1" --> "1" Identity : studentId
    Student "n" --> "1" Class : student2class
    Student "n" --> "m" Course : course
    Student "n" <-- "m" Course : students
    %% Class naming
    note for Student "Student Model"
    note for Class "Class Model"
    note for Course "Course Model"
    note for Identity "Identity Model"

---

queryFunctions

Unified read-only entry for CloudBase Functions. It queries function lists, function details, execution logs, layers, triggers, code download URLs, published versions, and traffic aliases through self-explanatory actions.

Pagination: listFunctions, listLayers, and listVersionByFunction support limit and offset.

• limit: page size; the backend chooses the default
• offset: pagination offset starting at 0
• Example: queryFunctions(action="listFunctions", offset=10, limit=10)

Cloud Function logs: use action="listFunctionLogs" with functionName.

• Example: queryFunctions(action="listFunctionLogs", functionName="my-function")
• For log details: queryFunctions(action="getFunctionLogDetail", requestId="xxx")

Scheduled jobs / cron / timers: use listFunctionTriggers to inspect timer triggers.

Versions and traffic routing: listVersionByFunction lists published versions (aligned with tcb fn list-function-versions); getFunctionAlias retrieves aliases and traffic routing (aligned with tcb fn get-route, with aliasName defaulting to $DEFAULT).

Layers:

• Layers use an account-level shared namespace. The same layer name in different environments shares one version sequence, and deleting a version affects every function bound to that version.
• Use a unique layer name containing the environment ID: {layerName}_{currentEnvId}, for example common_cloud1-d9ghadgak3edf6b36. Check listLayers before creating one.
• listLayers / listLayerVersions / getLayerVersionDetail return an account-level view and may include layers created for other environments.

Difference from queryLogs:

• This tool queries execution logs for a specific CloudBase Function.
• queryLogs searches CLS across services.

Parameters

Parameter	Type	Required	Description
action	string	Yes	Read-only operation type: listFunctions=list CloudBase Functions; getFunctionDetail=get function details (functionName required); listFunctionLogs=query execution logs (functionName required); getFunctionLogDetail=get log details (requestId required); listFunctionLayers=list layers bound to a function; listLayers=list all layers in the account-level namespace; listLayerVersions=list layer versions; getLayerVersionDetail=get layer version details; listFunctionTriggers=list triggers, including cron/timer configuration; getFunctionDownloadUrl=get a code download URL; getFunctionDeployStatus=query async deployment status by taskId; listVersionByFunction=list published versions; getFunctionAlias=query an alias and its traffic route; getFunctionUploadUrl=get a COS presigned upload URL for a function ZIP package (stage A of two-stage deployment). PUT the code ZIP to uploadUrl, including uploadHeaders when non-empty, then call manageFunctions createFunction or updateFunctionCode with the returned code triplet (stage B). functionName is optional and is used only to generate the upload object key. The returned uploadUrl contains a credential-bearing signature and must not be logged or persisted. Allowed values: "listFunctions", "getFunctionDetail", "listFunctionLogs", "getFunctionLogDetail", "listFunctionLayers", "listLayers", "listLayerVersions", "getLayerVersionDetail", "listFunctionTriggers", "getFunctionDownloadUrl", "getFunctionDeployStatus", "listVersionByFunction", "getFunctionAlias", "getFunctionUploadUrl"
functionName	string		CloudBase Function name. Required for getFunctionDetail, listFunctionLogs, listFunctionLayers, listFunctionTriggers, getFunctionDownloadUrl, listVersionByFunction, and getFunctionAlias; optional for getFunctionUploadUrl, where it is used only to generate the upload object key
limit	number		Pagination count. Optional for list-type actions
offset	number		Pagination offset. Optional for list-type actions
codeSecret	string		Code protection secret used to decrypt function code
revealEnvValues	boolean		Whether getFunctionDetail / listFunctionTriggers / listFunctionLayers returns plaintext environment-variable values. Defaults to false: values are masked as ***, retaining only Key and ValueLength. When true, sensitive values enter the model context; prefer the console or CLI for plaintext inspection.
startTime	string		Log query start time
endTime	string		Log query end time
requestId	string		Log requestId. Required when getting log details
qualifier	string		Function version, optional for log queries
runtime	string		Runtime filter for layer queries
searchKey	string		Layer name search keyword
layerName	string		Layer name. Required for layer-related actions
layerVersion	number		Layer version number. Required when getting layer version details
taskId	string		Async deployment task ID for getFunctionDeployStatus, returned by manageFunctions when wait=false. Tasks exist only in the current MCP process: completed tasks are retained for about 30 minutes and running tasks for up to two hours.
order	string		Sort direction for listVersionByFunction, such as ASC or DESC
orderBy	string		Sort field for listVersionByFunction, such as AddTime or ModTime
aliasName	string		Alias name for getFunctionAlias. Defaults to $DEFAULT, consistent with tcb fn get-route

---

manageFunctions

Unified write entry for CloudBase Functions. It supports creating functions, updating code and configuration, invoking functions, publishing versions, configuring traffic aliases, and managing timer triggers and layer bindings. The deployment package has a hard size limit: do not bundle static content into it — media files (video, large images, fonts), user uploads, and frequently updated static assets belong in cloud storage, referenced by URL. Otherwise every change needs a redeploy and the package may exceed the limit. To create a scheduled job, first create the function, then call createFunctionTrigger with a seven-field cron expression; delete it with deleteFunctionTrigger. publishVersion aligns with tcb fn publish-version / SDK publishVersion; updateFunctionAliasConfig aligns with tcb fn config-route / SDK updateFunctionAliasConfig and defaults aliasName to $DEFAULT. HTTP Function deployment uses func.buildStrategy: image deploys an existing image; local and cloud run the image build/deploy orchestration. Real local/cloud deployment requires dryRun=false and confirm=true. With wait=false it returns a taskId immediately; callers must poll queryFunctions/getFunctionDeployStatus until succeeded or failed. Local always requires local MCP; cloud requires local build context for real execution; Cloud Mode supports cloud dry-run and image only. Omitting buildStrategy, or setting it to zip, uses a traditional code package. Dangerous operations require confirm=true.

Personal-edition TCR credentials: local/cloud builds with imageType=personal require push credentials. Prefer TCB_TCR_USERNAME and TCB_TCR_PASSWORD in the MCP configuration's env; do not pass plaintext passwords in tool parameters. This environment-variable path works only with local stdio MCP clients that allow custom env values. For IDE-bundled MCP clients without that channel, use enterprise TCR or deploy an already-pushed image with buildStrategy=image.

Enterprise-edition login requirement: enterprise cloud/local builds mint temporary TCR credentials through CAM. Environment-level API Keys and OAuth temporary credentials do not carry CAM policies and are rejected before the build; use account-level credentials or image deployment. Personal-edition builds use a static registry password and do not call CAM.

Layers: layers use an account-level shared namespace. Use names in the form {layerName}_{currentEnvId}, check for duplicates with listLayers, and remember that deleting a layer version affects functions in every environment bound to it.

Parameters

Parameter	Type	Required	Description
action	string	Yes	Write operation type, including function creation, updates, invocation, timer triggers, layer management, version publishing, and alias/traffic routing. Allowed values: "createFunction", "updateFunctionCode", "updateFunctionConfig", "invokeFunction", "deleteFunction", "createFunctionTrigger", "deleteFunctionTrigger", "createLayerVersion", "deleteLayerVersion", "attachLayer", "detachLayer", "updateFunctionLayers", "publishVersion", "updateFunctionAliasConfig", "incrementalDeployFunction"
func	object		Function configuration for createFunction operation
func.name	string	Yes	Function name
func.type	string		Function type. Allowed values: "Event", "HTTP"
func.protocolType	string		HTTP cloud function protocol type. Allowed values: "HTTP", "WS"
func.protocolParams	object
func.protocolParams.wsParams	object
func.protocolParams.wsParams.idleTimeOut	number		WebSocket idle timeout (seconds)
func.instanceConcurrencyConfig	object
func.instanceConcurrencyConfig.dynamicEnabled	boolean
func.instanceConcurrencyConfig.maxConcurrency	number
func.timeout	number		Function timeout
func.envVariables	object		Environment variables
func.vpc	object		VPC configuration
func.vpc.vpcId	string	Yes
func.vpc.subnetId	string	Yes
func.runtime	string		Runtime environment. Event functions support multiple runtimes: Nodejs: Nodejs24.11(Beta), Nodejs22.21(Beta), Nodejs20.19, Nodejs18.15, Nodejs16.13 Python: Python3.11, Python3.10, Python3.9, Python3.7 Php: Php8.0, Php7.4 Java: Java11 Golang: Golang1 Image deployment (create HTTP function from TCR image) use "CustomImage", also provide imageConfig; no functionRootPath/zipFile needed. Recommended runtimes: Node.js: Nodejs20.19 Python: Python3.11 PHP: Php7.4 Java: Java11 Go: Golang1
func.imageConfig	object		Image deployment configuration (only used when runtime=CustomImage). Used for stage B of zip→COS→CloudApp custom build→TCR→SCF: creating an HTTP function from a TCR image. Once imageConfig is passed, the function is treated as image-deployed and requires no local code packaging, scf_bootstrap, or Handler.
func.imageConfig.imageType	string		Image registry type: enterprise (Enterprise TCR) or personal (Personal TCR). Defaults to enterprise when omitted. Allowed values: "enterprise", "personal"
func.imageConfig.imageUri	string	Yes	Full image address (must include tag), format {domain}/{namespace}/{image}:{tag}, e.g., ccr.ccs.tencentyun.com/your-ns/demo-app:demo-app-001. Do not use :latest.
func.imageConfig.registryId	string		TCR instance ID, e.g., tcr-xxxxxxxx. Required when imageType=enterprise.
func.imageConfig.command	string		Override image ENTRYPOINT. Uses Dockerfile default if not provided, e.g., python.
func.imageConfig.args	string		Override image CMD, space-separated, e.g., -u app.py.
func.imageConfig.entryPoint	string		Image entry point, generally not needed.
func.imageConfig.imagePort	number		Container listening port. Web Server functions use 9000 (default), Job-type images use -1.
func.imageConfig.containerImageAccelerate	boolean		Whether to enable image acceleration. Recommended for large images to reduce cold start time.
func.triggers	array of object		Trigger configuration array
func.triggers[].name	string	Yes	Trigger name
func.triggers[].type	string	Yes	Trigger type. Allowed values: "timer"
func.triggers[].config	string	Yes	Trigger configuration, timer uses 7-segment cron: second minute hour day month week year
func.handler	string		Function entry point
func.ignore	string | array of string		Ignored files
func.isWaitInstall	boolean		Whether to wait for dependency installation
func.layers	array of object		Layer configuration
func.layers[].name	string	Yes
func.layers[].version	number	Yes
functionRootPath	string		Function root directory (parent directory absolute path)
force	boolean		Whether to overwrite when createFunction
functionName	string		Top-level target function name. updateFunctionCode, updateFunctionConfig, invokeFunction, publishVersion, updateFunctionAliasConfig, and similar actions use this field. createFunction uses func.name. If func.name is provided by mistake, it is also recognized as functionName.
zipFile	string		Base64-encoded code package, retained only for special cases. For normal createFunction and updateFunctionCode operations, do not pre-compress a ZIP by default; prefer functionRootPath.
code	object		Stage B of two-stage ZIP deployment: the code package has already been uploaded to the environment COS bucket through queryFunctions action=getFunctionUploadUrl. Pass the returned cosBucketName, cosObjectName, and cosBucketRegion values unchanged. When code is provided, createFunction and updateFunctionCode no longer read a local directory, so functionRootPath and zipFile are unnecessary. Cloud-side dependency installation is disabled by default and can be overridden with func.installDependency. The bucket and region in the code triple must belong to this environment's own storage bucket, and the object key must have the fnzip-upload/... form returned by getFunctionUploadUrl; values assembled by hand, pointing at another bucket, or reused across environments are rejected and the caller must fetch a new URL.
code.cosBucketName	string	Yes	Environment bucket short name without the -appid suffix. Use the cosBucketName returned by getFunctionUploadUrl; do not construct it manually.
code.cosObjectName	string	Yes	Uploaded object key. Use the cosObjectName returned by getFunctionUploadUrl.
code.cosBucketRegion	string		Bucket region. If omitted, the current environment bucket region is used automatically.
handler	string		Function entry point
timeout	number		Timeout for config update
envVariables	object		Environment variables to merge for config update
vpc	unknown		VPC info for config update
params	object		Invocation parameters for invokeFunction
triggers	array of unknown		Trigger list for createFunctionTrigger
triggerName	string		Target trigger name for deleteFunctionTrigger
layerName	string		Layer name
layerVersion	number		Layer version number
contentPath	string		Layer content path, can be directory or ZIP file
base64Content	string		Layer content base64 encoding
runtimes	array of string		List of runtimes the layer applies to
description	string		Description. For createLayerVersion it describes the layer version; for publishVersion / updateFunctionAliasConfig it describes the function version or alias
licenseInfo	string		Layer license information
layers	array of object		Target layer list for updateFunctionLayers, order is final order
layers[].layerName	string	Yes	Layer name
layers[].layerVersion	number	Yes	Layer version number
codeSecret	string		Code protection secret for layer binding
imageConfig	unknown		Image deployment configuration (Runtime=CustomImage). Used with createFunction to create an HTTP function from a TCR image, or with updateFunctionCode to swap image tags only. Requires imageUri (with tag); enterprise TCR also requires registryId. Can also be provided in func.imageConfig; when both are passed, the top-level imageConfig takes precedence.
incrementalFile	string		File path for incrementalDeployFunction incremental deployment
aliasName	string		Alias name for updateFunctionAliasConfig. Defaults to $DEFAULT, consistent with tcb fn config-route
functionVersion	string		Primary version for updateFunctionAliasConfig. May be a concrete version number or $LATEST
routingConfig	object		Traffic-routing configuration for updateFunctionAliasConfig. AdditionalVersionWeights defines canary weights; AddtionVersionMatchs is the historical SCF/SDK field name, including its spelling
routingConfig.AdditionalVersionWeights	array of object		Additional version weights for canary rollout
routingConfig.AdditionalVersionWeights[].Version	string	yes	Additional traffic version number
routingConfig.AdditionalVersionWeights[].Weight	number	yes	Additional traffic weight (0–1 or a percentage, following SCF conventions)
routingConfig.AddtionVersionMatchs	array of object		Additional version match rules; field name preserved as SCF AddtionVersionMatchs
routingConfig.AddtionVersionMatchs[].Version	string	yes	Version targeted by the match rule
routingConfig.AddtionVersionMatchs[].Key	string	yes	Header or query key used by the rule
routingConfig.AddtionVersionMatchs[].Method	string	yes	Match method, such as Exact or Regex
routingConfig.AddtionVersionMatchs[].Expression	string	yes	Match expression
confirm	boolean		Dangerous operation confirmation switch

---

queryHosting

Query read-only information about CloudBase static hosting. Suitable for AI discovery before deciding next steps: action=websiteConfig queries index/error page, routing rules and site domain info; action=status queries hosting service status; action=findFiles finds files by prefix; action=listFiles lists all hosted files; action=domainStatus queries the current status and config of custom domains. This tool has no side effects.

Parameters

Parameter	Type	Required	Description
action	string	yes	Query type: websiteConfig=query static hosting website document config and site domain info, status=query static hosting service status, findFiles=find hosted files by prefix, listFiles=list all files in static hosting, domainStatus=query custom domain config and effective status. This tool is strictly read-only and does not modify any resources. Allowed values: "websiteConfig", "status", "findFiles", "listFiles", "domainStatus"
prefix	string		File prefix filter. Only used when action=findFiles, e.g. app/ or assets/logo
marker	string		Pagination start marker. Only used when action=findFiles, to continue fetching results after the previous page
maxKeys	integer		Max file entries returned per call. Only used when action=findFiles
domains	array of string		Custom domain list to query. Only used when action=domainStatus, e.g. ["www.example.com"]

---

manageHosting

Manage change operations for CloudBase static hosting. action=upload uploads local build artifacts to the shared domain (domain format: <envId>-<appId>.tcloudbaseapp.com/<cloudPath>); action=delete deletes hosted files or directories (must confirm=true); action=setWebsiteDocument sets index/error pages and routing rules; action=enableService enables static hosting; action=bindDomain / unbindDomain / updateDomain manage custom domains; action=downloadFile / downloadDirectory download hosted content to local. ⚠️ For new project deployments, prefer manageApps (deploys to an independent subdomain); this tool is for existing legacy projects or as a fallback for manageApps. manageApps and manageHosting use different domains; switching will break old links. If the task only needs to view config, files, or domain status, use queryHosting instead.

Parameters

Parameter	Type	Required	Description
action	string	yes	Management type: upload=upload local build artifacts to static hosting, delete=delete hosted files or directories, setWebsiteDocument=set index/error pages and routing rules, enableService=enable static hosting service, bindDomain=bind a custom domain, unbindDomain=unbind a custom domain, updateDomain=update domain cache/anti-leech/IP rules, downloadFile=download a single hosted file locally, downloadDirectory=download a hosted directory locally. Allowed values: "upload", "delete", "setWebsiteDocument", "enableService", "bindDomain", "unbindDomain", "updateDomain", "downloadFile", "downloadDirectory"
localPath	string		Local path. For action=upload, the local file/directory path to upload; for action=downloadFile or downloadDirectory, the local destination path. Absolute paths recommended
cloudPath	string		Target path in static hosting. For action=upload, the hosted path after upload; for action=delete/downloadFile/downloadDirectory, the hosted file or directory path
files	array of object		Multi-file upload config. Optional when action=upload; when passed, each file is uploaded individually and single localPath/cloudPath is not used
ignore	union		File patterns to ignore when uploading. Optional when action=upload, e.g. node_modules or ["/*.map", "/.DS_Store"]
isDir	boolean		Whether to treat cloudPath as a directory. Only used when action=delete; true=delete directory, false=delete a single file
confirm	boolean		Confirmation switch for high-risk operations. Must be explicitly true for action=delete and action=unbindDomain to avoid accidental file deletion or domain unbinding
indexDocument	string		Website index document name. Required only when action=setWebsiteDocument, e.g. index.html
errorDocument	string		Error page document name. Optional when action=setWebsiteDocument, e.g. 404.html
routingRules	array of object		Website routing rule list. Optional when action=setWebsiteDocument. A common SPA config rewrites 404 to index.html
domain	string		Custom domain. Used for action=bindDomain / unbindDomain / updateDomain, e.g. www.example.com
certId	string		Certificate ID. Required only when action=bindDomain
domainId	number		Domain ID. Required only when action=updateDomain, for precisely updating the specified domain config
domainConfig	object		Domain config. Required only when action=updateDomain; supports cache, Referer, anti-leech, IP rules, and rate limiting

---

queryStorage

Query cloud storage information, supports listing directory files, getting file information, getting temporary download links and other read-only operations. Returned file information includes file name, size, modification time, download link, etc.

Parameters

Parameter	Type	Required	Description
action	string	Yes	Query operation type: list=list all files in directory, info=get detailed information of specified file, url=get temporary download link for file. Allowed values: "list", "info", "url", "read"
cloudPath	string	Yes	Cloud file path, e.g., files/data.txt or files/ (directory)
maxAge	number		Temporary link validity period in seconds, range: 1-86400, default: 3600 (1 hour). Default: 3600

---

manageStorage

Manage cloud storage files, only for COS/Storage objects, not for static website hosting. Supports uploading files/directories, downloading files/directories, deleting files/directories and other operations. Delete operation requires setting force=true for confirmation to prevent accidental deletion of important files.

Parameters

Parameter	Type	Required	Description
action	string	Yes	Management operation type: upload=upload file or directory, download=download file or directory, delete=delete file or directory. Allowed values: "upload", "download", "delete"
localPath	string	Yes	Local file path, absolute path recommended, e.g., /tmp/files/data.txt
cloudPath	string	Yes	Cloud file path, e.g., files/data.txt
force	boolean		Force operation switch, recommended to set to true for delete operations to confirm deletion, defaults to false. Default: false
isDirectory	boolean		Whether directory operation, true=directory operation, false=file operation, defaults to false. Default: false

---

downloadTemplate

Automatically download and deploy CloudBase project templates. ⚠️ MANDATORY FOR NEW PROJECTS ⚠️

CRITICAL: This tool MUST be called FIRST when starting a new project.

Supported templates:

• react: React + CloudBase full-stack application template
• vue: Vue + CloudBase full-stack application template
• miniprogram: WeChat Mini Program + CloudBase template
• uniapp: UniApp + CloudBase cross-platform application template
• rules: Only includes AI editor configuration files (includes all mainstream editor configurations such as Cursor, WindSurf, CodeBuddy, etc.), suitable for supplementing AI editor configuration in existing projects

Supported IDE types:

• all: Download all IDE configurations
• cursor: Cursor AI editor
• Other IDE types see list below

Note: If ide parameter is not passed and IDE cannot be detected from environment, an error will be prompted and require passing ide parameter

• windsurf: WindSurf AI editor
• codebuddy: CodeBuddy AI editor
• claude-code: Claude Code AI editor
• cline: Cline AI editor
• gemini-cli: Gemini CLI
• opencode: OpenCode AI editor
• qwen-code: Tongyi Lingma
• baidu-comate: Baidu Comate
• openai-codex-cli: OpenAI Codex CLI
• augment-code: Augment Code
• github-copilot: GitHub Copilot
• roocode: RooCode AI editor
• tongyi-lingma: Tongyi Lingma
• trae: Trae AI editor
• qoder: Qoder AI editor
• antigravity: Google Antigravity AI editor
• vscode: Visual Studio Code
• kiro: Kiro AI editor
• aider: Aider AI editor

Special notes:

• rules template will automatically include current MCP version information, which helps with later maintenance and version tracking
• When downloading rules template, if README.md file already exists in the project, the system will automatically protect the file from being overwritten (unless overwrite=true is set)

Parameters

Parameter	Type	Required	Description
template	string	Yes	Template type to download. Allowed values: "react", "vue", "miniprogram", "uniapp", "rules"
ide	string	Yes	Specify the IDE type to download. Allowed values: "all", "cursor", "windsurf", "codebuddy", "claude-code", "cline", "gemini-cli", "opencode", "qwen-code", "baidu-comate", "openai-codex-cli", "augment-code", "github-copilot", "roocode", "tongyi-lingma", "trae", "qoder", "antigravity", "vscode", "kiro", "aider", "iflow-cli"
overwrite	boolean		Whether to overwrite existing files, defaults to false (no overwrite)

---

searchKnowledgeBase

CloudBase knowledge base search tool. It supports CloudBase official documentation (docs), curated skill documents (skill), and OpenAPI documents (openapi).

Choose the mode by scenario:

• If a tool error contains a specific error code such as OperationDenied.FreePackageDenied, use mode=docs + action=searchDocs with the error code as query. Read the official meaning and remediation before acting; do not retry by guesswork.
• If you do not know where the answer is, or need full-text search across official documentation, use mode=docs + action=searchDocs with query keywords.
• If you know the document title, hierarchy path, or URL, use mode=docs + action=findByName with input, or action=readDoc with docPath.
• For a scenario-specific implementation guide or best practice, use mode=skill + skillName.
• For an HTTP API definition, use mode=openapi + apiName.

⚠️ Important: when CloudBase skills are disabled or the current IDE cannot read skill files, use searchKnowledgeBase(mode=skill, skillName=...) to retrieve the CloudBase skill documentation. Do not try to read the skill file directly; that may return a 400 error. Examples:

• Minimal Web + database demo: searchKnowledgeBase(mode=skill, skillName=minimal-web-baas-demo)
• Authentication configuration guide: searchKnowledgeBase(mode=skill, skillName=auth-tool-cloudbase)
• Web authentication guide: searchKnowledgeBase(mode=skill, skillName=auth-web-cloudbase)
• CloudBase Agent guide: searchKnowledgeBase(mode=skill, skillName=cloudbase-agent)
• MCP connection modes (local / remote), calling tools from the shell with mcporter, or the site / plugin switches: searchKnowledgeBase(mode=skill, skillName=cloudbase-mcp)

The response contains the full SKILL.md of that skill plus the address list of every .md file for it in the remote aggregation repo (CNB raw) — SKILL.md, references/, and so on, directly fetchable over HTTP. Relative links outside code fences in the body are also rewritten to absolute addresses; if the skill does not exist in the remote repo, only the inline content is returned, clearly marked, and no dead links are returned.

If you are unsure which document to choose, call mode=skill without skillName or mode=openapi without apiName. The tool returns the available items and a short description of when to use each one; then call it again with the selected name. The skillName and apiName enums below contain the same choices (33 skills and 8 APIs).

OpenAPI queries need only mode="openapi" and apiName. Do not pass action; action is used only with mode="docs".

Parameters

Parameter	Type	Required	Description
mode	string	Yes	Allowed values: "skill", "openapi", "docs"
skillName	string		Specify when mode=skill. Skill name. Allowed values: "cloudbase-all-in-one", "ai-model-nodejs", "ai-model-web", "ai-model-wechat", "auth-nodejs-cloudbase", "auth-tool-cloudbase", "auth-web-cloudbase", "auth-wechat-miniprogram", "cloud-api-operations", "cloud-functions", "cloud-storage-web", "cloudbase-agent", "cloudbase-cli", "cloudbase-code-review", "cloudbase-declarative-deploy", "cloudbase-document-database-in-wechat-miniprogram", "cloudbase-document-database-web-sdk", "cloudbase-mcp", "cloudbase-platform", "cloudbase-wechat-integration", "cloudrun-development", "data-model-creation", "http-api-cloudbase", "minimal-web-baas-demo", "miniprogram-development", "ops-inspector", "postgresql-best-practices-cloudbase", "postgresql-development-cloudbase", "relational-database-mcp-cloudbase", "relational-database-web-cloudbase", "spec-workflow", "ui-design", "web-development"
apiName	string		Specify when mode=openapi. API name. Allowed values: "mysqldb", "pgdb", "functions", "auth", "cloudrun", "storage", "nosql", "ai_model"
action	string		Specify when mode=docs. CloudBase documentation operation type: listModules=list all documentation modules, listModuleDocs=get directory structure of specified module, findByName=smart search by name/path/URL, readDoc=read specified documentation Markdown, searchDocs=full-text search official documentation. Allowed values: "listModules", "listModuleDocs", "findByName", "readDoc", "searchDocs"
moduleName	string		Specify when mode=docs and action=listModuleDocs. Module name.
input	string		Specify when mode=docs and action=findByName. Supports module name, document title, hierarchy path or URL.
docPath	string		Specify when mode=docs and action=readDoc. Pass a site-relative path such as /quick-start, or a document URL returned by findByName / searchDocs. When a URL is provided, only its path is used and the hostname is ignored.
query	string		Specify when mode=docs and action=searchDocs. Full-text search keywords.

---

queryCloudRun

Query CloudBase Run service information, including service lists, service details, available templates, build logs (getDeployLog, cloud source builds only and dependent on CODING), process logs (getProcessLog, available for image and source deployments without CODING), deployment records, and environment enablement status (envStatus). Results include service name, status, access type, configuration details, and recent deployment context.

Parameters

Parameter	Type	Required	Description
action	string	Yes	Query operation type: list=get the CloudBase Run service list; detail=get service details and latest deployment status; templates=get project templates; getDeployLog=get source-build logs through CODING/DescribeCloudRunBuildLog; getProcessLog=get deployment-stage and container runtime logs through tcbr/DescribeCloudRunProcessLog; getDeployRecords=list deployment records newest first; envStatus=query whether CloudBase Run is enabled for the environment; getManageTask=query a service release task through tcbr/DescribeServerManageTask, returning task Id/Status and the latest deployment state to determine whether a deployment is progressing or stuck. When a deployment reports that another release task is running, use getManageTask before retrying. Allowed values: "list", "detail", "templates", "getDeployLog", "getProcessLog", "getDeployRecords", "envStatus", "getManageTask"
pageSize	number		Page size, controls number of services returned per page. Range: 1-100, default: 10. Adjust based on network performance and display requirements. Default: 10
pageNum	number		Page number, for paginated queries. Starts from 1, default: 1. Use with pageSize for paginated browsing. Default: 1
serverName	string		Service name filter condition, supports fuzzy matching. E.g., entering "test" matches "test-service", "my-test-app", etc. Leave empty to query all services
serverType	string		Service type filter condition: function=function-type CloudBase Run (Node.js only, with specialized development requirements), container=container service (recommended; supports Java, Go, Python, PHP, .NET, and other languages/frameworks). Allowed values: "function", "container"
envId	string		Environment ID used by action=envStatus. Uses the currently configured environment when omitted; format such as env-xxxxxx
detailServerName	string		Service name for detail, deployment records, build logs, process logs, or release-task status. Use an existing name returned by list
buildId	number		Build ID used only by action=getDeployLog for cloud source builds. Defaults to the latest deployment build when omitted
runId	string		RunId used only by action=getProcessLog. Defaults to the latest deployment record's RunId, shared with detail/getDeployRecords. Process logs are available for image and source deployments
revealEnvParams	boolean		Whether action=detail returns plaintext ServerConfig.EnvParams values. Defaults to false and masks values as "***" while retaining keys. When true, sensitive values such as password-bearing DATABASE_URL values may enter the model context; use with care

---

manageCloudRun

Manage CloudBase Run services in development order: enable CloudBase Run for the environment (initEnv), initialize a project from a template, download service code, run it locally (function services only), deploy code, update configuration without re-uploading code (updateConfig), and delete a service. deploy supports source builds through targetPath and existing-image deployment through imageUrl. It triggers deployment and waits briefly for task registration (up to about 45 seconds); set waitRegistration=false when no buildId is needed. Source builds return a buildId for getDeployLog, followed by getProcessLog. Image deployments commonly have BuildId 0; skip getDeployLog and use the returned runId/next_step or getDeployRecords before getProcessLog. When image deployment is requested, pass imageUrl rather than falling back to source merely because local source exists. Existing services use read-merge-write to preserve VpcConf, EnvParams, and OpenAccessTypes. updateConfig aligns with the console's service settings. Deletion requires confirmation; force=true is recommended. For a new environment, call the asynchronous, idempotent initEnv before the first deployment when CloudBase Run is not enabled. Before deploying, make sure the image carries no static content: media files (video, large images, fonts), user uploads, and frequently updated static assets belong in cloud storage, referenced by URL. Otherwise every deployment repushes everything and every scaled instance re-pulls it — a single demo video can turn a 30-second deploy into minutes.

Parameters

Parameter	Type	Required	Description
action	string	Yes	CloudBase Run management operation: init=initialize project code; download=download service code; run=run a function service locally; deploy=trigger deployment and briefly wait for task registration; updateConfig=update service configuration without uploading code; delete=delete a service; createAgent=create a function-type Agent; initEnv=enable CloudBase Run for the current environment; traffic=manage canary traffic with set/promote/rollback. Allowed values: "init", "download", "run", "deploy", "delete", "createAgent", "updateConfig", "initEnv", "traffic"
serverName	string		CloudBase Run service name. It becomes the subdirectory name for init and identifies the target service for other actions. Not required for initEnv
targetPath	string		Local code path, must be absolute path. In deploy operation specifies code directory to deploy, in download operation specifies download target directory, in init operation specifies CloudRun service parent directory (will create subdirectory named serverName under this directory). Recommended convention: cloudrun/ directory under project root, e.g., /Users/username/projects/my-project/cloudrun
serverConfig	object		Service configuration items, used to set service runtime parameters during deployment. Includes resource specs, access permissions, environment variables and other configuration. Uses default configuration if not provided
serverConfig.OpenAccessTypes	array of string		Public network access type configuration, controls service access permissions: OA=office network access, PUBLIC=public network access (default, accessible via HTTPS domain), MINIAPP=mini program access, VPC=VPC access (only accessible within same VPC). Can configure multiple types
serverConfig.Cpu	number		CPU spec configuration, unit is cores. Options: 0.25, 0.5, 1, 2, 4, 8, etc. Note: Memory spec must be 2x CPU spec (e.g., CPU=0.25 then memory=0.5, CPU=1 then memory=2). Affects service performance and billing
serverConfig.Mem	number		Memory spec configuration, unit is GB. Options: 0.5, 1, 2, 4, 8, 16, etc. Note: Must be 2x CPU spec. Affects service performance and billing
serverConfig.MinNum	number		Minimum instance count configuration, controls minimum number of running service instances. Setting to 0 enables scale-to-zero (no cost when no requests), setting > 0 always keeps specified number of instances running (ensures fast response but increases cost). Recommended to set to 1 to reduce cold start latency and improve user experience
serverConfig.MaxNum	number		Maximum instance count configuration, controls maximum number of running service instances. When request volume increases, service can scale up to specified number of instances, beyond which new requests will be rejected. Recommended to set based on business peak
serverConfig.PolicyDetails	array of object		Scaling configuration array, used to configure service auto-scaling policies. Can configure multiple scaling policies
serverConfig.PolicyDetails[].PolicyType	string	Yes	Scaling type: cpu=CPU utilization-based scaling, mem=memory utilization-based scaling, cpu/mem=CPU and memory utilization-based scaling. Allowed values: "cpu", "mem", "cpu/mem"
serverConfig.PolicyDetails[].PolicyThreshold	number	Yes	Scaling threshold, unit is percentage. E.g., 60 means trigger scaling when resource utilization reaches 60%
serverConfig.CustomLogs	string		Custom log configuration, used to configure service log collection and storage policies
serverConfig.Port	number		Service listening port. Function-type services use port 3000 through the function framework; application code must not call app.listen itself. Container services can use a custom port, and application code must listen on that port
serverConfig.EnvParams	string		Environment variable configuration, JSON string format. Used to pass configuration information to service code, e.g., '{"DATABASE_URL":"mysql://...","NODE_ENV":"production"}'. Sensitive information is recommended to use environment variables rather than hardcoding
serverConfig.Dockerfile	string		Dockerfile filename configuration, only required for container-type services. Specifies the Dockerfile file path for building container images, defaults to Dockerfile in project root
serverConfig.BuildDir	string		Build directory configuration, specifies the directory path for code building. Used when code structure differs from standard, defaults to project root
serverConfig.InternalAccess	string		Internal network access switch configuration, controls whether to enable internal network access. true=enable internal network access (can be called directly via CloudBase SDK), false=disable internal network access (public network access only)
serverConfig.InternalDomain	string		Internal network domain configuration, used to configure service internal network access domain. Only effective when internal network access is enabled
serverConfig.EntryPoint	array of string		Dockerfile EntryPoint parameter configuration, only required for container-type services. Specifies entry program array when container starts, e.g., ["node","app.js"]
serverConfig.Cmd	array of string		Dockerfile Cmd parameter configuration, only required for container-type services. Specifies default command array when container starts, e.g., ["npm","start"]
template	string		Project template identifier, used to specify template for project initialization. Available template list can be obtained via queryCloudRun templates operation. Common templates: helloworld=Hello World example, nodejs=Node.js project template, python=Python project template, etc. Default: "helloworld"
runOptions	object		Local run parameter configuration, only supports function-type CloudRun services. Used to configure local development environment run parameters, does not affect cloud deployment
runOptions.port	number		Local run port configuration, only effective for function-type services. Specifies the port number for service to listen on locally, default 3000. Ensure port is not occupied by other programs. Default: 3000
runOptions.envParams	object		Additional environment variable configuration for local run, used for local development and debugging. Format is key-value pairs, e.g., {"DEBUG":"true","LOG_LEVEL":"debug"}. These variables only take effect when running locally
runOptions.runMode	string		Run mode: normal=normal function mode, agent=Agent mode (for AI agent development). Allowed values: "normal", "agent"; Default: "normal"
runOptions.agentId	string		Agent ID, used in agent mode to identify specific Agent instance
agentConfig	object		Agent configuration items, only used in createAgent operation
agentConfig.agentName	string	Yes	Agent name, used to generate BotId
agentConfig.botTag	string		Bot tag, used to generate BotId, auto-generated if not provided
agentConfig.description	string		Agent description information
agentConfig.template	string		Agent template type, defaults to blank (blank template). Default: "blank"
force	boolean		Force operation switch, used to skip confirmation prompts. Defaults to false (requires confirmation), set to true to skip all confirmation steps. Strongly recommended to set to true for delete operations to avoid accidental operations. Default: false
serverType	string		Service type: function=Node.js function service for simple APIs; container=recommended container service supporting Java, Go, Python, PHP, .NET, and other languages/frameworks. If omitted, MCP detects: 1) existing service type, 2) Dockerfile → container, 3) @cloudbase/aiagent-framework dependency → function, 4) otherwise → container. Allowed values: "function", "container"
waitRegistration	boolean		Whether deploy waits for the platform to register the release, default true, for up to about 45 seconds. Waiting obtains identifiers needed for later queries (BuildId for source builds or RunId for image deployment). When false, perform one probe and return immediately; use it when buildId is unnecessary and task status will be queried later

---

deployBuild

Parses cloudbaserc and runs a local build for projects that declare buildCommand in hosting[] (it only executes buildCommand — it does not install dependencies and does not upload). Equivalent to the CLI's tcb app build, but it only handles hosting[] static hosting entries and is unrelated to the cloudbaserc app resource type (cloud build pipeline). Declarative hosting deployment is split into three steps — build → plan → apply — and this tool is the first step: build artifacts locally, then dry-run with deployPlan, and finally upload the artifacts with deployApply. deployApply no longer builds locally implicitly — hosting entries with a build command error out when artifacts are missing and point you here first. Pure static hosting (no buildCommand configured and no detectable framework) is skipped automatically. The build is a purely local operation: it does not resolve an environment, does not require login, and does not need confirm.

• cwd: Project root directory; cloudbaserc is searched downward from here. Defaults to the current working directory
• mode: Environment name; merges the corresponding override config when it matches envOverrides.<mode>

Parameters

Parameter	Type	Required	Description
cwd	string		Project root directory; cloudbaserc is searched downward from here. Defaults to the current working directory
mode	string		Environment name (e.g. production/staging); merges overrides when it matches envOverrides.<mode>

---

deployPlan

Parses cloudbaserc and computes a declarative deployment plan (dry-run — it produces no changes). This is the dry-run counterpart to deployApply: plan computes and deployApply executes the same cloudbaserc. It returns the action classification for each resource: create=new, update=overwrite update, skip=no change / will not run, conflict=conflict detected and must abort, deploy=direct upload overwrite. The plan has already been recomputed with yes into "the actions that will actually happen": when yes=true is not passed, functions that already exist in the cloud are marked skip (keeping update in declaredStatus), which matches what deployApply actually executes, so the dry-run never contradicts the real run. Applicability boundary: this tool is for project-level declarative orchestration (one cloudbaserc for plan/apply); for one-off single-resource direct uploads use manageFunctions/manageHosting/manageApps.

• cwd: Project root directory; cloudbaserc is searched downward from here. Defaults to the current working directory
• mode: Environment name; merges the corresponding override config when it matches envOverrides.<mode>
• envId: Target environment ID; takes precedence over the envId in cloudbaserc. When omitted, the configured value or the currently bound environment is used
• only: Compute the plan only for the specified resource types
• skip: Skip the specified resource types
• yes: Aligned with deployApply's yes, used to recompute the effective action for functions that already exist. true=dry-run as overwrite update; false (default)=dry-run as conservative skip

Parameters

Parameter	Type	Required	Description
cwd	string		Project root directory; cloudbaserc is searched downward from here. Defaults to the current working directory
mode	string		Environment name (e.g. production/staging); merges overrides when it matches envOverrides.<mode>
envId	string		Target environment ID; takes precedence over the envId in cloudbaserc. When omitted, the configured value or the currently bound environment is used
only	array of string		Compute the plan only for the specified resource types. Available values: database/functions/app/hosting/gateway
skip	array of string		Skip the specified resource types. Available values: database/functions/app/hosting/gateway
yes	boolean		Aligned with deployApply's yes, used to recompute the effective action for functions that already exist. true=dry-run as overwrite update; false (default)=dry-run as conservative skip

---

deployApply

Parses cloudbaserc and executes a declarative deployment in the order database→functions→app→hosting→gateway. This is the execution counterpart to deployPlan (plan dry-runs / deployApply executes the same cloudbaserc). It is a local-form apply (reads the local cloudbaserc, builds and uploads locally) and is a write operation that changes cloud resources, so it only runs when confirm=true is passed explicitly. Prefer running deployPlan first, then executing once the plan checks out. Applicability boundary: this tool is for project-level declarative orchestration (one cloudbaserc for plan/apply); for one-off single-resource direct uploads use manageFunctions/manageHosting/manageApps.

• confirm: Must be explicitly passed as true for the deployment to run, otherwise it is rejected outright
• confirmDestructive: When the database migrations in this run contain destructive statements (DROP/TRUNCATE/DELETE, ALTER…DROP/RENAME), confirmDestructive=true must additionally be passed explicitly on top of confirm; otherwise it is rejected and the matching migrations and statements are listed. Has no effect when there are no destructive migrations
• cwd: Project root directory; cloudbaserc is searched downward from here. Defaults to the current working directory
• mode: Environment name; merges the corresponding override config when it matches envOverrides.<mode>
• envId: Target environment ID; takes precedence over the envId in cloudbaserc. When omitted, the configured value or the currently bound environment is used
• only: Deploy only the specified resource types
• skip: Skip the specified resource types
• yes: How to handle resources that already exist. true=overwrite and update directly; false (default)=conservatively skip, so existing resources are not overwritten in scenarios where interactive confirmation is impossible (consistent with deployPlan's yes semantics)
• concurrency: Maximum parallelism within a resource type, default 1 (serial)
• continueOnError: Continue deploying the remaining resources after one fails (a database failure still aborts forcibly)

Parameters

Parameter	Type	Required	Description
confirm	boolean		Destructive-operation confirmation switch. Deployment changes cloud resources, so confirm=true must be passed explicitly for it to run
confirmDestructive	boolean		Destructive database change confirmation switch. When the pending migrations contain DROP/TRUNCATE/DELETE or ALTER…DROP/RENAME, confirmDestructive=true must additionally be passed explicitly on top of confirm=true; no effect when there are no destructive migrations
cwd	string		Project root directory; cloudbaserc is searched downward from here. Defaults to the current working directory
mode	string		Environment name (e.g. production/staging); merges overrides when it matches envOverrides.<mode>
envId	string		Target environment ID; takes precedence over the envId in cloudbaserc. When omitted, the configured value or the currently bound environment is used
only	array of string		Deploy only the specified resource types. Available values: database/functions/app/hosting/gateway
skip	array of string		Skip the specified resource types. Available values: database/functions/app/hosting/gateway
yes	boolean		Whether to overwrite and update resources that already exist. true=overwrite; false (default)=conservatively skip existing resources
concurrency	integer		Maximum parallelism within a resource type, default 1 (serial); only applies within a type, cross-type dependency order is unchanged
continueOnError	boolean		Whether to continue deploying the remaining resources after one fails; a database failure always aborts forcibly

---

queryGateway

Unified read-only entry for the gateway domain. Query gateway domains, access entries, and target exposure status via action.

Parameters

Parameter	Type	Required	Description
action	string	Yes	Read-only operation type, e.g., getAccess, listDomains. Allowed values: "getAccess", "listDomains", "listRoutes", "getRoute", "listCustomDomains"
targetType	string		Target resource type. Currently supports function, extensible in future. Allowed values: "function"
targetName	string		Target resource name. Required for getAccess
routeId	string		Route ID. Optional for getRoute

---

manageGateway

Unified write entry for the gateway domain. Create target access entries via action, with more general gateway configuration capabilities to follow.

Parameters

Parameter	Type	Required	Description
action	string	Yes	Write operation type, e.g., createAccess. Allowed values: "createAccess", "createRoute", "updateRoute", "deleteRoute", "bindCustomDomain", "deleteCustomDomain", "deleteAccess", "updatePathAuth"
targetType	string		Target resource type. Currently supports function, extensible in future. Allowed values: "function"
targetName	string		Target resource name
path	string		Access path, defaults to /{targetName}
type	string		Target function's own type (not access form). If the accessed function is Event type (default), pass Event here; only pass HTTP when the accessed function was created as HTTP function. Allowed values: "Event", "HTTP"
auth	boolean		Whether to enable authentication
route	object		HTTP route configuration object
route.routeId	string
route.path	string
route.serviceType	string
route.serviceName	string
route.auth	boolean
domain	string		Custom domain
certificateId	string		Certificate ID
accessName	string		Access entry name, reserved field

---

queryAppAuth

Read-only entry for application-side authentication configuration. Used to query login methods, providers, publishable key, API key, client configuration, and static domain authentication readiness status. If the business needs to accept plain username-style identifiers, first query action=getLoginConfig; if usernamePassword=false, the next step should immediately call manageAppAuth(action=patchLoginStrategy, patch={ usernamePassword: true }), do not directly write email login API.

Parameters

Parameter	Type	Required	Description
action	string	Yes	Allowed values: "getLoginConfig", "listProviders", "getProvider", "getClientConfig", "getPublishableKey", "getStaticDomain", "listApiKeys"
providerId	string		Provider identifier, e.g., email, google
clientId	string		OAuth client_id / DescribeClient Id; uses current environment ID (default client) when omitted
keyType	string		API key type filter, optional publish_key or api_key. Allowed values: "publish_key", "api_key"
pageNumber	integer		API key list page number, starts from 1
pageSize	integer		API key list items per page

---

manageAppAuth

Write entry for application-side authentication configuration. Used to modify login methods, providers, client configuration, ensure publishable key, and create or delete API keys and custom login keys. If the frontend needs to accept plain username-style identifiers, first execute action=patchLoginStrategy with patch={ usernamePassword: true }, then implement the corresponding frontend login logic.

Parameters

Parameter	Type	Required	Description
action	string	Yes	Allowed values: "patchLoginStrategy", "addProvider", "updateProvider", "deleteProvider", "updateClientConfig", "ensurePublishableKey", "createApiKey", "deleteApiKey", "createCustomLoginKeys"
patch	object		Simplified login strategy patch used by patchLoginStrategy, e.g., { usernamePassword: true }
providerId	string		Provider identifier, e.g., email, google; for addProvider can also be used as custom provider Id
providerType	string		Provider protocol type for addProvider, e.g., OAUTH, OIDC, EMAIL
displayName	string | object		Display name for addProvider, can pass string or multilingual object
clientId	string		Client Id for updateClientConfig; uses current environment ID when omitted
config	object		Provider / client configuration object
keyType	string		API key type for createApiKey, defaults to publish_key. Allowed values: "publish_key", "api_key"
keyName	string		API key name for createApiKey
expireIn	integer		Validity period for createApiKey, unit is seconds; 0 means no expiration
keyId	string		API key unique identifier for deleteApiKey

---

queryApps

Query CloudBase apps and versions deployed through app deployment. It can list apps and versions and retrieve their details; after deployment, poll build status with getAppVersion by buildId, and use getBuildLog to diagnose failures. action=getUploadUrl (read-only) returns a presigned upload URL. In cloud mode without a local filesystem, obtain uploadUrl, PUT the code ZIP, then pass the returned unixTimestamp as cosTimestamp to manageApps(action=deployApp). The uploadUrl is a one-time upload credential: do not share it or paste it into a ticket.

Parameters

Parameter	Type	Required	Description
action	string	yes	Allowed values: "listApps", "getApp", "listAppVersions", "getAppVersion", "getBuildLog", "getUploadUrl"
serviceName	string		CloudBase app service name. Required for getApp / listAppVersions / getAppVersion / getBuildLog; reuse the same serviceName after redeployment to query version history
searchKey	string		Fuzzy search keyword by app service name, only used when action=listApps
pageNo	number		Pagination page number, starting from 1
pageSize	number		Pagination size
versionName	string		Version name. For getAppVersion, can be used alternatively with buildId; prefer passing it when the version number is known
buildId	string,number		Build ID, accepted as a number or numeric string. For getAppVersion, use either buildId or versionName; after deployment returns BuildId, use it directly to poll status. Required for getBuildLog
start	number		Build log offset for paginating subsequent logs. Only used when action=getBuildLog; when omitted, returns from the beginning

---

manageApps

Deploy web apps to CloudBase, building the frontend and backend and deploying to an independent subdomain. Cloud upload flow (cloud mode, no local filesystem): call queryApps(action=getUploadUrl) or manageApps(action=getUploadUrl) for a presigned URL → PUT the code ZIP to uploadUrl with uploadHeaders and Content-Type: application/zip → pass the returned unixTimestamp as cosTimestamp to deployApp. action=getUploadUrl returns the presigned upload URL and cosTimestamp for cloud mode. action=deployApp uploads a source ZIP and triggers the remote build/deploy pipeline:

1. Remote npm install (can be skipped with installCmd="")
2. Remote npm run build (can be skipped with buildCmd="")
3. Remote tcb hosting deploy

Domain format: <serviceName>-<envId>.webapps.tcloudbase.com (each serviceName gets an independent subdomain)

✅ Recommended usage (new projects / web apps that need an independent domain, prefer this tool): On first deployment of a new project, pass framework=static, installCmd="", buildCmd="" to skip remote build, and only run tcb hosting deploy. After deployment you get an independent subdomain with version management.

⚠️ Compatibility notes:

• If an existing project was previously deployed with manageHosting (domain format: <envId>-<appId>.tcloudbaseapp.com), switching to manageApps produces a brand new URL and old links break. Keep the original deployment method unchanged.
• To check: call queryHosting to see if hosted files already exist.

Comparison with manageHosting:

• manageApps (this tool, preferred for new projects): domain <serviceName>-<envId>.webapps.tcloudbase.com, independent subdomain, version management
• manageHosting (existing projects or fallback): domain <envId>-<appId>.tcloudbaseapp.com/<path>, shared environment domain Both can bind custom domains.

⚠️ If manageApps build fails, first check logs with queryApps(action="getBuildLog"); if still failing, fall back to manageHosting.

Parameters

Parameter	Type	Required	Description
action	string	yes	Allowed values: "deployApp", "getUploadUrl", "deleteApp", "deleteAppVersion"
serviceName	string	yes	CloudBase app service name, reflected in the domain: <serviceName>-<envId>.webapps.tcloudbase.com. For deployApp, reusing an existing serviceName adds a new deployment version and triggers redeployment rather than delete-and-recreate. Use a new name for first deployment
filePath	string		Absolute path to the local project root to upload and deploy. Required for deployApp in local mode; usually the source directory (containing package.json and source), not the dist directory. Specify the build output directory with buildPath. Not needed in cloud mode; use cosTimestamp instead
cosTimestamp	string,number		COS timestamp returned as unixTimestamp by getUploadUrl; a string or number is accepted. Passing it creates the app from already-uploaded code and skips local packaging/upload. First obtain the presigned URL and PUT the ZIP. Required in cloud mode. Exactly one of filePath and cosTimestamp must be provided
appPath	string		App online access path (hosting mount path), e.g. /my-web-app. Not a local directory path; CloudApp already has an independent subdomain, defaults to / (root) when omitted
buildPath	string		Build output directory, relative to filePath, e.g. dist or build. ⚠️ When passed, the remote build system cds into this directory before running tcb hosting deploy, so deployCmd automatically uses . (current directory) instead of the directory name to avoid path duplication (e.g. dist/dist). Can be omitted for pure static HTML at the project root, but note deployCmd defaults to dist
framework	string		Frontend framework type. Options: vue, react, next, nuxt, vite, angular, static. Even when passing static, it still goes through the remote build pipeline. If already built locally, consider manageHosting to upload directly and skip remote build entirely. Allowed values: "vue", "react", "next", "nuxt", "vite", "angular", "static"
nodeJsVersion	string		Node.js version used for the build; CloudBase uses its default when omitted
installCmd	string		Dependency install command, e.g. npm install. Defaults to npm install. If already installed locally or no install needed, pass an empty string '' to skip, but the remote still runs tcb hosting deploy
buildCmd	string		Build command, e.g. npm run build. Defaults to npm run build. If already built locally, pass an empty string '' to skip the build step. To skip the remote pipeline entirely, use manageHosting
deployCmd	string		Custom deploy command. Usually not needed; a tcb hosting deploy command is generated by default. With buildPath the remote already cds into that directory and uses . as the source path; without buildPath it defaults to dist
ignore	array of string		File/directory glob patterns to ignore when uploading, e.g. /node_modules/
versionName	string		Historical version name to delete, required only when action=deleteAppVersion

---

queryPermissions

Read-only entry for CloudBase permissions and users. It queries resource permissions for databases, functions, and storage; role lists/details; application user lists/details; and gateway OPA authorization policies aligned with tcb policy list/get.

Examples:

• Query storage-bucket permissions: action="getResourcePermission", resourceType="storage", resourceId="bucket-name"
• List legacy gateway policies: action="listPolicy" (returns an empty list in PG / OPA-engine environments, consistent with the CLI)
• Read user Rego: action="getPolicy"; read platform extension policy with action="getPolicy", extension=true

Before crossing backend boundaries, call queryEnv(action="info", envId=...) and inspect EnvInfo.RuntimeBackends. resourceType="noSqlDatabase" applies to CloudBase NoSQL collection rules and is separate from PostgreSQL row-level security. Existing NoSQL collections in a PG environment still use these rules. Inspect PG policies with queryPgDatabase(action="sql", sql="SELECT * FROM pg_policies WHERE tablename=..."). This tool does not manage MySQL permissions.

On PostgreSQL environments, the platform rejects DescribeResourcePermission. For resourceType="function", this tool falls back to Manager SDK describeEnvAuthzConfig, consistent with tcb policy get. Use listPolicy / getPolicy for explicit OPA policies.

⚠️ Role actions (listRoles / getRole) are rejected for PostgreSQL environments with The current API does not support PostgreSQL type environments. This is a platform boundary, not a configuration error. Do not retry repeatedly; use PostgreSQL RLS through managePgDatabase(action="execute") and CREATE POLICY, or manage permissions in the console.

Parameters

Parameter	Type	Required	Description
action	string	Yes	Allowed values: "getResourcePermission", "listResourcePermissions", "listRoles", "getRole", "listUsers", "getUser", "listPolicy", "getPolicy"
resourceType	string		Allowed values: "noSqlDatabase", "sqlDatabase", "function", "storage"
resourceId	string
resourceIds	array of string
roleId	string
roleIdentity	string
roleName	string
uid	string
username	string
pageNo	number
pageSize	number
extension	boolean		Used only by action=getPolicy. true reads the platform extension policy (authz.platform.extension.rego); false, the default, reads the user policy (authz.user.rego), aligned with tcb policy get --extension
policyResourceType	string		Used only by action=listPolicy. Filters by resource type; currently only policy is supported, aligned with tcb policy list --resource-type policy. Allowed values: "policy"

---

managePermissions

Write entry for CloudBase permissions and users. It modifies resource permissions, manages roles, members, and policies, performs application-user CRUD, and sets gateway OPA Rego policies aligned with tcb policy set.

Examples:

• Set a storage bucket to private: action="updateResourcePermission", resourceType="storage", resourceId="bucket-name", permission="PRIVATE"
• Create a role: action="createRole", roleName="admin", roleIdentity="admin"
• Allow anonymous function invocation (PG uses OPA): action="updateResourcePermission", resourceType="function", resourceId="myFn", permission="CUSTOM", securityRule='{"invoke":true}'
• Set user Rego directly: action="setPolicy", regoContent="package authz.user\n\ndefault allow := false\n", confirm=true (this immediately disables legacy gateway authentication)

createUser / updateUser are environment-side application-user management capabilities for test accounts, administrators, or pre-provisioned users; they must not replace browser-side Web SDK registration forms. Frontend username/password registration should use auth.signUp({ username, password }), and login should use auth.signInWithPassword({ username, password }). Browser support for auth.signUp depends on the SDK/provider and must be verified; otherwise use a backend or management boundary without exposing credentials in the browser. securityRule semantics depend on resourceType. NoSQL concepts such as doc._openid, auth.openid, query-condition subset validation, and create / update / delete JSON templates apply only to resourceType="noSqlDatabase".

Before crossing backend boundaries, inspect EnvInfo.RuntimeBackends with queryEnv(action="info", envId=...):

• resourceType="noSqlDatabase" applies only to CloudBase NoSQL collections. PostgreSQL table access uses RLS through managePgDatabase(action="execute", confirm=true) with ALTER TABLE ... ENABLE ROW LEVEL SECURITY and CREATE POLICY. Existing NoSQL collections in a PG environment still use NoSQL rules.
• resourceType="storage" controls the NoSQL/COS bucket ACL; it does not cover PG pgstore buckets.
• MySQL permissions use MySQL GRANT/REVOKE statements through manageMysqlDatabase.

On PostgreSQL environments, the platform rejects ModifyResourcePermission. For resourceType="function", the tool falls back to Manager SDK modifyEnvAuthzConfig, consistent with tcb policy set, writing authz.user.rego. securityRule may contain complete Rego beginning with package authz.user or '{"invoke":true}', which generates a policy allowing anonymous/unauthenticated function calls. Setting Rego disables legacy gateway authentication. Prefer action="setPolicy" for explicit OPA policy changes.

⚠️ Role actions (createRole / deleteRoles / updateRole) are rejected for PostgreSQL environments with The current API does not support PostgreSQL type environments. This is a platform boundary, not a configuration error. Do not retry repeatedly; use PostgreSQL RLS through managePgDatabase(action="execute") and CREATE POLICY, or use the console.

Parameters

Parameter	Type	Required	Description
action	string	Yes	Allowed values: "updateResourcePermission", "createRole", "updateRole", "deleteRoles", "addRoleMembers", "removeRoleMembers", "addRolePolicies", "removeRolePolicies", "createUser", "updateUser", "deleteUsers", "setPolicy"
resourceType	string		Target resource type. The specific semantics of securityRule depend on this value; noSqlDatabase uses collection security rules, function and storage also have their own independent security rule semantics, do not apply NoSQL rule syntax. Allowed values: "noSqlDatabase", "sqlDatabase", "function", "storage"
resourceId	string
permission	string		Allowed values: "READONLY", "PRIVATE", "ADMINWRITE", "ADMINONLY", "CUSTOM"
securityRule	string		Resource type-specific rule content, detailed semantics depend on resourceType. When resourceType="noSqlDatabase" and permission="CUSTOM", should pass document database security rule JSON (document database rules: https://docs.cloudbase.net/database/security-rules); keys are typically read / create / update / delete, values are expressions. Important: create rule validates written data, document doesn't exist yet at this point, cannot use doc.*; read / update / delete rules can use doc.* to reference existing document fields. Do not misuse doc._openid, auth.openid, query condition subset validation or create / update / delete templates for function, storage or sqlDatabase. For configuring function or storage, please refer to official security rule documentation: cloud functions https://docs.cloudbase.net/cloud-function/security-rules, cloud storage https://docs.cloudbase.net/storage/security-rules. Example: {"read":"auth.uid != null","create":"auth.uid != null && auth.loginType != \"ANONYMOUS\"","update":"auth.uid != null && doc._openid == auth.openid","delete":"auth.uid != null && doc._openid == auth.openid"}
roleId	string
roleIds	array of string
roleName	string
roleIdentity	string
description	string
memberUids	array of string
policies	array of object
policyIds	array of string		Policy ID list. Direct binding by ID is not currently supported; pass policy detail objects through policies instead
uid	string
uids	array of string
username	string
password	string
userStatus	string		Allowed values: "ACTIVE", "BLOCKED"
regoContent	string		Used only by action=setPolicy. Complete user OPA Rego text; it must start with package authz.user, aligned with tcb policy set <regoContent>
confirm	boolean		Used only by action=setPolicy. Setting Rego immediately disables legacy gateway authentication, so confirm=true is required explicitly

---

queryLogs

Unified read-only entry for the logs domain. Supports checking log service status and searching CLS logs.

Parameters

Parameter	Type	Required	Description
action	string	Yes	Allowed values: "checkLogService", "searchLogs"
queryString	string
service	string		Allowed values: "tcb", "tcbr"
startTime	string
endTime	string
limit	number
context	string
sort	string		Allowed values: "asc", "desc"

---

manageLogs

Write entry for the CloudBase logs domain. Used to enable the CLS log service (aligned with Manager SDK log.createLogService / CreateEnvResource Resources=['log']).

When to use:

• Enable the CLS log service: action="createLogService", confirm=true

Enabling is asynchronous: a successful API call does not mean the service is immediately usable. Poll afterwards with queryLogs(action="checkLogService") to confirm.

Parameters

Parameter	Type	Required	Description
action	string	Yes	Operation type. createLogService=enable the CLS log service (requires confirm=true). Allowed values: "createLogService"
confirm	boolean		Explicit confirmation before enabling the log service. confirm=true is required; when omitted the tool returns CONFIRM_REQUIRED.

---

queryAgents

Unified read-only entry for the Agent domain. Supports listing, details, and log queries.

Parameters

Parameter	Type	Required	Description
action	string	Yes	Allowed values: "listAgents", "getAgent", "getAgentLogs"
agentId	string
pageNumber	number
pageSize	number
params	object

---

manageAgents

Unified write entry for the Agent domain. Supports creating, updating, and deleting remote Agents.

Parameters

Parameter	Type	Required	Description
action	string	Yes	Allowed values: "createAgent", "updateAgent", "deleteAgent"
agentId	string
params	object

---

callCloudApi

General cloud API calling tool, mainly used for CloudBase / Tencent Cloud management plane and dependent resource related API calls. Read the interface index before calling: https://docs.cloudbase.net/ai/cloudbase-ai-toolkit/api-reference.md (an Action-level index synced daily, including rate limits; check this index first to confirm service/Action/parameters so you never guess an Action name; for products the index does not cover, verify against that product's official API docs). If your goal is to directly integrate auth/functions/cloudrun/storage/mysqldb and other CloudBase business APIs via HTTP protocol, do not prioritize using callCloudApi, instead prioritize checking the corresponding OpenAPI / Swagger. The existing OpenAPI / Swagger capabilities are not a general management plane Action collection; for management plane APIs, please prioritize referring to CloudBase API Overview https://cloud.tencent.com/document/product/876/34809 and CloudBase Dependent Resource API Guide https://cloud.tencent.com/document/product/876/34808. For tcb service, common Action categories are as follows:

Environment Management: CreateEnv, ModifyEnv, DescribeEnvs, DestroyEnv User Management: CreateUser, ModifyUser, DescribeUserList, DeleteUsers Authentication Configuration: EditAuthConfig, DescribeAuthDomains Cloud Functions: DescribeFunctions, CreateFunction, UpdateFunctionCode, DeleteFunction Database: CreateMySQLInstance, DescribeMySQLInstances, DestroyMySQLInstance

⚠️ CloudBase Run uses the tcbr service for CreateCloudRunEnv, CreateCloudRunServer, DescribeEnvBaseInfo, and DescribeCloudRunEnvs with version 2022-02-17. Legacy small-tenant actions under tcb, such as CreateCloudBaseRunResource, are disabled; use manageCloudRun for deployment. Use DescribeEnvBaseInfo with required EnvId to query one environment's base information or enablement state; use DescribeCloudRunEnvs, optionally filtered by EnvId, for environment lists and resource information.

⚠️ Pass Region through the tool's top-level region parameter, which maps to X-TC-Region / the regional endpoint. Do not place Region in params; a Region value there is stripped and treated as the top-level region.

When destroying an environment, the common practice is to at least include EnvId and BypassCheck: true; if the environment is already in isolation period, add IsForce: true per documentation.

Parameters

Parameter	Type	Required	Description
service	string	Yes	Tencent Cloud product identifier. Values may only come from this field's enum whitelist (58 in total), which determines the request domain https://<service>.tencentcloudapi.com. Values outside the list are rejected — do not invent them; COS is not part of the cloud API system. See the cloud-api-operations skill for the product-to-Action mapping. CloudRun always goes through tcbr. Allowed values: "tcb", "tcbr", "scf", "sts", "cam", "cloudaudit", "tag", "billing", "region", "ba", "cvm", "lighthouse", "tke", "cbs", "cfs", "tcr", "cdb", "mariadb", "postgres", "sqlserver", "redis", "mongodb", "cynosdb", "dcdb", "tcaplusdb", "keewidb", "vpc", "clb", "cdn", "ecdn", "dnspod", "privatedns", "domain", "ssl", "teo", "gaap", "kms", "ssm", "waf", "cwp", "tcss", "ckafka", "tdmq", "tdmysql", "apigateway", "monitor", "cls", "apm", "tsf", "tat", "hunyuan", "lkeap", "tts", "trtc", "live", "vod", "sms", "ses"
action	string	Yes	Specific Action name, must conform to the corresponding service's official API definition. When unsure, check the official documentation first — do not guess from synonyms or historical names (a wrong guess surfaces as an invalid-action server error that is hard to diagnose). See the cloud-api-operations skill for common Actions.
params	object		Parameter object corresponding to the Action; key names match the official API definition — check the docs first when unsure. Do not put Region here; use the top-level region for cross-region calls. For CloudBase business APIs prefer searchKnowledgeBase(mode="openapi") rather than this tool. Examples are in the cloud-api-operations skill.
version	string		API version (omittable in most cases). Products with only one official version in the whitelist are auto-filled and need not pass it; the following multi-version products must pass it explicitly, otherwise an error listing the available options is returned: tke, mongodb, teo, monitor, vod, sms. Example: service="tcbr", version="2022-02-17", action="CreateCloudRunEnv", params={EnvId:"env-xxx",PackageType:"Standard"}; service="monitor" must explicitly pass "2018-07-24" (the alarm-policy Action family belongs to that version).
region	string		Cloud API region (X-TC-Region), e.g. ap-shanghai. Cross-region calls must pass this top-level parameter — do not write it into params. ⚠️ ap-singapore belongs to both the China site and the international site; when no site is specified it is treated as the international site (site=intl): to operate on that region on the China site, call auth(action="start_auth", site="domestic") or set TCB_SITE=domestic first.

---

prepareFeedback

Returns the new-issue page of the public repository.

When to use:

• channel="case": the work is done and the user wants to showcase it on the case wall.
• channel="retrospective": this build did not go smoothly and the user wants to feed the blockers back to the platform.

How to use:

• Call it once only. It returns a page address, not a submitted issue.
• Write the body in the conversation and hand the link to the user. The user logs in and submits it.
• Do not submit on the user's behalf, and do not put an environment ID or secret into the body.

Parameters

Parameter	Type	Required	Description
channel	string	Yes	case opens the case template; retrospective opens the retrospective template. Allowed values: "case", "retrospective"

---

queryMessagePush

Query Mini Program cloud development message push configuration (qbase getappconfig) or all valid message push event constraints (getcallbacksupportlist). There are two push modes: cloud function (default, callback per (msgType, event)) and CloudRun (qbase_open=true, receives all messages in bulk to container path). action=list also returns pushMode (cloudfunction|container), containerConfig, callbacks, and version; in CloudRun mode, callbacks may still exist but are not effective (see note), use ensureCloudFunctionMode to switch back to cloud function mode before callbacks take effect. action=listSupportedEvents returns all valid constraints (grouped by message type). Requires WeChat IDE login session channel (host-injected cloudBaseOptions.requestFn).

Parameters

Parameter	Type	Required	Description
appid	string	Yes	Mini Program AppID (required, consistent with WeChat Developer Tools; used to select WeChat login session)
env	string		Optional: Environment ID; when passed, list only returns subscription entries for that environment
action	string	Yes	list: Query current message push configuration list (includes pushMode/containerConfig). listSupportedEvents: Query all valid message push event constraints (grouped by msgType). Allowed values: "list", "listSupportedEvents"

---

manageMessagePush

Manage Mini Program cloud development message push configuration (write operations, requires confirm="yes" confirmation). Push modes: cloud function (default, callback per (msgType, event)) vs CloudRun (bulk reception; in CloudRun mode subscribe/unsubscribe/setEnable will be rejected, use ensureCloudFunctionMode first). Implements declarative idempotency based on "read full → merge → full overwrite (with version optimistic lock)". msg_type defaults to "event"; message types use msg_type=text|image|voice|video|miniprogrampage. action=subscribe validates that function_name actually exists in the environment before proceeding. action=ensureCloudFunctionMode disables CloudRun bulk reception; action=ensureContainerMode enables CloudRun (requires qbase_container_path/qbase_env/text_mode); action=setContainerCallback updates CloudRun path/env/text_mode. No write request is sent when the collection has no changes (idempotent no-op). Requires WeChat IDE login session channel.

Parameters

Parameter	Type	Required	Description
appid	string	Yes	Mini Program AppID (required, consistent with WeChat Developer Tools; used to select WeChat login session)
env_id	string	Yes	Environment ID (cloud development environment bound to cloud function subscriptions; also serves as default CloudRun environment when qbase_env is not passed for ensureContainerMode/setContainerCallback)
function_name	string	Yes	Cloud function name to receive message push (used by subscribe/unsubscribe/setEnable/ensureCloudFunctionMode; CloudRun-related actions can pass a placeholder)
action	string	Yes	subscribe: Subscribe to specified cloud function (rejected in CloudRun mode). unsubscribe: Remove matching subscription (rejected in CloudRun mode). setEnable: Enable/disable matching subscription (rejected in CloudRun mode). ensureCloudFunctionMode: Switch to cloud function push mode (disable qbase_open). ensureContainerMode: Switch to CloudRun bulk reception (requires qbase_container_path + text_mode). setContainerCallback: Update CloudRun callback path/env/text_mode. Allowed values: "subscribe", "unsubscribe", "setEnable", "ensureCloudFunctionMode", "ensureContainerMode", "setContainerCallback"
msg_type	string		Message type (defaults to "event"). "event": Event-type entries, used with event_types (subscribe defaults to virtual payment 7 events when omitted). "text"|"image"|"voice"|"video"|"miniprogrampage": Message type entries (event is always empty string), do not pass event_types. Allowed values: "event", "text", "image", "voice", "video", "miniprogrampage"
event_types	array of string		Event list to operate on (only used when msg_type="event"; can first query all constraints via queryMessagePush(action=listSupportedEvents)). subscribe defaults to subscribing to virtual payment 7 events when omitted; required for unsubscribe / setEnable when msg_type=event.
enable	boolean		Required for setEnable: true to enable subscription / false to disable subscription
qbase_container_path	string		CloudRun callback path/URL (required for ensureContainerMode; optional update for setContainerCallback)
qbase_env	string		CloudRun service environment ID (optional for ensureContainerMode/setContainerCallback; defaults to env_id when omitted)
text_mode	number		CloudRun message body encoding: 1=json, 2=xml (required for ensureContainerMode; optional update for setContainerCallback). Allowed values: 1, 2
confirm	string		Write operation confirmation: pass confirm="yes" to confirm execution; returns a pending configuration summary (CONFIRM_REQUIRED) when omitted or other value is passed, review and retry. No confirmation needed when the collection has no changes.

---