ionoscloud-mcp

IONOS CLOUD MCP Server is a server implementing the Model Context Protocol (MCP) for interacting with IONOS CLOUD resources, built and maintained by the IONOS Cloud team. It connects an IONOS CLOUD account to any MCP-compatible AI assistant or autonomous AI agent, such as Claude Desktop, Cursor, VS Code (GitHub Copilot), Windsurf, Cline, Continue, OpenCode, and others.

Purpose and Positioning

This server is used to list, inspect, and audit IONOS CLOUD infrastructure through natural language prompts or programmatic agent loops. It is read-only by default; out of the box, every tool is an inspection operation (list_, get_, head_*), so it can be safely connected to production accounts and can also be deployed in unattended agent loops on CI runners.

Main Capabilities

• 118 read-only tools, covering 7 IONOS CLOUD products.
• There are 102 optional write tools, covering Compute Engine, Kubernetes, DNS, and Certificate Manager. Write tools (create_, update_, delete_, and domain verbs such as start_, attach_*) are only registered after IONOS_MCP_TOOL_SCOPE is set.
• The default scope is read-only and can be set to tiered capabilities such as read, write, or destructive.
• Two-phase confirmation: every create_* and delete_, as well as destructive operations (stop_, reboot_, suspend_, upgrade_, restore_, detach_, recreate_) and DNS zone file import all require confirmation. The first call does not perform the change; instead, it returns a preview (delete operations provide an impact scope summary) and a one-time confirmation_token (valid for 5 minutes, bound to that target and operation); only the second call carrying that token will execute. Reversible single-field changes (update_, start_, attach_, assign_) are single-call.
• Write toolscarry MCP annotations (readOnlyHint, destructiveHint, idempotentHint), but enforcement is always on the server side.

Usage

Installation

Install via Homebrew (macOS or Linux); Docker (linux/amd64, linux/arm64), prebuilt binaries (download the archive for your OS/arch from the latest release; Linux, macOS, and Windows are supported on amd64 and arm64), go install, and building from source are also supported. An IONOS CLOUD account with API credentials is required. Generate a token in the IONOS CLOUD DCD under Management → Token Management; Object Storage credentials are created under Storage & Backup → IONOS CLOUD Object Storage → Key management.

Configuration

Add the server to the AI client's MCP configuration. Object Storage credentials are only required if you plan to use the Object Storage tools.

Tool Loading Modes

Set via the --load-mode flag or the IONOS_MCP_LOAD_MODE environment variable, with the flag taking precedence, defaulting to eager, and parsed case-insensitively:

• eager (default): all tools are registered at startup. Recommended for Claude Code, and the only available mode for clients that ignore notifications/tools/list_changed (Claude Desktop, the claude.ai connector, Claude in Chrome, the Smithery scanner).
• lazy: Compute and Object Storage are only registered when needed. At startup, two sentinel tools appear (ionos_load_compute_tools, ionos_load_objectstorage_tools); calling either tool registers the full product set and emits notifications/tools/list_changed. Only when the MCP clientUsed when the notification is supported and client-side schema latency is missing.
• dynamic (alias search): the server exposes only three meta-tools—ionos_search_tools, ionos_describe_tools, and ionos_call_tool—through which the model discovers and calls the full catalog at runtime. Suitable for clients that have a hard tool count limit and no tool search of their own (e.g., Cursor has a limit of about 40 tools, Windsurf 100). The cost is that the model must search → describe → call, adding extra round trips. At startup, the server logs the effective mode and its source (flag / env / default) to stderr.

Transport

stdio is used by default, which is the mode most MCP clients that spawn subprocesses expect. For remote or network deployments, use --transport http or IONOS_MCP_TRANSPORT=http to switch to the Streamable HTTP transport; the flag takes precedence. --http-addr or IONOS_MCP_HTTP_ADDR specifies the listening address for the HTTP transport, defaulting to 127.0.0.1:8080 (local only); use :8080 to listen on all interfaces. HTTP mode has no built-in TLS or authentication; if access from outside a trusted network is needed, it should be placed behind a reverse proxy. IONOS_TOKEN and other IONOS CLOUD credentials authenticate the server's own calls to the IONOS API regardless of the transport method.

When to use it

The example prompts given in the documentation include: cost audit, security scan, audit trail, finding forgotten resources, DNS correctness check, certificate expiry check, traffic spike investigation, onboarding tour, etc. Each prompt chains multiple list_* and get_* calls and produces a summary that can be pasted into a ticket, dashboard, or document.

Limitations and cautions

• Read-only by default; writes require explicit opt-in.
• Write operations create real resources and incur real costs, and take effect immediately. Some resources are billed even when idle (such as reserved IP blocks, snapshots, and volumes left behind after a server is deleted). Deletion is equally real: without a snapshot, data cannot be recovered, and a released IP address cannot be requested again.
• The AI model decides when and how frequently to call these tools, and may misread intent, retry more than expected, or choose more thanEnvision greater resources. The two-phase confirmation is intended to keep humans in the loop, but it cannot stop clients configured to auto-approve tool calls, under which setting the model can complete both phases on its own.
• The user is responsible for everything created, modified, or deleted in the account through these tools, as well as any resulting costs. IONOS does not control and is not responsible for how the model calls them, or for any costs, data loss, or disruptions arising from it.
• Risk can be reduced in the following ways: keep the server read-only unless writes are needed; grant write instead of destructive when deletion is not needed; require manual approval of tool calls in the client; read the preview before returning the confirmation token; prefer using a non-production account when experimenting.
• Tool count limits: Windsurf caps the total number of tools from connected MCP servers at 100, and Cursor caps the total number of tools from all servers at about 40. The default eager mode exceeds both. On Windsurf, lazy can keep the startup surface small enough; on Cursor (or any capped client without its own tool search), use dynamic to present only three tools.

Other Information

Compatibility: MCP specification 2024-11-05, building requires Go 1.25+, and OCI images are provided for linux/amd64 and linux/arm64. It can be used via HOME installation, Docker, prebuilt binaries, go install, or source. The server has been published in multiple MCP registries and IDE marketplaces. Related projects include the IONOS CLOUD MCP Server product documentation, IONOS CLOUD AI Model Hub, and IONOS CLOUD Documentation MCP. Licensed under the Apache License 2.0. For security vulnerabilities, do not publicly submit an issue; report them via GitHub private vulnerability reporting or by email to sdk-tooling@ionos.com.