IONOS CLOUD MCP Server

Built and maintained by the IONOS Cloud team. The server runs as a local binary on your workstation, a CI runner, or inside a container. IONOS CLOUD API calls go directly to IONOS over HTTPS; no third-party AI provider sits in the data path.

Compatibility:MCP spec 2024-11-05 · Go 1.25+ for builds · OCI images for linux/amd64 and linux/arm64.

Get started in 60 seconds(macOS or Linux, via Homebrew):

brew install ionos-cloud/ionos-cloud/ionoscloud-mcp

This server is published across multiple MCP registries and IDE marketplaces:

brew install ionos-cloud/ionos-cloud/ionoscloud-mcp

docker pull ghcr.io/ionos-cloud/ionoscloud-mcp:latest

Run with the MCP stdio transport (default):

docker run -i --rm \ -e IONOS_TOKEN="$IONOS_TOKEN" \ ghcr.io/ionos-cloud/ionoscloud-mcp

docker run --rm -p 8080:8080 \ -e IONOS_TOKEN="$IONOS_TOKEN" \ ghcr.io/ionos-cloud/ionoscloud-mcp --transport http --http-addr :8080

npx -y @smithery/cli install @ionos-cloud/ionoscloud-mcp --client claude-desktop

go install github.com/ionos-cloud/ionoscloud-mcp@latest

git clone https://github.com/ionos-cloud/ionoscloud-mcp.git cd ionoscloud-mcp make build

You need an IONOS CLOUD account with API credentials.

# Required: API token for control-plane APIs (Compute, DNS, Billing, Certificate Manager, Object Storage management) export IONOS_TOKEN="your-api-token" # Optional: only required if you use Object Storage data-plane tools # (listing objects, reading bucket configuration, checking access keys). export IONOS_S3_ACCESS_KEY="your-s3-access-key" export IONOS_S3_SECRET_KEY="your-s3-secret-key" # Optional: opt in to write operations (default: read-only). Values are hierarchical, # so a single level suffices: "write" allows create/update; "destructive" also allows # delete (it implies "write"). See "Write operations". # export IONOS_MCP_TOOL_SCOPE="write"

Add the server to your AI client's MCP config:

{ "mcpServers": { "ionoscloud": { "command": "/path/to/ionoscloud-mcp", "env": { "IONOS_TOKEN": "your-api-token", "IONOS_S3_ACCESS_KEY": "your-s3-access-key", "IONOS_S3_SECRET_KEY": "your-s3-secret-key" } } } }

The Object Storage credentials are only needed if you plan to use Object Storage tools.

The load mode selects how tools are exposed. Set it with either the--load-modeflag or theIONOS_MCP_LOAD_MODEenvironment variable;the flag wins if both are set, and otherwise the default iseager. Parsing is case-insensitive.

-

eager(default): all tools register at startup. Recommended for Claude Code (which defers full schemas client-side via ToolSearch, paying ~1–3k tokens for names only) and the only working mode for clients that ignorenotifications/tools/list_changed(Claude Desktop, claude.ai connectors, Claude in Chrome, Smithery scanner).

lazy: Compute and Object Storage register only on demand. Two sentinel tools (ionos_load_compute_tools,ionos_load_objectstorage_tools) appear at startup; calling either registers the full product set and emitsnotifications/tools/list_changed. Use only if your MCP client honours that notification AND lacks client-side schema deferral — otherwise eager mode is cheaper.

dynamic(alias:search): the server exposes onlythreemeta-tools —ionos_search_tools,ionos_describe_toolsandionos_call_tool— and the model discovers and invokes the full catalogue through them at runtime. The real tool list never changes, so unlikelazythis needs nonotifications/tools/list_changedsupport. Intended for clients withhard tool caps and no tool search of their own(e.g. Cursor's ~40-tool cap, Windsurf's 100). Trade-off: the model mustsearch→describe→callrather than seeing tools directly, costing extra round-trips, so prefereageron Claude Code.

The server logs the effective mode and its source (flag / env / default) to stderr at startup, e.g.load mode: dynamic (source: --load-mode flag).

./ionoscloud-mcp --transport http --http-addr :8080

- --transport <stdio|http>(orIONOS_MCP_TRANSPORT) — selects the transport. Unrecognised values fall back tostdiowith a warning.
- --http-addr <addr>(orIONOS_MCP_HTTP_ADDR) — listen address for the HTTP transport. Default:8080(all interfaces); use127.0.0.1:8080for local-only. Ignored for stdio.

The server logs the effective transport and its source to stderr at startup, e.g.transport: http (source: --transport flag).

In HTTP mode, point your MCP client athttp://<host>:<port>/as a Streamable HTTP server. There is no built-in TLS or authentication for the HTTP endpoint itself — put it behind a reverse proxy (e.g. nginx, Caddy) if it needs to be reachable outside a trusted network.IONOS_TOKENand the other IONOS CLOUD credentials still authenticate the server's own calls to the IONOS API regardless of transport.

The server is read-only until you opt in.Write tools are never registered and never appear intools/listunless you set theIONOS_MCP_TOOL_SCOPEenvironment variable. The gate applies in every load mode, including thedynamicdispatcher — there is no bypass.

Scope is a comma-separated, hierarchical set of capabilities (readis always on):

Unrecognised values fall back to read-only, and the effective scope is logged to stderr at startup. Because the levels are hierarchical, a single value is enough —destructivealone already grantswriteandread; you don't need to list them all (though a comma-separated list likeread,writeis also accepted).

77 tools in total. The server exposes 118 at the default read-only scope, 165 withwrite, and 195 withdestructive. Reads are unaffected and always available.

Two-phase confirmation.Everycreate_anddelete_, plus the disruptive actions (stop_,reboot_,suspend_,upgrade_,restore_,detach_,recreate_), is confirmation-gated. The first call performs no mutation: it returns a preview — for a delete, a blast-radius summary of what will be destroyed — plus a single-useconfirmation_token(5-minute TTL, bound to that exact target and operation). Only a second call carrying that token executes. This keeps a human in the loop and limits the agent to one resource per call. Reversible single-field changes (update_,start_,attach_,assign_) are a single call.

{ "mcpServers": { "ionoscloud": { "command": "/path/to/ionoscloud-mcp", "env": { "IONOS_TOKEN": "your-api-token", "IONOS_MCP_TOOL_SCOPE": "destructive" } } } }

- Cost audit:"Audit my IONOS CLOUD account, find the top 5 cost-inducing resources this month, and suggest cost-efficiency tips."
- Security sweep:"List every bucket whose public access block is off or whose policy is public — flag anything that looks unintentional."
- Audit trail:"Show me every failed API request on my contract in the last 30 days, grouped by user."
- Forgotten resources:"Find unattached volumes, unused IP blocks, and stopped servers across all my data centers."
- DNS sanity check:"List all zones on my account and flag any without DNSSEC enabled or with records pointing to IPs I no longer own."
- Certificate expiry:"Which certificates on my account expire in the next 60 days?"
- Traffic spike investigation:"My last invoice was higher than usual — show me daily traffic and utilization for the previous billing period and tell me what changed."
- Onboarding tour:"Walk me through what I have running on IONOS CLOUD — datacenters, servers, storage, DNS — like you're explaining it to a new teammate."

Each prompt chains multiplelist_andget_*calls and produces a summary you can paste into a ticket, dashboard, or doc. For end-to-end walkthroughs:

You can test the server's MCP protocol implementation using stdin/stdout:

# Initialize and list tools { echo '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"test","version":"0.1.0"}}}' echo '{"jsonrpc":"2.0","method":"notifications/initialized"}' echo '{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}' sleep 1 } | ./ionoscloud-mcp # Call a tool (requires a valid IONOS_TOKEN) { echo '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"test","version":"0.1.0"}}}' echo '{"jsonrpc":"2.0","method":"notifications/initialized"}' echo '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"list_datacenters","arguments":{}}}' sleep 1 } | ./ionoscloud-mcp

make build # or go build -o ionoscloud-mcp .

Runmakewith no arguments to see the available targets.

For more information about the IONOS CLOUD API:

Automate Akamai resource actions using a conversational AI client. Requires Akamai API credentials.

Query Azure retail pricing information using the Azure Retail Prices API.

Manage Azure Cloud PCs using the Microsoft Graph API.

Integrate with Apache CloudStack to manage cloud resources directly from your desktop.

Integrates with the Cloudways API, allowing AI assistants to access and manage Cloudways infrastructure.

Interact with Confluent Cloud REST APIs to manage Kafka clusters, topics, and data.

An MCP server for interacting with the Exoscale cloud platform.