Control Plane

Deploy, scale and delete cloud workloads on AWS, GCP and Azure.

Add to Agentman Studio

Opens Agent Studio, where connecting is one click. The connector URL below works in any MCP client.

Paste it into any MCP client. Setup docs

Resources

What the Control Plane connector does

The Control Plane MCP server connects a Control Plane organization — a platform that runs containerized workloads across AWS, GCP, Azure, Oracle Cloud and your own hardware — to Claude, ChatGPT and any MCP-compatible agent. It deploys, scales, inspects and deletes live infrastructure. Sign-in is OAuth with per-org consent.

Verified connector

Listed by Anthropic as a partner connector in its Connectors Directory.

Connection checked by Agentman on .

Anthropic states this reflects the level of review a connector received, not a security audit.

Control Plane tools (55)

  • add_domain_port
  • add_domain_route
  • browse_templates
  • build_image
  • clear_domain_tls
  • convert_to_terraform
  • create_domain
  • create_gvc
  • create_identity
  • create_policy
  • create_volumeset
  • create_workload
  • delete_resource
  • expand_volumeset
  • export_terraform
  • get_command
  • get_cpln_rules
  • get_cpln_skill
  • get_image_build
  • get_installed_template
  • get_permissions
  • get_resource
  • get_resource_schema
  • get_template
  • get_trace
  • get_workload_events
  • get_workload_logs
  • grant_workload_secret_access
  • install_template
  • list_commands
  • list_deployments
  • list_installed_templates
  • list_metrics
  • list_quotas
  • list_resources
  • list_workload_replicas
  • mount_volumeset_to_workload
  • query_audit_events
  • query_metrics
  • query_traces
  • remove_domain_port
  • remove_domain_route
  • search_control_plane
  • set_domain_tls
  • uninstall_template
  • update_domain
  • update_domain_route
  • update_gvc
  • update_identity
  • update_policy
  • update_volumeset
  • update_workload
  • upgrade_template
  • workload_start_cron
  • workload_stop_replica

Tool names from Anthropic's directory listing. This server requires sign-in, so we could not read tool descriptions or parameter schemas.

Limits

  • No OAuth scope draws a boundary. The server's RFC 9728 descriptor advertises scopes_supported of openid and offline_access; the authorization server at https://auth.cpln.io advertises openid, offline and offline_access. Both lists are identity and refresh-token claims. Nothing at the OAuth grant separates reading a workload from deleting one — the per-org consent screen and the toolset profile are the only boundaries.
  • The directory's 55 omits a destructive default-profile tool. workload_exec runs a command inside a running container and is marked core by Control Plane. Auditing the directory listing alone will miss it.
  • A raw-API dispatcher exists and we could not determine its state. cpln_api_request appears only in the plugin's generated manifest, marked conditional behind a kill switch and documented as bypassing typed-tool validation. We did not authenticate, so we cannot say whether it is advertised to your organization. If it is, the reachable surface is Control Plane's whole REST API rather than 132 tools.
  • Destructive confirmation is client-side, not server-side. Control Plane states plainly that destructive operations execute on a single call with no server-side preview or confirmation token, and that its guidance holds "even when host permissions are set to auto-approve". The protection is the MCP client's own write-action prompt plus prose the model is asked to follow.
  • Every safety behaviour we found is documentation, not enforcement. The operating guide's rules — read before delete, present the blast radius, get a fresh approval for a cascade, redact secrets, reject credential-bearing prompts — are instructions to the model. We found no evidence of a server-side control that enforces any of them, and we did not test for one.
  • The tool count is a URL parameter, not a property of the server. A page or audit that states "55 tools" describes one of four profiles. Check the endpoint URL your client is configured with before trusting any count.
  • Spending is unobservable in the moment. Creating a GVC, workload, IP set or mk8s cluster provisions billable capacity, and Control Plane documents ongoing charges for reserved IPs, dedicated per-location load balancers, cross-zone traffic, cross-GVC egress and observability storage over 100GB. The surface has list_quotas and get_quota but no billing, spend or cost tool, so an agent can provision without any tool that could price it first. Control Plane publishes no per-call rate, and we found no documentation of idempotency keys on the create tools.
  • We could not read tool schemas or protocol safety annotations. The endpoint returned 401 to an anonymous request, so no parameter-level detail and no server-declared destructiveHint is published here. The Read/Write/Destructive markers are Control Plane's documentation.
  • Control Plane's own tools reference is internally inconsistent by one row. The profile table states full holds 132 tools; the tables below it enumerate 131. The 132nd is cpln_api_request, which the manifest carries and the reference does not.
  • Service-account keys and agent bootstrap configs are shown once. Control Plane states they cannot be retrieved afterwards, and the only recovery is delete and regenerate.
  • get_agent_info is about Control Plane's network agents, not AI agents. The naming collides with MCP vocabulary; it reads a private-network connectivity agent's heartbeat.

Frequently asked questions

Can the Control Plane MCP server delete a running workload?

Yes, on the default profile. One tool named delete_resource removes a resource by kind and name, and Control Plane documents it as the single delete tool for every deletable kind. Deleting a GVC cascades to every workload and identity inside it. Control Plane states destructive operations execute on a single call with no server-side preview or confirmation token.

Can an AI agent run commands inside my production containers?

Yes, through a tool Anthropic's directory does not list. Control Plane's tools reference documents workload_exec, marked Destructive and available on the default core profile, which runs a single command in a running container and returns its output. It is the one core tool missing from the directory's 55, so a reader who audits only the directory listing will not see it.

How many tools does the Control Plane MCP server have?

132, and the number depends on a URL parameter. Control Plane's tools reference documents 30 tools on the readonly profile, 56 on core, 78 on mk8s and 132 on full, selected with the toolsets query parameter on the endpoint. Anthropic's directory lists 55, which is the core profile minus workload_exec.

What OAuth permissions does the Control Plane MCP server request?

Only identity claims. The server's RFC 9728 descriptor advertised scopes_supported of openid and offline_access on 2026-08-23, and its authorization server advertised openid, offline and offline_access. Neither names a Control Plane resource or verb, so no OAuth scope separates reading a workload from deleting one. The real boundary is the per-org consent screen.

Can the connector read my AWS or GCP credentials?

No tool returns a secret value. Control Plane documents secrets as read-only through the MCP server: list_resources and get_resource show a secret exists and its metadata, never its data, and no tool creates, edits, deletes or reveals one. But create_cloud_account and update_cloud_account on the full profile change the bridge between Control Plane and your AWS, GCP or Azure account.

How do I stop an AI agent from changing my infrastructure?

Connect to the readonly profile URL. Control Plane documents https://mcp.cpln.io/mcp?toolsets=readonly as a 30-tool set that advertises no tool which creates, updates, deletes or executes a command. The profile is fixed for the life of a connection and an agent cannot expand it mid-session, so reconnecting is the only way to change it.

Does the Control Plane connector cost money to use?

The connector is not metered, but the resources it creates are. Creating a GVC, workload, mk8s cluster or IP set provisions real capacity across AWS, GCP, Azure or Hetzner, and Control Plane documents that reserved IP addresses must be explicitly released to prevent ongoing charges. The surface exposes list_quotas and get_quota but no billing or spend tool.

What do I need before connecting Control Plane to Claude?

A Control Plane account and a decision about which orgs to authorize. Control Plane documents sign-in through Google, GitHub, Microsoft or SAML, followed by a consent screen where you pick the orgs the AI client may access. Its own guidance is to authorize only the orgs you need, because that consent is the connector's main access boundary.

Sources

More Developer Tools connectors

  • Base44

    Build and edit Base44 apps from an AI assistant, and query data your app's users submit.

  • CircleCI

    Diagnose failed builds, read job logs, inspect test results and rerun or roll back deployments from your AI assistant.

  • Claude Managed Agents

    Create, run, monitor and debug Anthropic's Claude Managed Agents from inside Claude itself.

Browse all MCP connectorsClaude and ChatGPT setup guideBrowse AI skills

Product names and logos belong to their owners. Agentman is not affiliated with a connector's maker unless the page says the connector is built and run by Agentman.

Use it in an agent

Put Control Plane to work.

Connect Control Plane once and your agents call these tools on their own: on a schedule, in a workflow, with nobody at the keyboard.

Open in Agentman Studio
Call (650) 285-1019Our AI receptionist answers.