Control Plane
Deploy, scale and delete cloud workloads across AWS, GCP and Azure from an AI agent. Anthropic lists 55 tools; Control Plane documents 132, including a container exec tool and a generic delete that removes any resource kind. OAuth with identity-only scopes.
Verified connector
Listed by Anthropic as a partner connector in its Connectors Directory.
Connection checked by Agentman on .
Anthropic states this reflects the level of review a connector received, not a security audit.
Connect Control Plane via MCP
https://mcp.cpln.io/mcpWorks in any MCP-compatible client. In Agentman Studio it is one click — no config file to edit.
Control Plane Tools & Capabilities (55)
Tool names from Anthropic's directory listing. This server requires sign-in, so we could not read tool descriptions or parameter schemas.
Limits
- No OAuth scope draws a boundary. The server's RFC 9728 descriptor advertises
scopes_supportedofopenidandoffline_access; the authorization server athttps://auth.cpln.ioadvertisesopenid,offlineandoffline_access. Both lists are identity and refresh-token claims. Nothing at the OAuth grant separates reading a workload from deleting one — the per-org consent screen and the toolset profile are the only boundaries. - The directory's 55 omits a destructive default-profile tool.
workload_execruns a command inside a running container and is markedcoreby Control Plane. Auditing the directory listing alone will miss it. - A raw-API dispatcher exists and we could not determine its state.
cpln_api_requestappears only in the plugin's generated manifest, marked conditional behind a kill switch and documented as bypassing typed-tool validation. We did not authenticate, so we cannot say whether it is advertised to your organization. If it is, the reachable surface is Control Plane's whole REST API rather than 132 tools. - Destructive confirmation is client-side, not server-side. Control Plane states plainly that destructive operations execute on a single call with no server-side preview or confirmation token, and that its guidance holds "even when host permissions are set to auto-approve". The protection is the MCP client's own write-action prompt plus prose the model is asked to follow.
- Every safety behaviour we found is documentation, not enforcement. The operating guide's rules — read before delete, present the blast radius, get a fresh approval for a cascade, redact secrets, reject credential-bearing prompts — are instructions to the model. We found no evidence of a server-side control that enforces any of them, and we did not test for one.
- The tool count is a URL parameter, not a property of the server. A page or audit that states "55 tools" describes one of four profiles. Check the endpoint URL your client is configured with before trusting any count.
- Spending is unobservable in the moment. Creating a GVC, workload, IP set or mk8s cluster provisions billable capacity, and Control Plane documents ongoing charges for reserved IPs, dedicated per-location load balancers, cross-zone traffic, cross-GVC egress and observability storage over 100GB. The surface has
list_quotasandget_quotabut no billing, spend or cost tool, so an agent can provision without any tool that could price it first. Control Plane publishes no per-call rate, and we found no documentation of idempotency keys on the create tools. - We could not read tool schemas or protocol safety annotations. The endpoint returned 401 to an anonymous request, so no parameter-level detail and no server-declared
destructiveHintis published here. The Read/Write/Destructive markers are Control Plane's documentation. - Control Plane's own tools reference is internally inconsistent by one row. The profile table states
fullholds 132 tools; the tables below it enumerate 131. The 132nd iscpln_api_request, which the manifest carries and the reference does not. - Service-account keys and agent bootstrap configs are shown once. Control Plane states they cannot be retrieved afterwards, and the only recovery is delete and regenerate.
get_agent_infois about Control Plane's network agents, not AI agents. The naming collides with MCP vocabulary; it reads a private-network connectivity agent's heartbeat.
Frequently asked questions
Yes, on the default profile. One tool named delete_resource removes a resource by kind and name, and Control Plane documents it as the single delete tool for every deletable kind. Deleting a GVC cascades to every workload and identity inside it. Control Plane states destructive operations execute on a single call with no server-side preview or confirmation token.
Yes, through a tool Anthropic's directory does not list. Control Plane's tools reference documents workload_exec, marked Destructive and available on the default core profile, which runs a single command in a running container and returns its output. It is the one core tool missing from the directory's 55, so a reader who audits only the directory listing will not see it.
132, and the number depends on a URL parameter. Control Plane's tools reference documents 30 tools on the readonly profile, 56 on core, 78 on mk8s and 132 on full, selected with the toolsets query parameter on the endpoint. Anthropic's directory lists 55, which is the core profile minus workload_exec.
Only identity claims. The server's RFC 9728 descriptor advertised scopes_supported of openid and offline_access on 2026-08-23, and its authorization server advertised openid, offline and offline_access. Neither names a Control Plane resource or verb, so no OAuth scope separates reading a workload from deleting one. The real boundary is the per-org consent screen.
No tool returns a secret value. Control Plane documents secrets as read-only through the MCP server: list_resources and get_resource show a secret exists and its metadata, never its data, and no tool creates, edits, deletes or reveals one. But create_cloud_account and update_cloud_account on the full profile change the bridge between Control Plane and your AWS, GCP or Azure account.
Connect to the readonly profile URL. Control Plane documents https://mcp.cpln.io/mcp?toolsets=readonly as a 30-tool set that advertises no tool which creates, updates, deletes or executes a command. The profile is fixed for the life of a connection and an agent cannot expand it mid-session, so reconnecting is the only way to change it.
The connector is not metered, but the resources it creates are. Creating a GVC, workload, mk8s cluster or IP set provisions real capacity across AWS, GCP, Azure or Hetzner, and Control Plane documents that reserved IP addresses must be explicitly released to prevent ongoing charges. The surface exposes list_quotas and get_quota but no billing or spend tool.
A Control Plane account and a decision about which orgs to authorize. Control Plane documents sign-in through Google, GitHub, Microsoft or SAML, followed by a consent screen where you pick the orgs the AI client may access. Its own guidance is to authorize only the orgs you need, because that consent is the connector's main access boundary.
Sources
- Control Plane Tools Reference, all 131 documented tools with Read/Write/Destructive markers and profiles (retrieved 2026-08-23, via the
.mdroute) · retrieved 2026-08-23 - Control Plane MCP Server documentation, toolset profiles and endpoint (retrieved 2026-08-23) · retrieved 2026-08-23
- Control Plane AI Tools overview, sign-in and per-org consent (retrieved 2026-08-23). The server's RFC 9728 descriptor nominates
docs.controlplane.com/mcp/overview, which serves this same page. · retrieved 2026-08-23 - Control Plane MCP usage examples (retrieved 2026-08-23) · retrieved 2026-08-23
- Control Plane Claude Web setup guide (retrieved 2026-08-23) · retrieved 2026-08-23
- Control Plane documentation corpus,
llms.txtindex andllms-full.txt(543,814 words) — · (retrieved 2026-08-23) · retrieved 2026-08-23 - Control Plane AI Plugin repository, generated tool manifest at
scripts/tools-manifest.json, operating guide atplugins/cpln/rules/cpln-guardrails.md, andSECURITY.md(MIT, commita8873a6, read 2026-08-23) · retrieved 2026-08-23 - Live OAuth posture check: anonymous initialize to
https://mcp.cpln.io/mcpreturned HTTP 401 withwww-authenticate: Bearer realm="https://mcp.cpln.io/mcp", resource_metadata="https://mcp.cpln.io/.well-known/oauth-protected-resource/mcp", scope="openid offline_access"; RFC 9728 descriptor and authorization server metadata athttps://auth.cpln.io/.well-known/oauth-authorization-server(2026-08-23) · retrieved 2026-08-23 docs.controlplane.com/robots.txtcarriesContent-Signal: ai-train=yes, search=yes, ai-input=yes— the publisher expressly permits AI synthesis of this content (retrieved 2026-08-23) · retrieved 2026-08-23- Anthropic Connectors Directory entry — , read from our directory snapshot dated 2026-08-23 · retrieved 2026-08-23
- Control Plane support — <mailto:support@controlplane.com> · Privacy
Use in Agentman
Connect once and your agents call these tools on their own — on a schedule, in a workflow, with nobody at the keyboard.
Open in Agentman StudioServer Info
- Category
- Developer Tools
- Developer
- Control Plane
- Tools
- 55
- Domain
- mcp.cpln.io
Using Claude Desktop or another MCP client? Setup docs — the connection URL above works anywhere.