--- title: "CockroachDB Cloud MCP server for AI agents - actionlake" description: "Give Claude 161 CockroachDB Cloud actions through one MCP server: scim, metric export. Your agent never holds the credential. 100,000 calls a month free." canonical: https://actionlake.com/connectors/cockroachdb-cloud updated: 2026-10-23 --- Connectors · Developer & infrastructure # CockroachDB Cloud MCP server for AI agents. actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to CockroachDB Cloud and the rest of your systems. It gives your agent 161 CockroachDB Cloud actions (72 reads, 59 writes and 30 that wait for a confirmation) and holds the CockroachDB Cloud credential itself, so the agent never does. It paces CockroachDB Cloud's limits and records every call. [Connect CockroachDB Cloud free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) 100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you. `claude mcp add --transport http actionlake https://connect.actionlake.com/mcp` the first call ``` do { action: "cockroachdb_cloud.organizations.get_organization_info", intent: "check which CockroachDB Cloud account is connected" } # Get information about the caller's organization · read · 1 upstream call ``` - 161 actions in one signed file - 72 read look, never change - 59 write create and update - 30 wait for a yes destructive, confirmed first Set up ## Connect CockroachDB Cloud in three steps. 1. 01 ### Add actionlake to Claude. Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us. `https://connect.actionlake.com/mcp` 2. 02 ### Connect CockroachDB Cloud. Bearer token. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key. - `api_key` CockroachDB Cloud API key (secret key of a service account), sent as a Bearer token ``` account { op: "connections.requirements", service: "cockroachdb_cloud" } # free: exactly what to paste, and what is found for you ``` 3. 03 ### Make the first call. Check before a write. Ask in plain words; Claude picks the action. Before anything changes, `check` validates the call and prices it, for free. ``` do { action: "cockroachdb_cloud.organizations.get_organization_info" } # get information about the caller's organization · read · 1 upstream call check { action: "cockroachdb_cloud.clusters.create_cluster", input: { … } } # free: inputs, permissions, cost and confirmations, nothing sent ``` CockroachDB Cloud at a glance **Sign-in** Bearer token. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. **You provide** `api_key` **Limits we pace to** 10 calls a second, per connection **API covered** CockroachDB Cloud API 2026-09-15 (OpenAPI 3.0.0)`cockroachlabs.cloud` **Built from** CockroachDB Cloud's documentation, read 23 October 2026[cockroachlabs.cloud](https://cockroachlabs.cloud/assets/docs/api/latest/openapi.json) [cockroachlabs.com](https://www.cockroachlabs.com/docs/api/cloud/v1) **Service file** Version 1.0.0, signed (Ed25519) **Cached reads** 65 of 72 reads, for up to 5 minutes; a write clears what it affects **Shared entities** 3, so ask can line CockroachDB Cloud up with your other systems **Data** Processed and stored in Sydney, Australia. No US region yet Capabilities ## What an AI agent can do in CockroachDB Cloud. 161 actions in 29 areas. Every one carries its effect, so a key can allow the reads and hold the rest. - **72** read look, never change - **59** write create and update - **30** destructive wait for a confirmation 1. ### Scim 21 13 read · 6 write · 2 destructive List Users · List groups · Get a user by ID · Get a group by ID 2. ### Metric export 12 4 read · 4 write · 4 destructive Get the CloudWatch Metric Export configuration for a cluster · Get the Datadog Metric Export configuration for a cluster · Get the OTLP Metric Export configuration for a cluster · Get the Prometheus Metric Export configuration for a cluster 3. ### Clusters 11 6 read · 4 write · 1 destructive List clusters in the organization · Get extended information about a cluster · Create and initialize a new cluster · Create a virtual cluster in a workspace 4. ### Private endpoint services 11 5 read · 4 write · 2 destructive Add a connection to a cluster's private endpoint service · Add a private endpoint trusted owner to a cluster · Create all PrivateEndpointServices for a cluster · List all AwsEndpointConnections for a cluster 5. ### Service accounts 8 3 read · 3 write · 2 destructive List service accounts for an organization · Get a service account by ID · Create a service account · Create an OAuth credential for a service account 6. ### Backup restore 6 4 read · 2 write · 0 destructive Create a restore · List cluster backups · List restore jobs · Get the backup configuration for a cluster 7. ### Egress private endpoints 6 2 read · 3 write · 1 destructive Create an egress private endpoint · List egress private endpoints · Get egress private endpoint · Delete an egress private endpoint 8. ### Egress rules 6 2 read · 3 write · 1 destructive Add an egress rule · List all egress rules associated with a cluster · Get an existing egress rule · Outbound traffic management **21 more areas · 80 actions** - Folders **6** - Migration assistant **6** - Role management **6** - API keys **5** - Blackout windows **5** - Databases **5** - Ip allowlists **5** - JWT issuers **5** - Client ca certificates **4** - Customer managed encryption keys **4** - Physical cluster replication **4** - SQL users **4** - Billing **3** - Log export **3** - Maintenance windows **3** - Runtime scanning **3** - Virtual cluster workspaces **3** - Cluster disruption **2** - Version deferral **2** - Audit logs **1** - Organizations **1** Top actions ## The CockroachDB Cloud API, shaped for agents. The ids your agent types, what each does, and the one name it shares with other systems. 14 of CockroachDB Cloud's 14 action names are shared with at least one other connector, so an agent learns them once. | Action | What it does | Effect | Same name in | | --- | --- | --- | --- | | `cockroachdb_cloud.scim.get_users` List Users | List Users. | read | `identity.user.list` 474 connectors | | `cockroachdb_cloud.scim.get_groups` List groups | List groups. | read | `identity.group.list` 262 connectors | | `cockroachdb_cloud.service_accounts.list_service_accounts` List service accounts for an organization | List service accounts for an organization. | read | `identity.service_account.list` 35 connectors | | `cockroachdb_cloud.scim.get_user` Get a user by ID | Get a user by ID. | read | `identity.user.get` 399 connectors | | `cockroachdb_cloud.scim.get_group` Get a group by ID | Get a group by ID. | read | `identity.group.get` 212 connectors | | `cockroachdb_cloud.service_accounts.get_service_account` Get a service account by ID | Get a service account by ID. | read | `identity.service_account.get` 28 connectors | | `cockroachdb_cloud.api_keys.list_api_keys` List API Keys | List API Keys. | read | `identity.api_key.list` 96 connectors | | `cockroachdb_cloud.role_management.list_role_grants` List all RoleGrants | List all RoleGrants. | read | `identity.role_assignment.list` 41 connectors | | `cockroachdb_cloud.clusters.create_cluster` Create and initialize a new cluster | Create and initialize a new cluster. | write | this connector | | `cockroachdb_cloud.databases.create_database` Create a new database | Create a new database. | write | this connector | | `cockroachdb_cloud.sql_users.create_sql_user` Create a new SQL user | Create a new SQL user. | write | this connector | | `cockroachdb_cloud.clusters.delete_cluster` Delete a cluster and all of its data | Delete a cluster and all of its data. | destructive | this connector | Try it ## Prompts to paste into Claude. Each one names the CockroachDB Cloud actions it will call, so you know what it reads and what it changes before you send it. 1. Read read Who has access in CockroachDB Cloud? List every user and their role. calls `cockroachdb_cloud.scim.get_users` 2. Write write Create and initialize a new cluster in CockroachDB Cloud. Show me exactly what you will send before you save it. calls `cockroachdb_cloud.clusters.create_cluster` Governance for CockroachDB Cloud ## Destructive actions wait for a yes. 30 CockroachDB Cloud actions are destructive. These are all of them: - Delete a cluster and all of its data `cockroachdb_cloud.clusters.delete_cluster` - Delete a database `cockroachdb_cloud.databases.delete_database` - Delete a SQL user `cockroachdb_cloud.sql_users.delete_sql_user` - Delete an IP allowlist entry `cockroachdb_cloud.ip_allowlists.delete_allowlist_entry` - Delete a service account `cockroachdb_cloud.service_accounts.delete_service_account` - Delete a service account's OAuth credential `cockroachdb_cloud.service_accounts.delete_service_account_credential` - Delete a user based on ID `cockroachdb_cloud.scim.delete_user` - Delete a group based on ID `cockroachdb_cloud.scim.delete_group` - Delete a folder `cockroachdb_cloud.folders.delete_folder` - Delete an API Key `cockroachdb_cloud.api_keys.delete_api_key` - Delete the Log Export configuration for a cluster `cockroachdb_cloud.log_export.delete_log_export` - Delete a JWT Issuer `cockroachdb_cloud.jwt_issuers.delete_jwt_issuer` - Delete an existing egress rule `cockroachdb_cloud.egress_rules.delete_egress_rule` - Add a role to a user, service account, or group `cockroachdb_cloud.role_management.add_user_to_role` - Replace the roles for a user, service account, or group with exactly those provided `cockroachdb_cloud.role_management.set_roles_for_user` - Remove a role from a user, service account, or group `cockroachdb_cloud.role_management.remove_user_from_role` - Delete a blackout window for a cluster `cockroachdb_cloud.blackout_windows.delete_blackout_window` - Delete the OTLP Metric Export configuration for a cluster `cockroachdb_cloud.metric_export.delete_otlp_metric_export` - Delete the Datadog Metric Export configuration for a cluster `cockroachdb_cloud.metric_export.delete_datadog_metric_export` - Delete Client CA Cert for a cluster `cockroachdb_cloud.client_ca_certificates.delete_client_ca_cert` - Update disruption specifications for a cluster `cockroachdb_cloud.cluster_disruption.update_cluster_disruption` - Delete the maintenance window for a cluster `cockroachdb_cloud.maintenance_windows.delete_maintenance_window` - Disable Prometheus Metric Export for a cluster `cockroachdb_cloud.metric_export.delete_prometheus_metric_export` - Delete the CloudWatch Metric Export configuration for a cluster `cockroachdb_cloud.metric_export.delete_cloud_watch_metric_export` - Delete the Migration Assistant for a cluster `cockroachdb_cloud.migration_assistant.delete_migration_assistant` - Disable runtime scanning on a cluster `cockroachdb_cloud.runtime_scanning.disable_cluster_runtime_scanning` - Delete an egress private endpoint `cockroachdb_cloud.egress_private_endpoints.delete_egress_private_endpoint` - Delete a connection from a cluster's private endpoint service `cockroachdb_cloud.private_endpoint_services.delete_private_endpoint_connection` - Delete the source-database CA certificate for a cluster's Migration Assistant `cockroachdb_cloud.migration_assistant.delete_migration_assistant_source_ca_cert` - Remove a private endpoint trusted owner from a cluster `cockroachdb_cloud.private_endpoint_services.remove_private_endpoint_trusted_owner` A destructive action runs only with `confirm: true`. Under the `human` policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after. do cockroachdb_cloud.clusters.delete_cluster confirm_policy: **human** Delete a cluster and all of its data? **intent:** the user asked me to delete a cluster and all of its data run suspended · waiting for a named person · key _cockroachdb-cloud-agent_ cannot confirm itself In the console, or from an emailed signed link. a key for this connector ``` account { op: "keys.create", name: "cockroachdb-cloud-agent", allowed_actions: ["cockroachdb_cloud.*"], cap_calls: 2000, confirm_policy: "human_for_writes", approval_rules: [ { match: "cockroachdb_cloud.clusters.delete_cluster", approver: "lead@example.com" }, { match: "cockroachdb_cloud.databases.delete_database", approver: "lead@example.com" }, { match: "cockroachdb_cloud.sql_users.delete_sql_user", approver: "lead@example.com" } ] } ``` Illustrative. Scoped to CockroachDB Cloud only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person. Cost ## What CockroachDB Cloud costs on actionlake. Every CockroachDB Cloud action is one upstream call, the only thing actionlake bills. Searching, `check`, `cost`, `account` and any call CockroachDB Cloud refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. - 1 upstream call per action all 161 CockroachDB Cloud actions - 161 actions page each page of a long list is one call - 65 reads can be cached a cache hit costs nothing - 100,000 calls a month, free paid plans from US$49 a month for 250,000 [See pricing](https://actionlake.com/pricing) Action index ## Every CockroachDB Cloud action. 161 actions by area: the id your agent calls, what it does, and its effect. **Scim 21** - `cockroachdb_cloud.scim.create_group` Create a group write - `cockroachdb_cloud.scim.create_user` Create a user write - `cockroachdb_cloud.scim.delete_group` Delete a group based on ID destructive - `cockroachdb_cloud.scim.delete_user` Delete a user based on ID destructive - `cockroachdb_cloud.scim.get_group` Get a group by ID read - `cockroachdb_cloud.scim.get_groups` List groups read - `cockroachdb_cloud.scim.get_resource_type` Get a SCIM resource type by ID read - `cockroachdb_cloud.scim.get_resource_types` List the SCIM resource types read - `cockroachdb_cloud.scim.get_schema` Get a SCIM schema by ID read - `cockroachdb_cloud.scim.get_schemas` List the SCIM schemas read - `cockroachdb_cloud.scim.get_service_provider_config` Return the SCIM Service Provider configuration read - `cockroachdb_cloud.scim.get_user` Get a user by ID read - `cockroachdb_cloud.scim.get_users` List Users read - `cockroachdb_cloud.scim.patch_group` Patch a group by supplying partial updates write - `cockroachdb_cloud.scim.patch_user` Patch a user by supplying partial updates write - `cockroachdb_cloud.scim.search_group` Search a group by ID read - `cockroachdb_cloud.scim.search_groups` Search groups read - `cockroachdb_cloud.scim.search_user` Search for a user by ID read - `cockroachdb_cloud.scim.search_users` Search Users read - `cockroachdb_cloud.scim.update_group` Update a group by supplying all values of the user object write - `cockroachdb_cloud.scim.update_user` Update a user by supplying all values of the user object write **Metric export 12** - `cockroachdb_cloud.metric_export.delete_cloud_watch_metric_export` Delete the CloudWatch Metric Export configuration for a cluster destructive - `cockroachdb_cloud.metric_export.delete_datadog_metric_export` Delete the Datadog Metric Export configuration for a cluster destructive - `cockroachdb_cloud.metric_export.delete_otlp_metric_export` Delete the OTLP Metric Export configuration for a cluster destructive - `cockroachdb_cloud.metric_export.delete_prometheus_metric_export` Disable Prometheus Metric Export for a cluster destructive - `cockroachdb_cloud.metric_export.enable_cloud_watch_metric_export` Create or update the CloudWatch Metric Export configuration for a cluster write - `cockroachdb_cloud.metric_export.enable_datadog_metric_export` Create or update the Datadog Metric Export configuration for a cluster write - `cockroachdb_cloud.metric_export.enable_otlp_metric_export` Create or update the OTLP Metric Export configuration for a cluster write - `cockroachdb_cloud.metric_export.enable_prometheus_metric_export` Enable Prometheus Metric Export for a cluster write - `cockroachdb_cloud.metric_export.get_cloud_watch_metric_export_info` Get the CloudWatch Metric Export configuration for a cluster read - `cockroachdb_cloud.metric_export.get_datadog_metric_export_info` Get the Datadog Metric Export configuration for a cluster read - `cockroachdb_cloud.metric_export.get_otlp_metric_export_info` Get the OTLP Metric Export configuration for a cluster read - `cockroachdb_cloud.metric_export.get_prometheus_metric_export_info` Get the Prometheus Metric Export configuration for a cluster read **Clusters 11** - `cockroachdb_cloud.clusters.create_cluster` Create and initialize a new cluster write - `cockroachdb_cloud.clusters.create_virtual_cluster` Create a virtual cluster in a workspace write - `cockroachdb_cloud.clusters.delete_cluster` Delete a cluster and all of its data destructive - `cockroachdb_cloud.clusters.get_cluster` Get extended information about a cluster read - `cockroachdb_cloud.clusters.get_connection_string` Get a formatted generic connection string for a cluster read - `cockroachdb_cloud.clusters.list_available_regions` List the regions available for new clusters and nodes read - `cockroachdb_cloud.clusters.list_cluster_nodes` List nodes for a cluster read - `cockroachdb_cloud.clusters.list_clusters` List clusters in the organization read - `cockroachdb_cloud.clusters.list_major_cluster_versions` List available major cluster versions read - `cockroachdb_cloud.clusters.update_cluster` Scale, edit or upgrade a cluster write - `cockroachdb_cloud.clusters.update_virtual_cluster` Update a specific virtual cluster write **Private endpoint services 11** - `cockroachdb_cloud.private_endpoint_services.add_private_endpoint_connection` Add a connection to a cluster's private endpoint service write - `cockroachdb_cloud.private_endpoint_services.add_private_endpoint_trusted_owner` Add a private endpoint trusted owner to a cluster write - `cockroachdb_cloud.private_endpoint_services.create_private_endpoint_services` Create all PrivateEndpointServices for a cluster write - `cockroachdb_cloud.private_endpoint_services.delete_private_endpoint_connection` Delete a connection from a cluster's private endpoint service destructive - `cockroachdb_cloud.private_endpoint_services.get_private_endpoint_trusted_owner` Get a private endpoint trusted owner entry for a cluster read - `cockroachdb_cloud.private_endpoint_services.list_aws_endpoint_connections` List all AwsEndpointConnections for a cluster read - `cockroachdb_cloud.private_endpoint_services.list_private_endpoint_connections` List all connections to a cluster's private endpoint service read - `cockroachdb_cloud.private_endpoint_services.list_private_endpoint_services` List all PrivateEndpointServices for a cluster read - `cockroachdb_cloud.private_endpoint_services.list_private_endpoint_trusted_owners` List all private endpoint trusted owners for a cluster read - `cockroachdb_cloud.private_endpoint_services.remove_private_endpoint_trusted_owner` Remove a private endpoint trusted owner from a cluster destructive - `cockroachdb_cloud.private_endpoint_services.set_aws_endpoint_connection_state` Set the AWS Endpoint Connection state write **Service accounts 8** - `cockroachdb_cloud.service_accounts.create_service_account` Create a service account write - `cockroachdb_cloud.service_accounts.create_service_account_credential` Create an OAuth credential for a service account write - `cockroachdb_cloud.service_accounts.delete_service_account` Delete a service account destructive - `cockroachdb_cloud.service_accounts.delete_service_account_credential` Delete a service account's OAuth credential destructive - `cockroachdb_cloud.service_accounts.get_service_account` Get a service account by ID read - `cockroachdb_cloud.service_accounts.list_service_account_credentials` List a service account's OAuth credentials read - `cockroachdb_cloud.service_accounts.list_service_accounts` List service accounts for an organization read - `cockroachdb_cloud.service_accounts.update_service_account` Update a service account write **Backup restore 6** - `cockroachdb_cloud.backup_restore.create_restore` Create a restore write - `cockroachdb_cloud.backup_restore.get_backup_configuration` Get the backup configuration for a cluster read - `cockroachdb_cloud.backup_restore.get_restore` View a restore job read - `cockroachdb_cloud.backup_restore.list_backups` List cluster backups read - `cockroachdb_cloud.backup_restore.list_restores` List restore jobs read - `cockroachdb_cloud.backup_restore.update_backup_configuration` Update the backup configuration for a cluster write **Egress private endpoints 6** - `cockroachdb_cloud.egress_private_endpoints.create_egress_private_endpoint` Create an egress private endpoint write - `cockroachdb_cloud.egress_private_endpoints.delete_egress_private_endpoint` Delete an egress private endpoint destructive - `cockroachdb_cloud.egress_private_endpoints.get_egress_private_endpoint` Get egress private endpoint read - `cockroachdb_cloud.egress_private_endpoints.list_egress_private_endpoints` List egress private endpoints read - `cockroachdb_cloud.egress_private_endpoints.update_egress_private_endpoint` Update egress private endpoint write - `cockroachdb_cloud.egress_private_endpoints.update_egress_private_endpoint_domain_names` Update egress private endpoint domain names. This endpoint is deprecated in favor of PATCH /api/v1/clusters/{cluster_id} write **Egress rules 6** - `cockroachdb_cloud.egress_rules.add_egress_rule` Add an egress rule write - `cockroachdb_cloud.egress_rules.delete_egress_rule` Delete an existing egress rule destructive - `cockroachdb_cloud.egress_rules.edit_egress_rule` Edit an existing egress rule write - `cockroachdb_cloud.egress_rules.get_egress_rule` Get an existing egress rule read - `cockroachdb_cloud.egress_rules.list_egress_rules` List all egress rules associated with a cluster read - `cockroachdb_cloud.egress_rules.set_egress_traffic_policy` Outbound traffic management write **Folders 6** - `cockroachdb_cloud.folders.create_folder` Create a folder write - `cockroachdb_cloud.folders.delete_folder` Delete a folder destructive - `cockroachdb_cloud.folders.get_folder` Get folder info for a folder read - `cockroachdb_cloud.folders.list_folder_contents` List contents of a folder read - `cockroachdb_cloud.folders.list_folders` List folders owned by an organization read - `cockroachdb_cloud.folders.update_folder` Update a folder write **Migration assistant 6** - `cockroachdb_cloud.migration_assistant.create_migration_assistant` Provision a Migration Assistant for a cluster write - `cockroachdb_cloud.migration_assistant.delete_migration_assistant` Delete the Migration Assistant for a cluster destructive - `cockroachdb_cloud.migration_assistant.delete_migration_assistant_source_ca_cert` Delete the source-database CA certificate for a cluster's Migration Assistant destructive - `cockroachdb_cloud.migration_assistant.get_migration_assistant` Get the Migration Assistant for a cluster read - `cockroachdb_cloud.migration_assistant.get_migration_assistant_source_ca_cert` Get the source-database CA certificate for a cluster's Migration Assistant read - `cockroachdb_cloud.migration_assistant.update_migration_assistant_source_ca_cert` Update the source-database CA certificate for a cluster's Migration Assistant write **Role management 6** - `cockroachdb_cloud.role_management.add_user_to_role` Add a role to a user, service account, or group destructive - `cockroachdb_cloud.role_management.get_all_roles_for_user` Get all role grants for a user, service account, or group read - `cockroachdb_cloud.role_management.get_person_users_by_email` Search person users by email address read - `cockroachdb_cloud.role_management.list_role_grants` List all RoleGrants read - `cockroachdb_cloud.role_management.remove_user_from_role` Remove a role from a user, service account, or group destructive - `cockroachdb_cloud.role_management.set_roles_for_user` Replace the roles for a user, service account, or group with exactly those provided destructive **API keys 5** - `cockroachdb_cloud.api_keys.create_api_key` Create a new API Key write - `cockroachdb_cloud.api_keys.delete_api_key` Delete an API Key destructive - `cockroachdb_cloud.api_keys.get_api_key` Get an API Key by ID read - `cockroachdb_cloud.api_keys.list_api_keys` List API Keys read - `cockroachdb_cloud.api_keys.update_api_key` Update an API Key write **Blackout windows 5** - `cockroachdb_cloud.blackout_windows.create_blackout_window` Create a blackout window for a cluster write - `cockroachdb_cloud.blackout_windows.delete_blackout_window` Delete a blackout window for a cluster destructive - `cockroachdb_cloud.blackout_windows.get_blackout_window` Get a blackout window by its ID for a cluster read - `cockroachdb_cloud.blackout_windows.list_blackout_windows` List all blackout windows for a cluster read - `cockroachdb_cloud.blackout_windows.update_blackout_window` Update a blackout window for a cluster write **Databases 5** - `cockroachdb_cloud.databases.create_database` Create a new database write - `cockroachdb_cloud.databases.delete_database` Delete a database destructive - `cockroachdb_cloud.databases.edit_database` Update a database write - `cockroachdb_cloud.databases.edit_database_by_body` Update a database write - `cockroachdb_cloud.databases.list_databases` List databases for a cluster read **Ip allowlists 5** - `cockroachdb_cloud.ip_allowlists.add_allowlist_entry` Add a new CIDR address to the IP allowlist write - `cockroachdb_cloud.ip_allowlists.delete_allowlist_entry` Delete an IP allowlist entry destructive - `cockroachdb_cloud.ip_allowlists.list_allowlist_entries` Get the IP allowlist and propagation status for a cluster read - `cockroachdb_cloud.ip_allowlists.put_allowlist_entry` Add a new CIDR address to the IP allowlist write - `cockroachdb_cloud.ip_allowlists.update_allowlist_entry` Update an IP allowlist entry write **JWT issuers 5** - `cockroachdb_cloud.jwt_issuers.add_jwt_issuer` Add a JWT Issuer write - `cockroachdb_cloud.jwt_issuers.delete_jwt_issuer` Delete a JWT Issuer destructive - `cockroachdb_cloud.jwt_issuers.get_jwt_issuer` Get a JWT Issuer read - `cockroachdb_cloud.jwt_issuers.list_jwt_issuers` List all JWT Issuers read - `cockroachdb_cloud.jwt_issuers.update_jwt_issuer` Update a JWT Issuer write **Client ca certificates 4** - `cockroachdb_cloud.client_ca_certificates.delete_client_ca_cert` Delete Client CA Cert for a cluster destructive - `cockroachdb_cloud.client_ca_certificates.get_client_ca_cert` Get Client CA Cert information for a cluster read - `cockroachdb_cloud.client_ca_certificates.set_client_ca_cert` Set Client CA Cert for a cluster write - `cockroachdb_cloud.client_ca_certificates.update_client_ca_cert` Update Client CA Cert for a cluster write **Customer managed encryption keys 4** - `cockroachdb_cloud.customer_managed_encryption_keys.enable_cmek_spec` Enable CMEK for a cluster write - `cockroachdb_cloud.customer_managed_encryption_keys.get_cmek_cluster_info` Get CMEK-related information for a cluster read - `cockroachdb_cloud.customer_managed_encryption_keys.update_cmek_spec` Enable or update the CMEK spec for a cluster write - `cockroachdb_cloud.customer_managed_encryption_keys.update_cmek_status` Update the CMEK-related status for a cluster write **Physical cluster replication 4** - `cockroachdb_cloud.physical_cluster_replication.create_physical_replication_stream` Create a physical replication stream write - `cockroachdb_cloud.physical_cluster_replication.get_physical_replication_stream` Get a physical replication stream read - `cockroachdb_cloud.physical_cluster_replication.list_physical_replication_streams` List physical replication streams read - `cockroachdb_cloud.physical_cluster_replication.update_physical_replication_stream` Update a physical replication stream write **SQL users 4** - `cockroachdb_cloud.sql_users.create_sql_user` Create a new SQL user write - `cockroachdb_cloud.sql_users.delete_sql_user` Delete a SQL user destructive - `cockroachdb_cloud.sql_users.list_sql_users` List SQL users for a cluster read - `cockroachdb_cloud.sql_users.update_sql_user_password` Update a SQL user's password write **Billing 3** - `cockroachdb_cloud.billing.get_invoice` Get a specific invoice for an organization read - `cockroachdb_cloud.billing.list_invoice_daily_usage` List an invoice's daily usage breakdown read - `cockroachdb_cloud.billing.list_invoices` List invoices for a given organization read **Log export 3** - `cockroachdb_cloud.log_export.delete_log_export` Delete the Log Export configuration for a cluster destructive - `cockroachdb_cloud.log_export.enable_log_export` Create or update the Log Export configuration for a cluster write - `cockroachdb_cloud.log_export.get_log_export_info` Get the Log Export configuration for a cluster read **Maintenance windows 3** - `cockroachdb_cloud.maintenance_windows.delete_maintenance_window` Delete the maintenance window for a cluster destructive - `cockroachdb_cloud.maintenance_windows.get_maintenance_window` Get the maintenance window for a cluster read - `cockroachdb_cloud.maintenance_windows.set_maintenance_window` Set the maintenance window for a cluster write **Runtime scanning 3** - `cockroachdb_cloud.runtime_scanning.disable_cluster_runtime_scanning` Disable runtime scanning on a cluster destructive - `cockroachdb_cloud.runtime_scanning.enable_cluster_runtime_scanning` Enable runtime scanning on a cluster write - `cockroachdb_cloud.runtime_scanning.get_cluster_runtime_scanning` Get the runtime scanning status of a cluster read **Virtual cluster workspaces 3** - `cockroachdb_cloud.virtual_cluster_workspaces.get_virtual_cluster_workspace` Show details for a specific workspace read - `cockroachdb_cloud.virtual_cluster_workspaces.list_virtual_cluster_workspaces` List workspaces in the organization read - `cockroachdb_cloud.virtual_cluster_workspaces.update_virtual_cluster_workspace` Update the configuration of a specific workspace write **Cluster disruption 2** - `cockroachdb_cloud.cluster_disruption.get_cluster_disruption_info` Get disruption specifications for a cluster read - `cockroachdb_cloud.cluster_disruption.update_cluster_disruption` Update disruption specifications for a cluster destructive **Version deferral 2** - `cockroachdb_cloud.version_deferral.get_cluster_version_deferral` Get the version upgrade deferral policy for a cluster read - `cockroachdb_cloud.version_deferral.set_cluster_version_deferral` Set the version upgrade deferral policy for a cluster write **Audit logs 1** - `cockroachdb_cloud.audit_logs.list_audit_logs` List audit logs read **Organizations 1** - `cockroachdb_cloud.organizations.get_organization_info` Get information about the caller's organization read Questions ## The CockroachDB Cloud MCP server, answered. **Is there a CockroachDB Cloud MCP server for Claude?** Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 161 CockroachDB Cloud actions across scim, metric export, clusters and private endpoint services, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by CockroachDB Cloud. **What do I need to connect CockroachDB Cloud?** CockroachDB Cloud API key (secret key of a service account), sent as a Bearer token. The free call account { op: "connections.requirements", service: "cockroachdb_cloud" } lists exactly what to paste. **Can an AI agent delete or change things in CockroachDB Cloud?** Only if its key allows it, and only with an explicit confirmation. 30 CockroachDB Cloud actions are destructive, including delete a cluster and all of its data, delete a database and delete a SQL user. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it. **Will an AI agent use up my CockroachDB Cloud API limit?** actionlake paces every call to the limits in the CockroachDB Cloud service file: 10 calls a second per connection. Repeated reads are answered from cache (65 CockroachDB Cloud actions can be), which never reaches CockroachDB Cloud. **What does a CockroachDB Cloud action cost?** One upstream call, the only unit actionlake bills. A list that pages bills one call per page (161 CockroachDB Cloud actions page). Cache hits, searches, dry runs and calls CockroachDB Cloud refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. **Which CockroachDB Cloud API does it cover?** The CockroachDB Cloud API 2026-09-15 (OpenAPI 3.0.0) at cockroachlabs.cloud. It is built from CockroachDB Cloud's documentation as read on 23 October 2026. 161 actions in 29 areas, each one in the signed service file (version 1.0.0). **Does actionlake keep my CockroachDB Cloud data, and where?** actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your CockroachDB Cloud credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models. **Which AI clients can use it?** Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names. ## More connectors like CockroachDB Cloud Shares the most action names with - [MongoDB Atlas 10](https://actionlake.com/connectors/mongodb-atlas) - [Akamai Cloud (Linode) 6](https://actionlake.com/connectors/akamai-cloud-linode) - [Spacelift 4](https://actionlake.com/connectors/spacelift) - [Veeam Backup for Microsoft 365 4](https://actionlake.com/connectors/veeam-backup-for-microsoft-365) - [HCP Terraform 4](https://actionlake.com/connectors/hcp-terraform) - [Unleash 3](https://actionlake.com/connectors/unleash) Joins with, on shared entities - [Microsoft 365 Users 3](https://actionlake.com/connectors/microsoft-365-users) - [Rubrik Security Cloud 3](https://actionlake.com/connectors/rubrik-security-cloud) - [Hugging Face 3](https://actionlake.com/connectors/hugging-face) - [Mistral AI 3](https://actionlake.com/connectors/mistral-ai) - [Starburst Galaxy 3](https://actionlake.com/connectors/starburst-galaxy) - [Doppler 3](https://actionlake.com/connectors/doppler) Browse - [All Developer & infrastructure connectors](https://actionlake.com/connectors/category/developer-and-infrastructure) - [All connectors](https://actionlake.com/connectors) - [How actionlake compares](https://actionlake.com/compare) actionlake is independent. It is not made or endorsed by CockroachDB Cloud; the name is the vendor's own. Counts are from the CockroachDB Cloud service file, version 1.0.0. ## Give your agent CockroachDB Cloud today. [Connect CockroachDB Cloud free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free. --- Source: https://actionlake.com/connectors/cockroachdb-cloud More: https://actionlake.com/llms.txt