Skip to content
actionlake
Start free

Connectors · Developer & infrastructure

Pulumi Cloud MCP server for AI agents.

actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Pulumi Cloud and the rest of your systems. It gives your agent 614 Pulumi Cloud actions (318 reads, 221 writes and 75 that wait for a confirmation) and holds the Pulumi Cloud credential itself, so the agent never does. It paces Pulumi Cloud's limits and records every call.

Connect Pulumi Cloud freeSee pricing

100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.

claude mcp add --transport http actionlake https://connect.actionlake.com/mcp
the first call
do {  action: "pulumi_cloud.environments_esc.list",  intent: "check which Pulumi Cloud account is connected"}# List environments (esc) · read · 1 upstream call
  • 614actionsin one signed file
  • 318readlook, never change
  • 221writecreate and update
  • 75wait for a yesdestructive, confirmed first

Set up

Connect Pulumi Cloud in three steps.

  1. 01

    Add actionlake to Claude.

    Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.

    https://connect.actionlake.com/mcp
  2. 02

    Connect Pulumi Cloud.

    API key. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key.

    • access_tokenPulumi access token
    account { op: "connections.requirements", service: "pulumi_cloud" }
# free: exactly what to paste, and what is found for you
  3. 03

    Make the first call. Check before a write.

    Ask in plain words; Claude picks the action. Before anything changes, check validates the call and prices it, for free.

    do    { action: "pulumi_cloud.environments_esc.list" }# list environments (esc) · read · 1 upstream callcheck { action: "pulumi_cloud.organization_member.add", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent

Pulumi Cloud at a glance

Sign-in
API key. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead.
You provide
access_token
Limits we pace to
10 calls a second, per connection
API covered
Pulumi Cloud REST API (OpenAPI 3.0.3, info.version 1.0.0, 630 operations)api.pulumi.com
Built from
Pulumi Cloud's documentation, read 23 October 2026api.pulumi.compulumi.com
Service file
Version 1.0.0, signed (Ed25519)
Cached reads
254 of 318 reads, for up to 5 minutes; a write clears what it affects
Shared entities
2, so ask can line Pulumi Cloud up with your other systems
Data
Processed and stored in Sydney, Australia. No US region yet

Capabilities

What an AI agent can do in Pulumi Cloud.

614 actions in 15 areas. Every one carries its effect, so a key can allow the reads and hold the rest.

  • 318readlook, never change
  • 221writecreate and update
  • 75destructivewait for a confirmation

  1. Organizations

    155

    76 read · 57 write · 22 destructive

    List organization members · Add organization member · Update organization member · Delete organization member

  2. Stacks

    119

    51 read · 57 write · 11 destructive

    Get stack · Create coherence window subgroup · List downstream stack references · Record engine event batch (destroy)

  3. Environments

    108

    64 read · 32 write · 12 destructive

    List environments (esc) · Create environment (esc/environments) · Delete environment (esc/environments) · List all environment tags (esc)

  4. VCS integrations

    49

    26 read · 15 write · 8 destructive

    List all VCS integrations · List azure dev ops integrations · Initiate azure dev ops o auth · List azure dev ops organizations

  5. Insights

    48

    29 read · 15 write · 4 destructive

    Create account · Scan account · Bulk create accounts · List accounts

  6. Deployments

    40

    21 read · 15 write · 4 destructive

    List org deployments · Get deployment · Cancel deployment · Create API deployment handler V2

  7. Registry

    29

    18 read · 6 write · 5 destructive

    List packages · List policy pack versions for registry · List policy packs · List policy packs (post)

  8. Users

    16

    10 read · 3 write · 3 destructive

    Get current user · List user stacks · List git hub organization teams · List identity provider organizations

7 more areas · 50 actions
  • AI agents 12
  • Cloud setup 10
  • Registry preview 10
  • Neo 7
  • Workflows 5
  • Miscellaneous 4
  • AI 2

Top actions

The Pulumi Cloud API, shaped for agents.

The ids your agent types, what each does, and the one name it shares with other systems. 25 of Pulumi Cloud's 25 action names are shared with at least one other connector, so an agent learns them once.

ActionWhat it doesEffectSame name in
pulumi_cloud.organization_members.listList organization membersListOrganizationMembers lists the members of an organization.readidentity.user.list474 connectors
pulumi_cloud.current_user.getGet current userReturns the authenticated user's profile information, including login name, display name, email, avatar URL, and organization memberships.readidentity.current_user.get307 connectors
pulumi_cloud.organization_member.addAdd organization memberAdds an existing Pulumi user to an organization with a built-in role.writeidentity.user.create262 connectors
pulumi_cloud.roles_by_org_id_and_ux_purpose.listList roles by org ID and UX purposeReturns custom roles for an organization filtered by their UX purpose (e.g., 'organization', 'team', or 'token').readidentity.role.list184 connectors
pulumi_cloud.role.createCreate roleCreates a new custom role for an organization.writeidentity.role.create105 connectors
pulumi_cloud.org_token.createCreate org tokenGenerates a new access token scoped to the organization for use in CI/CD pipelines and automated workflows.writeidentity.api_key.create100 connectors
pulumi_cloud.org_tokens.listList org tokensRetrieves the access tokens created for an organization.readidentity.api_key.list96 connectors
pulumi_cloud.audit_log_events_handler_v2.listList audit log events handler V2Lists audit log events for an organization.readidentity.audit_event.list51 connectors
pulumi_cloud.environments_esc.listList environments (esc)ListEnvironments.readdevops.environment.list24 connectors
pulumi_cloud.org_invite.cancelCancel org inviteCancels a pending organization invitation, reclaiming the seat it reserves in the organization.destructiveidentity.invitation.delete23 connectors
pulumi_cloud.org_deployments.listList org deploymentsReturns a paginated list of all Pulumi Deployments executions across an organization, filtered to only include deployments for stacks the requesting user has…readdevops.deployment.list22 connectors
pulumi_cloud.environment_esc.createCreate environment (esc/environments)CreateEnvironment.writedevops.environment.create18 connectors

Try it

Prompts to paste into Claude.

Each one names the Pulumi Cloud actions it will call, so you know what it reads and what it changes before you send it.

  1. Readread

    Who has access in Pulumi Cloud? List every user and their role.

    callspulumi_cloud.organization_members.list

  2. Writewrite

    Add organization member in Pulumi Cloud. Show me exactly what you will send before you save it.

    callspulumi_cloud.organization_member.add

Governance for Pulumi Cloud

Destructive actions wait for a yes.

75 Pulumi Cloud actions are destructive. The first 10:

  • Delete organization memberpulumi_cloud.organization_member.delete
  • Delete rolepulumi_cloud.role.delete
  • Delete org tokenpulumi_cloud.org_token.delete
  • Cancel org invitepulumi_cloud.org_invite.cancel
  • Delete environment (esc/environments)pulumi_cloud.environment_esc.delete
  • Cancel deploymentpulumi_cloud.deployment.cancel
  • Delete stackpulumi_cloud.stack.delete
  • Delete gatepulumi_cloud.gate.delete
  • Delete teampulumi_cloud.team.delete
  • Delete accountpulumi_cloud.account.delete

A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.

dopulumi_cloud.organization_member.deleteconfirm_policy: human

Delete organization member?

intent: the user asked me to delete organization member

run suspended · waiting for a named person · key pulumi-cloud-agent cannot confirm itself
In the console, or from an emailed signed link.
a key for this connector
account {  op: "keys.create", name: "pulumi-cloud-agent",  allowed_actions: ["pulumi_cloud.*"], cap_calls: 2000,  confirm_policy: "human_for_writes",  approval_rules: [    { match: "pulumi_cloud.organization_member.delete", approver: "[email protected]" },    { match: "pulumi_cloud.role.delete", approver: "[email protected]" },    { match: "pulumi_cloud.org_token.delete", approver: "[email protected]" }  ]}
Illustrative. Scoped to Pulumi Cloud only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person.

Cost

What Pulumi Cloud costs on actionlake.

Every Pulumi Cloud action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call Pulumi Cloud refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

  • 1upstream call per actionall 614 Pulumi Cloud actions
  • 614actions pageeach page of a long list is one call
  • 254reads can be cacheda cache hit costs nothing
  • 100,000calls a month, freepaid plans from US$49 a month for 250,000

See pricing

Action index

Every Pulumi Cloud action.

614 actions by area: the id your agent calls, what it does, and its effect.

Organizations155
  • pulumi_cloud.organization_member.addAdd organization memberwrite
  • pulumi_cloud.organization_member.deleteDelete organization memberdestructive
  • pulumi_cloud.organization_member.updateUpdate organization memberwrite
  • pulumi_cloud.organization_members.listList organization membersread
  • pulumi_cloud.all_organization_keys.disableDisable all organization keysdestructive
  • pulumi_cloud.all_stacks.transferTransfer all stacksdestructive
  • and 149 more in this area
Stacks119
  • pulumi_cloud.coherence_window_subgroup.createCreate coherence window subgroupwrite
  • pulumi_cloud.downstream_stack_references.listList downstream stack referencesread
  • pulumi_cloud.engine_event_batch_destroy.recordRecord engine event batch (destroy)write
  • pulumi_cloud.stack.getGet stackread
  • pulumi_cloud.coherence_window_subgroup.closeClose coherence window subgroupdestructive
  • pulumi_cloud.engine_event_batch_preview.recordRecord engine event batch (preview)write
  • and 113 more in this area
Environments108
  • pulumi_cloud.all_environment_tags_esc.listList all environment tags (esc)read
  • pulumi_cloud.environment_esc.createCreate environment (esc/environments)write
  • pulumi_cloud.environment_esc.deleteDelete environment (esc/environments)destructive
  • pulumi_cloud.environments_esc.listList environments (esc)read
  • pulumi_cloud.all_environment_tags_preview.listList all environment tags (preview)read
  • pulumi_cloud.anonymous_open_environment_esc.readRead anonymous open environment (esc)read
  • and 102 more in this area
VCS integrations49
  • pulumi_cloud.all_vcs_integrations.listList all VCS integrationsread
  • pulumi_cloud.azure_dev_ops_integrations.listList azure dev ops integrationsread
  • pulumi_cloud.azure_dev_ops_o_auth.initiateInitiate azure dev ops o authwrite
  • pulumi_cloud.azure_dev_ops_organizations.listList azure dev ops organizationsread
  • pulumi_cloud.azure_dev_ops_access_status.getGet azure dev ops access statusread
  • pulumi_cloud.azure_dev_ops_integration.deleteDelete azure dev ops integrationdestructive
  • and 43 more in this area
Insights48
  • pulumi_cloud.account.createCreate accountwrite
  • pulumi_cloud.account.scanScan accountwrite
  • pulumi_cloud.accounts.bulk_createBulk create accountswrite
  • pulumi_cloud.accounts.listList accountsread
  • pulumi_cloud.account.deleteDelete accountdestructive
  • pulumi_cloud.account.headHead accountread
  • and 42 more in this area
Deployments40
  • pulumi_cloud.api_deployment_handler_v2.createCreate API deployment handler V2write
  • pulumi_cloud.deployment.cancelCancel deploymentdestructive
  • pulumi_cloud.deployment.getGet deploymentread
  • pulumi_cloud.org_deployments.listList org deploymentsread
  • pulumi_cloud.deploy_usage_report.getGet deploy usage reportread
  • pulumi_cloud.deployment_logs.getGet deployment logsread
  • and 34 more in this area
Registry29
  • pulumi_cloud.packages.listList packagesread
  • pulumi_cloud.policy_pack_versions_for_registry.listList policy pack versions for registryread
  • pulumi_cloud.policy_packs.listList policy packsread
  • pulumi_cloud.policy_packs_post.listList policy packs (post)read
  • pulumi_cloud.package_docs.getGet package docsread
  • pulumi_cloud.package_examples.getGet package examplesread
  • and 23 more in this area
Users16
  • pulumi_cloud.current_user.getGet current userread
  • pulumi_cloud.git_hub_organization_teams.listList git hub organization teamsread
  • pulumi_cloud.identity_provider_organizations.listList identity provider organizationsread
  • pulumi_cloud.user_stacks.listList user stacksread
  • pulumi_cloud.default_organization.getGet default organizationread
  • pulumi_cloud.default_organization.updateUpdate default organizationwrite
  • and 10 more in this area
AI agents12
  • pulumi_cloud.agent_signup.claimClaimwrite
  • pulumi_cloud.agent_signup.createSignupwrite
  • pulumi_cloud.task_events.getGet task eventsread
  • pulumi_cloud.tasks.createCreate taskswrite
  • pulumi_cloud.agent_claim_status.getClaim statusread
  • pulumi_cloud.agent_signup.challengeSignup challengeread
  • and 6 more in this area
Cloud setup10
  • pulumi_cloud.aws_setup.createAWS setupwrite
  • pulumi_cloud.aws_sso.initiateAWSSSO initiatewrite
  • pulumi_cloud.aws_sso_setup.createAWSSSO setupwrite
  • pulumi_cloud.azure_setup.createAzure setupwrite
  • pulumi_cloud.aws_sso_accounts.listAWSSSO list accountsread
  • pulumi_cloud.azure_accounts.listAzure list accountsread
  • and 4 more in this area
Registry preview10
  • pulumi_cloud.packages_preview.listList packages (preview)read
  • pulumi_cloud.publish_package_version_complete_preview.postPost publish package version complete (preview)write
  • pulumi_cloud.publish_package_version_preview.postPost publish package version (preview)write
  • pulumi_cloud.publish_template_version_complete_preview.postPost publish template version complete (preview)write
  • pulumi_cloud.package_version_preview.getGet package version (preview)read
  • pulumi_cloud.publish_package_version_preview.deleteDelete publish package version (preview)destructive
  • and 4 more in this area
Neo7
  • pulumi_cloud.neo_member_usage_cap.updateUpdate neo member usage capwrite
  • pulumi_cloud.neo_member_usage_caps.listList neo member usage capsread
  • pulumi_cloud.neo_usage_cap.getGet neo usage capread
  • pulumi_cloud.neo_usage_cap.updateUpdate neo usage capwrite
  • pulumi_cloud.neo_member_usage_cap.deleteDelete neo member usage capdestructive
  • pulumi_cloud.neo_usage_cap.deleteDelete neo usage capdestructive
  • and 1 more in this area
Workflows5
  • pulumi_cloud.agent_pool.getGet agent poolread
  • pulumi_cloud.org_agent_pool.createCreate org agent poolwrite
  • pulumi_cloud.org_agent_pool.listList org agent poolread
  • pulumi_cloud.org_agent_pool.patchPatch org agent poolwrite
  • pulumi_cloud.org_agent_pool.deleteDelete org agent pooldestructive
Miscellaneous4
  • pulumi_cloud.capabilities.getCapabilitiesread
  • pulumi_cloud.cli_version.getVersionread
  • pulumi_cloud.oauth_token.exchangeTokenwrite
  • pulumi_cloud.openapi_spec.getFetch rest specificationread
AI2
  • pulumi_cloud.ai_template.generateAI templateread
  • pulumi_cloud.copilot_skill.runCopilot skillread

This index shows a sample of each area. All 614 actions, with their inputs and prices, are in the catalogue, which a free sandbox key can search.

Questions

The Pulumi Cloud MCP server, answered.

Is there a Pulumi Cloud MCP server for Claude?

Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 614 Pulumi Cloud actions across organizations, stacks, environments and VCS integrations, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Pulumi Cloud.

What do I need to connect Pulumi Cloud?

Pulumi access token. The free call account { op: "connections.requirements", service: "pulumi_cloud" } lists exactly what to paste.

Can an AI agent delete or change things in Pulumi Cloud?

Only if its key allows it, and only with an explicit confirmation. 75 Pulumi Cloud actions are destructive, including delete organization member, delete role and delete org token. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.

Will an AI agent use up my Pulumi Cloud API limit?

actionlake paces every call to the limits in the Pulumi Cloud service file: 10 calls a second per connection. Repeated reads are answered from cache (254 Pulumi Cloud actions can be), which never reaches Pulumi Cloud.

What does a Pulumi Cloud action cost?

One upstream call, the only unit actionlake bills. A list that pages bills one call per page (614 Pulumi Cloud actions page). Cache hits, searches, dry runs and calls Pulumi Cloud refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

Which Pulumi Cloud API does it cover?

The Pulumi Cloud REST API (OpenAPI 3.0.3, info.version 1.0.0, 630 operations) at api.pulumi.com. It is built from Pulumi Cloud's documentation as read on 23 October 2026. 614 actions in 15 areas, each one in the signed service file (version 1.0.0).

Does actionlake keep my Pulumi Cloud data, and where?

actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Pulumi Cloud credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.

Which AI clients can use it?

Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.

More connectors like Pulumi Cloud

Shares the most action names with

Joins with, on shared entities

Browse

actionlake is independent. It is not made or endorsed by Pulumi Cloud; the name is the vendor's own. Counts are from the Pulumi Cloud service file, version 1.0.0.

Give your agent Pulumi Cloud today.

Connect Pulumi Cloud freeSee pricing

Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.