--- title: "Pulumi Cloud MCP server for AI agents - actionlake" description: "Give Claude 614 Pulumi Cloud actions through one MCP server: organizations, stacks. Your agent never holds the credential. 100,000 calls a month free." canonical: https://actionlake.com/connectors/pulumi-cloud updated: 2026-10-23 --- Connectors · Developer & infrastructure # Pulumi Cloud MCP server for AI agents. actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Pulumi Cloud and the rest of your systems. It gives your agent 614 Pulumi Cloud actions (318 reads, 221 writes and 75 that wait for a confirmation) and holds the Pulumi Cloud credential itself, so the agent never does. It paces Pulumi Cloud's limits and records every call. [Connect Pulumi Cloud free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) 100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you. `claude mcp add --transport http actionlake https://connect.actionlake.com/mcp` the first call ``` do { action: "pulumi_cloud.environments_esc.list", intent: "check which Pulumi Cloud account is connected" } # List environments (esc) · read · 1 upstream call ``` - 614 actions in one signed file - 318 read look, never change - 221 write create and update - 75 wait for a yes destructive, confirmed first Set up ## Connect Pulumi Cloud in three steps. 1. 01 ### Add actionlake to Claude. Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us. `https://connect.actionlake.com/mcp` 2. 02 ### Connect Pulumi Cloud. API key. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key. - `access_token` Pulumi access token ``` account { op: "connections.requirements", service: "pulumi_cloud" } # free: exactly what to paste, and what is found for you ``` 3. 03 ### Make the first call. Check before a write. Ask in plain words; Claude picks the action. Before anything changes, `check` validates the call and prices it, for free. ``` do { action: "pulumi_cloud.environments_esc.list" } # list environments (esc) · read · 1 upstream call check { action: "pulumi_cloud.organization_member.add", input: { … } } # free: inputs, permissions, cost and confirmations, nothing sent ``` Pulumi Cloud at a glance **Sign-in** API key. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. **You provide** `access_token` **Limits we pace to** 10 calls a second, per connection **API covered** Pulumi Cloud REST API (OpenAPI 3.0.3, info.version 1.0.0, 630 operations)`api.pulumi.com` **Built from** Pulumi Cloud's documentation, read 23 October 2026[api.pulumi.com](https://api.pulumi.com/api/openapi/pulumi-spec.json) [pulumi.com](https://www.pulumi.com/docs/pulumi-cloud/reference/cloud-rest-api/) **Service file** Version 1.0.0, signed (Ed25519) **Cached reads** 254 of 318 reads, for up to 5 minutes; a write clears what it affects **Shared entities** 2, so ask can line Pulumi Cloud up with your other systems **Data** Processed and stored in Sydney, Australia. No US region yet Capabilities ## What an AI agent can do in Pulumi Cloud. 614 actions in 15 areas. Every one carries its effect, so a key can allow the reads and hold the rest. - **318** read look, never change - **221** write create and update - **75** destructive wait for a confirmation 1. ### Organizations 155 76 read · 57 write · 22 destructive List organization members · Add organization member · Update organization member · Delete organization member 2. ### Stacks 119 51 read · 57 write · 11 destructive Get stack · Create coherence window subgroup · List downstream stack references · Record engine event batch (destroy) 3. ### Environments 108 64 read · 32 write · 12 destructive List environments (esc) · Create environment (esc/environments) · Delete environment (esc/environments) · List all environment tags (esc) 4. ### VCS integrations 49 26 read · 15 write · 8 destructive List all VCS integrations · List azure dev ops integrations · Initiate azure dev ops o auth · List azure dev ops organizations 5. ### Insights 48 29 read · 15 write · 4 destructive Create account · Scan account · Bulk create accounts · List accounts 6. ### Deployments 40 21 read · 15 write · 4 destructive List org deployments · Get deployment · Cancel deployment · Create API deployment handler V2 7. ### Registry 29 18 read · 6 write · 5 destructive List packages · List policy pack versions for registry · List policy packs · List policy packs (post) 8. ### Users 16 10 read · 3 write · 3 destructive Get current user · List user stacks · List git hub organization teams · List identity provider organizations **7 more areas · 50 actions** - AI agents **12** - Cloud setup **10** - Registry preview **10** - Neo **7** - Workflows **5** - Miscellaneous **4** - AI **2** Top actions ## The Pulumi Cloud API, shaped for agents. The ids your agent types, what each does, and the one name it shares with other systems. 25 of Pulumi Cloud's 25 action names are shared with at least one other connector, so an agent learns them once. | Action | What it does | Effect | Same name in | | --- | --- | --- | --- | | `pulumi_cloud.organization_members.list` List organization members | ListOrganizationMembers lists the members of an organization. | read | `identity.user.list` 474 connectors | | `pulumi_cloud.current_user.get` Get current user | Returns the authenticated user's profile information, including login name, display name, email, avatar URL, and organization memberships. | read | `identity.current_user.get` 307 connectors | | `pulumi_cloud.organization_member.add` Add organization member | Adds an existing Pulumi user to an organization with a built-in role. | write | `identity.user.create` 262 connectors | | `pulumi_cloud.roles_by_org_id_and_ux_purpose.list` List roles by org ID and UX purpose | Returns custom roles for an organization filtered by their UX purpose (e.g., 'organization', 'team', or 'token'). | read | `identity.role.list` 184 connectors | | `pulumi_cloud.role.create` Create role | Creates a new custom role for an organization. | write | `identity.role.create` 105 connectors | | `pulumi_cloud.org_token.create` Create org token | Generates a new access token scoped to the organization for use in CI/CD pipelines and automated workflows. | write | `identity.api_key.create` 100 connectors | | `pulumi_cloud.org_tokens.list` List org tokens | Retrieves the access tokens created for an organization. | read | `identity.api_key.list` 96 connectors | | `pulumi_cloud.audit_log_events_handler_v2.list` List audit log events handler V2 | Lists audit log events for an organization. | read | `identity.audit_event.list` 51 connectors | | `pulumi_cloud.environments_esc.list` List environments (esc) | ListEnvironments. | read | `devops.environment.list` 24 connectors | | `pulumi_cloud.org_invite.cancel` Cancel org invite | Cancels a pending organization invitation, reclaiming the seat it reserves in the organization. | destructive | `identity.invitation.delete` 23 connectors | | `pulumi_cloud.org_deployments.list` List org deployments | Returns a paginated list of all Pulumi Deployments executions across an organization, filtered to only include deployments for stacks the requesting user has… | read | `devops.deployment.list` 22 connectors | | `pulumi_cloud.environment_esc.create` Create environment (esc/environments) | CreateEnvironment. | write | `devops.environment.create` 18 connectors | Try it ## Prompts to paste into Claude. Each one names the Pulumi Cloud actions it will call, so you know what it reads and what it changes before you send it. 1. Read read Who has access in Pulumi Cloud? List every user and their role. calls `pulumi_cloud.organization_members.list` 2. Write write Add organization member in Pulumi Cloud. Show me exactly what you will send before you save it. calls `pulumi_cloud.organization_member.add` Governance for Pulumi Cloud ## Destructive actions wait for a yes. 75 Pulumi Cloud actions are destructive. The first 10: - Delete organization member `pulumi_cloud.organization_member.delete` - Delete role `pulumi_cloud.role.delete` - Delete org token `pulumi_cloud.org_token.delete` - Cancel org invite `pulumi_cloud.org_invite.cancel` - Delete environment (esc/environments) `pulumi_cloud.environment_esc.delete` - Cancel deployment `pulumi_cloud.deployment.cancel` - Delete stack `pulumi_cloud.stack.delete` - Delete gate `pulumi_cloud.gate.delete` - Delete team `pulumi_cloud.team.delete` - Delete account `pulumi_cloud.account.delete` A destructive action runs only with `confirm: true`. Under the `human` policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after. do pulumi_cloud.organization_member.delete confirm_policy: **human** Delete organization member? **intent:** the user asked me to delete organization member run suspended · waiting for a named person · key _pulumi-cloud-agent_ cannot confirm itself In the console, or from an emailed signed link. a key for this connector ``` account { op: "keys.create", name: "pulumi-cloud-agent", allowed_actions: ["pulumi_cloud.*"], cap_calls: 2000, confirm_policy: "human_for_writes", approval_rules: [ { match: "pulumi_cloud.organization_member.delete", approver: "lead@example.com" }, { match: "pulumi_cloud.role.delete", approver: "lead@example.com" }, { match: "pulumi_cloud.org_token.delete", approver: "lead@example.com" } ] } ``` Illustrative. Scoped to Pulumi Cloud only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person. Cost ## What Pulumi Cloud costs on actionlake. Every Pulumi Cloud action is one upstream call, the only thing actionlake bills. Searching, `check`, `cost`, `account` and any call Pulumi Cloud refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. - 1 upstream call per action all 614 Pulumi Cloud actions - 614 actions page each page of a long list is one call - 254 reads can be cached a cache hit costs nothing - 100,000 calls a month, free paid plans from US$49 a month for 250,000 [See pricing](https://actionlake.com/pricing) Action index ## Every Pulumi Cloud action. 614 actions by area: the id your agent calls, what it does, and its effect. **Organizations 155** - `pulumi_cloud.organization_member.add` Add organization member write - `pulumi_cloud.organization_member.delete` Delete organization member destructive - `pulumi_cloud.organization_member.update` Update organization member write - `pulumi_cloud.organization_members.list` List organization members read - `pulumi_cloud.all_organization_keys.disable` Disable all organization keys destructive - `pulumi_cloud.all_stacks.transfer` Transfer all stacks destructive - and 149 more in this area **Stacks 119** - `pulumi_cloud.coherence_window_subgroup.create` Create coherence window subgroup write - `pulumi_cloud.downstream_stack_references.list` List downstream stack references read - `pulumi_cloud.engine_event_batch_destroy.record` Record engine event batch (destroy) write - `pulumi_cloud.stack.get` Get stack read - `pulumi_cloud.coherence_window_subgroup.close` Close coherence window subgroup destructive - `pulumi_cloud.engine_event_batch_preview.record` Record engine event batch (preview) write - and 113 more in this area **Environments 108** - `pulumi_cloud.all_environment_tags_esc.list` List all environment tags (esc) read - `pulumi_cloud.environment_esc.create` Create environment (esc/environments) write - `pulumi_cloud.environment_esc.delete` Delete environment (esc/environments) destructive - `pulumi_cloud.environments_esc.list` List environments (esc) read - `pulumi_cloud.all_environment_tags_preview.list` List all environment tags (preview) read - `pulumi_cloud.anonymous_open_environment_esc.read` Read anonymous open environment (esc) read - and 102 more in this area **VCS integrations 49** - `pulumi_cloud.all_vcs_integrations.list` List all VCS integrations read - `pulumi_cloud.azure_dev_ops_integrations.list` List azure dev ops integrations read - `pulumi_cloud.azure_dev_ops_o_auth.initiate` Initiate azure dev ops o auth write - `pulumi_cloud.azure_dev_ops_organizations.list` List azure dev ops organizations read - `pulumi_cloud.azure_dev_ops_access_status.get` Get azure dev ops access status read - `pulumi_cloud.azure_dev_ops_integration.delete` Delete azure dev ops integration destructive - and 43 more in this area **Insights 48** - `pulumi_cloud.account.create` Create account write - `pulumi_cloud.account.scan` Scan account write - `pulumi_cloud.accounts.bulk_create` Bulk create accounts write - `pulumi_cloud.accounts.list` List accounts read - `pulumi_cloud.account.delete` Delete account destructive - `pulumi_cloud.account.head` Head account read - and 42 more in this area **Deployments 40** - `pulumi_cloud.api_deployment_handler_v2.create` Create API deployment handler V2 write - `pulumi_cloud.deployment.cancel` Cancel deployment destructive - `pulumi_cloud.deployment.get` Get deployment read - `pulumi_cloud.org_deployments.list` List org deployments read - `pulumi_cloud.deploy_usage_report.get` Get deploy usage report read - `pulumi_cloud.deployment_logs.get` Get deployment logs read - and 34 more in this area **Registry 29** - `pulumi_cloud.packages.list` List packages read - `pulumi_cloud.policy_pack_versions_for_registry.list` List policy pack versions for registry read - `pulumi_cloud.policy_packs.list` List policy packs read - `pulumi_cloud.policy_packs_post.list` List policy packs (post) read - `pulumi_cloud.package_docs.get` Get package docs read - `pulumi_cloud.package_examples.get` Get package examples read - and 23 more in this area **Users 16** - `pulumi_cloud.current_user.get` Get current user read - `pulumi_cloud.git_hub_organization_teams.list` List git hub organization teams read - `pulumi_cloud.identity_provider_organizations.list` List identity provider organizations read - `pulumi_cloud.user_stacks.list` List user stacks read - `pulumi_cloud.default_organization.get` Get default organization read - `pulumi_cloud.default_organization.update` Update default organization write - and 10 more in this area **AI agents 12** - `pulumi_cloud.agent_signup.claim` Claim write - `pulumi_cloud.agent_signup.create` Signup write - `pulumi_cloud.task_events.get` Get task events read - `pulumi_cloud.tasks.create` Create tasks write - `pulumi_cloud.agent_claim_status.get` Claim status read - `pulumi_cloud.agent_signup.challenge` Signup challenge read - and 6 more in this area **Cloud setup 10** - `pulumi_cloud.aws_setup.create` AWS setup write - `pulumi_cloud.aws_sso.initiate` AWSSSO initiate write - `pulumi_cloud.aws_sso_setup.create` AWSSSO setup write - `pulumi_cloud.azure_setup.create` Azure setup write - `pulumi_cloud.aws_sso_accounts.list` AWSSSO list accounts read - `pulumi_cloud.azure_accounts.list` Azure list accounts read - and 4 more in this area **Registry preview 10** - `pulumi_cloud.packages_preview.list` List packages (preview) read - `pulumi_cloud.publish_package_version_complete_preview.post` Post publish package version complete (preview) write - `pulumi_cloud.publish_package_version_preview.post` Post publish package version (preview) write - `pulumi_cloud.publish_template_version_complete_preview.post` Post publish template version complete (preview) write - `pulumi_cloud.package_version_preview.get` Get package version (preview) read - `pulumi_cloud.publish_package_version_preview.delete` Delete publish package version (preview) destructive - and 4 more in this area **Neo 7** - `pulumi_cloud.neo_member_usage_cap.update` Update neo member usage cap write - `pulumi_cloud.neo_member_usage_caps.list` List neo member usage caps read - `pulumi_cloud.neo_usage_cap.get` Get neo usage cap read - `pulumi_cloud.neo_usage_cap.update` Update neo usage cap write - `pulumi_cloud.neo_member_usage_cap.delete` Delete neo member usage cap destructive - `pulumi_cloud.neo_usage_cap.delete` Delete neo usage cap destructive - and 1 more in this area **Workflows 5** - `pulumi_cloud.agent_pool.get` Get agent pool read - `pulumi_cloud.org_agent_pool.create` Create org agent pool write - `pulumi_cloud.org_agent_pool.list` List org agent pool read - `pulumi_cloud.org_agent_pool.patch` Patch org agent pool write - `pulumi_cloud.org_agent_pool.delete` Delete org agent pool destructive **Miscellaneous 4** - `pulumi_cloud.capabilities.get` Capabilities read - `pulumi_cloud.cli_version.get` Version read - `pulumi_cloud.oauth_token.exchange` Token write - `pulumi_cloud.openapi_spec.get` Fetch rest specification read **AI 2** - `pulumi_cloud.ai_template.generate` AI template read - `pulumi_cloud.copilot_skill.run` Copilot skill read This index shows a sample of each area. All 614 actions, with their inputs and prices, are in the [catalogue](https://actionlake.com/console/catalogue), which a free sandbox key can search. Questions ## The Pulumi Cloud MCP server, answered. **Is there a Pulumi Cloud MCP server for Claude?** Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 614 Pulumi Cloud actions across organizations, stacks, environments and VCS integrations, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Pulumi Cloud. **What do I need to connect Pulumi Cloud?** Pulumi access token. The free call account { op: "connections.requirements", service: "pulumi_cloud" } lists exactly what to paste. **Can an AI agent delete or change things in Pulumi Cloud?** Only if its key allows it, and only with an explicit confirmation. 75 Pulumi Cloud actions are destructive, including delete organization member, delete role and delete org token. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it. **Will an AI agent use up my Pulumi Cloud API limit?** actionlake paces every call to the limits in the Pulumi Cloud service file: 10 calls a second per connection. Repeated reads are answered from cache (254 Pulumi Cloud actions can be), which never reaches Pulumi Cloud. **What does a Pulumi Cloud action cost?** One upstream call, the only unit actionlake bills. A list that pages bills one call per page (614 Pulumi Cloud actions page). Cache hits, searches, dry runs and calls Pulumi Cloud refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. **Which Pulumi Cloud API does it cover?** The Pulumi Cloud REST API (OpenAPI 3.0.3, info.version 1.0.0, 630 operations) at api.pulumi.com. It is built from Pulumi Cloud's documentation as read on 23 October 2026. 614 actions in 15 areas, each one in the signed service file (version 1.0.0). **Does actionlake keep my Pulumi Cloud data, and where?** actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Pulumi Cloud credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models. **Which AI clients can use it?** Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names. ## More connectors like Pulumi Cloud Shares the most action names with - [ClickHouse Cloud 14](https://actionlake.com/connectors/clickhouse-cloud) - [env zero (env0) 13](https://actionlake.com/connectors/env-zero-env0) - [Sumo Logic 12](https://actionlake.com/connectors/sumo-logic) - [Splunk Platform 11](https://actionlake.com/connectors/splunk-platform) - [Red Hat Quay / Quay.io 8](https://actionlake.com/connectors/red-hat-quay-quay-io) - [Spacelift 8](https://actionlake.com/connectors/spacelift) Joins with, on shared entities - [Rubrik Security Cloud 2](https://actionlake.com/connectors/rubrik-security-cloud) - [Cloudflare 2](https://actionlake.com/connectors/cloudflare) - [Databricks 2](https://actionlake.com/connectors/databricks) - [Delinea Secret Server 2](https://actionlake.com/connectors/delinea-secret-server) - [MuleSoft Anypoint Platform 2](https://actionlake.com/connectors/mulesoft-anypoint-platform) - [Docebo 2](https://actionlake.com/connectors/docebo) Browse - [All Developer & infrastructure connectors](https://actionlake.com/connectors/category/developer-and-infrastructure) - [All connectors](https://actionlake.com/connectors) - [How actionlake compares](https://actionlake.com/compare) actionlake is independent. It is not made or endorsed by Pulumi Cloud; the name is the vendor's own. Counts are from the Pulumi Cloud service file, version 1.0.0. ## Give your agent Pulumi Cloud today. [Connect Pulumi Cloud free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free. --- Source: https://actionlake.com/connectors/pulumi-cloud More: https://actionlake.com/llms.txt