AceDataCloudMCPCAUTION
MCP server for managing your Ace Data Cloud account — services, pricing, APIs, docs, balance, usage, API keys, orders and announcements.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://pypi.org/project/mcp-acedatacloud/) [](https://www.python.org/downloads/) [](https://opensource.org/licenses/MIT) [](https://modelcontextprotocol.io)
A Model Context Protocol (MCP) server for managing your [AceDataCloud](https://platform.acedata.cloud?utm_source=github&utm_medium=referral&utm_campaign=evergreen&utm_content=acedatacloud_mcp_readme_platform) account through the platform management API.
Check your balance, look up usage and spend, manage API keys, list services, create and pay recharge orders, manage platform tokens, list models, and use account permissions to edit and publish blogs or announcements — directly from Claude, VS Code, Studio, or any MCP-compatible client.
This is the management / console API (platform.acedata.cloud) — different from the data-generation MCP servers (Suno, Midjourney, ...) that callapi.acedata.cloud.
Tool Reference
The default curated catalog advertises 347 tools before account-permission filtering, including acedatacloud_get_usage_guide. The complete compatibility registry retains 519 tools. Discovery is grouped by business task, not by one tool per REST endpoint.
ed0fc164d8d7OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mcp-acedatacloud --env ACEDATACLOUD_PLATFORM_TOKEN=${ACEDATACLOUD_PLATFORM_TOKEN} -- uvx mcp-acedatacloud==2026.6.28.0Exposed tools (57)
49 read · 7 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
acedatacloud_check_frame_ancestor | read | Check whether an origin may frame the login page. |
acedatacloud_create_platform_token | write | Create a new platform token (never expires). Requires ``confirm=true``. |
acedatacloud_delete_blog_post | destructive | Delete a blog and its translations. Requires blog:write; published posts also need blog:publish. |
acedatacloud_disable_x402_authorization | write | Disable the current authorization without revoking it on-chain. |
acedatacloud_enable_x402_authorization | write | Re-enable a valid current authorization. |
acedatacloud_get_access_request | read | Get one caller-visible access request. |
acedatacloud_get_api_spec | read | Get one API endpoint |
acedatacloud_get_application | read | Get one application and its service/pricing details. |
acedatacloud_get_auto_recharge | read | Get one auto-recharge configuration and its authoritative quote. |
acedatacloud_get_balance | read | Summarize your remaining credit balance across subscriptions. |
acedatacloud_get_blog_draft | write | Read the full editable source of a draft or published post. Requires blog:read. |
acedatacloud_get_credential | read | Get one credential with token/password values masked. |
acedatacloud_get_deployment_events | read | Get workload scheduling and image-pull events for a deployment. |
acedatacloud_get_deployment_status | read | Get live deployment status and redacted access metadata. |
acedatacloud_get_doc | read | Fetch one documentation page |
acedatacloud_get_invoice | read | Get one caller-owned invoice. |
acedatacloud_get_invoice_download | read | Get a short-lived signed invoice URL as JSON without following redirects. |
acedatacloud_get_model | read | Look up models by id/name (case-insensitive substring) with their credit |
acedatacloud_get_order | write | Get one caller-owned order in its authenticated detail representation. |
acedatacloud_get_order_invoice | write | Get the current active invoice linked to an order. |
acedatacloud_get_pricing | read | Get billing unit, free amount and display cost rules. Public contact-only |
acedatacloud_get_proxy_usage | read | Get one caller-authorized proxy usage record. |
acedatacloud_get_public_usage_packages | read | Get one service |
acedatacloud_get_service | read | Get one service |
acedatacloud_get_site | read | Get one site. |
acedatacloud_get_site_banner | read | return await _get(f |
acedatacloud_get_site_capability_override | read | return await _get(f |
acedatacloud_get_site_document_override | read | return await _get(f |
acedatacloud_get_site_domain | read | Get one custom domain and DNS instructions. |
acedatacloud_get_site_service_override | read | return await _get(f |
acedatacloud_get_survey | read | Get one active survey template. |
acedatacloud_get_survey_response | read | Get the caller |
acedatacloud_get_translation_capabilities | read | List models and fields that support automatic translation. |
acedatacloud_get_usage | read | Get one caller-authorized API usage record. |
acedatacloud_get_usage_guide | read | Get a guide for using the AceDataCloud platform management tools. |
acedatacloud_get_user_info | read | Get the current authenticated AceDataCloud account |
acedatacloud_get_wallet_summary | read | Get wallet binding, balance freshness, discounts, and visible ACE services. |
acedatacloud_get_x402_authorization | read | Get the caller |
acedatacloud_initialize_distribution | read | Initialize or refresh the caller |
acedatacloud_list_announcements | read | List published platform announcements (newest first). |
acedatacloud_list_billing_profiles | read | List caller-owned billing profiles used for invoice applications. |
acedatacloud_list_blog_comments | read | List private review threads, replies and resolution states. Requires blog:read. |
acedatacloud_list_coin_info | read | List the caller |
acedatacloud_list_datasets | read | List downloadable datasets (title, price, download/preview URLs). No token required. |
acedatacloud_list_distribution_levels | read | List public affiliate levels, thresholds, and reward percentages. |
acedatacloud_list_distributions | read | Show your referral/affiliate earnings: current status (level, total price, |
acedatacloud_list_email_preferences | read | List the caller |
acedatacloud_list_integrations | read | List third-party integrations (title, options, stage). No token required. |
acedatacloud_list_models | read | List the chat-completion models available on the platform (OpenAI-style). |
acedatacloud_list_platform_tokens | read | List your platform tokens (the credentials used to call this management API). Masked. |
acedatacloud_list_site_capability_overrides | read | return await _list_override( |
acedatacloud_list_site_document_overrides | read | return await _list_override( |
acedatacloud_list_site_service_overrides | read | return await _list_override( |
acedatacloud_list_surveys | read | List active survey templates available to the caller. |
acedatacloud_preview_invoice | read | Preview exact invoice amount and currency without creating an invoice. |
acedatacloud_unpublish_blog_post | write | Return a published blog post to draft. Requires blog:write and blog:publish. |
acedatacloud_withdraw_blog_approval | read | Withdraw a draft |
Trust audit
CAUTIONgrade B · trust 80/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (4 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- found
Findings (17)
gradle-wrapper.jar
logger.info(f"Revoked token: {token.token[:8]}...")callback_url = f"{settings.server_url}/oauth/callback""redirect_uri": callback_url,
callback_url = f"{settings.server_url}/oauth/callback""redirect_uri": callback_url,
await REGISTERED_TOOLS[name](domain="llm", api_key="secret-do-not-disclose")
acedatacloud_delete_blog_post
.ruff.toml
.vscodeignore
self._cipher = Fernet(base64.urlsafe_b64encode(bytes.fromhex(key)))
assert base64.b64decode(result["content_base64"]) == csv
content = base64.b64decode(body["content_base64"], validate=True)
| `acedatacloud_list_credentials_detail` | List credentials. Backend account permissions and ownership checks apply. | admin | credentials:read, credentials:write:any |
and does not read a production .env or execute endpoint handlers.
| `acedatacloud_list_credentials_detail` | List credentials. Backend account permissions and ownership checks apply. | admin | credentials:read, credentials:write:any |
and does not read a production .env or execute endpoint handlers.
Gates applied: no_behavioural_pass.
ed0fc164d8d7full audit observations/trust-audit/mcp-server/acedatacloud__acedatacloudmcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | ed0fc164d8d7 | CAUTION | B | 80 | first audit |
Questions
What is the AceDataCloudMCP MCP server?
MCP server for managing your Ace Data Cloud account — services, pricing, APIs, docs, balance, usage, API keys, orders and announcements.
What tools does AceDataCloudMCP expose?
57 in total: 49 read-only, 7 that write, and 1 that can delete or overwrite (acedatacloud_delete_blog_post). Every one is listed on this page with its risk.
Is AceDataCloudMCP safe to connect to an agent?
With care. The audit graded it B (80/100) and found 17 things worth knowing before you trust this server, listed below with the exact line each was found on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does AceDataCloudMCP need?
It reads ACEDATACLOUD_AUTH_BASE_URL, ACEDATACLOUD_OAUTH_CLIENT_ID, ACEDATACLOUD_PLATFORM_TOKEN, MCP_OAUTH_REDIS_PASSWORD, MCP_OAUTH_REDIS_URL and MCP_OAUTH_STATE_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does AceDataCloudMCP run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as mcp-acedatacloud at 0.3.0.
How current is this page?
The grade is for one exact copy of the source (ed0fc164d8d7), read on 2026-10-11. The repository is watched and re-audited when it changes.