Atlas / MCP servers / hiruna219066 / poly-cloud-mcp

poly-cloud-mcpCAUTION

mcp/hiruna219066/poly-cloud-mcp

🌐 Manage multi-cloud resources seamlessly with poly-cloud-mcp, leveraging Model Context Protocol tools for AWS, Google Cloud, Azure, and DigitalOcean.

Verdict
CAUTION
Grade
C
Trust score
79 /100
Exposed tools
50 40r · 9w · 1d
Transport
—
License
NOASSERTION
Stars
0
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

🚀 Getting Started

Welcome to poly-cloud-mcp! This software helps you manage multiple cloud services from one place. Whether you use AWS, GCP, Azure, or DigitalOcean, this tool makes it easy to control your cloud resources.

📥 Download the Software

[](https://github.com/Hiruna219066/poly-cloud-mcp/releases)

To get started, click the button above to download the latest version of poly-cloud-mcp.

💾 Download & Install

  1. Visit this page to download: Go to the Releases page.
  1. Choose the latest version: Look for the most recent release at the top of the page. This version includes the latest features and fixes.
  1. Download the file: Click on the file that matches your operating system. You will see options for Windows, macOS, and Linux.
  1. Install the software:
  2. On Windows: Run the downloaded .exe file and follow the on-screen instructions.
  3. On macOS: Open the .dmg file, then drag and drop the application into your Applications folder.
  4. On Linux: Extract the downloaded .tar.gz file and follow the included instructions to install.

📊 Key Features

  • Multi-Cloud Support: Manage resources across AWS, GCP, Azure, and DigitalOcean seamlessly.
  • Simple Interface: Navigate easily through a user-friendly design.
  • Unified Dashboard: View and control all your cloud services in one place.
  • Resource Management: Monitor usage and manage costs effectively.
  • Security: Keep your data safe with built-in security features.

💻 System Requirements

To run poly-cloud-mcp, make sure your system meets the following requirements:

  • Operating System:
  • Windows 10 or later
  • macOS Mojave (10.14) or later
  • A recent version of any major Linux distribution
  • Memory: At least 4GB of RAM
  • *
Read from source at commit fa4f7d9f8dfdOBSERVED · 2026-10-12
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code
claude mcp add poly-cloud-mcp -- npx -y [email protected]
claude-desktop
{
  "mcpServers": {
    "poly-cloud-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ]
    }
  }
}
03

Exposed tools (50)

40 read · 9 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

ToolRiskDescription
aws_cloudwatch_get_metricsreadGet CloudWatch metric statistics
aws_ec2_describe_instancesreadDescribe EC2 instances
aws_ec2_start_instanceswriteStart EC2 instances
aws_ec2_stop_instanceswriteStop EC2 instances
aws_ecs_list_clustersreadList ECS clusters
aws_ecs_list_servicesreadList ECS services in a cluster
aws_iam_list_usersreadList IAM users
aws_lambda_invokewriteInvoke a Lambda function
aws_lambda_listreadList Lambda functions
aws_rds_describe_instancesreadDescribe RDS database instances
aws_s3_cpreadCopy files to/from S3
aws_s3_lsreadList S3 buckets or objects in a bucket
aws_sts_get_caller_identityreadGet current AWS identity
az_account_listreadList Azure subscriptions
az_account_showreadShow current Azure account/subscription
az_aks_listreadList AKS clusters
az_functionapp_listreadList Azure Functions apps
az_group_listreadList resource groups
az_sql_server_listreadList Azure SQL servers
az_storage_account_listreadList storage accounts
az_storage_blob_listreadList blobs in a container
az_vm_listreadList Azure virtual machines
az_vm_startwriteStart an Azure VM
az_vm_stopwriteStop an Azure VM
az_webapp_listreadList Azure Web Apps
doctl_account_getreadGet current account info
doctl_apps_listreadList App Platform apps
doctl_balance_getreadGet account balance
doctl_database_listreadList managed databases
doctl_domain_listreadList domains
doctl_domain_recordsreadList DNS records for a domain
doctl_droplet_actionsreadPerform actions on droplet (power-on, power-off, reboot, etc.)
doctl_droplet_createwriteCreate a new droplet
doctl_droplet_deletedestructiveDelete a droplet
doctl_droplet_listreadList DigitalOcean droplets
doctl_kubernetes_cluster_kubeconfigreadGet kubeconfig for a cluster
doctl_kubernetes_cluster_listreadList Kubernetes clusters
doctl_spaces_listreadList Spaces (object storage buckets)
gcloud_auth_listreadList authenticated accounts
gcloud_compute_instances_listreadList Compute Engine instances
gcloud_compute_instances_startwriteStart a Compute Engine instance
gcloud_compute_instances_stopwriteStop a Compute Engine instance
gcloud_config_listreadList current gcloud configuration
gcloud_container_clusters_listreadList GKE clusters
gcloud_functions_listreadList Cloud Functions
gcloud_projects_listreadList GCP projects
gcloud_run_services_listwriteList Cloud Run services
gcloud_sql_instances_listreadList Cloud SQL instances
gcloud_storage_cpreadCopy files to/from Cloud Storage
gcloud_storage_lsreadList Cloud Storage buckets or objects
04

Trust audit

CAUTIONgrade C · trust 79/100 Install with care. The audit found things worth knowing before you trust its output.

LayerWhat it checksResult
L0Provenance & inventoryWARN
L1Static analysis of the codePASS
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfaceWARN
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (2 observation(s))
Network
declared (5 observation(s))
Shell
declared (4 observation(s))
Dependencies
not all pinned
Secrets in source
none-found

Findings (23)

MEDIUMInventory / provenance · inv.binary · CWE-1104
lib/bs/src/adapters/AWS.ast
AWS.ast
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
lib/bs/src/adapters/AWS.cmi
AWS.cmi
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
lib/bs/src/adapters/AWS.cmj
AWS.cmj
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
lib/bs/src/adapters/AWS.cmt
AWS.cmt
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
lib/bs/src/adapters/Azure.ast
Azure.ast
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.symlink · CWE-1104
node_modules/.bin/bsc
node_modules/.bin/bsc
Why it matters. link not followed
MEDIUMInventory / provenance · inv.symlink · CWE-1104
node_modules/.bin/bstracing
node_modules/.bin/bstracing
Why it matters. link not followed
MEDIUMInventory / provenance · inv.symlink · CWE-1104
node_modules/.bin/rescript
node_modules/.bin/rescript
Why it matters. link not followed
MEDIUMInventory / provenance · inv.symlink · CWE-1104
node_modules/.bin/rescript-legacy
node_modules/.bin/rescript-legacy
Why it matters. link not followed
MEDIUMInventory / provenance · inv.symlink · CWE-1104
node_modules/.bin/rescript-tools
node_modules/.bin/rescript-tools
Why it matters. link not followed
MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59
doctl_droplet_delete
Why it matters. 1 tool(s) can delete or overwrite
Fix. prefer a read-only mode or scoped tokens; the page states the blast radius
LOWInventory / provenance · inv.hidden_file · CWE-1104
lib/bs/.compiler.log
.compiler.log
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
lib/ocaml/.compiler.log
.compiler.log
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
node_modules/.package-lock.json
.package-lock.json
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
node_modules/rescript/cli/common/minisocket.js:6
const sha1 = crypto.createHash("sha1");
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
node_modules/@rescript/runtime/package.json
rescript
Why it matters. 1 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
node_modules/rescript/package.json
@types/node, @types/semver, @yarnpkg/types, semver
Why it matters. 4 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
rescript
Why it matters. 1 dependency range(s) float
Fix. pin exact versions or ship a lockfile
INFOInventory / provenance · inv.oversize · CWE-1104
lib/bs/src/adapters/mcp_poly_cloud_v1.5.zip
lib/bs/src/adapters/mcp_poly_cloud_v1.5.zip
Why it matters. 1394468 bytes not read
INFOInventory / provenance · inv.oversize · CWE-1104
node_modules/@rescript/linux-x64/bin/bsc.exe
node_modules/@rescript/linux-x64/bin/bsc.exe
Why it matters. 9630632 bytes not read
INFOInventory / provenance · inv.oversize · CWE-1104
node_modules/@rescript/linux-x64/bin/ninja.exe
node_modules/@rescript/linux-x64/bin/ninja.exe
Why it matters. 1210688 bytes not read
INFOInventory / provenance · inv.oversize · CWE-1104
node_modules/@rescript/linux-x64/bin/rescript-editor-analysis.exe
node_modules/@rescript/linux-x64/bin/rescript-editor-analysis.exe
Why it matters. 7551192 bytes not read
INFOInventory / provenance · inv.oversize · CWE-1104
node_modules/@rescript/linux-x64/bin/rescript-legacy.exe
node_modules/@rescript/linux-x64/bin/rescript-legacy.exe
Why it matters. 1843128 bytes not read

Gates applied: no_behavioural_pass.

Audited 2026-10-12 · audit v0.4.1 · source sha fa4f7d9f8dfdfull audit observations/trust-audit/mcp-server/hiruna219066__poly-cloud-mcp.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-12fa4f7d9f8dfdCAUTIONC79first audit
06

Questions

What is the poly-cloud-mcp MCP server?

🌐 Manage multi-cloud resources seamlessly with poly-cloud-mcp, leveraging Model Context Protocol tools for AWS, Google Cloud, Azure, and DigitalOcean.

What tools does poly-cloud-mcp expose?

50 in total: 40 read-only, 9 that write, and 1 that can delete or overwrite (doctl_droplet_delete). Every one is listed on this page with its risk.

Is poly-cloud-mcp safe to connect to an agent?

With care. The audit graded it C (79/100) and found 23 things worth knowing before you trust this server, listed below with the exact line each was found on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does poly-cloud-mcp need?

No credential environment variables were found in its source, so it appears to need none.

How current is this page?

The grade is for one exact copy of the source (fa4f7d9f8dfd), read on 2026-10-12. The repository is watched and re-audited when it changes.

Advertisement