Skip to main content

Security and Permissions

The CloudYali MCP server is read-only and cannot change anything. Not your budgets, not your recommendations, not your tags, not your account settings, and nothing at all in AWS, Azure or Google Cloud. Creating and editing budgets still happens in the portal, by a human, on purpose.

What it can read against what it can never change

Three layers enforce read-only​

The guarantee does not rest on the model behaving well. It is enforced in the code, three times over:

  1. The catalog. Write endpoints are not present in src/catalog.ts at all. There is nothing to call.
  2. A method allowlist. Only GET and read-style POST actions execute, and a POST entry must additionally carry readOnly: true. Some read operations are POSTs because they take a large filter body; those are the only POSTs that run.
  3. A path denylist. Account management, customer administration, user administration, sync, marketplace and provisioning endpoints are blocked regardless of method or readOnly flag.

The source is public and MIT-licensed at github.com/cloudyali/cloudyali-mcp-server, so you can read exactly which API call each of the 35 actions makes before you run it.

The caveat worth reading​

The read-only restriction lives in this client. The token it holds is a normal, full-privilege CloudYali user token.

So the guarantee protects you against the model taking a write action. It does not protect you against anyone who can read your credentials file. Treat ~/.cloudyali-mcp/credentials.json like a password.

It sees exactly what you see​

The server does not widen your permissions by a single row. It authenticates as you and inherits your CloudYali role. If you cannot see a linked cloud account in the console, the assistant cannot see it either. There is no service account, no shared key, and no elevated scope.

How sign-in works​

Sign-in is your normal CloudYali browser flow, with the same MFA and the same SSO.

  1. The login tool opens your browser to the console's authorize page.
  2. Your terminal prints a short verification code, and the browser page shows one too.
  3. Authorize only if the two match.

That code check is not decoration. Without it, another process on your machine could open a login page and wait for you to click through it. The code binds the page in front of you to the request your assistant actually made.

Tokens travel only in the URL fragment, to a listener on localhost. They never reach a remote server and never land in a server log.

Where credentials live​

Location~/.cloudyali-mcp/credentials.json (%USERPROFILE%\.cloudyali-mcp\credentials.json on Windows)
PermissionsMode 0600 on macOS and Linux; protected by your user profile's ACLs on Windows
ContentsA refresh token
RefreshAutomatic. You sign in again only when the refresh token itself expires.
OverrideCLOUDYALI_CREDS_DIR moves the directory; CLOUDYALI_JWT bypasses the file entirely

The credential is created on your machine and stays there. It is never sent to CloudYali beyond the normal token exchange, and it is never written to a log.

To sign out, delete the credentials file. To rotate, delete it and run login again.

What leaves your machine​

Two flows, and it is worth being precise about both.

To CloudYali. The server calls the CloudYali API over HTTPS with your token, exactly as the console does. Nothing new is shared.

To your AI assistant. The results are handed to whichever assistant you pointed at the server, so they fall under that assistant's own data handling policy, the same as anything else you put in front of it. CloudYali adds no sharing of its own, but this is the question worth answering for yourself before you install it: your cost data will pass through the model you are using.

If that matters in your environment, the answer is the same as for any other data you put in that assistant: check the vendor's retention and training terms, and prefer a client with the terms you need.

Headless use​

Set CLOUDYALI_JWT to a Cognito access token to skip the browser flow. This is meant for CI and other non-interactive contexts. The same read-only enforcement applies. Treat the token like any other secret and inject it from your secret store rather than a checked-in file.

Where write access stands​

There is no write path today, and that is deliberate rather than unfinished. An AI assistant with write access to cost controls is a blast radius worth refusing in a first version.

If write actions ever arrive, they will be narrow, individually named and explicitly opted into, one at a time. Until then, state changes such as recommendation status, anomaly dismissal and settings happen in the portal at console.cloudyali.io.

Reporting a security issue​

The repository carries a SECURITY.md with the current disclosure process. For anything sensitive, mail support@cloudyali.io rather than opening a public issue.

Last updated on