AI Integration (MCP)

Cloud.Red exposes a Model Context Protocol (MCP) server that lets AI assistants interact with your F5 and NGINX infrastructure in real time. Instead of copying and pasting data between your browser and an AI chat window, your AI client can call Cloud.Red tools directly — listing devices, running scripts, querying logs, making iControl REST calls, and more.

MCP is an open standard. Any client that supports MCP over stdio or SSE can connect — including Claude Desktop, Cursor, and Claude Code.

🔑 Prerequisites

A Cloud.Red account with API access enabled
crcli installed and authenticated

Contact WorldTech IT support to enable MCP access for your account.

🚀 Quick Start

crcli mcp is the recommended connection method. It acts as a local stdio ↔ SSE bridge: it handles authentication, token refresh, and tunnels JSON-RPC between your AI client and the Cloud.Red MCP server.

1. Install and authenticate crcli

# Authenticate (opens browser for device-flow login)
crcli auth login

2. Configure your AI client

Claude Desktop
Cursor
Claude Code
Direct SSE

Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

{
  "mcpServers": {
    "cloudred": {
      "command": "crcli",
      "args": ["mcp"]
    }
  }
}

Restart Claude Desktop. The Cloud.Red tools will appear in the tools panel.

Open Cursor Settings → MCP and add a new server:

{
  "cloudred": {
    "command": "crcli",
    "args": ["mcp"]
  }
}

In the project directory, run:

claude mcp add cloudred -- crcli mcp

Or add to .claude/settings.json:

{
  "mcpServers": {
    "cloudred": {
      "command": "crcli",
      "args": ["mcp"]
    }
  }
}

For clients with native SSE support, connect directly:

Field	Value
SSE URL	`https://<your-account>.cloud.red/api/v1/mcp/sse`
Auth header	`Authorization: Bearer <access-token>`
Realm header	`Cr-Realm: <your-tenant>`

Obtain a token via crcli or the Keycloak token endpoint for your realm.

🔄 Multi-account access (crcli)

If you manage multiple tenants, crcli mcp injects a set_context tool that lets the AI switch between accounts without reconnecting:

“Switch context to acmecorp.”

The AI calls set_context(tenant: "acmecorp") and all subsequent tool calls are scoped to that account. You can also pass _tenant on any individual tool call for a one-off override.

🛠 Available capabilities

Area	What the AI can do
Devices & Groups	List, inspect, and identify active/standby device state
Orchestration	Run scripts (single device or whole group), upload/download files
iControl REST	Authenticate and make arbitrary iControl REST API calls
Metrics	Pull time-series metrics for BIG-IP and F5OS devices
Backups	List UCS backup history with status
Log Search	Query F5 log data via SQL against ClickHouse

See the Tool Reference for the complete list with parameters.

🔒 Access control

Tools respect the same RBAC model as the Cloud.Red UI:

View permission is required to list devices, groups, and metrics.
Write permission is required to run scripts, push files, and make iControl REST calls.
list_accounts and list_agents are admin-only.

The AI cannot escalate beyond what the authenticated user is permitted to do.

Documentation Index

​🔑 Prerequisites

​🚀 Quick Start

​1. Install and authenticate crcli

​2. Configure your AI client

​🔄 Multi-account access (crcli)

​🛠 Available capabilities

​🔒 Access control

🔑 Prerequisites

🚀 Quick Start

1. Install and authenticate crcli

2. Configure your AI client

🔄 Multi-account access (crcli)

🛠 Available capabilities

🔒 Access control