> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloud.red/llms.txt
> Use this file to discover all available pages before exploring further.

# AI Integration (MCP)

> Connect Claude, Cursor, or any MCP-compatible AI assistant directly to your Cloud.Red environment.

Cloud.Red exposes a **Model Context Protocol (MCP)** server that lets AI assistants interact with your F5 and NGINX infrastructure in real time. Instead of copying and pasting data between your browser and an AI chat window, your AI client can call Cloud.Red tools directly — listing devices, running scripts, querying logs, making iControl REST calls, and more.

<Tip>MCP is an open standard. Any client that supports MCP over stdio or SSE can connect — including Claude Desktop, Cursor, and Claude Code.</Tip>

***

## 🔑 Prerequisites

* A Cloud.Red account with API access enabled
* **`crcli`** installed and authenticated
* The [CRCLI and MCP Authorization Grant](/getting-started/crcli-mcp-authorization) enabled for your tenant

<Note>Contact WorldTech IT support to enable MCP access for your account.</Note>

***

## 🚀 Quick Start

`crcli mcp` is the recommended connection method. It acts as a local **stdio ↔ SSE bridge**: it handles authentication, token refresh, and tunnels JSON-RPC between your AI client and the Cloud.Red MCP server.

### 1. Install and authenticate crcli

```bash theme={null}
# Authenticate (opens browser for device-flow login)
crcli auth login
```

### 2. Configure your AI client

<Tabs>
  <Tab title="Claude Desktop">
    Edit `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS) or `%APPDATA%\Claude\claude_desktop_config.json` (Windows):

    ```json theme={null}
    {
      "mcpServers": {
        "cloudred": {
          "command": "crcli",
          "args": ["mcp"]
        }
      }
    }
    ```

    Restart Claude Desktop. The Cloud.Red tools will appear in the tools panel.
  </Tab>

  <Tab title="Cursor">
    Open **Cursor Settings → MCP** and add a new server:

    ```json theme={null}
    {
      "cloudred": {
        "command": "crcli",
        "args": ["mcp"]
      }
    }
    ```
  </Tab>

  <Tab title="Claude Code">
    In the project directory, run:

    ```bash theme={null}
    claude mcp add cloudred -- crcli mcp
    ```

    Or add to `.claude/settings.json`:

    ```json theme={null}
    {
      "mcpServers": {
        "cloudred": {
          "command": "crcli",
          "args": ["mcp"]
        }
      }
    }
    ```
  </Tab>

  <Tab title="Direct SSE">
    For clients with native SSE support, connect directly:

    | Field        | Value                                             |
    | ------------ | ------------------------------------------------- |
    | SSE URL      | `https://<your-account>.cloud.red/api/v1/mcp/sse` |
    | Auth header  | `Authorization: Bearer <access-token>`            |
    | Realm header | `Cr-Realm: <your-tenant>`                         |

    Obtain a token via `crcli` or the Keycloak token endpoint for your realm.
  </Tab>
</Tabs>

***

## 🔄 Multi-account access (crcli)

If you manage multiple tenants, `crcli mcp` injects a `set_context` tool that lets the AI switch between accounts without reconnecting:

> "Switch context to acmecorp."

The AI calls `set_context(tenant: "acmecorp")` and all subsequent tool calls are scoped to that account. You can also pass `_tenant` on any individual tool call for a one-off override.

***

## 🛠 Available capabilities

| Area                 | What the AI can do                                                |
| -------------------- | ----------------------------------------------------------------- |
| **Devices & Groups** | List, inspect, and identify active/standby device state           |
| **Orchestration**    | Run scripts (single device or whole group), upload/download files |
| **iControl REST**    | Authenticate and make arbitrary iControl REST API calls           |
| **Metrics**          | Pull time-series metrics for BIG-IP and F5OS devices              |
| **Backups**          | List UCS backup history with status                               |
| **Log Search**       | Query F5 log data via SQL against ClickHouse                      |

See the [Tool Reference](/mcp/tools) for the complete list with parameters.

***

## 🔒 Access control

Tools respect the same RBAC model as the Cloud.Red UI:

* **View** permission is required to list devices, groups, and metrics.
* **Write** permission is required to run scripts, push files, and make iControl REST calls.
* `list_accounts` and `list_agents` are **admin-only**.

The AI cannot escalate beyond what the authenticated user is permitted to do.