MCP Tools Reference
Complete reference for all 118 Cloud Guardian MCP tools. Auto-generated from the MCP server source code.
Regenerate with: npx tsx scripts/generate-mcp-docs.ts
Auth
cg_login
Sign in to Cloud Guardian via Google OAuth. Opens browser for authentication.
cg_whoami
Show current authenticated user info: email, UID, and org memberships.
Organizations
cg_list_organizations
List all organizations the current user belongs to, with member counts.
cg_create_organization
Create a new organization. Caller becomes the owner.
| Parameter | Type | Required | Description |
|---|---|---|---|
| name | string | yes | Organization name |
cg_delete_organization
Delete an organization and all its data (projects, members, invitations). Requires owner or admin role.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | yes | Organization ID to delete |
cg_get_organization
Get organization details by ID.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | yes | Organization ID |
Members
cg_list_members
List org members with roles and pending invitations.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | no | Organization ID (uses default org if not specified) |
cg_invite_member
Invite a user to the organization by email with a specified role.
| Parameter | Type | Required | Description |
|---|---|---|---|
| string | yes | Email address to invite | |
| role | string | no | Role: viewer (default), member, admin, owner |
| org_id | string | no | Organization ID (uses default org if not specified) |
cg_update_member_role
Change a member's role in the organization.
| Parameter | Type | Required | Description |
|---|---|---|---|
| membership_id | string | yes | Membership ID (from cg_list_members) |
| role | string | yes | New role: viewer, member, admin, owner |
| org_id | string | no | Organization ID (uses default org if not specified) |
cg_remove_member
Remove a member from the organization.
| Parameter | Type | Required | Description |
|---|---|---|---|
| membership_id | string | yes | Membership ID to remove |
| org_id | string | no | Organization ID (uses default org if not specified) |
Projects & Connectors
cg_get_project_status
Get project status summary for the current org. Optionally filter by GCP project ID.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | no | Organization ID (uses default org if not specified) |
| gcp_project_id | string | no | Optional GCP project ID filter |
cg_list_connectors
List all GCP, AWS, Azure, DigitalOcean, Supabase, Hetzner, Vultr, and Neon connectors with provider identity and status.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | no | Organization ID (uses default org if not specified) |
cg_test_connector
Test a connector's connectivity and return verified permissions.
| Parameter | Type | Required | Description |
|---|---|---|---|
| connector_id | string | yes | Connector ID to test |
| org_id | string | no | Organization ID (uses default org if not specified) |
cg_onboard_gcp_project
Fully automate GCP project onboarding: create service account, grant roles, generate key, create connector, test connectivity, and link to org. Requires gcloud CLI.
| Parameter | Type | Required | Description |
|---|---|---|---|
| gcp_project_id | string | yes | GCP project ID to onboard |
| org_id | string | yes | Organization ID to link the project to |
| display_name | string | no | Display name for the project (defaults to project ID) |
| gcloud_account | string | no | gcloud account to use (for --account flag). Omit to use default. |
| remediation_scopes | string | no | Comma-separated remediation scopes to enable. Options: cloud_run:optimize, cloud_run:cleanup, secret_manager:cleanup, artifact_registry:cleanup, billing:alerts |
| auto_remediation_scopes | string | no | Comma-separated scopes that auto-execute after each scan cycle. Must be a subset of remediation_scopes. |
cg_onboard_aws
Onboard an AWS account to Cloud Guardian. Creates connector, tests connectivity with retries, links project, and provides IAM role setup instructions. Composes CreateConnector → TestConnector → LinkProject.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | yes | Organization ID to link the account to |
| account_id | string | yes | AWS account ID (12 digits) |
| region | string | no | AWS region (default: us-east-1) |
| role_arn | string | no | IAM role ARN for cross-account access. Auto-generated if not provided. |
| external_id | string | no | External ID for STS AssumeRole. Auto-generated if not provided. |
| access_key_id | string | no | Static access key ID (alternative to IAM role) |
| secret_access_key | string | no | Static secret access key |
| provision | string | no | Set to 'true' to auto-provision a least-privilege 'cloudguardian-scanner' IAM user using this machine's local AWS credentials (~/.aws), then onboard with the generated key. Recommended over pasting admin keys. |
cg_onboarding_start
Start a guided onboarding session. Returns a one-click link the user opens (AWS CloudFormation quick-create, or OAuth consent for GCP/DigitalOcean) — provider-side automation completes the connector without credential copy-paste. Poll cg_onboarding_status until complete.
| Parameter | Type | Required | Description |
|---|---|---|---|
| provider | string | yes | aws | gcp | digitalocean |
| account_id | string | no | AWS account ID (optional — auto-detected by the stack) |
| project_id | string | no | GCP project ID (required for gcp) |
| region | string | no | AWS region for the console link (default us-east-1) |
cg_onboarding_status
Poll a guided onboarding session (from cg_onboarding_start) for completion.
| Parameter | Type | Required | Description |
|---|---|---|---|
| token | string | yes | Session token from cg_onboarding_start |
cg_onboard_azure
Onboard an Azure subscription using service-principal credentials (tenant_id, client_id, client_secret). Creates connector, links subscription, verifies Reader access. For guided setup use cg_onboarding_start with provider='azure' — the user runs one line in Cloud Shell and the SP self-registers.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | yes | Organization ID |
| subscription_id | string | yes | Azure subscription ID |
| tenant_id | string | yes | Entra tenant ID |
| client_id | string | yes | Service principal app/client ID |
| client_secret | string | yes | Service principal secret |
| name | string | no | Connector display name |
cg_onboard_do
Onboard a DigitalOcean account to Cloud Guardian. Verifies API token, probes resource permissions, creates connector, links project. Composes VerifyAccount → CreateConnector → LinkProject → TestConnector.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | yes | Organization ID to link the account to |
| api_token | string | yes | DigitalOcean API token (starts with dop_v1_) |
| name | string | no | Connector display name (auto-generated from team name if not provided) |
cg_onboard_supabase
Onboard one Supabase organization to Cloud Guardian. Validates the PAT, picks the Supabase org (auto when unambiguous), creates a connector, and LinkProjects every Supabase project in that org. Next scan cycle populates per-project compute cost in the cost trend/breakdown.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | yes | Cloud Guardian organization ID to link the Supabase org to |
| personal_access_token | string | yes | Supabase Personal Access Token (sbp_*). Create at https://supabase.com/dashboard/account/tokens |
| supabase_org_slug | string | no | Optional Supabase org slug/ID. Required when the PAT can see more than one org; auto-selected when there's only one. |
| name | string | no | Connector display name (defaults to supabase-<slug>) |
cg_supabase_db_query
Run a read-only SQL query against a Supabase project's database via the Management API (SELECT/EXPLAIN/SHOW only). Use for db optimization: index usage, table sizes, pg_stat_statements.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | yes | Cloud Guardian org ID |
| project | string | yes | Supabase project name or ref |
| query | string | yes | Read-only SQL — SELECT/WITH/EXPLAIN/SHOW, single statement |
cg_supabase_db_inspect
Canned DB optimization reports for a Supabase project: index_usage, table_sizes, cache_hit, top_queries, seq_scans, unused_indexes, bloat_estimate, extensions — or 'all'.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | yes | Cloud Guardian org ID |
| project | string | yes | Supabase project name or ref |
| report | string | no | Report kind (default index_usage; 'all' runs the full suite) |
cg_neon_db_query
Run a read-only SQL query against a Neon project's database via the stored connection string (SELECT/EXPLAIN/SHOW only). Requires database_urls in the connector credentials.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | yes | Cloud Guardian org ID |
| project | string | yes | Neon project ID or display name |
| query | string | yes | Read-only SQL — SELECT/WITH/EXPLAIN/SHOW, single statement |
cg_neon_db_inspect
Canned DB optimization reports for a Neon project (shared dbinspect suite): unused_indexes, seq_scan_heavy, dead_rows, missing_fk_indexes, cache_hit, top_queries, table_sizes — or 'all'.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | yes | Cloud Guardian org ID |
| project | string | yes | Neon project ID or display name |
| report | string | no | Report kind (default: all) |
cg_neon_database_url
Attach or remove a per-project Postgres connection string on the Neon connector — enables DB inspect findings for that project. Use a read-only role's connection URI.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | yes | Cloud Guardian org ID |
| project | string | yes | Neon project ID or display name |
| url | string | no | postgres connection string — omit with remove=true |
| remove | boolean | no | Remove the stored connection string |
cg_db_optimize
LLM-driven Postgres optimization — pulls live pg_stat_* data and the app's SQL from its repo, then recommends indexes, query rewrites, and config changes with file references. provider=supabase|neon.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | yes | Cloud Guardian org ID |
| provider | string | yes | supabase | neon |
| project | string | yes | Project name or ref/ID |
| repo | string | no | Optional owner/repo override — else uses the OrgProject's linked repo |
cg_repo_files
List files/dirs in a GitHub repo visible to the org's installation. Returns tree entries.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | yes | Cloud Guardian org ID |
| repo | string | yes | owner/name |
| path | string | no | Directory path (default: repo root) |
cg_repo_file
Read a file's content from a repo via the org's GitHub installation.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | yes | Cloud Guardian org ID |
| repo | string | yes | owner/name |
| path | string | yes | File path |
cg_repo_search
GitHub code search across an org repo — e.g. 'users table_name', 'SELECT FROM runs'. Finds the files where queries live.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | yes | Cloud Guardian org ID |
| repo | string | yes | owner/name |
| q | string | yes | GitHub code-search terms (bare query — repo: qualifier auto-added) |
cg_db_report
Run a deep Postgres inspection now — all stats sections + deep checks (connections, long-running queries, autovacuum, blocking, sizes) — persisted as a db_report snapshot and viewable in /admin/databases.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | yes | Cloud Guardian org ID |
| provider | string | yes | supabase | neon |
| project | string | yes | Project name or ref/ID |
cg_db_report_latest
Fetch the last persisted deep report for a project.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | yes | Cloud Guardian org ID |
| provider | string | no | supabase | neon — optional filter |
| project | string | yes | Project name or ref/ID |
cg_onboard_neon
Onboard one Neon organization (or personal account) to Cloud Guardian. Without api_key, runs a browser OAuth grant (neonctl-style PKCE localhost flow) — the stored token set auto-refreshes on each scan. With api_key, uses it directly. Picks the Neon org (auto when unambiguous), creates a connector, and LinkProjects every Neon project in scope. Next scan cycle populates per-project usage-cost estimates and optimisation findings (always-on computes, over-provisioned CU floors, stale branches, PITR storage).
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | yes | Cloud Guardian organization ID to link the Neon org to |
| api_key | string | no | Optional Neon API key (neon_*). Omit to use the browser OAuth flow instead. Create keys at https://console.neon.tech/app/settings/api-keys or the org's Settings → API keys |
| neon_org_id | string | no | Optional Neon org ID (org-...). Required for org-scoped keys; auto-selected when a personal key sees exactly one org. |
| name | string | no | Connector display name (defaults to neon-<org_id>) |
| database_urls | string | no | Optional JSON object mapping Neon project ID → read-only Postgres connection string — enables the DB inspect pass |
cg_remap_do_projects
Intelligently map already-onboarded DigitalOcean resources to GCP OrgProjects. Per-resource matching uses DO tags (strongest signal), resource name, OrgProject display_name, and Cloud Run service name. Read-only by default — pass apply=true to rename DO OrgProjects' display_name when one team unambiguously hosts a single GCP project's app.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | no | Organization ID (uses default org if not specified) |
| apply | string | no | Set to 'true' to apply display_name renames; default is read-only proposal |
cg_compare_resource_cost
Compare a resource's current cost against equivalent shapes across AWS, GCP, Azure, DigitalOcean, Hetzner, Linode, and Vultr (full provider pricing catalogs, refreshed via catalogpull). Read-only advisory output — no migration is performed. Cloud Run resources work best; the advisor needs CPU/RAM/utilisation metadata which only Cloud Run snapshots fully populate today. Equivalent monthly cost is scaled by observed avg active instances.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | no | Organization ID (defaults to current user's org) |
| resource_name | string | no | Compare a single named resource (e.g. 'shorts'). When omitted, returns the top-N most expensive resources matching the other filters. |
| project | string | no | Restrict to a single GCP project |
| snapshot_type | string | no | Snapshot type filter (default 'cloud_run'). Pass empty string to consider all types — but most non-Cloud-Run types lack the shape metadata the advisor needs. |
| min_cost_usd | string | no | Skip resources below this monthly USD threshold (default 0) |
| top_n | string | no | Max comparisons to return (default 10, max 50) |
cg_onboard_hetzner
Onboard one Hetzner Cloud project to Cloud Guardian. Validates the Project API token, creates a connector, LinkProjects, and runs intelligent matching against existing GCP OrgProjects so cost breakdowns group naturally. Hetzner project tokens are project-scoped — onboard each Hetzner project separately.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | yes | Cloud Guardian organization ID to link the Hetzner project to |
| api_token | string | yes | Hetzner Cloud Project API token. Create at https://console.hetzner.cloud/projects/<project>/security/tokens |
| project_name | string | yes | Name of your Hetzner Cloud project (Hetzner does not expose this via API) |
| name | string | no | Connector display name (defaults to hetzner-<project_name>) |
cg_create_connector
Create a cloud connector for GCP, AWS, Azure, DigitalOcean, Supabase, Hetzner, Vultr, Neon, or Vercel. Vultr and Vercel are read-only and have no remediation scopes; prefer their provider onboarding tools.
| Parameter | Type | Required | Description |
|---|---|---|---|
| name | string | yes | Display name for the connector |
| project_id | string | yes | Provider project/account identity (for example GCP project ID, AWS account ID, DO team UUID, or opaque Vultr account key) |
| provider | string | no | Cloud provider: gcp (default), aws, azure, do, supabase, hetzner, vultr, neon, or vercel |
| region | string | no | Cloud region |
| credentials_blob | string | no | |
| remediation_scopes | string | no | Comma-separated scopes. Options: cloud_run:optimize, cloud_run:cleanup, secret_manager:cleanup, artifact_registry:cleanup |
| auto_remediation_scopes | string | no | Comma-separated auto-execute scopes (subset of remediation_scopes) |
| org_id | string | no | Organization ID (uses default org if not specified) |
cg_delete_connector
Delete a connector and its stored credentials.
| Parameter | Type | Required | Description |
|---|---|---|---|
| connector_id | string | yes | Connector ID to delete |
| org_id | string | no | Organization ID (uses default org if not specified) |
cg_clone_credentials
Clone encrypted credentials from one connector to another without decrypting.
| Parameter | Type | Required | Description |
|---|---|---|---|
| source_connector_id | string | yes | Source connector ID |
| target_connector_id | string | yes | Target connector ID |
| org_id | string | no | Organization ID (uses default org if not specified) |
cg_list_org_projects
List linked provider projects/accounts with their Cloud Guardian IDs, provider mappings, GitHub repos, and any supported auto-remediation scopes. Vultr links are read-only and have no remediation scopes.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | no | Organization ID (uses default org if not specified) |
cg_update_org_project
Update an org project's settings: display name, auto-remediation scopes, GitHub repo, or connector.
| Parameter | Type | Required | Description |
|---|---|---|---|
| id | string | yes | Org project ID (use cg_list_org_projects to find it) |
| auto_remediation_scopes | string | no | Comma-separated scopes to enable. Options: cloud_run:optimize, cloud_run:cleanup, secret_manager:cleanup, artifact_registry:cleanup |
| display_name | string | no | New display name |
| github_repo | string | no | GitHub repo in owner/repo format |
| connector_id | string | no | Connector ID to associate |
| org_id | string | no | Organization ID (uses default org if not specified) |
Infrastructure
cg_get_infrastructure_status
Query cached infrastructure status, including GCP resources and all Vultr VKE cluster, node-pool, linked load-balancer, and linked block-storage snapshots. Vultr output is read-only and includes run-rate completeness and staleness.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | no | Organization ID (uses default org if not specified) |
cg_list_guardian_rules
List all enforcement rules configured for the organization.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | no | Organization ID (uses default org if not specified) |
cg_create_guardian_rule
Create a CEL enforcement rule for automated policy checks.
| Parameter | Type | Required | Description |
|---|---|---|---|
| name | string | yes | Rule name |
| match_expression | string | yes | CEL expression to evaluate |
| description | string | no | Rule description |
| resource_type | string | no | Resource type: cloud_run, artifact_registry, secret_manager |
| action_type | string | no | Action to take on match: alert, remediate |
| severity | string | no | Rule severity: critical, high, medium, low |
| schedule | string | no | Cron schedule for rule evaluation |
| org_id | string | no | Organization ID (uses default org if not specified) |
cg_update_guardian_rule
Update a guardian rule's expression, severity, or settings.
| Parameter | Type | Required | Description |
|---|---|---|---|
| rule_id | string | yes | Guardian rule ID to update |
| name | string | no | New rule name |
| description | string | no | New description |
| match_expression | string | no | New CEL expression |
| action_type | string | no | New action type |
| severity | string | no | New severity |
| enabled | string | no | Set to 'true' or 'false' |
| schedule | string | no | New cron schedule |
| org_id | string | no | Organization ID (uses default org if not specified) |
cg_delete_guardian_rule
Delete a guardian enforcement rule.
| Parameter | Type | Required | Description |
|---|---|---|---|
| rule_id | string | yes | Guardian rule ID to delete |
| org_id | string | no | Organization ID (uses default org if not specified) |
cg_validate_rule_expression
Validate a CEL rule expression without creating a rule. Checks syntax and returns parsed representation.
| Parameter | Type | Required | Description |
|---|---|---|---|
| expression | string | yes | CEL expression to validate |
| resource_type | string | no | Resource type context for validation |
| org_id | string | no | Organization ID (uses default org if not specified) |
cg_get_cost_trend
Get monthly run-rate trend data across monitored provider projects/accounts, including GCP BQ-derived categories and Vultr scanner-estimated VKE run-rate. Provider billing evidence remains separate.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | no | Organization ID (uses default org if not specified) |
| project | string | no | Optional provider project/account identity to filter by |
| days | number | no | Number of days of history (default 30) |
cg_get_resource_cost_history
Get per-resource cost and utilization history over time for supported snapshots. Vultr resources expose run-rate evidence; utilization fields are primarily available for Cloud Run.
| Parameter | Type | Required | Description |
|---|---|---|---|
| resource_name | string | yes | Name of the resource (e.g., Cloud Run service name) |
| project | string | no | Optional provider project/account identity filter |
| snapshot_type | string | no | Snapshot type, including cloud_run, secret_manager, artifact_registry, supabase_compute, neon_project, neon_compute_endpoint, AWS/DO/Hetzner resource types, vultr_vke_cluster, vultr_vke_node_pool, vultr_load_balancer, or vultr_block_storage |
| org_id | string | no | Organization ID (uses default org if not specified) |
| days | number | no | Number of days of history (default 30) |
cg_get_cost_breakdown
Get a ranked provider-resource run-rate breakdown with cost status, completeness, staleness, metadata, change, and available utilization. Incomplete Vultr estimates are labeled lower bounds; account invoices are separate.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | no | Organization ID (uses default org if not specified) |
| project | string | no | Optional provider project/account identity filter |
| snapshot_type | string | no | Snapshot type, including cloud_run, secret_manager, artifact_registry, supabase_compute, neon_project, neon_compute_endpoint, AWS/DO/Hetzner resource types, vultr_vke_cluster, vultr_vke_node_pool, vultr_load_balancer, or vultr_block_storage |
| sort_by | string | no | Sort by: cost (default), cost_change |
| days | number | no | Comparison window in days (default 30) |
| top_n | number | no | Number of top resources to return (default 20, max 100) |
cg_list_service_metrics
Get per-service utilization metrics over time: CPU, memory, request count, RPS, active/idle instances, and cost. Use for traffic pattern analysis and identifying idle or over-utilized services.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | no | Organization ID (uses default org if not specified) |
| service_name | string | no | Filter to a specific Cloud Run service name |
| project | string | no | Filter to a specific GCP project |
| days | number | no | Lookback window in days (default 7) |
cg_get_service_metrics_summary
Get the latest utilization snapshot for all Cloud Run services: CPU, memory, requests, instance counts, and costs. Best for a quick overview of service health.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | no | Organization ID (uses default org if not specified) |
cg_get_savings_summary
Get verified savings summary: estimated vs actual savings from completed remediations.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | no | Organization ID (uses default org if not specified) |
| project | string | no | Optional GCP project ID filter |
| days | number | no | Lookback window in days (default 90) |
Checks
cg_list_checks
List all available checks with their thresholds, categories, and override status.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | no | Organization ID (uses default org if not specified) |
| resource_type | string | no | Filter by resource type: cloud_run, artifact_registry, secret_manager |
| category | string | no | Filter by category: cost_optimization, cleanup, security |
cg_update_check_override
Customize a check's threshold, severity, or enabled status for your org.
| Parameter | Type | Required | Description |
|---|---|---|---|
| check_id | string | yes | Check ID to override (from cg_list_checks) |
| enabled | string | no | Set to 'true' or 'false' |
| severity | string | no | Custom severity: critical, high, medium, low |
| org_id | string | no | Organization ID (uses default org if not specified) |
| threshold | number | no | Custom threshold value |
cg_delete_check_override
Reset a check to its default threshold and settings.
| Parameter | Type | Required | Description |
|---|---|---|---|
| check_id | string | yes | Check ID to reset |
| org_id | string | no | Organization ID (uses default org if not specified) |
Operations
cg_trigger_scan
Trigger an immediate read scan across connected GCP, AWS, Azure, DigitalOcean, Supabase, Hetzner, Vultr, and Neon projects/accounts. Vultr refreshes VKE inventory/run-rate and separate account billing evidence; it performs no remediation. Pass gcp_project_id to scan a single project, which returns in about a minute instead of around 15.
| Parameter | Type | Required | Description |
|---|---|---|---|
| gcp_project_id | string | no | Scan only this GCP project (e.g. pfinance-app-1748773335). Strongly preferred: a full cycle covers every connected project and takes around 15 minutes, longer than the gateway will hold the response open. |
| org_id | string | no | Organization ID (uses default org if not specified) |
cg_update_connector
Update a connector's settings: name, region, remediation scopes, or auto-remediation scopes.
| Parameter | Type | Required | Description |
|---|---|---|---|
| connector_id | string | yes | Connector ID to update |
| name | string | no | New display name |
| region | string | no | GCP region |
| remediation_scopes | string | no | Comma-separated scopes. Options: cloud_run:optimize, cloud_run:cleanup, secret_manager:cleanup, artifact_registry:cleanup |
| auto_remediation_scopes | string | no | Comma-separated scopes that auto-execute after each scan. Must be subset of remediation_scopes. |
| org_id | string | no | Organization ID (uses default org if not specified) |
cg_get_operational_health
Get platform operational health across all connector providers: scan cycles, connector health, alerts/remediation, estimated run-rate, and separately reported Vultr account billing evidence.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | no | Organization ID (uses default org if not specified) |
cg_cost_forecast
Forecast the monthly run rate at month-end from closed UTC-day observations; show covered GCP month-to-date accrued usage separately with coverage and freshness. Project scanner estimates and smoothed organization rates have different bases.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | no | Organization ID (uses caller's org if omitted) |
cg_kubernetes_costs
Kubernetes cost analysis per cluster from the in-cluster agent: per-node pricing, namespace cost attribution, utilization findings (overprovisioned requests, idle nodes, missing requests), and a same-workload price comparison across providers (aws/gcp/azure/vultr/digitalocean/hetzner/linode).
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | no | Organization ID (uses caller's org if omitted) |
| cluster_id | string | no | Limit to one cluster ID |
cg_kubernetes_services
List automatically discovered Kubernetes workload services or inspect one service's CPU/memory allocation and observed cost history. Worker catalog estimates include idle/unallocated capacity and coverage gaps; provider charges and credits are separate.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | no | Organization ID (uses caller's org if omitted) |
| cluster_id | string | no | Limit to one cluster ID |
| service_id | string | no | Stable service ID from the list; returns cost and resource-hour history |
| q | string | no | Filter workload name, namespace, kind, or cluster |
| namespace | string | no | Filter to one namespace |
| kind | string | no | Filter to one workload controller kind |
| days | number | no | History window in days (default 7, integer 1-30) |
| limit | number | no | List page size (default 100, integer 1-500) |
| offset | number | no | List offset (default 0, nonnegative integer) |
cg_kubernetes_tenants
Compare per-tenant Kubernetes workload CPU/memory and provisioned PV costs. Uses existing tenant labels or namespaces; preserves shared infrastructure, idle and unallocated capacity, and identifies unknown storage rates. USD catalog estimates are a subledger, not additional cloud charges or applied credits.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | no | Organization ID (default organization when omitted) |
| cluster_id | string | no | Optional cluster ID |
| tenant_id | string | no | Optional tenant label value or namespace |
cg_kubernetes_utilization
7-day percentile utilization model for a cluster: p95/avg CPU+memory, advisory node lower bound, estimated monthly savings, confidence and risk ratings.
| Parameter | Type | Required | Description |
|---|---|---|---|
| cluster_id | string | yes | Cluster ID from cg_kubernetes_costs |
| org_id | string | no | Organization ID (uses caller's org if omitted) |
| days | number | no | Lookback window in days (default 7, max 30) |
cg_kubernetes_scale
Plan or apply provider-level cluster scaling (Karpenter-style). mode=plan lists actions; mode=apply executes one action — dry-run unless confirm=true.
| Parameter | Type | Required | Description |
|---|---|---|---|
| cluster_id | string | yes | Cluster ID |
| mode | string | no | plan | apply (default plan) |
| action_id | string | no | Action ID from plan output (required for apply) |
| org_id | string | no | Organization ID |
| confirm | boolean | no | Execute the provider change (default: dry-run) |
cg_kubernetes_scaler_config
View or set per-cluster scaler bounds — min/max nodes, max delta per apply, cooldown, cost ceiling, enabled. set=true writes.
| Parameter | Type | Required | Description |
|---|---|---|---|
| cluster_id | string | yes | |
| mode | string | no | observe (propose only — default) | apply (execute) |
| org_id | string | no | Organization ID |
| min_nodes | number | no | |
| max_nodes | number | no | |
| max_delta | number | no | |
| cooldown_minutes | number | no | |
| max_monthly_cents | number | no | |
| set | boolean | no | Write mode (default: read) |
| enabled | boolean | no |
cg_metric_series
Read a rolled-up metric series — any source/scope/metric written to the rollup store (e.g. kubernetes node cpu.util, namespace cpu.usage_of_req). Returns hourly buckets with avg/p50/p95/min/max.
| Parameter | Type | Required | Description |
|---|---|---|---|
| source | string | yes | Metric source, e.g. kubernetes |
| scope_type | string | yes | cluster | node | namespace | workload | service |
| scope_id | string | no | Kubernetes: cluster ID for cluster scope; cluster ID/node, cluster ID/namespace, cluster ID/ns/kind:name for others — empty for all |
| metric | string | yes | cpu.util | mem.util | cpu.usage_of_req | nodes.count | … |
| org_id | string | no | Organization ID |
| days | number | no | Lookback days (default 7) |
cg_commitment_coverage
Commitment coverage per provider: AWS Savings Plans / Reserved Instance coverage per account and GCP committed-use (CUD) recommendations with estimated monthly savings.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | no | Organization ID (uses caller's org if omitted) |
cg_cost_anomalies
Detect recent spend anomalies — projects or categories whose run rate jumped vs the trailing baseline. Returns severity, baseline vs current, delta, and when it started.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | no | Organization ID (uses caller's org if omitted) |
cg_list_scan_logs
List scan cycle history with per-project drill-down results: status, disabled APIs, extractor warnings, and cost per project.
| Parameter | Type | Required | Description |
|---|---|---|---|
| project_id | string | no | Filter project rows to this project/account ID |
| org_id | string | no | Organization ID (uses default org if not specified) |
| limit | number | no | Number of scan cycles to return (default 10) |
cg_auto_discover_projects
Discover unlinked GCP projects accessible by a connector's service account.
| Parameter | Type | Required | Description |
|---|---|---|---|
| connector_id | string | yes | Connector whose credentials to use for discovery |
| org_id | string | no | Organization ID (uses default org if not specified) |
cg_system_diagnostics
Get system diagnostics: connectivity status for Firestore, KMS, email, GitHub, Firebase Auth, Vertex AI, and scanner health.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | no | Organization ID (uses default org if not specified) |
cg_send_test_email
Send a test email to the currently logged-in user to verify email delivery.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | no | Organization ID (uses default org if not specified) |
cg_send_test_daily_report
Send a test daily cost report email to the currently logged-in user. Shows the full daily cost summary with trends, top resources, alerts, and savings.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | no | Organization ID (uses default org if not specified) |
Remediation
cg_plan_remediation
Scan infrastructure for violations and create pending remediation actions based on enabled scopes. Shows estimated savings.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | no | Organization ID (uses default org if not specified) |
| gcp_project_id | string | no | Optional GCP project ID to filter by |
| resource_name | string | no | Optional resource name to filter to a single resource |
cg_execute_remediation
Execute a specific pending remediation action. Use dry_run=true to validate without executing.
| Parameter | Type | Required | Description |
|---|---|---|---|
| action_id | string | yes | Remediation action ID to execute |
| dry_run | string | no | Set to 'true' to validate without executing |
| force_direct | string | no | Set to 'true' to bypass github_pr mode and execute directly via GCP APIs |
| org_id | string | no | Organization ID (uses default org if not specified) |
cg_batch_execute_remediation
Execute multiple pending remediation actions in one call. Returns per-action results.
| Parameter | Type | Required | Description |
|---|---|---|---|
| action_ids | string | yes | Comma-separated action IDs to execute |
| dry_run | string | no | Set to 'true' to validate without executing |
| force_direct | string | no | Set to 'true' to bypass github_pr mode and execute directly via GCP APIs |
| org_id | string | no | Organization ID (uses default org if not specified) |
cg_delete_remediation_action
Delete a pending remediation action. Only pending actions can be deleted.
| Parameter | Type | Required | Description |
|---|---|---|---|
| action_id | string | yes | Remediation action ID to delete |
| org_id | string | no | Organization ID (uses default org if not specified) |
cg_list_remediation_actions
List remediation actions with their status. Filter by project or status.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | no | Organization ID (uses default org if not specified) |
| gcp_project_id | string | no | Optional GCP project ID to filter by |
| status | string | no | Filter by status: pending, executing, completed, failed |
Alerts
cg_list_cost_alerts
List cost alerts with spend spikes, idle resources, and recommendations.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | no | Organization ID (uses default org if not specified) |
| status | string | no | Filter: active, acknowledged, resolved |
| severity | string | no | Filter: critical, high, medium, low |
cg_acknowledge_cost_alert
Acknowledge a cost alert to mark it as reviewed.
| Parameter | Type | Required | Description |
|---|---|---|---|
| alert_id | string | yes | Cost alert ID to acknowledge |
| org_id | string | no | Organization ID (uses default org if not specified) |
cg_get_cost_alert_counts
Get quick counts of active and acknowledged cost alerts.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | no | Organization ID (uses default org if not specified) |
API Keys
cg_create_api_key
Create a programmatic API key. Returns the raw key (shown only once).
| Parameter | Type | Required | Description |
|---|---|---|---|
| name | string | yes | Name for the API key |
| role | string | no | Role: viewer, member, admin (default: viewer). Capped at your role level. |
| org_id | string | no | Organization ID (uses default org if not specified) |
| expires_in_days | number | no | Days until expiry (0 = no expiry) |
cg_list_api_keys
List all API keys for the current user.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | no | Organization ID (uses default org if not specified) |
cg_revoke_api_key
Revoke (delete) an API key.
| Parameter | Type | Required | Description |
|---|---|---|---|
| key_id | string | yes | API key ID to revoke |
| org_id | string | no | Organization ID (uses default org if not specified) |
Webhooks
cg_list_webhook_endpoints
List webhook endpoints for an organization. Shows URL, event subscriptions, status, and failure count.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | no | Organization ID (uses default org if not specified) |
cg_create_webhook_endpoint
Create a webhook endpoint. Returns a signing secret (HMAC-SHA256) for verifying payloads. Save it immediately — it cannot be retrieved later.
| Parameter | Type | Required | Description |
|---|---|---|---|
| url | string | yes | Webhook URL to POST events to |
| description | string | no | Human-readable description |
| event_types | string | no | Comma-separated event types: scan.completed, alert.created, remediation.completed, etc. Empty = all events |
| org_id | string | no | Organization ID (uses default org if not specified) |
cg_update_webhook_endpoint
Update a webhook endpoint's URL, description, event types, or enabled status.
| Parameter | Type | Required | Description |
|---|---|---|---|
| id | string | yes | Webhook endpoint ID |
| url | string | no | New webhook URL |
| description | string | no | New description |
| event_types | string | no | Comma-separated event types to subscribe to |
| enabled | string | no | true or false |
| org_id | string | no | Organization ID (uses default org if not specified) |
cg_delete_webhook_endpoint
Delete a webhook endpoint and all its delivery history.
| Parameter | Type | Required | Description |
|---|---|---|---|
| id | string | yes | Webhook endpoint ID |
| org_id | string | no | Organization ID (uses default org if not specified) |
cg_list_webhook_deliveries
List recent delivery attempts for a webhook endpoint. Shows status, HTTP code, duration, and errors.
| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint_id | string | yes | Webhook endpoint ID |
| org_id | string | no | Organization ID (uses default org if not specified) |
cg_test_webhook_endpoint
Send a test event to a webhook endpoint to verify connectivity.
| Parameter | Type | Required | Description |
|---|---|---|---|
| id | string | yes | Webhook endpoint ID |
| org_id | string | no | Organization ID (uses default org if not specified) |
Teams
cg_list_teams
List all teams in an organization with their allocation rules.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | no | Organization ID (uses default org if not specified) |
cg_create_team
Create a new team for cost allocation. Add allocation rules to match resources.
| Parameter | Type | Required | Description |
|---|---|---|---|
| name | string | yes | Team name |
| description | string | no | Team description |
| color | string | no | Hex color for display (e.g. #3b82f6) |
| org_id | string | no | Organization ID (uses default org if not specified) |
cg_update_team
Update a team's name, description, color, or allocation rules.
| Parameter | Type | Required | Description |
|---|---|---|---|
| id | string | yes | Team ID |
| name | string | no | New team name |
| description | string | no | New description |
| color | string | no | New hex color |
| org_id | string | no | Organization ID (uses default org if not specified) |
cg_delete_team
Delete a team. Cost allocations will become unallocated.
| Parameter | Type | Required | Description |
|---|---|---|---|
| id | string | yes | Team ID |
| org_id | string | no | Organization ID (uses default org if not specified) |
cg_get_team_cost_report
Get cost attribution report showing how costs are distributed across teams.
| Parameter | Type | Required | Description |
|---|---|---|---|
| team_id | string | no | Filter to a specific team (optional) |
| org_id | string | no | Organization ID (uses default org if not specified) |
| days | number | no | Lookback period in days (default 30) |
cg_export_team_cost_csv
Export team cost allocation as CSV for finance teams.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | no | Organization ID (uses default org if not specified) |
| days | number | no | Lookback period in days (default 30) |
cg_get_team_cost_trend
Get per-team cost trend over N days using pre-computed daily rollups.
| Parameter | Type | Required | Description |
|---|---|---|---|
| team_id | string | no | Filter to a specific team (optional) |
| org_id | string | no | Organization ID (uses default org if not specified) |
| days | number | no | Lookback period in days (default 30, max 90) |
cg_get_unallocated_resources
List cost items that are not matched to any team's allocation rules.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | no | Organization ID (uses default org if not specified) |
| days | number | no | Lookback period in days (default 30) |
Billing
cg_setup_billing_budget
Create a GCP billing budget with automated Pub/Sub alerts forwarded to Cloud Guardian.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | yes | Organization ID |
| gcp_project_id | string | yes | GCP project ID to monitor |
| billing_account_id | string | yes | GCP billing account ID (e.g. XXXXXX-XXXXXX-XXXXXX or billingAccounts/XXXXXX-XXXXXX-XXXXXX) |
| currency_code | string | no | Budget currency — MUST match billing account currency (e.g. USD, AUD). Run 'gcloud billing accounts describe BILLING_ACCOUNT_ID' to check. |
| display_name | string | no | Budget display name (default: 'Cloud Guardian - <project>') |
| thresholds | string | no | Comma-separated threshold percents as decimals (default: 0.5,0.8,1.0) |
| amount_cents | number | no | Monthly budget in cents (default 10000 = $100) |
cg_list_billing_budgets
List all GCP billing budgets managed by Cloud Guardian for an organization.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | no | Organization ID (uses default org if not specified) |
cg_delete_billing_budget
Delete a billing budget. Removes the GCP budget, Pub/Sub topic, and push subscription.
| Parameter | Type | Required | Description |
|---|---|---|---|
| id | string | yes | Billing budget ID |
| org_id | string | no | Organization ID (uses default org if not specified) |
cg_list_billing_webhook_events
List recent billing webhook events received from GCP Pub/Sub. Shows processed, unmatched, and error events for debugging the billing alert pipeline.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | no | Organization ID (uses default org if not specified) |
| limit | number | no | Max events to return (default 20) |
cg_send_test_billing_webhook
Send a mock GCP Pub/Sub billing alert to the webhook endpoint for testing. Simulates a budget threshold exceeded notification.
| Parameter | Type | Required | Description |
|---|---|---|---|
| budget_id | string | no | Budget ID to simulate (default: test-budget-001) |
| budget_name | string | no | Budget display name (default: Cloud Guardian Test Budget) |
| threshold | number | no | Threshold exceeded as decimal (default: 0.5 = 50%) |
| cost_amount | number | no | Current cost in dollars (default: 50.0) |
| budget_amount | number | no | Budget amount in dollars (default: 100.0) |
cg_setup_billing_export
Connect and verify an existing BigQuery billing export for actual GCP cost tracking. Checks dataset, standard or detailed export table, and query access. To create the dataset or grant permissions, use browser-assisted billing setup in the Connectors onboarding page.
| Parameter | Type | Required | Description |
|---|---|---|---|
| connector_id | string | yes | Connector ID with GCP credentials (SA needs BigQuery Data Viewer on the dataset) |
| bq_project_id | string | yes | GCP project ID where the BQ billing export dataset lives |
| billing_account_id | string | yes | GCP billing account ID (e.g. 01ABCD-234567-89EFGH) |
| org_id | string | no | Organization ID (uses default org if not specified) |
| dataset_id | string | no | BQ dataset ID (default: cloud_billing_export) |
cg_bq_export_status
Check the status of BigQuery billing export configuration for an organization.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | no | Organization ID (uses default org if not specified) |
cg_query_actual_costs
Query actual GCP costs from BigQuery billing export data. Returns cached cost data by service and project. Use 'date' for single-day detail or 'days' for multi-day trend. Use 'project' to filter to a single GCP project.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | no | Organization ID (uses default org if not specified) |
| date | string | no | Specific date to query (YYYY-MM-DD format) |
| days | string | no | Number of days to query (default: 7, max: 90) |
| project | string | no | Optional GCP project ID to filter to a single project |
cg_sync_bq_now
Run an on-demand BQ billing-export sync and return the typed outcome (observed / observed_empty / skipped / error). Use to verify the cost pipeline without waiting for the next scheduled scan (~6h).
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | no | Organization ID (uses default org if not specified) |
| date | string | no | Closed UTC usage date to refresh (YYYY-MM-DD, last 90 days; default: yesterday). Refreshes all active billing accounts, replacing that date's cache. |
cg_list_recommendations
List active GCP Active Assist cost recommendations across all projects. Shows idle VMs, disks, IPs, right-sizing opportunities, and unattended projects with estimated monthly savings.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | no | Organization ID (uses default org if not specified) |
| gcp_project_id | string | no | Optional GCP project ID to filter recommendations |
cg_onboard_gcp_billing
Start GCP billing export setup using CloudGuard's bundled local browser helper. Prepares the dataset and scanner IAM access, reuses an existing export or configures Standard usage export in Google Console. Requires Node.js 20+, npm, gcloud and Chrome on this machine. The user completes Google login/MFA locally. Returns immediately with a session ID; poll cg_gcp_billing_onboarding_status for durable progress or view the organization's Connectors onboarding card.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | yes | Explicit CloudGuard organization ID; caller must administer it |
| connector_id | string | yes | GCP connector ID in this organization |
| billing_account_id | string | yes | Google billing account ID, XXXXXX-XXXXXX-XXXXXX |
| bq_project_id | string | yes | BigQuery destination project; reuse the current export destination if one exists |
| dataset_id | string | yes | Exact BigQuery destination dataset |
| location | string | no | BigQuery dataset location (default US); use its existing location |
| gcloud_account | string | yes | Explicit Google administrator email for local gcloud and Console sign-in |
cg_gcp_billing_onboarding_status
Read durable progress, verification, and failure stage for a GCP billing setup session. Uses authenticated organization and session ID; no session token is needed.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | yes | CloudGuard organization ID |
| session_id | string | yes | Session ID returned by cg_onboard_gcp_billing |
cg_query_provider_billing
Query provider account billing evidence for Vultr or Vercel. Evidence is not per-cluster allocation and is not added to resource run-rate. Vercel breakdowns retain project/service attribution and separate effective costs.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | no | Organization ID (uses default org if not specified) |
| provider | string | no | Provider filter: vultr (default) or vercel |
| connector_id | string | no | Optional connector ID filter |
| from_date | string | no | Inclusive UTC start date (YYYY-MM-DD; must be paired with to_date) |
| to_date | string | no | Inclusive UTC end date (YYYY-MM-DD; must be paired with from_date) |
| days | number | no | Lookback in days (default 90, minimum 1, maximum 365); ignored when from_date/to_date are supplied |
Demo
cg_seed_demo_data
Populate an organization with realistic fake GCP projects, resource snapshots, cost history, teams, alerts, and remediation actions for demo/testing.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | no | Organization ID to seed (uses default org if not specified) |
| project_count | number | no | Number of fake projects (1-4, default 3) |
| cost_history_days | number | no | Days of cost history to generate (default 30) |
Native app
cg_open_overview
Read a complete Cloud Guardian overview of connected projects and resource costs, with an interactive view in supported hosts. Reads saved data without scanning or changing infrastructure.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | no | Organization ID; automatically selects a sole organization, otherwise opens an organization chooser |
| refresh | boolean | no | Bypass the 30-second in-process overview cache for a fresh read |
cg_overview_app
Open the native cost overview immediately, using a recent session snapshot while saved data loads in the background. For a complete text summary, call cg_open_overview.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | no | Organization ID; automatically selects a sole organization, otherwise opens an organization chooser |
cg_search_mentions
Search connected Cloud Guardian projects for composer mentions. Empty query lists available projects; returns at most 20 authenticated resource references.
| Parameter | Type | Required | Description |
|---|---|---|---|
| query | string | yes | Search text, which may be empty (maximum 200 characters) |
| org_id | string | no | Optional organization to search; defaults to all available organizations |
Costs
cg_explore_vercel_costs
Explore Vercel billed and effective costs by project and service using the local Vercel CLI login. Reads the specified team directly; Cloud Guardian sign-in or a persistent connector is not required. Defaults to the current billing period. Requires Vercel CLI with usage support and vercel login. Charges are separate from Cloud Guardian resource monthly run-rates.
| Parameter | Type | Required | Description |
|---|---|---|---|
| team | string | yes | Vercel team slug or ID (explicit scope, for example my-team or team_...) |
| from_date | string | no | Inclusive YYYY-MM-DD start date, interpreted in America/Los_Angeles; must pair with to_date |
| to_date | string | no | Inclusive YYYY-MM-DD end date, interpreted in America/Los_Angeles; must pair with from_date |
Projects
cg_onboard_vercel
Connect one Vercel team for scheduled project inventory and actual billed/effective cost exploration. Reuses a matching connector. Requires an explicit Cloud Guardian organization and dedicated Vercel team token (or CLOUD_GUARDIAN_VERCEL_TOKEN environment variable). Stores credentials encrypted; never imports the local CLI OAuth session. First scheduled scan supplies provisional billing observations and project links; use cg_explore_vercel_costs for immediate local CLI exploration.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | yes | Cloud Guardian organization ID |
| team_id | string | yes | Explicit Vercel team ID, beginning team_; use Vercel team discovery to resolve a slug |
| api_token | string | no | Dedicated secret Vercel token. Prefer CLOUD_GUARDIAN_VERCEL_TOKEN to avoid copying secrets into chat; omitted when reusing an existing connector. |
| name | string | no | Optional connector display name |
cg_onboard_vultr
Onboard a Vultr account and its VKE clusters atomically after verifying account-wide read permissions.
| Parameter | Type | Required | Description |
|---|---|---|---|
| org_id | string | yes | Cloud Guardian organization ID |
| api_key | string | yes | Secret Vultr API key; never displayed or logged |
| name | string | no | Optional connector display name |