# mcp-terraform

**Repository Path**: boranli_admin/mcp-ecs

## Basic Information

- **Project Name**: mcp-terraform
- **Description**: MCP+terraform 双框架，实现自动化完成云上资源查询、创建和删除
- **Primary Language**: Unknown
- **License**: Not specified
- **Default Branch**: master
- **Homepage**: None
- **GVP Project**: No

## Statistics

- **Stars**: 0
- **Forks**: 0
- **Created**: 2026-06-17
- **Last Updated**: 2026-06-22

## Categories & Tags

**Categories**: Uncategorized

**Tags**: None

## README

# Huawei Cloud MCP

`huaweicloud_mcp` is a Python/FastMCP server for safe Huawei Cloud China resource provisioning. The first version focuses on the ECS creation workflow: inspect configuration, query dependencies, produce a creation plan, dry-run the request, submit a confirmed creation, and query job status.

The server is designed for distribution. Account credentials, region, project id, resource defaults, billing mode, counts, and safety limits are read from `.env`, environment variables, or `config.yaml`; no account-specific value is hard-coded. Exact `image_id` and `flavor_id` are optional: when they are omitted, the server resolves them from natural preferences such as `2 vCPU / 4 GiB` and `Ubuntu`.

## Features

- FastMCP stdio server named `huaweicloud_mcp`
- Optional streamable HTTP transport via environment variables
- Huawei Cloud China account configuration checks
- Read-only tools for regions, availability zones, VPCs, subnets, security groups, images, flavors, ECS instances, and job status
- ECS creation plan generation without provisioning
- ECS creation tool with default `dry_run=true`
- Explicit confirmation required for real creation
- Configurable allowlists and resource limits
- JSON Lines audit log for creation attempts
- JSON and Markdown responses for data-returning tools

## Safety Design

Creation tools are intentionally conservative:

- Real creation is disabled unless `dry_run=false`.
- Real creation also requires `confirm="CREATE_HUAWEICLOUD_RESOURCE"` by default.
- Public EIP creation is disabled by default.
- Region, resource type, flavor, image, instance count, disk sizes, and EIP bandwidth are validated before every create call.
- Deletion, unsubscribe, auto-pay, auto-renew, and billing-mode changes are not implemented in the first version.
- AK/SK, security tokens, passwords, and private keys are redacted from output and audit logs.

## Install

```powershell
uv sync --extra test
```

## Run

Default stdio transport:

```powershell
uv run huaweicloud-mcp
```

Streamable HTTP transport:

```powershell
$env:MCP_TRANSPORT = "streamable_http"
$env:MCP_HOST = "127.0.0.1"
$env:MCP_PORT = "8000"
uv run huaweicloud-mcp
```

The server maps `streamable_http` to the FastMCP transport name `streamable-http` and serves the MCP endpoint at `/mcp`.

## Configuration

Copy the examples and edit them for your Huawei Cloud China account:

```powershell
Copy-Item .env.example .env
Copy-Item config.example.yaml config.yaml
```

Sensitive values should be placed in `.env` or exported as environment variables:

```env
HUAWEICLOUD_AK=replace-with-ak
HUAWEICLOUD_SK=replace-with-sk
HUAWEICLOUD_REGION=cn-north-4
HUAWEICLOUD_PROJECT_ID=replace-with-project-id
```

Normal defaults and safety limits belong in `config.yaml`. For ECS image and flavor, you can either set exact IDs or let the server resolve them from preferences:

```yaml
defaults:
  vpc_id: "your-vpc-id"
  subnet_id: "your-subnet-id"
  security_group_id: "your-security-group-id"

  # Optional exact IDs. Leave empty for automatic resolution.
  image_id: ""
  flavor_id: ""

  # Used when flavor_id is empty.
  flavor_vcpus: 2
  flavor_memory_gb: 4
  flavor_name_contains: ""

  # Used when image_id is empty.
  image_os_type: Linux
  image_name_contains: Ubuntu
  image_visibility: ""
  image_type: gold
```

`vpc_id`, `subnet_id`, and `security_group_id` are still required for creation because they define the network where the ECS will be placed. `image_id` and `flavor_id` are no longer required if the preference fields can resolve a unique usable candidate.

`image_type: gold` is the default for automatic image selection. It avoids marketplace images that can trigger product-order failures during ECS creation.

## MCP Client Config

Example stdio configuration:

```json
{
  "mcpServers": {
    "huaweicloud_mcp": {
      "command": "uv",
      "args": ["run", "huaweicloud-mcp"],
      "cwd": "D:\\workspace\\mcp-service"
    }
  }
}
```

If `uv` is not on PATH, use the absolute path to `uv.exe`.

## Tools

- `huaweicloud_check_config`: check local configuration without exposing secrets.
- `huaweicloud_check_auth`: validate Huawei Cloud authentication with a read-only API call.
- `huaweicloud_list_regions`: list known/configured China regions.
- `huaweicloud_list_availability_zones`: list AZs for the configured region.
- `huaweicloud_list_vpcs`: list VPCs.
- `huaweicloud_list_subnets`: list subnets.
- `huaweicloud_list_security_groups`: list security groups.
- `huaweicloud_list_images`: list images.
- `huaweicloud_list_ecs_flavors`: list ECS flavors.
- `huaweicloud_plan_create_ecs`: produce an ECS creation plan only.
- `huaweicloud_create_ecs`: dry-run or submit a confirmed ECS creation request.
- `huaweicloud_get_job_status`: query async job status.
- `huaweicloud_list_ecs`: list ECS instances.
- `huaweicloud_get_ecs`: get one ECS instance.

## Typical Flow

1. Check configuration:

```text
Call huaweicloud_check_config with response_format="markdown".
```

2. Generate a plan:

```text
Call huaweicloud_plan_create_ecs with instance_count=1, flavor_vcpus=2, flavor_memory_gb=4, image_name_contains="Ubuntu", and response_format="json".
```

3. Dry-run creation:

```text
Call huaweicloud_create_ecs with dry_run=true.
```

4. Submit real creation:

```text
Call huaweicloud_create_ecs with dry_run=false and confirm="CREATE_HUAWEICLOUD_RESOURCE".
```

5. Track the job:

```text
Call huaweicloud_get_job_status with the returned job_id.
```

## Test

Tests use mocks and do not create real Huawei Cloud resources:

```powershell
uv run pytest
uv run python -m py_compile src/huaweicloud_mcp/server.py
```

## MCP Inspector

```powershell
npx @modelcontextprotocol/inspector uv run huaweicloud-mcp
```

## Troubleshooting

- AK/SK error: verify `HUAWEICLOUD_AK` and `HUAWEICLOUD_SK`.
- Project mismatch: confirm `HUAWEICLOUD_REGION` and `HUAWEICLOUD_PROJECT_ID` are from the same region.
- Permission denied: attach the needed IAM policies to the dedicated IAM user.
- Quota or balance error: check ECS quota and account billing status in Huawei Cloud.
- Flavor unavailable: query `huaweicloud_list_ecs_flavors` for the target region/AZ.
- Image unavailable: query `huaweicloud_list_images` and update `image_id`.
- Network resource missing: query VPC, subnet, and security group tools and update `config.yaml`.