> For the complete documentation index, see [llms.txt](https://docs.ionos.com/cloud/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ionos.com/cloud/ai/mcp-server/tool-reference.md).
# Tool Reference
This page lists all tools that the MCP server exposes, organised by product. The server is read-only by default; write tools on Compute Engine and Managed Kubernetes are opt-in.
For full parameter schemas and return field definitions, see the source documentation in the [ionoscloud-mcp repository](https://github.com/ionos-cloud/ionoscloud-mcp/tree/main/docs).
All tools are registered at startup by default. If you have opted into lazy mode by setting `IONOS_MCP_LOAD_MODE=lazy`, Compute Engine and Object Storage tools register only after you call the matching loader sentinel. For more information, see [Selective Tool Loading](/cloud/ai/mcp-server/configuration/selective-tool-loading.md).
## Tool scopes
The **Scope** column in the tables below shows the lowest `IONOS_MCP_TOOL_SCOPE` value at which each tool is registered. A tool that the active scope disallows is never registered and does not appear in the server's tool list at all.
| Scope | Registers | Tools |
| ---------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------- | ----- |
| `read` (default, and the value when the variable is unset) | `list_*`, `get_*`, `head_*` | 118 |
| `write` | The above, plus `create_*`, `update_*`, `start_`, `resume_`, `attach_`, `assign_` | 165 |
| `destructive` | The above, plus `delete_*`, `stop_`, `reboot_`, `suspend_`, `upgrade_`, `restore_`, `detach_`, `recreate_` | 195 |
Every `create_*` tool, every `delete_*` tool, and every disruptive action is confirmation-gated: the first call returns a preview and a single-use token, and only a second call carrying that token performs the operation. For more information, see [Write Operations](/cloud/ai/mcp-server/configuration/write-operations.md).
## Loader tools
The loader sentinels below are present **only when `IONOS_MCP_LOAD_MODE=lazy`** is set; in the default eager mode they do not appear because Compute Engine and Object Storage tools are already registered.
| Tool | Description |
| -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `ionos_load_compute_tools` | Registers the Compute Engine tools and notifies the client to refresh its tool catalog (lazy mode only). Registers 50 read-only tools, or more if write tools are enabled |
| `ionos_load_objectstorage_tools` | Registers all 23 Object Storage tools and notifies the client to refresh its tool catalog (lazy mode only) |
## Most commonly used tools
If you are just getting started, these tools cover the most frequent use cases:
| Tool | What it does |
| ------------------------------- | ------------------------------------------------------------------------------------ |
| `list_datacenters` | Entry point for all Compute exploration; lists your data centers and their locations |
| `list_servers` | Lists servers in a data center |
| `list_billing_invoices` | Lists your invoices; starting point for cost checks |
| `get_billing_utilization_daily` | Daily resource usage breakdown; starting point for cost analysis |
| `list_dns_zones` | Lists all DNS zones; starting point for DNS audit |
| `list_object_storage_buckets` | Lists all Object Storage buckets |
| `get_contract` | Shows account-level resource limits and contract information |
| `list_activitylog_events` | Queries the full API audit trail: who did what, when, on which resource |
## [Compute Engine](https://docs.ionos.com/cloud/compute-services/compute-engine)
### Data centers
| Tool | Scope | Description |
| ------------------- | ------------- | --------------------------------------------- |
| `list_datacenters` | `read` | List all data centers in your account |
| `get_datacenter` | `read` | Get details of a specific data center |
| `create_datacenter` | `write` | Create one data center in a location |
| `update_datacenter` | `write` | Update a data center's name or description |
| `delete_datacenter` | `destructive` | Delete a data center and everything inside it |
### Servers
| Tool | Scope | Description |
| ------------------------------- | ------------- | ----------------------------------------------------------------------------------------------- |
| `list_servers` | `read` | List all servers in a data center |
| `get_server` | `read` | Get details of a specific server |
| `list_server_volumes` | `read` | List volumes attached to a server |
| `list_server_cdroms` | `read` | List CD-ROMs attached to a server |
| `list_server_gpus` | `read` | List GPUs attached to a server |
| `get_server_gpu` | `read` | Get details of a specific GPU |
| `get_server_remote_console` | `read` | Get the remote console URL for a server |
| `create_server` | `write` | Create one server (virtual machine) in a data center |
| `update_server` | `write` | Update a server's name, cores, RAM, CPU family, hostname, Multi Queue setting, or `bootVolume` |
| `start_server` | `write` | Start a stopped ENTERPRISE, VCPU, or GPU server |
| `resume_server` | `write` | Resume a suspended CUBE server |
| `attach_server_volume` | `write` | Attach an existing volume to a server |
| `assign_server_security_groups` | `write` | Set which security groups a server has |
| `delete_server` | `destructive` | Delete a server |
| `stop_server` | `destructive` | Stop an ENTERPRISE, VCPU, or GPU server; equivalent to cutting power, so unwritten data is lost |
| `reboot_server` | `destructive` | Restart a server |
| `suspend_server` | `destructive` | Suspend a CUBE server |
| `upgrade_server` | `destructive` | Upgrade a server to the latest available hardware generation |
| `detach_server_volume` | `destructive` | Detach a volume from a server |
Power actions are asynchronous. Check progress with `get_server` and read `vmState`.
### Volumes
| Tool | Scope | Description |
| ------------------------- | ------------- | ------------------------------------------------------------------------ |
| `list_volumes` | `read` | List all volumes in a data center |
| `get_volume` | `read` | Get details of a specific volume |
| `create_volume` | `write` | Create one storage volume in a data center |
| `update_volume` | `write` | Update a volume's name, size, bus type, serial exposure, or `bootOrder` |
| `create_volume_snapshot` | `write` | Take a snapshot of a volume, capturing its contents at that moment |
| `delete_volume` | `destructive` | Delete a storage volume and all data on it |
| `restore_volume_snapshot` | `destructive` | Restore a snapshot onto a volume, overwriting everything currently on it |
### NICs
| Tool | Scope | Description |
| ---------------------------- | ------------- | ----------------------------------------------------------------- |
| `list_nics` | `read` | List all NICs on a server |
| `get_nic` | `read` | Get details of a specific NIC |
| `create_nic` | `write` | Create one NIC on a server and connect it to a LAN |
| `update_nic` | `write` | Update a NIC's name, LAN, IP addresses, or firewall settings |
| `assign_nic_security_groups` | `write` | Set which security groups a NIC has |
| `delete_nic` | `destructive` | Delete a NIC from a server, with its firewall rules and flow logs |
### LANs
| Tool | Scope | Description |
| --------------- | ------------- | ---------------------------------------------------------------------------- |
| `list_lans` | `read` | List all LANs in a data center |
| `get_lan` | `read` | Get details of a specific LAN |
| `list_lan_nics` | `read` | List NICs connected to a LAN |
| `create_lan` | `write` | Create one LAN in a data center |
| `update_lan` | `write` | Update a LAN's name, public or private setting, cross connect, or IPv6 block |
| `delete_lan` | `destructive` | Delete a LAN |
### Firewall rules
| Tool | Scope | Description |
| ---------------------- | ------------- | --------------------------------------- |
| `list_firewall_rules` | `read` | List firewall rules on a NIC |
| `get_firewall_rule` | `read` | Get details of a specific firewall rule |
| `create_firewall_rule` | `write` | Add one firewall rule to a NIC |
| `update_firewall_rule` | `write` | Update a firewall rule on a NIC |
| `delete_firewall_rule` | `destructive` | Delete a firewall rule from a NIC |
### IP blocks
| Tool | Scope | Description |
| ----------------- | ------------- | ---------------------------------------- |
| `list_ip_blocks` | `read` | List all IP blocks in your account |
| `get_ip_block` | `read` | Get details of a specific IP block |
| `create_ip_block` | `write` | Reserve a block of public IPv4 addresses |
| `delete_ip_block` | `destructive` | Release a block of public IPv4 addresses |
An IP block cannot be renamed through the MCP server. For more information, see [Operations that are not available](/cloud/ai/mcp-server/configuration/write-operations.md#operations-that-are-not-available).
### Load balancers
| Tool | Scope | Description |
| ------------------------ | ------------- | ------------------------------------------------------------------------- |
| `list_loadbalancers` | `read` | List all load balancers in a data center |
| `get_loadbalancer` | `read` | Get details of a specific load balancer |
| `list_loadbalancer_nics` | `read` | List NICs associated with a load balancer |
| `create_loadbalancer` | `write` | Create one classic load balancer |
| `update_loadbalancer` | `write` | Update a classic load balancer's name, listening address, or DHCP setting |
| `delete_loadbalancer` | `destructive` | Delete a classic load balancer |
### Network load balancers
| Tool | Scope | Description |
| ----------------------------- | ------------- | -------------------------------------------------------------------------------------- |
| `list_network_loadbalancers` | `read` | List all network load balancers in a data center |
| `get_network_loadbalancer` | `read` | Get details of a specific network load balancer |
| `list_nlb_forwarding_rules` | `read` | List forwarding rules of a network load balancer |
| `create_network_loadbalancer` | `write` | Create one network load balancer |
| `update_network_loadbalancer` | `write` | Update a network load balancer's name, listener LAN, target LAN, addresses, or logging |
| `create_nlb_forwarding_rule` | `write` | Add one forwarding rule to a network load balancer |
| `update_nlb_forwarding_rule` | `write` | Update a network load balancer forwarding rule |
| `delete_network_loadbalancer` | `destructive` | Delete a network load balancer and all its forwarding rules |
| `delete_nlb_forwarding_rule` | `destructive` | Delete a forwarding rule from a network load balancer |
### Application load balancers
| Tool | Scope | Description |
| --------------------------------- | ------------- | ------------------------------------------------------------------------------------------- |
| `list_application_loadbalancers` | `read` | List all application load balancers in a data center |
| `get_application_loadbalancer` | `read` | Get details of a specific application load balancer |
| `list_alb_forwarding_rules` | `read` | List forwarding rules of an application load balancer |
| `create_application_loadbalancer` | `write` | Create one application load balancer |
| `update_application_loadbalancer` | `write` | Update an application load balancer's name, listener LAN, target LAN, addresses, or logging |
| `create_alb_forwarding_rule` | `write` | Add one forwarding rule to an application load balancer |
| `update_alb_forwarding_rule` | `write` | Update an application load balancer forwarding rule |
| `delete_application_loadbalancer` | `destructive` | Delete an application load balancer and all its forwarding rules |
| `delete_alb_forwarding_rule` | `destructive` | Delete a forwarding rule from an application load balancer |
### Target groups
| Tool | Scope | Description |
| --------------------- | ------------- | ------------------------------------------------------------------------------------------------- |
| `list_target_groups` | `read` | List all target groups in your account |
| `get_target_group` | `read` | Get details of a specific target group |
| `create_target_group` | `write` | Create one target group: a named pool of backends that application load balancer rules forward to |
| `update_target_group` | `write` | Update a target group's name, algorithm, protocol, or backends |
| `delete_target_group` | `destructive` | Delete a target group |
### NAT gateways
| Tool | Scope | Description |
| ------------------------- | ------------- | ------------------------------------------------------------- |
| `list_nat_gateways` | `read` | List all NAT gateways in a data center |
| `get_nat_gateway` | `read` | Get details of a specific NAT gateway |
| `list_nat_gateway_rules` | `read` | List rules of a NAT gateway |
| `create_nat_gateway` | `write` | Create one NAT gateway |
| `update_nat_gateway` | `write` | Update a NAT gateway's name, public addresses, or served LANs |
| `create_nat_gateway_rule` | `write` | Add one translation rule to a NAT gateway |
| `update_nat_gateway_rule` | `write` | Update a NAT gateway translation rule |
| `delete_nat_gateway` | `destructive` | Delete a NAT gateway and all its rules |
| `delete_nat_gateway_rule` | `destructive` | Delete a translation rule from a NAT gateway |
### Security groups
| Tool | Scope | Description |
| ---------------------------- | ------------- | ----------------------------------------------------------------------------------- |
| `list_security_groups` | `read` | List all security groups in a data center |
| `get_security_group` | `read` | Get details of a specific security group |
| `list_security_group_rules` | `read` | List rules in a security group |
| `get_security_group_rule` | `read` | Get details of a specific security group rule |
| `create_security_group` | `write` | Create one security group in a data center |
| `update_security_group` | `write` | Update a security group's name or description |
| `create_security_group_rule` | `write` | Add one rule to a security group, so every server and NIC in that group inherits it |
| `update_security_group_rule` | `write` | Update a rule in a security group |
| `delete_security_group` | `destructive` | Delete a security group and all the rules in it |
| `delete_security_group_rule` | `destructive` | Delete a rule from a security group |
To attach a security group to a resource, use `assign_server_security_groups` or `assign_nic_security_groups`.
### Private cross connects
| Tool | Scope | Description |
| ----------------------------- | ------------- | ---------------------------------------------------- |
| `list_private_cross_connects` | `read` | List all private cross connects in your account |
| `get_private_cross_connect` | `read` | Get details of a specific private cross connect |
| `create_pcc` | `write` | Create one private cross connect |
| `update_pcc` | `write` | Update a private cross connect's name or description |
| `delete_pcc` | `destructive` | Delete a private cross connect |
### Snapshots
| Tool | Scope | Description |
| ----------------- | ------------- | ----------------------------------------------------------------------------------------- |
| `list_snapshots` | `read` | List all snapshots in your account |
| `get_snapshot` | `read` | Get details of a specific snapshot |
| `update_snapshot` | `write` | Update a snapshot's name, description, licence type, protection flag, or capability flags |
| `delete_snapshot` | `destructive` | Delete a snapshot |
To create a snapshot, use `create_volume_snapshot` on the volume you want to capture.
### Images
| Tool | Scope | Description |
| -------------- | ------------- | ------------------------------------------------------------------------------------------------------- |
| `list_images` | `read` | List all available images |
| `update_image` | `write` | Update a private image's name, description, licence type, cloud-init compatibility, or capability flags |
| `delete_image` | `destructive` | Delete a private image |
### Templates
| Tool | Scope | Description |
| ---------------- | ------ | ---------------------------------- |
| `list_templates` | `read` | List all server templates |
| `get_template` | `read` | Get details of a specific template |
### Locations
| Tool | Scope | Description |
| ---------------- | ------ | ---------------------------------------- |
| `list_locations` | `read` | List all available IONOS CLOUD locations |
### Requests
| Tool | Scope | Description |
| -------------------- | ------ | ----------------------------------------- |
| `list_requests` | `read` | List recent API requests and their status |
| `get_request` | `read` | Get details of a specific request |
| `get_request_status` | `read` | Get the current status of a request |
### Contract
| Tool | Scope | Description |
| -------------- | ------ | ------------------------------------------------------------ |
| `get_contract` | `read` | Get contract and resource limit information for your account |
## [Managed Kubernetes](https://docs.ionos.com/cloud/containers/managed-kubernetes)
Kubernetes tools are always registered at startup, regardless of the `IONOS_MCP_LOAD_MODE` setting.
### Clusters
| Tool | Scope | Description |
| -------------------- | ------------- | ------------------------------------------------------------------------------------------------------------ |
| `list_k8s_clusters` | `read` | List all Kubernetes clusters in your account |
| `get_k8s_cluster` | `read` | Get details of a specific Kubernetes cluster |
| `create_k8s_cluster` | `write` | Create one Managed Kubernetes cluster (the control plane) |
| `update_k8s_cluster` | `write` | Update a cluster's name, Kubernetes version, maintenance window, API server allow list, or audit-log buckets |
| `delete_k8s_cluster` | `destructive` | Delete a Managed Kubernetes cluster |
After creation, you cannot change the cluster location, NAT gateway IP, node subnet, or the public/private setting.
### Node pools
| Tool | Scope | Description |
| --------------------- | ------------- | ---------------------------------------------------------------------------------------------------------------------------- |
| `list_k8s_nodepools` | `read` | List all node pools in a Kubernetes cluster |
| `get_k8s_nodepool` | `read` | Get details of a specific Kubernetes node pool |
| `create_k8s_nodepool` | `write` | Create one node pool of worker nodes |
| `update_k8s_nodepool` | `write` | Scale or upgrade a node pool, or change its maintenance window, autoscaling bounds, LANs, labels, annotations, or public IPs |
| `delete_k8s_nodepool` | `destructive` | Delete a node pool and all its worker nodes |
The node pool name and its per-node hardware are immutable after creation.
### Nodes
| Tool | Scope | Description |
| ------------------------- | ------------- | ------------------------------------------------------------------ |
| `list_k8s_nodepool_nodes` | `read` | List all nodes in a Kubernetes node pool |
| `get_k8s_node` | `read` | Get details of a specific node in a Kubernetes node pool |
| `recreate_k8s_node` | `destructive` | Recreate one worker node |
| `delete_k8s_node` | `destructive` | Delete one worker node; pods are evicted and local storage is lost |
To replace a node, use `recreate_k8s_node`. `delete_k8s_node` removes the node first, and an active autoscaler may hold the pool at the smaller size instead of replacing it.
### Versions
| Tool | Scope | Description |
| ------------------------- | ------ | ------------------------------------------------------------------------------- |
| `list_k8s_versions` | `read` | List all available Kubernetes versions |
| `get_k8s_default_version` | `read` | Get the current default Kubernetes version that new clusters and node pools use |
{% hint style="info" %}
**Managed Kubernetes writes are asynchronous.** The API answers with `202 Accepted` and the tool returns before the change has taken effect. Poll `get_k8s_cluster` or `get_k8s_nodepool` and read `metadata.state` before chaining a dependent call. A resource in the `BUSY` state queues further modifications rather than rejecting them.
{% endhint %}
{% hint style="info" %}
**Kubeconfig retrieval is intentionally not exposed:** A kubeconfig grants workload-level access to the cluster, which exceeds the inspection and provisioning scope of this server. Download it from the DCD or from space.vars.ionos\_cloud\_api instead.
{% endhint %}
## [IONOS CLOUD Object Storage](https://docs.ionos.com/cloud/backup-and-storage/ionos-object-storage)
### Buckets
| Tool | Description |
| ------------------------------------ | ------------------------------------------------------- |
| `list_object_storage_buckets` | List all Object Storage buckets in your account |
| `get_object_storage_bucket_location` | Get the location of a bucket |
| `head_object_storage_bucket` | Check whether a bucket exists and retrieve its metadata |
### Bucket configuration
| Tool | Description |
| ----------------------------------------------- | -------------------------------------------------------- |
| `get_object_storage_bucket_cors` | Get the CORS configuration of a bucket |
| `get_object_storage_bucket_encryption` | Get the server-side encryption configuration of a bucket |
| `get_object_storage_bucket_lifecycle` | Get the lifecycle configuration of a bucket |
| `get_object_storage_bucket_policy` | Get the bucket policy |
| `get_object_storage_bucket_policy_status` | Get the public access status of the bucket policy |
| `get_object_storage_bucket_replication` | Get the replication configuration of a bucket |
| `get_object_storage_bucket_tagging` | Get the tags applied to a bucket |
| `get_object_storage_bucket_versioning` | Get the versioning configuration of a bucket |
| `get_object_storage_bucket_public_access_block` | Get the public access block configuration of a bucket |
| `get_object_storage_bucket_lock_configuration` | Get the Object Lock configuration of a bucket |
### Objects
| Tool | Description |
| -------------------------------------- | -------------------------------------------------------- |
| `list_object_storage_objects` | List objects in a bucket |
| `head_object_storage_object` | Check whether an object exists and retrieve its metadata |
| `list_object_storage_object_versions` | List versions of an object |
| `get_object_storage_object_tagging` | Get the tags applied to an object |
| `get_object_storage_object_retention` | Get the retention settings of an object |
| `get_object_storage_object_legal_hold` | Get the legal hold status of an object |
### Access keys
| Tool | Description |
| --------------------------------- | --------------------------------------------------- |
| `list_object_storage_access_keys` | List all Object Storage access keys in your account |
| `get_object_storage_access_key` | Get details of a specific access key |
### Regions
| Tool | Description |
| ----------------------------- | ----------------------------------------------- |
| `list_object_storage_regions` | List all available Object Storage regions |
| `get_object_storage_region` | Get details of a specific Object Storage region |
## [Cloud DNS](https://docs.ionos.com/cloud/network-services/cloud-dns)
### Zones
| Tool | Description |
| ------------------- | ---------------------------------- |
| `list_dns_zones` | List all DNS zones in your account |
| `get_dns_zone` | Get details of a specific DNS zone |
| `get_dns_zone_file` | Get the zone file for a DNS zone |
### Records
| Tool | Description |
| --------------------------------- | --------------------------------------- |
| `list_dns_records` | List all DNS records across all zones |
| `list_dns_zone_records` | List all records in a specific DNS zone |
| `get_dns_record` | Get details of a specific DNS record |
| `list_dns_secondary_zone_records` | List records in a secondary DNS zone |
### Reverse records
| Tool | Description |
| -------------------------- | -------------------------------------------- |
| `list_dns_reverse_records` | List all reverse DNS records |
| `get_dns_reverse_record` | Get details of a specific reverse DNS record |
### Secondary zones
| Tool | Description |
| ----------------------------- | -------------------------------------------- |
| `list_dns_secondary_zones` | List all secondary DNS zones |
| `get_dns_secondary_zone` | Get details of a specific secondary DNS zone |
| `get_dns_secondary_zone_axfr` | Get the AXFR status of a secondary DNS zone |
### DNSSEC
| Tool | Description |
| --------------------------- | ------------------------------- |
| `list_dns_zone_dnssec_keys` | List DNSSEC keys for a DNS zone |
### Quota
| Tool | Description |
| --------------- | ---------------------------------------- |
| `get_dns_quota` | Get DNS quota and usage for your account |
## [Billing](https://docs.ionos.com/cloud/management/usage/cost-and-usage)
All Billing tools are available at startup; no loader call required.
The billing tools return native IONOS API fields. To produce **FOCUS v1.3** (FinOps Open Cost and Usage Specification) output, the server ships the full column mapping in two equivalent forms:
* the MCP resource `ionos://billing/focus-v1.3` (preferred when the AI client supports `resources/read`)
* the tool `get_billing_focus_spec` (use this when the client does not expose resources)
Ask your AI assistant to read whichever is available, then apply the mapping to the raw tool responses. For more information, see [FinOps and FOCUS Billing](/cloud/ai/mcp-server/use-cases/finops-focus-billing.md). Currency follows the contract billing currency; timestamps are UTC ISO-8601; quantity units depend on the resource (see `PricingUnit` in the pricing catalog).
### FOCUS
| Tool | Description |
| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `get_billing_focus_spec` | Returns the FOCUS v1.3 column specification and IONOS tool → FOCUS field mappings. Equivalent to reading the `ionos://billing/focus-v1.3` resource; use this when your AI client does not support `resources/read` |
### Profile
| Tool | Description |
| --------------------- | ---------------------------------------- |
| `get_billing_profile` | Get the billing profile for your account |
### Invoices
| Tool | Description |
| --------------------------------- | ------------------------------------------- |
| `list_billing_invoices` | List all invoices |
| `list_billing_invoices_by_period` | List invoices for a specific billing period |
| `get_billing_invoice` | Get details of a specific invoice |
### EVN (provisioning intervals)
An EVN record captures the start and end of each billed provisioning interval for a resource: the unit that space.vars.ionos\_cloud uses to calculate hourly charges. Each time a resource is created, resized, or deleted, a new EVN record is produced.
| Tool | Description |
| ---------------------------- | ------------------------------------------------------- |
| `list_billing_evn` | List all provisioning interval records |
| `list_billing_evn_by_period` | List provisioning interval records for a billing period |
### Traffic
| Tool | Description |
| -------------------------------- | ------------------------------------------------ |
| `list_billing_traffic` | List traffic usage records |
| `list_billing_traffic_by_period` | List traffic usage for a specific billing period |
### Usage
| Tool | Description |
| --------------------------------- | ----------------------------------------- |
| `list_billing_usage` | List resource usage records |
| `get_billing_usage_by_datacenter` | Get resource usage grouped by data center |
### Utilization
| Tool | Description |
| ------------------------------------ | ---------------------------------------- |
| `list_billing_utilization` | List usage records |
| `list_billing_utilization_by_period` | List usage for a specific billing period |
| `get_billing_utilization_daily` | Get daily usage for a specific period |
### Products
| Tool | Description |
| ----------------------- | -------------------------------------------- |
| `list_billing_products` | List the IONOS CLOUD product pricing catalog |
## [Activity Log](https://docs.ionos.com/cloud/observability/activity-logs)
All Activity Log tools are available at startup; no loader call required. They appear in the catalog regardless of token privileges; if the token is missing the `ACCESS_ACTIVITY_LOG` privilege, calls return 403 even though the tools are listed. For more information, see [Authentication](/cloud/ai/mcp-server/configuration/authentication.md).
### Contracts
| Tool | Description |
| ---------------------------- | ----------------------------------------------------------------------------------------------------------------------- |
| `list_activitylog_contracts` | List contracts available for Activity Log queries; primarily for reseller and partner users managing multiple contracts |
### Events
| Tool | Description |
| ------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `list_activitylog_events` | Query the full API audit trail for a contract: who did what, when, on which resource. Supports date range, user, and event type filters. Defaults to the last 7 days, 25 events, excluding high-volume status updates |
## [Certificate Manager](https://docs.ionos.com/cloud/security/certificate-manager)
### Certificates
| Tool | Description |
| ------------------------ | ------------------------------------- |
| `list_cert_certificates` | List all certificates |
| `get_cert_certificate` | Get details of a specific certificate |
### Auto-certificates
| Tool | Description |
| ----------------------------- | ------------------------------------------ |
| `list_cert_auto_certificates` | List all auto-certificates |
| `get_cert_auto_certificate` | Get details of a specific auto-certificate |
### Providers
| Tool | Description |
| --------------------- | ---------------------------------------------- |
| `list_cert_providers` | List all certificate providers |
| `get_cert_provider` | Get details of a specific certificate provider |
## Scope boundaries
Write tools are available on Compute Engine and Managed Kubernetes only. space.vars.ionos\_cloud\_object\_storage, Cloud DNS, Billing, Certificate Manager, and Activity Log are read-only at every scope level.
The following are out of scope for all products:
| Product | Not included |
| -------------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
| Compute Engine | Real-time metrics, health checks, autoscaling configuration, console access beyond the remote-console URL |
| Managed Kubernetes | Kubeconfig retrieval, workload-level operations inside a cluster |
| IONOS CLOUD Object Storage | Bucket metrics, replication status monitoring, inventory reports, and all create, update, and delete operations |
| Cloud DNS | Dynamic DNS, zone transfer triggering (AXFR status is readable, not triggerable), and all create, update, and delete operations |
| Billing | Payment methods, invoice download, budget alert configuration |
| Certificate Manager | Certificate issuance or renewal |
A small number of Compute Engine write operations are also unavailable because the space.vars.ionos\_cloud Go SDK cannot construct a request the API accepts. For more information, see [Operations that are not available](/cloud/ai/mcp-server/configuration/write-operations.md#operations-that-are-not-available).
## Next steps
* [Write Operations](/cloud/ai/mcp-server/configuration/write-operations.md): enable write tools and understand the confirmation flow
* [Use Cases](/cloud/ai/mcp-server/use-cases.md): see the tools in action in real workflows
* [Quick Start](/cloud/ai/mcp-server/quick-start.md): connect to your first AI client
* [Selective Tool Loading](/cloud/ai/mcp-server/configuration/selective-tool-loading.md): if Compute or Object Storage tools are not visible
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.ionos.com/cloud/ai/mcp-server/tool-reference.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.