CloudBase AI Toolkit
Let AI coding tools build, operate, and deploy a CloudBase backend from chat.
The workflows use explicit @claude triggers, read-only repository access, and a default-off boolean gate for cross-repository commits, providing ordinary confirmation and external-effect controls. However, the purpose of OIDC write access, CloudBase/MCP data flows, secret-handling boundaries, and product-level least privilege are not fully documented. Most dependencies and Actions are pinned or security-overridden, but the global @cloudbase/cli@latest installation and an npm install without a lockfile weaken supply-chain reproducibility. Pre-commit diff checks exist, while product-level undo or recovery procedures do not. The MIT notice and Tencent CloudBase attribution are clear, although publisher identity remains unverified by the stated registry.
Concrete tests cover build consistency, compatibility projections, skill mirroring, version sourcing, marketplace metadata, and rejection of invalid targets, supporting full static self-consistency credit. Dependency availability is only partial because tests require local NVM, zsh, and Node 24 and silently skip when unavailable, while workflows separately use Node 18 and 22. Missing-version and invalid-target cases have clear errors, but broader runtime and network failure messages are not shown.
The evidence covers web, mini-program, authentication, UI, specification workflows, and several editor projections, giving broad scenario coverage; builders also reject unsupported publication targets. Generated routing tables and concrete activation vocabulary are test-enforced, earning strong trigger-precision credit. Environment support includes Claude, Cursor, CodeBuddy, Kiro, and MCP, but divergent Node versions, shell/NVM assumptions, and size constraints prevent full marks.
Source/generated separation, compatibility projections, marketplace manifests, and a single metadata source show sound information architecture; naming mappings and semantic version formatting are test-protected. The supplied README-EN.md only redirects to an absent README.md, so installation notes cannot be credited; examples and FAQ support are only indirectly suggested by build tests and the examples-repository workflow. Limitations appear only in comments, skip conditions, and a TODO. The MIT license is complete. Package and skill versioning are present, but no changelog is evidenced. A copyright owner is named, while maintainers, support channels, and update responsibility are not.
The toolkit produces skill packages, editor compatibility files, MCP configuration, marketplace manifests, and example archives whose structure and metadata are tested, making the outputs practically usable. Projecting one skill source across multiple agents and editors supplies clear marginal value. Scores are reduced because no user outcomes, coverage measurements, or adoption evidence are supplied, and deployment cost, API expense, latency, and maintenance burden are undocumented.
Tests trace many claims to exact files, fields, generated paths, versions, and activation terms, providing strong claim traceability. The package manifest, workflows, and several test suites corroborate the build and publication structure, but the main README, skill bodies, implementation scripts, and execution results are absent. Assertions are generally distinguishable from explanatory comments, although capability and marketplace-summary claims are still validated mainly as expected strings rather than independently established facts.
- Do not treat the static test code as evidence that tests ran or behavior was independently verified; no code was executed for this assessment.
- Before enabling production credentials or writes, verify the OIDC purpose, CloudBase/MCP data destinations, secret exposure, and each tool's effective permission scope.
- Pin @cloudbase/cli, add a lockfile for example-build dependencies, and unify or document the Node 18/22/24 compatibility matrix.
- Cross-repository pushing is default-off, but when enabled it uses a PAT and git add .; confirm branch protection, token least privilege, and recovery procedures.
- Provide the main README, installation guidance, known limitations, changelog, and explicit maintenance and security contact paths.
What does this agent do, and when should you use it?
CloudBase AI Toolkit is Tencent Cloud's integration layer between AI coding environments and the CloudBase backend platform. The repository combines a Plugin, Agent Skills, Hooks, and an MCP Server: the Plugin installs the stack, Skills guide implementation patterns, and MCP performs operations against real cloud resources. It publishes the `@cloudbase/cloudbase-mcp` npm package and supports local `npx` execution, Tencent-hosted HTTP access, and a self-hosted Cloud Mode. Its scope includes PostgreSQL and document databases, authorization rules, authentication, object storage, cloud functions, Cloud Run, static hosting, logs, and deployment. Code and deployed resources target the user's own CloudBase environment, while sensitive actions still require human confirmation. It is a strong fit for developers who want Codex, Claude Code, Cursor, or another supported coding tool to deliver a working backend, but it remains tied to the CloudBase service ecosystem.
After connection, CloudBase Skills guide the application structure and @cloudbase/cloudbase-mcp logs in to the user's CloudBase environment to operate resources. The MCP layer can query and change PostgreSQL or document-database data, establish data models and CRUD flows, and configure permissions and security rules. It can also author, deploy, invoke, and debug cloud functions or Cloud Run services; configure login methods and object storage; publish static sites or Mini Programs; inspect logs; and redeploy. The Plugin bundles the MCP Server, Agent Skills, and Hooks, while MCP can be configured independently when only operational access is needed. Local mode runs through npx and includes local-file upload and template features. Hosted HTTP removes the local Node.js requirement but omits some local-file capabilities, while self-hosted remote deployments can set CLOUDBASE_MCP_CLOUD_MODE=true or MCP_CLOUD_MODE=true to disable local filesystem and process tools.
- A full-stack developer using Codex or Claude Code wants an agent to add login, a database, permissions, and deployment to a Todo application.
- A WeChat Mini Program team needs AI-assisted setup of CloudBase data, realtime behavior, authentication, and publishing.
- A developer working in Cursor, WindSurf, or another MCP client wants to inspect data, manage functions, read logs, and redeploy without leaving the conversation.
- A team supporting several AI IDEs wants one Plugin installation to provide the MCP Server, Skills, and Hooks instead of wiring each component separately.
- An organization needing centralized access can use Tencent's hosted HTTP MCP, while a team requiring infrastructure control can run the server in Cloud Mode.
- A developer who wants CloudBase implementation guidance without granting resource access can install and use the Skills separately.
What are this agent's strengths and limitations?
- The Plugin installs the MCP Server, Agent Skills, and Hooks together, reducing repeated setup across compatible AI coding environments.
- It covers an end-to-end CloudBase backend workflow—database, auth, storage, compute, logs, and deployment—instead of stopping at local code generation.
- Local
npx, Tencent-hosted HTTP, and self-hosted Cloud Mode provide distinct choices for local capabilities, managed operation, or infrastructure control. - The documented integration list spans Codex, Claude Code, Cursor, GitHub Copilot, Gemini CLI, and numerous other coding tools.
- Deployments go to the user's own CloudBase environment, and local-mode code does not need to leave the machine until deployment.
- Core operations depend on Tencent CloudBase; moving to another backend provider would require replacing the database, auth, function, and deployment integrations.
- The complete local mode requires Node.js 18.15.0+, while hosted HTTP avoids that dependency at the cost of some local-file features.
- Hosted access requires a CloudBase environment ID and Tencent Cloud Secret ID/Secret Key, creating a credential-management responsibility for teams.
- Sensitive actions still need human confirmation; the Toolkit supplies capabilities and workflows, not security judgment.
- The reported CloudBase-versus-VM evaluation is limited to a specific model, agent framework, task, and controlled setup, so it is not general evidence for every workload.
How do you install or deploy this agent?
You need a CloudBase environment and an AI tool that supports Plugins, Skills, or MCP. Local MCP execution requires Node.js 18.15.0 or newer. For an Open Plugin Spec tool, run npx plugins add TencentCloudBase/cloudbase-plugin. For the CloudBase AI CLI, run npm i -g @cloudbase/cli && tcb ai. For manual MCP setup, configure a server whose command is npx and whose arguments are ["@cloudbase/cloudbase-mcp@latest"]. For hosted HTTP access, use https://tcb-api.cloud.tencent.com/mcp/v1?env_id=<env_id> and provide X-TencentCloud-SecretId and X-TencentCloud-SecretKey headers. A remotely self-hosted server should set CLOUDBASE_MCP_CLOUD_MODE=true or MCP_CLOUD_MODE=true to turn off local filesystem and process tools.
How do you use this agent?
Once installed and connected, enter Login to CloudBase in the AI tool and select an existing, healthy CloudBase environment. A documented first end-to-end prompt is: Use CloudBase Skills to build a todo app with login, database and permissions, then deploy. Skills guide the code and architecture, while MCP creates or changes database, authentication, permission, and deployment resources. Verify the resulting data and APIs in your own environment rather than treating generated local files as completion. If login reports that the environment does not exist, confirm its existence and health in the CloudBase console, then sign in again and choose the correct environment. Review and confirm critical operations such as data changes, permission updates, and deployments before execution.
How does this agent compare with similar options?
Unlike Vercel or Netlify, which the source characterizes as focusing on frontend or container delivery, this Toolkit centers on AI-operated backend building blocks such as databases, authentication, functions, and storage. The repository also describes a controlled comparison with a traditional self-managed cloud VM for the same Todo task: CloudBase performed more favorably on completion latency, token usage, and tool-call count under that specific model and task setup, but the result is explicitly not presented as universally generalizable.
FAQ
What does the Toolkit cost?
Where do the code and deployed resources reside?
How should a remotely self-hosted MCP server be secured?
CLOUDBASE_MCP_CLOUD_MODE=true or MCP_CLOUD_MODE=true to disable local filesystem and process tools for remote callers. Tencent's hosted HTTP service includes this protection.