Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

cloud.redu/mcp

REMOTE · MCP.REDU.CLOUD · SCANNED SEP 21

Agent-native cloud, EU-hosted. Provision VMs, networks & databases on redu.cloud via MCP.

Available components

0 this week 90 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →

Endpoint Security94
Transport & Reachability100
Schema Quality & AI Usability61
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 27275 tokens (~336/item across 81 items; 81 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
  • No destabilizing schema changes in the last 30 days.Pass
Tool Coverage97
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 88% of tool parameters carry a description.Partial
  • Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety96
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • 14 of 17 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "check_deploy_prerequisites" implies "deploy" and declares readOnlyHint instead, contradicting what its own name says it does. See how to fix → Partial
  • An AI judge read all 82 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

How do I install the cloud.redu/mcp server?

cloud.redu/mcp is a hosted endpoint at https://mcp.redu.cloud/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

remote · mcp.redu.cloud

# add to Claude Code
claude mcp add --transport http cloud-redu-mcp 'https://mcp.redu.cloud/mcp'
// .cursor/mcp.json
{
  "mcpServers": {
    "cloud-redu-mcp": {
      "url": "https://mcp.redu.cloud/mcp"
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "cloud-redu-mcp": {
      "type": "http",
      "url": "https://mcp.redu.cloud/mcp"
    }
  }
}
# ~/.codex/config.toml
[mcp_servers.cloud-redu-mcp]
url = "https://mcp.redu.cloud/mcp"
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "cloud-redu-mcp": {
      "type": "remote",
      "url": "https://mcp.redu.cloud/mcp",
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add cloud-redu-mcp --url 'https://mcp.redu.cloud/mcp' --transport streamable-http
# ~/.hermes/config.yaml
mcp_servers:
  cloud-redu-mcp:
    url: "https://mcp.redu.cloud/mcp"
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "cloud-redu-mcp": {
      "Transport": "http",
      "Url": "https://mcp.redu.cloud/mcp"
    }
  }
}
# add to Vellum
assistant mcp add cloud-redu-mcp -t streamable-http -u 'https://mcp.redu.cloud/mcp'
// mcp.json
{
  "mcpServers": {
    "cloud-redu-mcp": {
      "type": "http",
      "url": "https://mcp.redu.cloud/mcp"
    }
  }
}

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 16 Sept 26 0
    • Stability: 0.97 → pass security
  • 15 Sept 26 0
    • Stability: pass → 0.97 functional
  • 26 Aug 26 0
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 25 Aug 26 +1
    • Stability: 0.97 → pass security
  • 24 Aug 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.

  • 22 Aug 26 0
    • Tool “plan_deploy” rewrote its description, which is the text the model reads security
    • New tool “wait_for_deployment” functional
    • “plan_deploy” added an optional parameter “source_token” cosmetic
    • “get_deployment” reworded the description of “redu_md” cosmetic
    • “plan_deploy” reworded the description of “redu_md” cosmetic
  • 21 Aug 26 0
    • New tool “verify_deployment” functional
  • 19 Aug 26 0
    • Tool “get_ssh_command” rewrote its description, which is the text the model reads security
    • “get_ssh_command” reworded the description of “instance_id” cosmetic
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 21 Sept 2026 · Probed https://mcp.redu.cloud/mcp

TLS valid

Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .

Subject Issuer Valid from Valid until Key Signature Serial
CN=*.redu.cloud CN=YE2,O=Let's Encrypt,C=US 6 Aug 2026 4 Nov 2026 ECDSA 384 ECDSA-SHA384 606fedbc02b5d8b84f5612d390aeb9b8245
SANs: *.redu.cloud, redu.cloud
CN=YE2,O=Let's Encrypt,C=US (CA) CN=Root YE,O=ISRG,C=US 3 Sept 2025 2 Sept 2028 ECDSA 384 ECDSA-SHA384 4df3b15dd6c0784c507cd37b58e6f115
CN=Root YE,O=ISRG,C=US (CA) CN=ISRG Root X2,O=Internet Security Research Group,C=US 13 May 2026 2 Sept 2032 ECDSA 384 ECDSA-SHA384 872165fc34b6e5fba8add5b3705fb53a
CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) CN=ISRG Root X1,O=Internet Security Research Group,C=US 13 May 2026 2 Sept 2032 ECDSA 384 SHA256-RSA 6c8f1dc727c7117f7baf853ac980f9cd

Background: What to check on a remote MCP endpoint →

DNSSEC insecure

Validation of mcp.redu.cloud. Not signed

Zone DS Keys Algorithms Outcome
. trust_anchor 20326, 38696 8, 8 Verified
cloud. present 7041 13 Verified
redu.cloud. absent Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation
Authentication Enforced and verified

The endpoint asked for a token and published valid RFC 9728 metadata describing how to get one.

Result Enforced and verified
Enforced On tool calls
HTTP status 200

WWW-Authenticate challenge Bearer resource_metadata="https://mcp.redu.cloud/.well-known/oauth-protected-resource", scope="openid"

Bearer resource_metadata="https://mcp.redu.cloud/.well-known/oauth-protected-resource", scope="openid"
Header Value
strict-transport-security max-age=63072000; preload

Protected resource metadata

Document https://mcp.redu.cloud/.well-known/oauth-protected-resource
Retrieved Yes
Resource https://mcp.redu.cloud
Authorisation server https://login.redu.cloud/realms/eu-central-1

Background: How OAuth 2.1 works in the 2026 MCP spec →

Transports 2 probes
Transport URL Outcome Status Location
streamable-http https://mcp.redu.cloud/mcp Verified 200
http (plaintext) http://mcp.redu.cloud/mcp HTTPS enforced 301 https://mcp.redu.cloud/mcp
MCP tools · 81 exposed · ~24,169 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
upgrade_to_cluster ~2,703

THE WAY TO MAKE AN EXISTING APP HIGHLY AVAILABLE. If the user asks for high availability, redundancy, no single point of failure, surviving a host or VM failure, or 'stay up if a machine dies', this is the tool: point it at their running VM and pass high_availability:true. It needs no rebuild and no redeploy, and the URL does not change. Turns a single running instance into a horizontally-autoscaling cluster: snapshots the instance and puts your SOURCE VM behind a load balancer as its ALWAYS-ON BASELINE MEMBER, then an autoscaling group adds EXTRA members (booted from that snapshot) on CPU load and scales them back down to zero. FLAVOR — LEAD WITH A MEMORY-OPTIMIZED SMALL-DISK FLAVOR (m1.mem16/m1.mem32) for the cluster, and ideally have the SOURCE VM on one too: clustering snapshots the source VM's FULL disk, so DISK size (not RAM) drives how long the cluster takes to build and to add each member under load — a 40 GB mem flavor is several times faster to snapshot and scale than a 160 GB standard flavor (m1.xlarge) and costs less for the same RAM. If the source VM is on a big-disk flavor, RECOMMEND migrating the app onto a mem-flavor VM first (a root disk cannot be shrunk in place), even though it is extra work — it pays off on every scale-out, and a clustered app is stateless anyway (state in the managed DB) so the lean disk fits. Expect a DRASTICALLY better clustering experience on a mem flavor: far faster cluster-create, snapshots, and every scale-out. The user can override with any flavor. At rest ONLY your source VM serves — there is NO idle extra VM to pay for (the source VM is the cluster's minimum, so the floor is 0 extra members). Use it to LOAD-SCALE a stateless app tier while managed services hold state: it becomes highly-available UNDER LOAD (multiple members behind the LB), but at rest a SINGLE source VM serves — and that source VM is a plain VM, not an autoscaled member, so it is NOT auto-replaced if it fails while idle (only the autoscaled extra membe…

NameTypeReqDescription
app_profilestringSet wordpress/woocommerce when upgrading an older deployment or raw VM that the backend has not profiled. WordPress/WooCommerce clusters require managed MySQL/MariaDB plus a media_space or explicitly…
auto_restructurebooleanInstead of just refusing a stateful VM, have redu get its co-located database OFF the VM first, then cluster. FULLY AUTO for a single_vm Postgres (redu deployed it): redu provisions a managed Postgre…
cluster_media_modestringFor WordPress/WooCommerce, use media_space as the default real cluster fix. local_uploads is refused because wp-content/uploads would diverge across members.
confirm_statelessbooleanOverride the stateful-VM safety refusal. redu REFUSES to cluster a VM that holds its own data (deployed with database:'single_vm' or a compose 'db' service) - a cluster clones the VM into members, so…
create_media_spacebooleanSet TRUE when upgrading a WordPress/WooCommerce deployment that has no media_space_id yet. Redu creates a small NFS media VM + volume, records it, and mounts it on all members.
dnamestringOptional public DNS name for the cluster's load-balancer access point (a .redu.cloud name is auto-generated if omitted).
flavor_idstringyesMember VM size — from list_flavors. Every autoscaling member uses this flavor. STRONGLY prefer m1.mem16/m1.mem32 (memory-optimized, 40 GB disk): clustering snapshots the source disk, so a lean disk m…
high_availabilitybooleanSet TRUE whenever the user asks for HIGH AVAILABILITY, redundancy, 'no single point of failure', 'survive a host/node failure', or 'stay up if a VM dies'. This is the ONLY way to get an HA cluster an…
idempotency_keystring
instance_idstringyesThe instance to turn into a cluster (from list_instances, or the VM of a deploy_app/deploy_compose deployment). It is snapshotted, and the autoscaling members are booted from that snapshot.
keypair_namestringyesSSH keypair name — from list_keypairs.
max_sizeintegerPeak member count under load (default 5). In the default mode this is EXTRA members added on top of your always-on source VM, and the floor is 0 extra. With high_availability:true the group runs betw…
media_mount_pathstringHost mount path on cluster members. Redu mounts this into /var/www/html/wp-content/uploads for WordPress/WooCommerce.
media_origin_urlstringPublic base URL where WordPress wp-content/uploads is served from the central media origin. This should be a separate media origin, not the DB VM.
media_space_flavor_idstringFlavor id for the media VM when create_media_space:true. Defaults to the cluster member flavor.
media_space_idintegerExisting Redu media space id to mount on every WordPress/WooCommerce cluster member.
media_space_namestringOptional name for the media space when create_media_space:true. Defaults to <cluster-name>-media.
media_space_size_gbintegerMedia space data volume size in GB when create_media_space:true (default 20).
namestringyesName for the cluster (lowercase letters, numbers, hyphens).
network_idstringyesPrivate network id — from list_private_networks. Use the SAME network the app's managed DB / other services are on, so members can reach them by private IP.
portintegerPort the app listens on / the load balancer forwards to (default 80). Your source VM must actually serve on this port — the load balancer health-checks it.
restructure_db_flavor_idstringOptional VM size for the provisioned managed database (from list_flavors). Defaults to the member flavor; pick a smaller one (e.g. m1.small) if the DB is light.
restructure_enginestringFor the ASSISTED path (a compose-stack database), which managed engine to provision. WordPress/WooCommerce = 'mysql' (or 'mariadb'). Required when auto_restructure is set and the DB runs inside the c…
scale_in_thresholdnumberAverage CPU fraction (0-1) below which a member is removed (default 0.2).
scale_out_thresholdnumberAverage CPU fraction (0-1) above which a member is added (default 0.7).
startup_commandstringSingle-line shell command to (re)start the app on each fresh member if the snapshot's own services do not auto-start it. For a podman-compose app: 'cd /opt/app && podman-compose up -d'. Omit to rely…
NameTypeReqDescription
available_keypairsarray
duplicateboolean
errorboolean
idempotency_keystring
invalid_keypair_nameboolean
modestring
needs_keypairboolean
needs_keypair_nameboolean
needs_planboolean
nextstring
plan_toolstring
request
result
validation

No examples provided.

upgrade_to_ha ~825

Turns an EXISTING, running single-machine managed Postgres or ClickHouse into a THREE-machine highly available cluster, in place, keeping the data and the same username, password and database name. Use this when the user has a live database and wants it to survive a machine or host failure: they do NOT have to create a new one and migrate by hand. How it works: a full backup is taken first (kept whatever happens), the cluster is built alongside, the data is copied in and verified by counting both sides, and only then does the database's address move to the load balancer. The original machine is left running and untouched throughout, so a failure changes nothing and the user is never without a database. SAY THREE THINGS TO THE USER AND GET A YES BEFORE CALLING: (1) COST, it becomes three machines behind a load balancer instead of one, so roughly 3x the hourly rate, and the old single machine keeps billing until they delete it; (2) WRITE LOSS, anything written to the old machine during the copy is not carried over (see acknowledge_write_loss); (3) THEY MUST REPOINT THE APP afterwards, the connection address changes and nothing redeploys their app for them. Takes about 20 minutes and returns immediately; poll list_databases / list_clickhouse_databases until the address changes. Requires a payment method: high availability is not available on the no-card trial. ⛔ CLICKHOUSE ONLY, a FOURTH thing to say: after the upgrade every table has to use a REPLICATED engine. The existing tables are converted for them as part of the copy, but any NEW `CREATE TABLE ... ENGINE = MergeTree` is refused from then on (ClickHouse error 56) and has to be written `ENGINE = ReplicatedMergeTree`. It is refused rather than accepted because a plain MergeTree on three machines replicates its schema and not its rows, which would leave two of the three answering with an empty table and no error. If their app ships plain-MergeTree migrations (Plausible, PostHog and Langfuse all do), those migration…

NameTypeReqDescription
acknowledge_write_lossbooleanREQUIRED, and you must tell the user this in your own words and get a yes BEFORE you set it true. The upgrade copies the data while the old machine is still serving, so anything the application write…
flavor_idstringOnly needed for an old database whose build settings were not recorded; the API says so if it is missing. Otherwise the cluster reuses the machine size the database already has.
idyesNumeric id of the EXISTING single-machine database (from list_databases / list_clickhouse_databases). It must be status='ready'.
keypair_namestringOnly needed for an old database whose build settings were not recorded.
network_idstringOnly needed for an old database whose build settings were not recorded. Otherwise the cluster joins the same private network.
servicestringyesWhich managed database type the id belongs to. 'postgres' for one from create_database/list_databases; 'clickhouse' for one from create_clickhouse/list_clickhouse_databases. MySQL, MariaDB, Redis and…
NameTypeReqDescription
errorboolean
modestring
nextstring
result

No examples provided.

verify_deployment ~198

Asks redu to re-probe a deployment's public URL and update its status from what it actually observes. USE THIS AFTER YOU HAVE FIXED A FAILED DEPLOY - a deployment that ended 'error' or 'build_failed' but is now serving becomes 'ready' again, and you do NOT need to redeploy it to get a green status. Redeploying working infrastructure to clear a red flag wastes the user's money and throws away the fix. You cannot set the status yourself: this tool triggers a check, and the probe decides. Readiness means the URL answers with a non-5xx (401/403/404 count - they prove the app is answering), the same rule the deploy's own health gate uses. A deployment with no public URL (a headless worker) cannot be verified this way; use get_containers for its container state instead.

NameTypeReqDescription
idintegeryesDeployment id from list_deployments.
NameTypeReqDescription
changedboolean
idnumber
messagestring
nextstring
previous_statusstring
probe
ready_atstring
ready_signalstring
statusstring

No examples provided.

verify_domain ~73

Checks the DNS TXT ownership record for a custom domain and marks it verified when the record is present. Call get_domain_verification first, add the TXT record at your DNS provider, then call this until status is verified.

NameTypeReqDescription
domainstringyesThe custom domain to verify ownership of (e.g. app.example.com).
NameTypeReqDescription
domainstring
modestring
nextstring
result
statusstring
verified_atstring|null

No examples provided.

wait_for_deployment ~261

⭐ CALL THIS INSTEAD OF POLLING. Blocks until the deployment reaches a TERMINAL state (ready, build_failed, error or vm_missing) and returns, in ONE response, everything you would otherwise fetch afterwards: the HTTP status of the PUBLIC url (not the VM's private interface, which can answer 401 while the public path still 502s), the container table with health and restarts, the host's memory/disk/load, and the .env KEY NAMES. Do NOT loop on get_deployment: that is 8-9 round trips per deploy that learn nothing, and then three more asking for what this already returned. ⚠️ A TIMEOUT IS NOT A FAILURE: if it returns timed_out:true the build is simply still running, so call again, optionally with a larger timeout_s. Only status decides success. On build_failed or error, call get_deployment(id) for the full build_log, which is the diagnosis.

NameTypeReqDescription
idintegeryesDeployment id, from the deploy call or list_deployments.
timeout_sintegerHow long to wait before returning timed_out:true (default 300, max 600). A typical deploy reaches ready in 90 to 250 seconds.
NameTypeReqDescription
deployment
evidence
nextstring
notestring
terminalboolean
timed_outboolean
waited_secondsnumber

No examples provided.

whoami ~54

Verifies your redu.cloud credential with a REAL server round-trip and returns your identity + live quota. A green result means the key actually works — not merely that one is configured. Use this first if anything is 401ing.

Input schema present but exposes no named parameters.

NameTypeReqDescription
auth_typestring
nextstring
quota
user
verifiedboolean

No examples provided.

Common questions

What is the cloud.redu/mcp server?

cloud.redu/mcp is listed in the public MCP registry as cloud.redu/mcp. Agent-native cloud, EU-hosted. Provision VMs, networks & databases on redu.cloud via MCP. This page covers its hosted endpoint (https://mcp.redu.cloud/mcp).

Is the cloud.redu/mcp server safe to use?

cloud.redu/mcp scores 90 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the cloud.redu/mcp server expose?

cloud.redu/mcp exposes 81 tools: whoami, check_deploy_prerequisites, deploy_overview, create_api_key, integrate_overview, and 76 more. Their descriptions and schemas cost roughly 24,169 tokens of context every time the server is loaded.

Does the cloud.redu/mcp server require authentication?

Yes. cloud.redu/mcp asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.

Is the cloud.redu/mcp server still maintained?

cloud.redu/mcp is still listed as active in the MCP registry. We last reached this channel on 21 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.