ParalonCloud
NPM · @PARALONCLOUD/MCP
Rent GPUs on ParalonCloud, or as a provider manage your nodes, prices and earnings.
Available components
Last scanned (21 hours ago)
Scores higher than 38% of npm servers
Category Cloud Infrastructure
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 31 of 92 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 0 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability76
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 1494 tokens (~99/item across 15 items; 15 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage83
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 48% of tool parameters carry a description.Partial
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "destroy_rental" implies "destroy" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 15 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Unverified: 1 category
A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 22 Oct 26 +15
- Malware scan: unverified → pass ▲ security
- 21 Oct 26 52
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 22 Oct 2026 · Analysed npm/@paraloncloud/mcp@1.2.0
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 92 packages
| Packages resolved | 92 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
add_node ~175
PROVIDER: add a new node to the account and get the docker command that installs the agent on the machine. Confirm the name and type with the user first. The returned command contains the node's secret token: show it only to the user, never paste it anywhere public. The node comes online once the command runs on the machine, then goes through the GPU check. At most 20 nodes an hour per key.
| Name | Type | Req | Description |
|---|---|---|---|
| available | boolean | – | On the market as soon as it is ready. Default true. |
| name | string | yes | A label for the node, up to 100 characters. |
| os | string | – | Operating system of the machine. Default linux. |
| spot | boolean | – | A spot node: discounted and reclaimable (GPU only). Default false. |
| type | string | – | Default gpu. |
No output schema declared.
No examples provided.
create_rental ~273
Start renting a GPU. SPENDS CREDITS (per-minute billing) — confirm with the user before calling. Asynchronous: returns a rental_id with status 'pending'. Provisioning + the secure tunnel take ~20-40 seconds. After creating, call get_rental ONCE to fetch the connection URL — it waits internally for startup and returns when ready, so do NOT poll it in a tight loop. DURATION: the rental is open-ended by default (runs until the user stops it with destroy_rental) — use open-ended as the default. When starting one, briefly tell the user it's open-ended and bills per minute until stopped, and that they can set an 'hours' auto-stop cap instead if they prefer; only pass 'hours' when the user asks for a time limit. An idempotency key is generated automatically so accidental repeats don't start a second GPU.
| Name | Type | Req | Description |
|---|---|---|---|
| hours | integer | – | Optional auto-stop cap: the rental stops itself after this many whole hours. Omit (the default) for an open-ended rental that runs until stopped with destroy_rental. |
| name | string | – | Optional label for the rental. |
| node_id | string | yes | Node UUID from list_gpus. |
| type | string | – | Environment to start. Only 'jupyter' is supported. |
No output schema declared.
No examples provided.
destroy_rental ~53
Stop a rental — stops the GPU and STOPS BILLING. This is the money brake; safe to call twice. Confirm with the user unless they clearly asked to stop it.
| Name | Type | Req | Description |
|---|---|---|---|
| rental_id | string | yes | – |
No output schema declared.
No examples provided.
get_balance ~30
Get the account's credit balance (rentals are billed per minute against it). Read-only, no cost.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_earnings ~94
PROVIDER: the account's earnings in USD by UTC day for the last `days` days (default 30, max 366): rentals per node and inference for the account, after the platform fee; the total; the balance that can be withdrawn now; and what rentals still running have billed so far. Payouts themselves are not available through the API. Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | – | – |
No output schema declared.
No examples provided.
get_my_node ~53
PROVIDER: one of the account's nodes, same fields as list_my_nodes (state, price, rental, live GPU metrics). Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| node_id | string | yes | Node UUID from list_my_nodes. |
No output schema declared.
No examples provided.
get_node_install_command ~57
PROVIDER: the docker command that installs the agent for an existing node (to reinstall or move it). It contains the node's secret token: show it only to the user. Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| node_id | string | yes | – |
No output schema declared.
No examples provided.
get_rental ~119
Get one rental's status and connection details (Jupyter URL + token). After create_rental, call this to get the URL. It WAITS internally (up to ~24s) for the rental to finish coming up and returns as soon as it's ready — so you usually only need ONE call, at most two. Do NOT call it repeatedly in a tight loop. Provisioning plus the secure tunnel take ~20-40 seconds total; the URL is ready when connection_pending is false. Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| rental_id | string | yes | – |
No output schema declared.
No examples provided.
list_gpus ~66
List GPU nodes available to rent right now, with price per hour, GPU model, VRAM, CUDA compute capability, and country. Rent by the returned node_id. Read-only, no cost. For modern LLM work prefer compute_cap >= 8.9 (FP8).
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_my_nodes ~114
PROVIDER: list the GPU nodes this account provides (needs a key with the 'nodes' scope). For each node: state (available, rented, paused, not_verified, not_ready, offline), GPUs and VRAM, price (default, allowed min/max, custom, what a renter pays), verification, reputation, the current rental (never the renter), and live metrics from the last minute: per-GPU load %, temperature °C, power W and VRAM, plus host CPU and memory. Read-only.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_rentals ~50
List the account's rentals. By default only active ones (what's running and billing). Pass status='all' for full history. Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| status | string | – | Default: active. |
No output schema declared.
No examples provided.
reclaim_spot_node ~84
PROVIDER: take a spot node back for the owner's own use ("In use"): rentals and inference go off, and a spot rental running on it STOPS TWO MINUTES LATER (the renter is told). Only for spot nodes. Always confirm with the user first. Put the node back afterwards with set_node_available(true).
| Name | Type | Req | Description |
|---|---|---|---|
| node_id | string | yes | – |
No output schema declared.
No examples provided.
set_node_available ~89
PROVIDER: take a node off the market (available=false) or put it back (available=true). Off stops new rentals at once; a rental already running goes on to its end. Use it when the owner needs the machine or it is rented on another marketplace. Confirm with the user unless they asked for exactly this.
| Name | Type | Req | Description |
|---|---|---|---|
| available | boolean | yes | – |
| node_id | string | yes | – |
No output schema declared.
No examples provided.
set_node_price ~130
PROVIDER: set a node's price in US dollars per hour for the whole node (what the renter pays; the provider gets it minus the platform fee), or null to go back to the platform default. Must be within the node's price.min and price.max (50% to 300% of the default; see get_my_node). A rental already running keeps its price. Not possible on a spot node. Confirm the new price with the user first.
| Name | Type | Req | Description |
|---|---|---|---|
| node_id | string | yes | – |
| price_per_hour | number|null | yes | USD per hour, or null for the default price. |
No output schema declared.
No examples provided.
update_node ~107
PROVIDER: change several things on a node at once: name, spot (true/false; refused while the node is rented, and turning spot on clears a custom price), available, price_per_hour (USD per hour or null). Send only what changes. Confirm changes with the user first.
| Name | Type | Req | Description |
|---|---|---|---|
| available | boolean | – | – |
| name | string | – | – |
| node_id | string | yes | – |
| price_per_hour | number|null | – | – |
| spot | boolean | – | – |
No output schema declared.
No examples provided.
How do I install the ParalonCloud MCP server?
ParalonCloud runs locally as an npm package, launched with npx -y @paraloncloud/mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @paraloncloud/mcp
claude mcp add paraloncloud-paralon-mcp -- npx -y @paraloncloud/mcp
What is the ParalonCloud MCP server?
ParalonCloud is an MCP server listed in the public MCP registry as io.github.ParalonCloud/paralon-mcp. Rent GPUs on ParalonCloud, or as a provider manage your nodes, prices and earnings. This page covers its npm package (@paraloncloud/mcp).
Is the ParalonCloud MCP server safe to use?
ParalonCloud scores 67 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 22 October 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the ParalonCloud MCP server expose?
ParalonCloud exposes 15 tools: list_gpus, get_balance, create_rental, get_rental, list_rentals, and 10 more. Their descriptions and schemas cost roughly 1,494 tokens of context every time the server is loaded.
Is the ParalonCloud MCP server still maintained?
ParalonCloud is still listed as active in the MCP registry. We last reached this channel on 22 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the ParalonCloud MCP server under?
ParalonCloud declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.