CloudBase
NPM · @CLOUDBASE/CLOUDBASE-MCP · 3 COMPONENTS
CloudBase MCP: DB, functions, storage, hosting via @cloudbase/cloudbase-mcp
Last scanned (17 hours ago)
Scores higher than 94% of npm servers
Category Cloud Infrastructure
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- No production dependencies, so there is no dependency health to assess. View diagnostics → Pass
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to TencentCloudBase/CloudBase-AI-Toolkit). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 0 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability54
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 32929 tokens (~784/item across 42 items; 42 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage96
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 88% of tool parameters carry a description.Partial
Tool Safety92
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 2 of 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "deployPlan" implies "deploy" and declares readOnlyHint instead, contradicting what its own name says it does. See how to fix → Partial
- An AI judge read all 43 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
- Supports UI / widget rendering.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 +11
- Tool safety: pass → unverified ▼ security
- Stability: pass → unverified ▼ security
- Malware scan: pass → unverified ▼ security
- Known CVEs: unverified → pass ▲ security
- Tool coverage: 100 → unverified ▼ functional
- Capabilities: pass → unverified ▼ functional
- Dependency health: unverified → pass ▲ functional
- Package version: 2.37.1 → 2.37.4 functional
- Package version: 2.35.2 → 2.37.4 functional
- Package version: 2.37.1 → 2.37.3 functional
- Package version: 2.37.1 → 2.37.2 functional
- 3 Nov 26 −11
- Known CVEs: pass → unverified ▼ security
- Dependency health: pass → unverified ▼ functional
- First check of Capabilities: pass functional
- Package version: 2.36.2 → 2.37.1 functional
- 29 Oct 26 +15
- Malware scan: unverified → pass ▲ security
- 28 Oct 26 −14
- Malware scan: pass → unverified ▼ security
- Stability: 0.97 → pass security
- Security disclosure: fail → pass ▲ functional
- Package version: 2.36.1 → 2.36.2 functional
- 27 Oct 26 0
- Stability: pass → 0.97 functional
- 22 Oct 26 +26
- Malware scan: unverified → pass ▲ security
- Known CVEs: unverified → pass ▲ security
- Stability: fail → pass ▲ security
- Dependency health: unverified → pass ▲ functional
- 21 Oct 26 −26
- Malware scan: pass → unverified ▼ security
- Known CVEs: pass → unverified ▼ security
- Dependency health: pass → unverified ▼ functional
- Package version: 2.36.0 → 2.36.1 functional
- 19 Oct 26 +1
- Stability: fail → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Package version: 2.35.2 → 2.36.0 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Nov 2026 · Analysed npm/@cloudbase/cloudbase-mcp@2.37.4
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | TencentCloudBase/CloudBase-AI-Toolkit |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/TencentCloudBase/CloudBase-AI-Toolkit/.github/workflows/npm-publish.yaml@refs/tags/v2.37.4 |
| Rekor log index | 3687874812 |
| Predicate type | SLSA build provenance https://slsa.dev/provenance/v1 |
| Subject digest | sha512:a1b4cdbbac32ace241361451778cff761cbb7e6b8bb43680fad5d66f0bd178e96050ebb73d7f438a987694ebaeb1dcd95b25f6c7c8510d71574a6dde5 |
Background: How many MCP packages publish verified provenance →
Dependencies 0 packages
| Packages resolved | 0 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
readNoSqlDatabaseContent 查询并获取 CloudBase NoSQL 数据库数据记录 ~326
查询 CloudBase NoSQL 数据库中的数据记录。支持按条件筛选、分页、排序，适用于管理端数据查询与运维。limit 默认 100、最大 1000；超出请用 offset 分页。projection 仅支持 { field: 1|0 } 对象（示例 {"_id":1,"name":1,"createdAt":1}），不要传字段数组。
| Name | Type | Req | Description |
|---|---|---|---|
| collectionName | string | yes | 集合名称 |
| instanceId | string | – | 可选：显式指定数据库实例ID；未传时会自动解析并缓存 |
| limit | number | – | 返回数量限制，整数，范围 1-1000，默认 100。超过 1000 会被 Cloud API MgoLimit lte 校验拒绝；请用 offset 分页。 |
| offset | number | – | 跳过的记录数 |
| projection | – | – | 返回字段投影，仅支持对象或对应 JSON 字符串，值只能是 1/0/true/false。合法示例：{"_id":1,"name":1,"createdAt":1}（包含）或 {"password":0}（排除）。不要传 ["name","age"] 这类字段数组，也不要混用包含与排除（_id 除外）。 |
| query | – | – | 查询条件(对象或字符串,推荐对象) |
| sort | – | – | 排序条件，仅支持数组 [{"key":"createdAt","direction":-1}] 或对应 JSON 字符串。 |
No output schema declared.
No examples provided.
readNoSqlDatabaseStructure 读取 CloudBase NoSQL 数据库结构 ~208
读取 CloudBase NoSQL 数据库集合与索引结构，支持列出集合、查看集合详情、列出索引以及检查索引是否存在。本工具为服务端管理工具，用于管理端查询数据库结构，不用于编写客户端代码。
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | listCollections: 列出集合列表 describeCollection: 描述集合详情（会返回索引摘要） checkCollection: 检查集合是否存在 listIndexes: 列出指定集合的索引列表 checkIndex: 检查指定索引是否存在 |
| collectionName | string | – | 集合名称(describeCollection、listIndexes、checkIndex 操作时必填) |
| indexName | string | – | 索引名称(checkIndex 操作时必填) |
| limit | number | – | 返回数量限制(listCollections 操作时可选) |
| offset | number | – | 偏移量(listCollections 操作时可选) |
No output schema declared.
No examples provided.
searchKnowledgeBase 云开发知识库检索 ~1,000
云开发知识库检索工具，支持 CloudBase 官方文档 (docs)、固定技能文档 (skill) 和 OpenAPI 文档 (openapi) 查询。 按场景选择 mode： - 工具调用报错且错误信息含具体错误码（如 OperationDenied.FreePackageDenied）时：mode=docs + action=searchDocs（query=错误码），先查错误码官方含义与处理指引再行动，不要凭猜测重试 - 不确定答案在哪、需要对官方文档做全文检索时：mode=docs + action=searchDocs（传 query 关键词） - 已知文档标题、层级路径或 URL 时：mode=docs + action=findByName（传 input）或 action=readDoc（传 docPath） - 需要某个场景的落地指南 / 最佳实践时：mode=skill + skillName - 需要 HTTP API 的接口定义时：mode=openapi + apiName ⚠️ 重要：当 CloudBase skills 处于禁用状态或当前 IDE 不支持 skill 文件读取时，必须使用 searchKnowledgeBase(mode=skill, skillName=...) 来获取 CloudBase 技能文档内容，而不是尝试直接读取 skill 文件。直接读取可能返回 400 错误。示例： - 需要最小 Web+数据库 Demo 路径时：searchKnowledgeBase(mode=skill, skillName=minimal-web-baas-demo) - 需要 auth-tool-cloudbase 指南时：searchKnowledgeBase(mode=skill, skillName=auth-tool-cloudbase) - 需要 auth-web-cloudbase 指南时：searchKnowledgeBase(mode=skill, skillName=auth-web-cloudbase) - 需要 cloudbase-agent 指南时：searchKnowledgeBase(mode=skill, skillName=cloudbase-agent) - 需要 MCP 接入方式（本地 / 远程）、用 mcporter 在命令行调用工具、或站点 / 插件开关时：searchKnowledgeBase(mode=skill, skillName=cloudbase-mcp) 返回内容包含该 skill 的 SKILL.md 全文，以及它在远端聚合仓（CNB raw）中的全部 .md 文件地址清单（SKILL.md 与 references/ 等，可直接 HTTP 抓取）。正文中代码栅栏之外的相对链接也会改写为绝对地址；若该 skill 在远端仓中不存在，则只返回内联内容并明确标注，不返回失效链接。 不确定该选哪个时：mode=skill 下不传 skillName、mode=openapi 下不传 apiName 直接调用，会返回当前可用清单及各自的适用场景 / 接口简介，再带上名称重新调用即可。可选名称也见本工具的 skillName / apiName 枚举（skill 共 0 个，API 共 0 个）。 注意：OpenAPI 文档 (openapi) 查询只需要传 mode="openapi" 和 apiName，不要传 action；action 仅用于 mode="docs"。
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | 仅 mode=docs 时指定；mode=openapi 不要传 action。CloudBase 文档操作类型：listModules=列出所有文档模块，listModuleDocs=获取指定模块的目录结构，findByName=按名称/路径/URL 智能查找，readDoc=读取指定文档 Markdown，searchDocs=全文搜索官方文档。 |
| apiName | string | – | mode=openapi 时指定。API 名称。 当前暂时无法枚举可选值；如需查看当前可用项，可直接传入字符串，工具会在执行时返回可用列表。 |
| docPath | string | – | mode=docs 且 action=readDoc 时指定。站内相对路径（如 /quick-start），或 action=findByName / action=searchDocs 返回的文档地址 —— 传地址时只取其中的路径，主机部分一律忽略。 |
| input | string | – | mode=docs 且 action=findByName 时指定。支持模块名、文档标题、层级路径或 URL。 |
| mode | string | yes | – |
| moduleName | string | – | mode=docs 且 action=listModuleDocs 时指定。模块名称。 |
| query | string | – | mode=docs 且 action=searchDocs 时指定。全文检索关键词。 |
| skillName | string | – | mode=skill 时指定。技能名称。 当前暂时无法枚举可选值；如需查看当前可用项，可直接传入字符串，工具会在执行时返回可用列表。 |
No output schema declared.
No examples provided.
writeNoSqlDatabaseContent 修改 CloudBase NoSQL 数据库数据记录 ~514
修改 CloudBase NoSQL 数据库中的数据记录。支持插入、更新（含 $set/$inc/$push 等操作符）、删除、upsert 等操作，适用于管理端数据写入与运维。⚠️ 服务端写入不含 _openid：若集合依赖客户端 SDK（@cloudbase/js-sdk 或微信小程序 wx.cloud.database()）的行级安全规则（如 doc._openid == auth.openid），服务端写入时需手动补充 _openid 字段，否则客户端将无法读取到该数据。⚠️ 部分更新嵌套字段须使用点号路径，如 `$set: {"shipping.city": "guangzhou"}`，直接传嵌套对象会覆盖整个字段。
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | insert: 插入数据（新增文档） update: 更新数据 delete: 删除数据 |
| collectionName | string | yes | 集合名称 |
| documents | array | – | 要插入的文档对象数组,每个文档都是对象(insert 操作必填) |
| instanceId | string | – | 可选：显式指定数据库实例ID；未传时会自动解析并缓存 |
| isMulti | boolean | – | 是否更新多条记录(update/delete 操作可选) |
| query | – | – | 查询条件(对象或字符串,推荐对象)(update/delete 操作必填) |
| update | – | – | 更新内容(对象或字符串,推荐对象)(update 操作必填)。按 MongoDB 更新语义传入 MgoUpdate：部分更新请使用 `$set`、`$inc`、`$unset`、`$push` 等操作符，例如使用 `$set` 更新 `status`；不要直接传"字段到值的普通对象"，否则可能替换整条文档。 ⚠️ 嵌套字段必须用点号路径（如 `shipping.city`），禁止整对象替换：… |
| upsert | boolean | – | 是否在不存在时插入(update 操作可选) |
No output schema declared.
No examples provided.
writeNoSqlDatabaseStructure 创建并管理 CloudBase NoSQL 数据库集合 ~178
创建、删除和管理 CloudBase NoSQL 数据库集合（collection）。支持创建新集合、删除现有集合，以及通过 updateCollection 的 updateOptions.CreateIndexes / updateOptions.DropIndexes 添加索引和删除索引。当需要新建集合时，使用 action=createCollection。本工具为服务端管理工具，用于管理端操作集合和索引结构，不用于编写客户端代码。
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | createCollection: 创建集合 updateCollection: 更新集合配置；添加索引请传 updateOptions.CreateIndexes，删除索引请传 updateOptions.DropIndexes deleteCollection: 删除集合 |
| collectionName | string | yes | 集合名称 |
| updateOptions | object | – | 更新选项(updateCollection 时使用)。CreateIndexes 用于添加索引，DropIndexes 用于删除索引。 |
No output schema declared.
No examples provided.
How do I install the CloudBase MCP server?
CloudBase runs locally as an npm package, launched with npx -y @cloudbase/cloudbase-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @cloudbase/cloudbase-mcp
claude mcp add tencentcloudbase-cloudbase-mcp -- npx -y @cloudbase/cloudbase-mcp
What is the CloudBase MCP server?
CloudBase is an MCP server listed in the public MCP registry as io.github.TencentCloudBase/cloudbase-mcp. CloudBase MCP: DB, functions, storage, hosting via @cloudbase/cloudbase-mcp. This page covers its npm package (@cloudbase/cloudbase-mcp).
Is the CloudBase MCP server safe to use?
CloudBase scores 91 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 4 November 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the CloudBase MCP server expose?
CloudBase exposes 42 tools: auth, queryEnv, envDomainManagement, manageEnv, readNoSqlDatabaseStructure, and 37 more. Their descriptions and schemas cost roughly 32,671 tokens of context every time the server is loaded.
Is the CloudBase MCP server still maintained?
CloudBase is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the CloudBase MCP server under?
CloudBase declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.