Control Plane

Grant Cloud Access

grant_cloud_access

DestructiveIdempotent

Give a workload credential-free access to AWS, GCP, or Azure resources through a cloud account: ensures the workload has an identity, binds the provider access to it (policyRefs or roleName for AWS, bindings or serviceAccount for GCP, roleAssignments for Azure), and waits until the identity reports it usable (an existing roleName or serviceAccount is not checked). The cloud account must exist already (create_cloud_account and how_to_create_cloud_account, which need ?toolsets=full). Replaces this identity's existing provider configuration, so previous access can be revoked for every workload sharing the identity. No key passes through the chat.

Input Schema

Name	Required	Description
`aws`	No	With provider aws: policyRefs or roleName, one of the two.
`gcp`	No	With provider gcp: bindings or serviceAccount, one of the two.
`gvc`	Yes	GVC name.
`org`	No	Organization slug.
`azure`	No	With provider azure.
`provider`	Yes
`workload`	Yes	Workload that needs the access.
`waitSeconds`	No	Seconds to wait on the server until the identity reports the access usable, 0 to 45. The call returns as soon as it is, or with the latest state when the time runs out. Use this instead of calling again and again.
`cloudAccount`	Yes	An existing cloud account of that provider (create_cloud_account, needs `?toolsets=full`).

Output Schema

Name	Required	Description
`ok`	Yes
`data`	No	The full result. Read this, not only the summary.
`details`	No
`summary`	Yes
`nextSteps`	No

Schema Changelog

Changes observed during successful MCP inspections.

Changed4 schema fields changedOct 28, 2026

changedInput schema / properties / azure / properties / roleAssignments / description

Previous value: -"Roles per scope, e.g. { scope: \"/subscriptions/.../resourceGroups/RG\", roles: [\"Storage Blob Data Reader\"] }."New value: +"Roles per scope, e.g. { scope: \"/subscriptions/.../resourceGroups/RG\", roles: [\"Storage Blob Data Reader\"] }; no scope means the subscription."

changedInput schema / properties / azure / properties / roleAssignments / items / required
```
Previous value: -[
-  "scope",
-  "roles"
-]New value: +[
+  "roles"
+]
```

changedInput schema / properties / gcp / properties / bindings / description

Previous value: -"Roles per resource, e.g. { resource: \"//storage.googleapis.com/projects/_/buckets/NAME\", roles: [\"roles/storage.objectViewer\"] }."New value: +"Roles per resource, e.g. { resource: \"//storage.googleapis.com/projects/_/buckets/NAME\", roles: [\"roles/storage.objectViewer\"] }; no resource means the project."

changedInput schema / properties / gcp / properties / bindings / items / required
```
Previous value: -[
-  "resource",
-  "roles"
-]New value: +[
+  "roles"
+]
```

Changed2 schema fields changedOct 22, 2026

changedInput schema / properties / cloudAccount / description

Previous value: -"An existing cloud account of that provider (create_cloud_account, full profile)."New value: +"An existing cloud account of that provider (create_cloud_account, needs `?toolsets=full`)."

changedInput schema / properties / gvc / description

Previous value: -"GVC slug. If the user named none, list_resources (kind \"gvc\") and let them choose."New value: +"GVC name."

AddedSep 30, 2026

TDQS

Score is being calculated.

All Control Plane tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.