Skip to main content
Glama

oci-mcp

An MCP server for operating Oracle Cloud Infrastructure from an MCP-aware agent — Identity, Compute, Block Volume, Networking (VCN), Object Storage and OKE.

Runs locally over stdio and reads credentials straight from ~/.oci/config, so they never leave your machine.

Status: Phase 1. Read-only — orientation, list, get and search across 39 resource types. Write and delete phases are still to come — see Roadmap.

Requirements

  • Python 3.12 (pinned in .python-version — the oci SDK does not support 3.14)

  • uv

  • A working ~/.oci/config, verifiable with oci iam region-list

Related MCP server: mcp-server-oci

Install

uv sync

Run

uv run oci-mcp

It speaks MCP over stdio, so on its own it just waits on stdin — that is correct behaviour, not a hang. Normally a client launches it; see Register with Claude Code.

Test

Unit tests — offline, no credentials, no network:

uv run pytest -q

Inspect the catalog without writing any client code:

uv run fastmcp list --command "uv run oci-mcp"
uv run fastmcp list --command "uv run oci-mcp" --output-schema

Call a tool directly, which is the fastest way to check a change end to end:

uv run fastmcp call --command "uv run oci-mcp" --target oci_whoami --json

Pass tool arguments with --input-json '{...}'. (Bare key=value pairs only work when you give a server file instead of --command, which this package cannot do — see the note below.)

Note: point fastmcp at the --command, not at src/oci_mcp/server.py. Passing the file loads it as a standalone script rather than a package module, which breaks its relative imports.

Check the safety gates by varying the environment — the fail-closed default means an unconfigured server can mutate nothing:

# default: writes enabled but no allowlist -> mutations_possible false
uv run fastmcp call --command "uv run oci-mcp" --target oci_whoami --json

# allowlist set -> mutations_possible true, mutable_compartments [lab]
uv run fastmcp call --command "env OCI_MCP_COMPARTMENTS=lab uv run oci-mcp" \
  --target oci_whoami --json

The env prefix is load-bearing: --command is executed without a shell, so a bare VAR=value prefix would be treated as the program name and fail with No such file or directory.

Verify the client sees it:

claude mcp list        # expect: oci: ... - ✔ Connected

Configure

All settings are environment variables; see .env.example. The defaults fail closed — writes are enabled but the compartment allowlist is empty, so no mutating call can succeed until you name a compartment.

Variable

Default

Purpose

OCI_CLI_PROFILE

DEFAULT

Profile in ~/.oci/config

OCI_MCP_REGION

profile's region

Region override

OCI_MCP_ALLOW_WRITE

true

Register write tools

OCI_MCP_ALLOW_DELETE

false

Register delete tools

OCI_MCP_COMPARTMENTS

(empty)

Compartments where mutation is permitted. Empty = none.

OCI_MCP_AUDIT_LOG

~/.oci-mcp/audit.jsonl

Mutation audit trail

Register with Claude Code

A stdio server does not inherit your shell environment — the client supplies it. So pass any non-default settings with --env, or they are silently ignored:

claude mcp add oci \
  --env OCI_MCP_COMPARTMENTS=lab \
  -- uv --directory "$PWD" run oci-mcp

Verify by asking the agent to call oci_whoami; its permissions.notes will say plainly why a mutation would be refused.

Safety model

Four independent layers, none of which rely on client cooperation:

  1. Capability flags enforced at registration — a disabled capability's tools are absent from the catalog, not merely refusing when called.

  2. Compartment allowlist — every mutating call resolves its target's compartment and is rejected outside the list.

  3. Two-phase confirm tokens — destructive tools first return a preview plus a short-lived HMAC token bound to that exact operation and OCID; nothing is destroyed until the token is echoed back.

  4. Append-only audit log of every mutation.

Tools

Tool

Notes

oci_whoami

Active tenancy, user, region, auth method, and this server's own permissions

oci_list

List one resource type. Omit compartment to sweep the tenancy; rows are tagged with where they came from

oci_get

Full detail for one resource by OCID (buckets: by name)

oci_search

Tenancy-wide Resource Search — structured query or free text

Reads collapse into three dispatch tools because their schemas are uniform: "show me type in compartment". Writes will stay explicit because theirs are not.

Resource types

Service

resource_type values

compute

instance image shape vnic_attachment volume_attachment boot_volume_attachment

block_storage

volume boot_volume volume_backup boot_volume_backup volume_group

network

vcn subnet security_list nsg route_table internet_gateway nat_gateway service_gateway drg dhcp_options public_ip load_balancer

oke

cluster node_pool virtual_node_pool

database

autonomous_database db_system db_home db_node mysql_db_system nosql_table

object_storage

bucket

identity

compartment user group policy availability_domain region

Every list is projected to the handful of fields that identify and locate a resource; pass verbose=true for the full object. An OCI Instance has 36 fields, so this is the difference between a usable answer and a blown context.

Things worth knowing:

  • OKE clusters are not indexed by Resource Search. oci_search will never return one; use oci_list('cluster').

  • Buckets are addressed by name, not OCID: oci_get('bucket', 'my-bucket').

  • boot_volume_attachment is availability-domain scoped; the server fans out across ADs for you.

  • Nothing in the database group has been exercised against real resources — this tenancy has none — but every call is verified to return an empty list rather than an error.

Examples

C="uv run oci-mcp"

# every running instance in the tenancy
uv run fastmcp call --command "$C" --target oci_list \
  --input-json '{"resource_type":"instance","lifecycle_state":"RUNNING"}' --json

# OKE clusters in one compartment
uv run fastmcp call --command "$C" --target oci_list \
  --input-json '{"resource_type":"cluster","compartment":"test-deploy-kubeflow"}' --json

# one bucket, by name
uv run fastmcp call --command "$C" --target oci_get \
  --input-json '{"resource_type":"bucket","target":"terraform-state-kubeflow"}' --json

# anything, anywhere, by structured query
uv run fastmcp call --command "$C" --target oci_search \
  --input-json '{"query":"query all resources where lifecycleState = '"'"'RUNNING'"'"'"}' --json

Arguments must go through --input-json here: with --command in play, a bare key=value positional is parsed as a server spec and fails with Cannot use both a server spec and --command.

Roadmap

Phase

Scope

0 ✅

Scaffold, config, lazy clients, oci_whoami

1 ✅

Read layer — oci_list, oci_get, oci_search over 39 resource types

2

Safety — compartment allowlist guard and audit log, landed before any write exists

3

Create and modify — explicit tools for instances, volumes, VCNs/subnets, buckets, OKE node pools

Scope is deliberately list, create, modify. Delete/terminate is not planned; the OCI_MCP_ALLOW_DELETE flag exists so it can be added later without touching the architecture, but it stays false and registers nothing today.

Reads collapse into three dispatch tools since their schemas are uniform, while writes stay explicit because theirs are not.

License

Apache License 2.0.

Available Tools

4 tools
oci_getGet one OCI resourceA
Read-onlyIdempotent

Fetch full details for a single resource.

Use this after oci_list or oci_search has given you an OCID and you need the complete record — configuration, nested settings, tags.

ParametersJSON Schema
NameRequiredDescriptionDefault
targetYesThe resource OCID. For resource_type='bucket' pass the bucket NAME instead.
verboseNoFull detail (default). Set false for the compact projection.
resource_typeYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint and openWorldHint, so the safety profile is covered. The description adds real value by telling the agent what it gets back ('configuration, nested settings, tags'), which is behavioral rather than restating annotations. It says nothing about auth requirements or rate limits, but with annotations and an output schema present those are less critical.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences, zero filler, with the core action front-loaded and the workflow cue immediately after. Every phrase earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema, full annotation coverage, and a self-documenting enum of 38 resource types, the description only needs to establish the read-one workflow, which it does. It does not explain the breadth of resource_type choices, but the enum carries that load.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 67%, above the baseline threshold, and the schema documents the bucket-NAME exception and the verbose toggle. The description reinforces that 'target' is an OCID obtained from oci_list/oci_search, but adds no format or validation detail beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Fetch full details for a single resource') and the phrase 'single resource' implicitly contrasts with the list/search siblings. It stops short of naming an alternative directly in the purpose statement, so sibling separation is left partly to inference.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly tells the agent when to reach for this tool: 'after oci_list or oci_search has given you an OCID'. That is a concrete triggering condition referencing two named siblings. It lacks an explicit when-not clause, but the workflow context is unambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

oci_listList OCI resourcesA
Read-onlyIdempotent

List resources of one type, compactly.

Covers compute, block storage, networking, OKE, database, object storage and identity. Results are projected to the identifying fields; pass verbose=True for the full objects.

Omitting compartment scans the whole tenancy and tags each row with the compartment it came from.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum rows to return.
verboseNoReturn every field instead of the compact projection.
compartmentNoCompartment name or OCID. Omit to scan every compartment in the tenancy.
resource_typeYes
lifecycle_stateNoFilter by state, e.g. RUNNING, AVAILABLE, ACTIVE, TERMINATED.

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent and open-world, so safety is covered. The description adds genuinely non-annotated behavior: results are projected to identifying fields by default, and a tenancy-wide scan when compartment is omitted tags each row with its origin. Return-shape detail is left to the output schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short, front-loaded paragraphs with no filler; the primary purpose leads and secondary behaviors follow. Efficient and readable, though slightly more verbose than a single tight paragraph would need to be.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, return values need no explanation, and the description covers scope, projection behavior and the omitted-compartment case. It leaves the list-vs-search boundary unstated, which is the main remaining gap for a tool with three siblings.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is high (80%), so the schema already documents limit, verbose, compartment and resource_type. The description largely restates the verbose and compartment semantics that the schema already provides, adding no syntax or format detail beyond it, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (List) and resource (OCI resources of a single type), and enumerates the service families covered. It does not explicitly differentiate itself from siblings like oci_search or oci_get, so the agent must infer the boundary, but the core purpose is unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives conditional guidance for two parameters (pass verbose=True for full objects; omit `compartment` to scan the whole tenancy), which is useful in-context usage. However, it never states when to reach for oci_list versus oci_search or oci_get, leaving the sibling routing to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

oci_whoamiWho am I on OCIA
Read-onlyIdempotent

Report the active OCI identity and this server's own permissions.

Returns the tenancy, user, region and auth method in use, plus which compartments may be mutated and which capability flags are enabled.

Call this first in a session to learn what is reachable before acting.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint and openWorldHint, so the safety profile is covered. The description goes beyond them by disclosing what is actually exposed (tenancy, user, region, auth method, which compartments may be mutated, capability flags) — security-relevant context about what the call reveals. Minor gap: no note on latency, caching, or whether identity can change mid-session.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, each load-bearing: what it reports, exactly what comes back, and when to call it. Front-loaded with the verb and outcome; no filler or restatement of the title.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be spelled out, yet the description still summarizes them usefully. Combined with annotations covering the read-only/idempotent profile and a zero-parameter schema, an agent has everything required to invoke this correctly as a session-opening call.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so per the rubric the baseline is 4. Nothing in the description is needed to clarify arguments, and nothing is misleading about input.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb ('Report') plus a precisely scoped resource: the active OCI identity and the server's own permissions. It further enumerates the exact fields returned (tenancy, user, region, auth method), which no sibling tool (oci_list/oci_get/oci_search) does, so an agent can distinguish it immediately.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit sequencing rule: 'Call this first in a session to learn what is reachable before acting.' That is clear, actionable when-to-use guidance. It does not explicitly name the sibling tools or state when not to use it, but the intent is unambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 4 tool updatesv0.1.0
    • First observedoci_get
    • First observedoci_list
    • First observedoci_search
    • First observedoci_whoami

TDQS

A3.9/5.0

Scored across 4 tools

Disambiguation4/5

oci_whoami, oci_list, oci_get, and oci_search have largely distinct purposes. The main overlap is between list (one resource type) and search (cross-type query), but descriptions clearly guide when to use each.

Naming Consistency5/5

All four tools follow a consistent oci_<verb> snake_case pattern (oci_whoami, oci_list, oci_get, oci_search). The convention is predictable and readable.

Tool Count4/5

Four tools is lean but appropriate for a focused read/discovery server, with each tool covering a distinct aspect: identity, enumeration, detail retrieval, and cross-type search. It is slightly thin for the broad OCI domain but not problematic.

Completeness2/5

The toolset is entirely read-only: no create, update, delete, or action tools exist, despite oci_whoami advertising mutation permissions. Agents tasked with modifying OCI resources will hit dead ends, constituting a significant gap for an OCI management server.

Maintenance

ActivityMaintained
ResponsivenessUnresponsive

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    D
    maintenance
    MCP server for Oracle Container Engine for Kubernetes (OKE) that enables inspection, querying, and troubleshooting of OKE clusters through safe, composable tools.
    Universal Permissive v1.0
  • F
    license
    Not graded
    quality
    B
    maintenance
    Enables interaction with Oracle Cloud Infrastructure through the MCP protocol. Supports dynamic profile selection and provides 85 tools for managing compute, databases, networking, IAM, storage, load balancers, OKE, monitoring, and cost management.
    -
  • A
    license
    A
    quality
    D
    maintenance
    MCP server for Oracle Cloud Infrastructure (OCI) that provides tools to manage Compute, Object Storage, Block Storage, Networking, Autonomous Database, and IAM via the official OCI SDK.
    23
    67
    MIT
  • A
    license
    A
    quality
    C
    maintenance
    MCP server for Oracle Cloud Infrastructure (OCI) that exposes Compute, Networking, and Object Storage operations to MCP clients, with support for multiple authentication modes, read-only enforcement, and per-call region overrides.
    18
    MIT