oci-mcp
Summary: Use an MCP-capable AI agent to inspect Oracle Cloud Infrastructure resources read-only, with credentials kept local via ~/.oci/config.
oci_whoami: report active tenancy, user, region, auth method, and server permission/allowlist status.oci_list: list one OCI resource type compactly, across a compartment or the whole tenancy, with optional lifecycle-state filtering and verbose output.oci_get: fetch full details for one resource by OCID, or by name for buckets.oci_search: find indexed resources across the tenancy using structured queries or free text; OKE clusters must be reached withoci_listinstead.Inspect resources across compute, block storage, networking, OKE, database, object storage, and identity.
Configure profile, region, mutation allowlist, write tools, and delete tools via environment variables.
Run locally over stdio and add to MCP clients such as Claude Code, Cursor, VS Code, and Zed.
Currently read-only; create/modify/delete capabilities are planned or disabled unless configured, and the allowlist fails closed.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@oci-mcplist all compute instances in the lab compartment"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
oci-mcp
Operate Oracle Cloud Infrastructure from an AI agent.
An MCP server that exposes OCI — compute, block
storage, networking, OKE, database, object storage and identity — as tools an agent
can call, so you can ask for things instead of assembling oci CLI invocations and
copying OCIDs between them.
"which of my instances are running?"
"what's in the test-deploy-kubeflow compartment?"
"show me the config for my OKE cluster"It runs locally over stdio and reads credentials straight from ~/.oci/config, so
they never leave your machine.
Demo
Ask in plain language; the agent picks the tool. No compartment was given here, so it swept the whole tenancy and tagged every row with where it came from:

oci_whoami reports the active tenancy and the server's own permissions — writes
are impossible until you name an allowlisted compartment:

OKE clusters are invisible to OCI Resource Search, so oci_list is the way to reach
them. The tool says so in its own output:

Output above is real, captured from a live tenancy. All identifiers — OCIDs, e-mail, tenancy name, public IPs, and the OCID fragments embedded in OKE node names — were replaced with placeholders before rendering.
Status: read-only today. Create and modify tools are planned — see open issues.
Related MCP server: mcp-server-oci
Requirements
Python 3.12 — pinned in
.python-version;uvfetches it. TheociSDK does not support 3.14.A working
~/.oci/config. Verify withoci iam region-list.
Install
git clone https://github.com/jaiakash/oracle-cloud-mcp.git
cd oracle-cloud-mcp
uv syncRun
uv run oci-mcpThis speaks MCP over stdio, so on its own it just waits on stdin — that is correct, not a hang. Normally your client launches it.
Add to your MCP client
Claude Code:
claude mcp add oci -- uv --directory "$PWD" run oci-mcpCursor, VS Code, Zed and others take the same command as JSON:
{
"mcpServers": {
"oci": {
"command": "uv",
"args": ["--directory", "/absolute/path/to/oracle-cloud-mcp", "run", "oci-mcp"]
}
}
}A stdio server inherits nothing from your shell, so any setting from Configure has to be passed by the client:
claude mcp add oci --env OCI_MCP_COMPARTMENTS=lab -- uv --directory "$PWD" run oci-mcpConfirm it connected by asking the agent to call oci_whoami.
Tools
Tool | What it does |
| Active tenancy, user, region and auth method, plus which compartments this server may modify. Cheap orientation call. |
| List one resource type. Omit |
| Full detail for one resource by OCID — or by name, for buckets. |
| Find anything across the tenancy in one call, by structured query or free text. |
Reads collapse into three dispatch tools because their schemas are uniform: "show me
type in compartment". Results are projected down to the fields that identify and
locate a resource — an OCI Instance has 36 fields, most of them null — with
verbose=true to get the full object.
Resource types
Pass any of these as resource_type:
Service | Values |
compute |
|
block storage |
|
network |
|
OKE |
|
database |
|
object storage |
|
identity |
|
Two quirks worth knowing:
OKE clusters are not indexed by OCI Resource Search, so
oci_searchwill never return one. Useoci_list("cluster").Buckets are addressed by name, not OCID:
oci_get("bucket", "my-bucket").
Configure
Everything is an environment variable, and every default is safe. See
.env.example.
Variable | Default | Purpose |
|
| Profile in |
| profile's region | Region override |
| (empty) | Compartments where mutation is permitted. Empty means none. |
|
| Register write tools |
|
| Register delete tools |
The allowlist fails closed: an unconfigured server cannot mutate anything, anywhere. Name a disposable compartment to enable writes — never the root. A disabled capability's tools are absent from the catalog entirely rather than present and refusing, so an agent cannot be talked into calling one.
oci_whoami reports the active allowlist and flags, and explains why a mutation
would be refused.
Contributing
Contributions are welcome — see CONTRIBUTING.md. Adding a new
resource type is usually a single entry in registry.py and the test suite covers it
automatically, which makes it a good first change.
License
Available Tools
4 toolsoci_getGet one OCI resourceARead-onlyIdempotent
Fetch full details for a single resource.
Use this after oci_list or oci_search has given you an OCID and you need the complete record — configuration, nested settings, tags.
| Name | Required | Description | Default |
|---|---|---|---|
| target | Yes | The resource OCID. For resource_type='bucket' pass the bucket NAME instead. | |
| verbose | No | Full detail (default). Set false for the compact projection. | |
| resource_type | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint and openWorldHint, so the safety profile is covered. The description adds real value by telling the agent what it gets back ('configuration, nested settings, tags'), which is behavioral rather than restating annotations. It says nothing about auth requirements or rate limits, but with annotations and an output schema present those are less critical.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences, zero filler, with the core action front-loaded and the workflow cue immediately after. Every phrase earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema, full annotation coverage, and a self-documenting enum of 38 resource types, the description only needs to establish the read-one workflow, which it does. It does not explain the breadth of resource_type choices, but the enum carries that load.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 67%, above the baseline threshold, and the schema documents the bucket-NAME exception and the verbose toggle. The description reinforces that 'target' is an OCID obtained from oci_list/oci_search, but adds no format or validation detail beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Fetch full details for a single resource') and the phrase 'single resource' implicitly contrasts with the list/search siblings. It stops short of naming an alternative directly in the purpose statement, so sibling separation is left partly to inference.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly tells the agent when to reach for this tool: 'after oci_list or oci_search has given you an OCID'. That is a concrete triggering condition referencing two named siblings. It lacks an explicit when-not clause, but the workflow context is unambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
oci_listList OCI resourcesARead-onlyIdempotent
List resources of one type, compactly.
Covers compute, block storage, networking, OKE, database, object storage and identity. Results are projected to the identifying fields; pass verbose=True for the full objects.
Omitting compartment scans the whole tenancy and tags each row with the
compartment it came from.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum rows to return. | |
| verbose | No | Return every field instead of the compact projection. | |
| compartment | No | Compartment name or OCID. Omit to scan every compartment in the tenancy. | |
| resource_type | Yes | ||
| lifecycle_state | No | Filter by state, e.g. RUNNING, AVAILABLE, ACTIVE, TERMINATED. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent and open-world, so safety is covered. The description adds genuinely non-annotated behavior: results are projected to identifying fields by default, and a tenancy-wide scan when compartment is omitted tags each row with its origin. Return-shape detail is left to the output schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short, front-loaded paragraphs with no filler; the primary purpose leads and secondary behaviors follow. Efficient and readable, though slightly more verbose than a single tight paragraph would need to be.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, return values need no explanation, and the description covers scope, projection behavior and the omitted-compartment case. It leaves the list-vs-search boundary unstated, which is the main remaining gap for a tool with three siblings.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is high (80%), so the schema already documents limit, verbose, compartment and resource_type. The description largely restates the verbose and compartment semantics that the schema already provides, adding no syntax or format detail beyond it, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (List) and resource (OCI resources of a single type), and enumerates the service families covered. It does not explicitly differentiate itself from siblings like oci_search or oci_get, so the agent must infer the boundary, but the core purpose is unmistakable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives conditional guidance for two parameters (pass verbose=True for full objects; omit `compartment` to scan the whole tenancy), which is useful in-context usage. However, it never states when to reach for oci_list versus oci_search or oci_get, leaving the sibling routing to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
oci_searchSearch OCI resourcesARead-onlyIdempotent
Find resources of any type across the whole tenancy in one call.
The fastest way to locate something when you do not know its compartment. Prefer this over sweeping oci_list across many types.
Examples: query="query all resources where lifecycleState = 'RUNNING'" query="query instance, volume resources where displayName =~ 'test'" free_text="kubeflow"
Note: Resource Search does not index every service. OKE clusters never appear; use oci_list('cluster') for those.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum rows to return. | |
| query | No | Structured query, e.g. "query instance resources where lifecycleState = 'RUNNING'". Use 'all' in place of a type to search every resource type. | |
| free_text | No | Plain-text search over names and tags. Mutually exclusive with query. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and openWorldHint, so the safety profile is covered. The description adds non-obvious behavioral context the annotations cannot convey: that Resource Search does not index every service and that OKE clusters are never returned. Pagination/limit behavior is left to the schema, so not a full 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded purpose statement, then the routing preference, then concrete examples, then a caveat. Every sentence carries distinct information and the example block is clearly delineated; nothing is redundant with the title.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only, open-world search tool with an output schema, the description covers all decision-relevant information: scope, alternative tools, query syntax, and known coverage gaps. Return-value shape is handled by the output schema, so nothing an agent needs before calling is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3 and the schema already documents each parameter. The description adds value on top by supplying a multi-type query example and the regex operator form (displayName =~ 'test'), plus a free_text example, which goes beyond the single example in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ("Find resources of any type across the whole tenancy") with explicit scope wording ("any type", "whole tenancy"). It also implicitly distinguishes itself from siblings by naming oci_list as the tool it replaces, so an agent can route correctly without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit selection condition ("when you do not know its compartment"), a stated preference over the alternative ("Prefer this over sweeping oci_list across many types"), and a named exception with the correct fallback (OKE clusters never appear; use oci_list('cluster')). This is close to a complete routing rule.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
oci_whoamiWho am I on OCIARead-onlyIdempotent
Report the active OCI identity and this server's own permissions.
Returns the tenancy, user, region and auth method in use, plus which compartments may be mutated and which capability flags are enabled.
Call this first in a session to learn what is reachable before acting.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint and openWorldHint, so the safety profile is covered. The description goes beyond them by disclosing what is actually exposed (tenancy, user, region, auth method, which compartments may be mutated, capability flags) — security-relevant context about what the call reveals. Minor gap: no note on latency, caching, or whether identity can change mid-session.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, each load-bearing: what it reports, exactly what comes back, and when to call it. Front-loaded with the verb and outcome; no filler or restatement of the title.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be spelled out, yet the description still summarizes them usefully. Combined with annotations covering the read-only/idempotent profile and a zero-parameter schema, an agent has everything required to invoke this correctly as a session-opening call.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so per the rubric the baseline is 4. Nothing in the description is needed to clarify arguments, and nothing is misleading about input.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb ('Report') plus a precisely scoped resource: the active OCI identity and the server's own permissions. It further enumerates the exact fields returned (tenancy, user, region, auth method), which no sibling tool (oci_list/oci_get/oci_search) does, so an agent can distinguish it immediately.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit sequencing rule: 'Call this first in a session to learn what is reachable before acting.' That is clear, actionable when-to-use guidance. It does not explicitly name the sibling tools or state when not to use it, but the intent is unambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
4 tool updates
v0.1.0- First observed
oci_get - First observed
oci_list - First observed
oci_search - First observed
oci_whoami
TDQS
Scored across 4 tools
oci_whoami, oci_list, oci_get, and oci_search have largely distinct purposes. The main overlap is between list (one resource type) and search (cross-type query), but descriptions clearly guide when to use each.
All four tools follow a consistent oci_<verb> snake_case pattern (oci_whoami, oci_list, oci_get, oci_search). The convention is predictable and readable.
Four tools is lean but appropriate for a focused read/discovery server, with each tool covering a distinct aspect: identity, enumeration, detail retrieval, and cross-type search. It is slightly thin for the broad OCI domain but not problematic.
The toolset is entirely read-only: no create, update, delete, or action tools exist, despite oci_whoami advertising mutation permissions. Agents tasked with modifying OCI resources will hit dead ends, constituting a significant gap for an OCI management server.
Maintenance
Related MCP Connectors
Read-only MCP access to a documented IT fleet: state, changes, posture. 15 tools.
Governed MCP gateway: one endpoint for your tools, with credential custody and audit log.
CloudOracle - 14-tool multi-cloud compliance MCP: AWS, Azure, GCP posture, IAM, configs.
- ZopDev MCPOAuthdev.zop
Cloud cost, inventory and governance on AWS/Azure/GCP. Read-only by default, optional scoped writes
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceMCP server for Oracle Container Engine for Kubernetes (OKE) that enables inspection, querying, and troubleshooting of OKE clusters through safe, composable tools.Universal Permissive v1.0
- FlicenseNot gradedqualityBmaintenanceEnables interaction with Oracle Cloud Infrastructure through the MCP protocol. Supports dynamic profile selection and provides 85 tools for managing compute, databases, networking, IAM, storage, load balancers, OKE, monitoring, and cost management.-
- AlicenseAqualityDmaintenanceMCP server for Oracle Cloud Infrastructure (OCI) that provides tools to manage Compute, Object Storage, Block Storage, Networking, Autonomous Database, and IAM via the official OCI SDK.2320 npmMIT
- AlicenseAqualityCmaintenanceMCP server for Oracle Cloud Infrastructure (OCI) that exposes Compute, Networking, and Object Storage operations to MCP clients, with support for multiple authentication modes, read-only enforcement, and per-call region overrides.18MIT