ArvanCloud MCP Server

Get the current account/project details for Cloud Server.

Run an Ansible playbook against a host (requires ansible-playbook).

playbook is the YAML content. Auth/host default to the SSH settings. Host-key checking is disabled (fresh servers).

Attach a floating IP to a server/port.

Attach a network to a server (optionally with a fixed IP).

Attach a security group to a server.

Attach a tag to a resource (e.g. a server).

Attach a volume to a server.

Return the most recent mutating tool calls (newest last).

Discover ArvanCloud products and their API endpoints.

Call without arguments for a compact overview of every service. Pass a service key (compute, network, storage, cdn, dns, vod, live) to get its full endpoint list, including request-body hints you can feed to arvan_request.

Convenience: create an A record pointing name at one or more IPs.

Create a CDN app (edge application) for a domain.

Convenience: create a CNAME record from name to target.

Create a DNS record. See module docs for value shapes per type.

Args: domain: Zone the record belongs to. type: Record type (a, aaaa, cname, mx, txt, ns, srv, …). name: Record name/subdomain (@ for the root). value: Type-specific value (see the shapes in this tool's docs). ttl: Time-to-live in seconds. cloud: Whether to proxy the record through ArvanCloud (orange-cloud). upstream_https: Upstream HTTPS mode when cloud is enabled. ip_filter_mode: Optional IP-filter/health-check configuration.

Add a domain to the CDN / Cloud DNS (the "dns-service" onboarding call).

Args: domain: The domain name, e.g. example.com. extra: Additional fields to merge into the request body (e.g. plan).

Create a firewall (WAF) rule.

Args: domain: The CDN domain. name: Rule name. action: Action to take, e.g. block, allow, challenge. filters: Match conditions for the rule. extra: Additional fields to merge into the request body.

Allocate a new floating (public) IP address.

Create a log forwarder (ship access logs to an external sink).

Create a metric exporter for a domain.

Create a page rule.

Args: domain: The CDN domain. url: URL pattern the rule applies to (e.g. example.com/blog/*). actions: Map of rule actions, e.g. {"cache_level": "bypass"}.

Create a private network (subnet).

Args: name: Network name. region: Region code; defaults to ARVAN_DEFAULT_REGION. subnet_ip: CIDR for the subnet, e.g. 192.168.0.0/24. subnet_gateway: Gateway IP within the subnet. enable_gateway: Whether to enable the gateway. enable_dhcp: Whether DHCP assigns addresses automatically. dns_servers: Comma-separated DNS servers. dhcp_start / dhcp_end: Optional DHCP allocation range.

Create a reverse-DNS (PTR) record mapping an IP to a domain.

Create a rate-limit rule.

rule carries the documented fields (e.g. url, method, count, duration, action).

Create a security group.

Add a rule to a security group.

Args: group_id: Target security-group id. direction: ingress (inbound) or egress (outbound). protocol: tcp, udp, icmp … (omit for any). port_from / port_to: Port range (as strings). ips: Source/destination CIDRs, e.g. ["0.0.0.0/0"]. description: Optional description.

Create one or more cloud servers.

Args: name: Server name (a numeric suffix is added when count > 1). flavor_id: Plan/flavor id — see arvan_list_plans. image_id: OS/snapshot image id — see arvan_list_images. region: Region code; defaults to ARVAN_DEFAULT_REGION. disk_size: Root disk size in GB. count: How many identical servers to create. network_ids: Private network ids to attach. security_group_names: Security groups to apply. ssh_key_name: Name of an SSH key to inject (see arvan_list_ssh_keys). init_script: Cloud-init / startup script. ha_enabled: Enable high availability. create_type: Optional create type (e.g. image, snapshot). extra: Any additional fields to merge into the request body.

Register an SSH public key so it can be injected into servers at create.

Create a resource tag.

Create a block-storage volume.

Args: name: Volume name. size: Size in GB. region: Region code; defaults to ARVAN_DEFAULT_REGION. description: Optional description.

Delete a CDN app by id.

Delete a DNS record by id.

Remove a domain from the CDN.

The delete endpoint requires the domain's id. If domain_id is not supplied it is looked up automatically via the domain details.

Delete a firewall (WAF) rule by id.

Release (delete) a floating IP address by id.

Delete a log forwarder by id.

Delete a page rule by id.

Delete a reverse-DNS (PTR) record by id.

Delete a rate-limit rule by id.

Delete a security group by id.

Delete a security-group rule by id.

Delete a cloud server. Set force_delete_floating_ips to also release IPs.

Delete a registered SSH key by name.

Delete a private-network subnet by id.

Delete a resource tag by id.

Delete a block-storage volume by id.

Detach a floating IP from the given port.

Detach a network from a server.

Detach a security group from a server.

Detach a tag from a resource.

Detach a volume from a server.

Fetch an ArvanCloud documentation page and return it as plain text.

Only ArvanCloud domains (arvancloud.ir / arvancloud.com) are allowed.

Search the curated ArvanCloud documentation index for a query.

List curated ArvanCloud documentation topics and their URLs.

Diagnose the server's configuration and connectivity.

Checks: whether the API key works (a live call), which optional CLI tools are installed (IaC/security/k8s/git/net), and whether Object Storage and SSH defaults are configured. Run this first to see what's ready to use.

Search this server's own tools by keyword (handy with 200+ tools).

Returns matching tool names and one-line descriptions, ranked by relevance.

Get caching settings for a domain.

Get a CDN app by id.

Get a single DNS record by id.

Get DNSSEC status (and DS records) for a domain.

Get details and settings for a CDN domain.

Get resource quotas and current usage for a region.

Get details of a single cloud server by id.

Get HTTPS/SSL settings for a domain.

Get a private-network subnet by id.

Get a single block-storage volume by id.

Get block-storage volume limits/quota for a region.

Report whether the git binary is installed.

Check out a branch, tag, or commit.

Clone a repository to dest (defaults to a fresh temp directory).

Returns the checkout path so you can pass it as directory to the IaC or Kubernetes tools. The path persists for the session.

Show the diff of unstaged (or, with staged, staged) changes.

List tracked files in a checkout.

Show recent commits (one line each).

Pull the latest changes for the current branch.

Show the working-tree status of a checkout (porcelain).

Install/upgrade a Helm chart.

values are passed as --set key=value pairs (flat keys). chart may be a local path (e.g. deploy/helm/arvancloud-mcp) or a repo chart.

Uninstall a Helm release.

Report which IaC validation tools are installed (and their paths).

Scan IaC for misconfigurations & security issues with Checkov.

framework optionally narrows the scan (e.g. terraform, kubernetes, dockerfile).

Lint Kubernetes manifests for security/correctness with kube-linter.

Lint a Dockerfile with hadolint (reads the content from stdin).

Lint a YAML document with yamllint (reads the content from stdin).

Validate OpenTofu configuration (tofu validate).

Validate a Packer template (packer validate).

Run terraform apply to create/update real ArvanCloud infrastructure.

This changes live infrastructure, so it refuses to run unless auto_approve=True is passed explicitly.

Estimate Terraform cost with Infracost (infracost breakdown).

Run terraform destroy (tears down infrastructure; needs auto_approve).

Check (or apply, with write=True) Terraform formatting.

Run terraform init (downloads the arvancloud/arvan provider).

Run terraform plan against the arvancloud/arvan provider.

Use this to preview infrastructure changes before applying. The configured API key is injected as TF_VAR_api_key/ARVAN_API_KEY.

Validate Terraform configuration (optionally terraform init first).

init runs terraform init -backend=false so providers resolve; disable it for an offline syntax-only check.

Lint Terraform with tflint (best-practice and provider checks).

Scan Terraform for security issues with tfsec.

Scan IaC/config for security issues with Trivy (trivy config).

Validate Kubernetes manifests against the schema with kubeconform.

Pass a single manifest YAML string, or files/directory.

Import DNS records from a BIND-style zone file.

zone is the text content of the zone file; it is uploaded as the f_zone_file multipart field the API expects.

kubectl apply a manifest (inline YAML) or a directory of manifests.

Report whether kubectl and helm are installed.

kubectl delete -f a manifest or directory.

kubectl get resources (e.g. resource='pods'), default JSON output.

Run an arbitrary kubectl command (e.g. ["get","pods","-o","wide"]).

List CDN apps configured for a domain.

List DNS records for a domain (optionally filter by search/type).

List CDN domains on the account (supports pagination & search).

List firewall (WAF) rules for a domain.

List floating (public) IP addresses in a region.

List server images.

Args: region: Region code; defaults to ARVAN_DEFAULT_REGION. image_type: Filter by type, e.g. distributions (OS images), snapshots (your snapshots), or private. marketplace: Set True to list marketplace app images instead.

List log-forwarding destinations for a domain.

List Prometheus-style metric exporters for a domain.

List networks (public and private) available in a region.

List page rules for a domain.

List available server plans/flavors (sizes) and their pricing.

List reverse-DNS (PTR) records in a region.

List rate-limit rules for a domain.

List all ArvanCloud IaaS regions (datacenters) and their codes.

List security groups (firewall groups) in a region.

List cloud servers (VMs) in a region.

List SSH keys registered in a region (for injecting into new servers).

List private-network subnets in a region.

List resource tags in a region.

List block-storage volumes in a region.

Create a live-streaming channel.

extra carries optional fields such as type (e.g. normal), archive_enabled, mode and slug.

Delete a live channel by id.

Get a live channel by id (includes push/pull URLs and stream keys).

List live-streaming channels.

List the inputs/streams configured for a live channel.

Update a live channel with the given fields.

Return server tool-call metrics (calls, errors, latency).

Set prometheus=True for Prometheus text-exposition format.

Resolve a DNS record.

Args: name: Hostname to look up. record_type: A, AAAA, CNAME, MX, TXT, NS, SOA, SRV, CAA, PTR … nameserver: Optional resolver IP to query directly (test propagation). timeout: Query timeout in seconds.

Make an HTTP(S) request and report status, timing, and key headers.

Fire a quick concurrent load test and report latency percentiles.

Bounded to 2000 requests and 200 concurrency. Useful for sanity-checking a freshly deployed endpoint, not a substitute for a real load tool.

Return this server's public IP address (via an external echo service).

ICMP ping a host (requires the system ping binary).

Scan a list of TCP ports on a host (defaults to common service ports).

Reverse-resolve an IP address to a hostname (PTR).

Check whether a TCP port is open and measure connect latency.

Inspect the TLS certificate served by a host (issuer, SANs, expiry).

Trace the network path to a host (requires traceroute).

WHOIS lookup for a domain or IP (requires the whois binary).

Send an email via SMTP.

SMTP settings fall back to ARVAN_SMTP_HOST/PORT/USER/PASSWORD/FROM env vars.

Post a message to a Slack incoming webhook.

webhook_url falls back to the SLACK_WEBHOOK_URL environment variable.

Send a Telegram message via a bot.

bot_token/chat_id fall back to TELEGRAM_BOT_TOKEN / TELEGRAM_CHAT_ID.

POST a JSON payload (or {"text": ...}) to an arbitrary webhook.

Provision a server and (optionally) configure it, in one call.

Supports several configuration methods (combine as needed):

• init_script — cloud-init that runs at first boot (no SSH needed).

• packages / install_docker / setup_script — run over SSH after boot (builds and runs a bash script). For Terraform-based provisioning use the arvan_iac_terraform_* tools; for Kubernetes use the arvan_k8s_* / arvan_helm_* tools.

Steps: register/generate an SSH key, create the server (optionally with cloud-init), wait for boot, detect its public IP, then SSH in and run the install script built from packages / install_docker / setup_script.

Args: name: Server name. flavor_id: Plan id (see arvan_list_plans). image_id: Image id (see arvan_list_images). region: Region; defaults to ARVAN_DEFAULT_REGION. disk_size: Root disk size (GB). networks: Network ids to attach (include a public network for SSH). security_group_names: Security groups to apply. ssh_public_key: Existing public key to inject. If omitted and generate_ssh_key is true, a new ed25519 keypair is generated and the private key is returned (store it securely!). ssh_key_name: Name to register the key under (default <name>-key). generate_ssh_key: Generate a keypair when no public key is given. ssh_user: SSH user for the install step (default ARVAN_SSH_USER/root). ssh_password: Use password auth for the install step instead of a key. packages: apt packages to install. install_docker: Install Docker via get.docker.com. setup_script: Extra shell commands to run after package install. wait_timeout: Max seconds to wait for boot + SSH availability. host_override: Use this IP/host for SSH instead of auto-detection.

Returns a summary with the server details, public IP, SSH info (incl. any generated private key), and install output.

Purge cached content for a domain.

Pass urls to purge specific paths, or omit to purge everything.

Rebuild a server from an image (destroys current root disk contents).

Rename a cloud server.

Call any ArvanCloud API endpoint directly (generic escape hatch).

Use this for any operation that does not have a dedicated tool. Discover available endpoints with arvan_capabilities.

Args: method: HTTP method. path: Endpoint path relative to the API base, e.g. /ecc/v1/regions/ir-thr-c2/servers or /cdn/4.0/domains. A leading slash is optional. query: Optional query-string parameters. body: Optional JSON request body (for POST/PUT/PATCH).

Returns: The decoded JSON response from ArvanCloud.

Change a server's plan/flavor (resize CPU & RAM).

Resize a server's root disk to the given size in GB.

Copy an object to another key/bucket.

Create a bucket. acl is one of private, public-read, public-read-write.

Delete an (empty) bucket.

Delete a single object.

Delete multiple objects in one call.

Configure a bucket for static website hosting (optionally make it public).

Generate a presigned URL for temporary access to an object.

operation is get_object (download) or put_object (upload).

Get a bucket's access policy (JSON).

Download an object. Returns text, or base64 when as_base64 or binary.

Bodies larger than 256 KiB are truncated; use a presigned URL for big files.

Get an object's metadata (size, type, etag) without downloading it.

List all Object Storage buckets.

List objects in a bucket (optionally under a prefix).

Set a bucket's access policy (an S3 policy document).

Upload an object.

Args: bucket: Target bucket. key: Object key (path) within the bucket. content: The object body. Plain text, or base64 if content_base64. content_base64: Set True when content is base64-encoded binary. content_type: Optional MIME type, e.g. application/json. acl: Optional ACL, e.g. public-read.

Set a bucket ACL (private, public-read, public-read-write).

Upload all files under a local directory to a bucket (recursive).

Audit ArvanCloud security groups for risky, world-open ingress rules.

Flags inbound rules open to 0.0.0.0/0 (or ::/0) that expose sensitive ports (SSH, RDP, databases, …) or all ports. Returns findings with a severity so you can tighten them.

Report which security scanners are installed (and their paths).

Generate a cryptographically strong random password.

Generate a Software Bill of Materials (SBOM) with syft.

Generate an SSH keypair (ed25519 or rsa) for provisioning servers.

Returns the OpenSSH private key and the public key. Register the public key with arvan_create_ssh_key and pass the private key to the arvan_ssh_* tools.

Scan a container image or a directory for vulnerabilities with grype.

Check a URL's HTTP security headers and grade them.

Static application security testing (SAST) with semgrep.

Scan a container image for vulnerabilities with Trivy (trivy image).

Scan a directory/files for committed secrets with gitleaks.

Scan a filesystem for vulns, secrets and misconfig with Trivy (trivy fs).

Run a power/maintenance action on a server.

Actions: power-on, power-off, reboot, hard-reboot, rescue, unrescue, reset-root-password, add-public-ip, change-public-ip.

Get available options for creating a server in a region.

Enable or disable DNSSEC for a domain.

Enable or disable port security on a network port.

Create a snapshot of a volume.

Verify SSH connectivity/auth to a server (useful after provisioning).

Returns whether the connection succeeded and the server's SSH banner.

Read a file from the server via SFTP (truncated to 256 KiB).

Run a single command on a server over SSH and return its output.

Args: host: Server IP or hostname (e.g. a freshly created server's public IP). command: The shell command to execute. username: SSH user (defaults to ARVAN_SSH_USER, typically root). port: SSH port (default 22). private_key: Inline PEM private key (overrides the configured default). key_file: Path to a private key file. password: Password auth (if not using a key). passphrase: Passphrase for an encrypted private key. known_hosts: Path to a known_hosts file; omit to skip host-key checks. connect_timeout: Seconds to wait for the connection. command_timeout: Seconds to wait for the command to finish.

Returns: {exit_status, stdout, stderr, host}.

Run a multi-line script on a server over SSH (piped to bash -s).

Use this for setup/bootstrap scripts. interpreter can be changed to, e.g., sh -s or python3 -.

Write content to a file on the server via SFTP.

content is plain text, or base64 when content_base64 is set.

Cancel a scheduled/running background task.

List background tasks and their status (most recent first).

Get a background task's full status, last result, and run history.

Run another tool in the background, now/later/recurring.

Args: tool: Name of the tool to run (e.g. arvan_provision_server, arvan_net_http_load_test, arvan_security_scan_vulnerabilities). arguments: Arguments for that tool. delay_seconds: Wait this long before the first run. interval_seconds: If set, re-run every N seconds (min 1) — a schedule. max_runs: Stop after this many runs (default 1; unlimited when an interval is set and this is omitted — cancel to stop). name: Friendly label for the task. announce_webhook: POST a status payload here when each run finishes (falls back to ARVAN_TASK_WEBHOOK). Use this for completion notifications that work even across replicas / after disconnect.

Returns the task record (with its id) immediately; poll with arvan_task_status or wait for the webhook.

Enable or disable cloud (proxy) for a DNS record.

Trigger a CDN app's webhook action.

Update caching settings for a domain.

settings accepts the caching fields documented by ArvanCloud, e.g. {"cache_status": "enable", "cache_page_200": "..."}.

Update a CDN app with the given fields.

Update a DNS record (full replace).

record should contain the same fields as creation (type, name, value, ttl, cloud …).

Update HTTPS/SSL settings for a domain.

Pass ssl_type (default for free Let's Encrypt, manual for an uploaded certificate, off to disable) and/or a full settings body.

Update a subnet (e.g. dns_servers, enable_dhcp, subnet_gateway).

Update a volume's name and/or description.

Create an audio item in a channel.

Create a VOD channel.

Create/set the VOD user domain.

Create an encoding profile in a channel.

Create a subtitle for a video (e.g. {"lang": "fa", "file_id": "..."}).

Create a video in a channel.

fields typically includes title, description and a file_id previously obtained by uploading to the channel's files endpoint, plus optional convert_mode, watermark_id etc.

Create a watermark in a channel (e.g. {"title":..., "file_id":...}).

Delete an audio item by id.

Delete a VOD channel by id.

Delete an uploaded source file by id.

Delete an encoding profile by id.

Delete a subtitle by id.

Delete a VOD video by id.

Delete a watermark by id.

Get an audio item by id.

Get a VOD channel by id.

Get the VOD user domain (the delivery domain for this account).

Get an uploaded source file by id.

Get an encoding profile by id.

Get a subtitle by id.

Get a VOD video by id.

Get a watermark by id.

List audio tracks in a channel.

List VOD channels.

List uploaded source files in a channel.

List encoding profiles in a channel.

List subtitles for a video.

List videos in a channel.

List watermarks in a channel.

Update an audio item with the given fields.

Update a VOD channel with the given fields.

Update an encoding profile with the given fields.

Update a VOD video with the given fields.

Update a watermark with the given fields.

Poll a server until it becomes active (or the timeout elapses).

Handy right after arvan_create_server and before SSHing in. Returns the latest server details plus ready/timed_out flags. The wait is bounded to 30 minutes regardless of timeout.