MCP server

français : cette page n’est pas encore traduite, la voici en anglais.

The MCP server lets a model deploy an image as a Cube, or several Cubes together, read their logs and go back to an earlier version; make sandboxes, run commands in them, read and write files, open ports, take snapshots and roll back; make Drives, disks that outlive sandboxes, mount them, keep snapshots of them and back them up; point domains at apps and sandboxes; and look at the project and the account. It keeps no state of its own: everything goes through the TypeScript SDK to the API.

It needs Node 23.6 or later, and runs from npm as glac-mcp, which brings the official MCP TypeScript SDK it is built on:

GLAC_API_URL=https://api.glac.ai GLAC_API_KEY=ak_... npx glac-mcp

Connect a client

Claude Code:

claude mcp add glac -e GLAC_API_URL=https://api.glac.ai -e GLAC_API_KEY=ak_... -- npx glac-mcp

Claude Desktop (claude_desktop_config.json; on macOS in ~/Library/Application Support/Claude/), and Cursor (~/.cursor/mcp.json or .cursor/mcp.json in a project) take the same entry:

{
  "mcpServers": {
    "glac": {
      "command": "npx",
      "args": ["glac-mcp"],
      "env": { "GLAC_API_URL": "https://api.glac.ai", "GLAC_API_KEY": "ak_..." }
    }
  }
}

Over HTTP

glac-mcp serve --http serves the same tools over MCP’s Streamable HTTP transport at /mcp, for a client that connects to an address instead of starting a process:

npx glac-mcp serve --http 127.0.0.1:7071
claude mcp add --transport http glac http://127.0.0.1:7071/mcp --header "Authorization: Bearer ak_..."

The server holds no key of its own: each request brings an API key as a Bearer token, the server checks it with the API (and takes it as good for 30 seconds), and the tools use that key and no other. A request without a key, or with one the API does not know, is answered 401 with a WWW-Authenticate: Bearer challenge that points at the endpoint’s protected resource metadata (RFC 9728, at /.well-known/oauth-protected-resource/mcp). Every request is served on its own, with no session, so any number of these servers can stand behind one address. It listens on this machine only unless told otherwise; on any other address put TLS in front of it, and set GLAC_MCP_PUBLIC_URL to the address clients use.

Sign in instead of pasting a key

The endpoint Glac serves also takes the access token of an app you connected to Glac by signing in. [TODO: the endpoint’s address and its authorization server’s, once they are served.] A client such as Claude, ChatGPT or Cursor then connects with no key and no set-up: add the endpoint’s address as a remote MCP server (in Claude, a custom connector), and the client reads the endpoint’s protected resource metadata, finds Glac’s authorization server there (Ory Hydra, with the scopes below), and registers itself with it: by its own Client ID Metadata Document, which is what MCP’s revision 2026-07-28 asks for first, or with a registration (RFC 7591) where it has none. Its redirect address has to be https, or localhost for an app on your own computer. Your browser opens the console: sign in (with your password, GitHub or Google), and the console shows the app’s name, whether it registered itself or published its description, the address it sends you back to, and what it asks for. Pick the account and the project (one unless you pick more) and what it may do:

Allow it, and the app gets an access token for the API and the MCP endpoint (it lasts ten minutes; the app refreshes it) and goes on as you allowed, in the projects you picked and no others. A tool outside those scopes is refused, naming the scope it takes (403 insufficient_scope), and so is what no connected app may do whatever its scopes: API keys, webhooks, the audit log, changes to billing or to the account’s settings, domains, secrets, log destinations. What your role in the account does not let you do, the app does not do either. Your connected apps are listed in the console under your settings (Connected apps), each with what it may do, where, and when it was last used; Revoke stops every token of it at the API at once, and at the MCP endpoint within 30 seconds.

An endpoint you run yourself is not one the authorization server issues tokens for: it takes API keys.

Tools

The 73 tools follow what a model needs to do, not the REST calls one by one. They are grouped, and named, by product: Cube (cube_*; the same tools answer to worker_* too, which are not listed), Sandbox (sandbox_*), Drive (drive_*), domains (domain_*), Browser (browser_*), Database (database_*), Managed Applications (catalogue_*, installation_*), then the project (project_*) and the account (account_*), and listed in that order.

Cube

Cube runs an image as a service at an address of its own, a Cube, which the API calls an app, and so do the tools’ arguments (app). These seven need the platform’s control plane.

Sandbox

Drive

A Drive is a disk of the project’s that outlives the sandboxes that use it: mounted read-write by one sandbox at a time, and kept, with what it holds, for the next sandbox: of its region, or of another whose machines read its home’s object store. A snapshot keeps a Drive as it is at an instant, a version of it in the object store: nothing is copied. A backup is a copy of it at an instant, in the object store, until it expires. These sixteen need the platform’s control plane. Behind a prefix, the server’s Drives carry it, and it mounts them in its own sandboxes only, so a Drive is made with a name.

The model calls a snapshot by its name or its id (dsnap-…), always with its Drive: drive_snapshot gives no name twice among a Drive’s snapshots, and behind a prefix it names each one under the prefix, making a name up (the Drive’s and the time) when none is given. A snapshot outlives its Drive: the result of drive_delete names those that remain, and they are reached by the Drive’s id. A snapshot is billed for what it keeps alone, at the Drives’ data price ($0.02 a GB-month), until it is deleted; a fork is billed by all it holds, like any Drive (a fork of a 10 GB snapshot is billed as a 10 GB Drive); what a read-only mount reads from the object store costs nothing. A restore keeps the versions in between where a snapshot or a fork keeps them, so a Drive restored to an older snapshot can be restored to a newer one after; what it held that no snapshot kept is gone.

A backup is not a snapshot: a snapshot is a version of its Drive, while a backup is a copy of its own, called by its id (bak-…), with no name, from which a Drive is made alone. A Drive’s backups keep only what changed since the one before, and a block several of them need is billed once, on the earliest: what each is billed for (stored_bytes), what deleting it would save (own_bytes) and what it shares (shared_bytes) are in its row. It is making until the object store has all of it, then ready, and billed from then at the price of what sleeping sandboxes keep ($0.02 a GB-month), until it expires or is deleted. It outlives its Drive: a new Drive is made of it whatever became of the one it was taken of. Behind a prefix, the server sees the backups of its own Drives alone, and names a Drive made of one under the prefix. A Drive whose machine copies nothing to an object store has none: drive_backup says so.

Domains

Browser

Not open yet. Browser is not open to accounts yet: what follows is the server as it stands, ahead of its opening.

A session is a hosted Chromium, awake while a client of the Chrome DevTools Protocol (CDP) is connected to it and asleep, its pages kept, a few seconds after the last one leaves. The server opens and closes sessions; what is done in the browser is done by Playwright’s MCP server, connected at the session’s address (npx @playwright/mcp --cdp-endpoint <cdp_url>). These three need the platform’s control plane. Behind a prefix, the server’s sessions carry it in their names: it sees and closes its own alone.

A session is billed by the Cube resources it uses, as any instance is: its CPU while it computes, its memory while it is awake and its traffic out (pricing and plans). account_usage gives a session’s use beside its sandbox.

Databases

A database is a managed Postgres, asleep when nothing asks anything of it and woken by a connection, its sessions kept. The server makes them and branches of them, and looks at them; deleting one or a branch, putting it to sleep, waking it and a new password are a person’s (glac db rm, glac db branches rm, glac db sleep, glac db wake, glac db reset-password). These four need the platform’s control plane. Behind a prefix, the server’s databases carry it in their names: it sees its own alone.

A database’s history (how far back it can be restored, glac db update --history) and a restore of it in place (glac db restore: its root branch back to a time, its connections dropped, its state before kept as a branch) are a person’s: no tool does either. A Drive’s window of versions is in the SDKs and glac drives versions|history, not yet among these tools.

A database is reached on the project’s network, from a sandbox made with project_network: true (and from the project’s apps), at its name.

Managed Applications

An application of the catalogue (Rivet, say) is installed in the project as its own Cube resources, labelled with the installation and changed through it alone (Managed Applications). The server looks at the catalogue, installs, and looks at the installations; changing one and deleting one, which takes its Volumes and buckets with what they hold, are a person’s (glac installations update, glac installations rm). These five need the platform’s control plane. Behind a prefix, the server’s installations carry it in their names: it sees its own alone.

The project and the account

A few rules the server keeps:

• State follows the name. A sandbox the model names stays the model’s, with its files, packages and processes, across conversations.
• A failed command is a result, not an error: a non-zero exit code, a time-out or a signal comes back as a normal result with the exit code on its first line. A missing sandbox, an API that cannot be reached or wrong arguments are errors, with what to do.
• Long output is cut in the middle: at most 16 384 bytes a call, the start and the end, with the call that reads the rest.
• A call waits at most 45 seconds; a command still running comes back as running with its id, and sandbox_output waits on.
• Paying is a person’s job. There are no tools to top up, change the plan, turn on auto reload, withdraw from a purchase or store a secret; the results say which glac command does it. Where the account buys as a consumer in the EEA or the UK, a purchase needs the buyer’s own express request to have it at once: that request is theirs to give (--start-now on the glac billing commands, or the box on the console’s billing page), never an agent’s, and the commands the results name carry --start-now there.
• Secrets stay out of reach of the model: an app deployed here (cube_deploy, project_deploy) gets no secrets or files from this server, its env refers to shared variables alone, and an image pull secret goes only to the registry configured for it (GLAC_MCP_IMAGE_PULL_SECRETS=GHCR=ghcr.io,HUB=docker.io).

Settings

It is built on the official MCP TypeScript SDK, and speaks the protocol of 2026-07-28 and, for older clients, the initialize handshake of 2025-11-25, 2025-06-18, 2025-03-26 and 2024-11-05: one revision a connection, the one its client opens it with. Not there yet: tools for volumes (the disks underneath Drives), a terminal (pty), a sandbox’s own environment, and making a sandbox from a snapshot.