Skip to main content
Celum is driven three ways: the dashboard, the API, and an MCP endpoint that lets an AI assistant call the same routes. This page is about the third one — what it reaches, what it is deliberately not allowed to do, and how it is authorized. The endpoint is served at /mcp when MCP_ENABLED=true.

​
Its permissions are yours

There is no service account and no second policy surface. Every tool declares the method and path it calls and re-dispatches internally, so the work is authorized as the route it actually invokes — same action, same KRN, same identity, exactly as the permissions model describes. Three consequences worth stating:
  • an assistant can never do something you could not do yourself;
  • narrowing a policy narrows the assistant with it, immediately, with nothing else to configure;
  • a tool’s effect lands in the audit log under the real route, not under /mcp.
Both the IAM and the audit middleware skip /mcp itself, because the re-dispatched call is the one that carries meaning. A routing detail rather than an exemption — see Architecture.

​
What it will not do

No tool in the catalogue destroys data. Deleting a cluster, a VM or a project has no tool and requires a person. Nor does deleting a volume, an image or a registry.This is policy, not an oversight, and it is why an assistant can carry you a long way into a flow and never back out of it. Plan around it: the assistant creates and inspects, a human removes.
A second limit is structural rather than chosen. Some required steps have no write tool at all — Cilium cannot be installed, nor can certificates be issued — so no supervisor can be onboarded end to end without the dashboard or the API. Platform onboarding carries the per-step table.

​
What it does reach

295 tools covering 347 of the 486 served routes — 71%. Reads dominate, which matches what the surface is for: answering questions about a live estate. Coverage is uneven by design rather than by accident. Flow telemetry has a tool for every query and none for enabling the pipeline; storage has install, disks and status; IAM has none at all. Each page states its own position under an MCP tab, and where a surface cannot do a thing the page says so — silence would read as yes.
One tool can carry many endpoints. 28 of them take a view or kind argument and dispatch to a whole family — forensics is eleven endpoints behind one name. Counting tool names understates the surface, which is why the number above counts reachable routes instead.

​
Writing the prompt is not the skill; reading the answer is

The tool descriptions carry the platform’s operational caveats, and the ones that matter most are about answers that look like success:
  • a 200 with an empty list can mean could not read, not nothing there;
  • a 201 from a re-apply does not prove the thing it re-applied came back;
  • changed: false is usually success, meaning it was already correct.
So the useful habit is the same one an operator needs: confirm with a read that comes from a different direction. Ask for the state after a write, not only for the write’s status.

Permissions model

The action and KRN every tool is authorized against.

Architecture

Where /mcp sits in the request pipeline.

Platform onboarding

Per-step coverage, including the two required steps no tool can perform.

Delegate to a team

Scoping a policy — which scopes the assistant too.