MCP server · Cloud and DevOps
Pulumi MCP server
Lets an assistant list Pulumi stacks, search cloud resources, check policy violations, look up Registry schemas and hand tasks to Neo.
- Maintainer
- Pulumi (official)
- Licence
- Not published (hosted service)
- Runs
- Remote (URL)
- Sign-in
- OAuth sign-in in the app
- Last activity
- 2026-10-12
- Source
- Official docs
Overview
What it does
The Pulumi MCP Server is hosted by Pulumi at mcp.ai.pulumi.com, so there is nothing to install. The first time your client connects, a browser window asks you to paste a Pulumi access token and choose a default organisation. Sessions last 30 days. For CI or headless agents you can instead send the token in an Authorization header, with an optional X-Pulumi-Org header. Pulumi suggests a separate token for the server, ideally an organisation token with a limited role.
Pulumi Cloud tools list stacks, users and policy violations and search resources across stacks. Registry tools list and describe resource types, functions and types for any provider, which helps an assistant write correct Pulumi code. A deploy-to-aws tool and prompts cover deploying an app to AWS and migrating from Terraform or the AWS CDK. The neo-bridge tool starts tasks for Pulumi Neo, the platform’s infrastructure agent, which can change infrastructure and is billed as Neo usage.
Tools
What the assistant can do
- get-stacks, get-users and get-policy-violations for your Pulumi Cloud organisation
- resource-search across all stacks (Essentials, Pro or Enterprise)
- Registry: list-resources, list-functions, get-resource, get-function, get-type
- deploy-to-aws: step-by-step instructions for generating Pulumi code that deploys to AWS
- Prompts for Terraform-to-TypeScript and AWS CDK migrations
- neo-bridge and related tools: start and follow Pulumi Neo tasks
Install
Install Pulumi MCP server in your app
You need:
- A Pulumi account and a Pulumi access token
Run in your project. --scope local keeps the servers private to you in this project; use user for every project.
claude mcp add --scope local --transport http pulumi https://mcp.ai.pulumi.com/mcp
- pulumi: if the server needs a sign-in, the app will ask (run /mcp in Claude Code).
Project root. Commit it to share the servers with your team; each person sets the variables in their own shell.
{
"mcpServers": {
"pulumi": {
"type": "http",
"url": "https://mcp.ai.pulumi.com/mcp"
}
}
}
- pulumi: if the server needs a sign-in, the app will ask (run /mcp in Claude Code).
macOS: ~/Library/Application Support/Claude/claude_desktop_config.json · Windows: %APPDATA%\Claude\claude_desktop_config.json (Settings → Developer → Edit Config). Restart Claude after saving.
{
"mcpServers": {}
}
- pulumi is a remote server: add it as a custom connector (Customize → Connectors → + Add → Add custom connector; on Team and Enterprise plans an owner adds it under Organization settings → Connectors), with the URL https://mcp.ai.pulumi.com/mcp.
In your project, or ~/.cursor/mcp.json for every project.
{
"mcpServers": {
"pulumi": {
"url": "https://mcp.ai.pulumi.com/mcp"
}
}
}
- pulumi: if the server needs a sign-in, the app will ask.
In your workspace. VS Code asks for each secret the first time a server starts and stores it securely.
{
"servers": {
"pulumi": {
"type": "http",
"url": "https://mcp.ai.pulumi.com/mcp"
}
}
}
- pulumi: if the server needs a sign-in, the app will ask.
macOS/Linux: ~/.config/devin/mcp_config.json · Windows: %APPDATA%\devin\mcp_config.json. Read by the default Devin Local agent and by the legacy Cascade agent.
{
"mcpServers": {
"pulumi": {
"url": "https://mcp.ai.pulumi.com/mcp"
}
}
}
- pulumi: if the server needs a sign-in, the app will ask.
Want it alongside other servers? Open Pulumi MCP Server in the MCP config generator and add the rest; it writes one file per app. The snippets follow the setup in the server’s README, checked on 2026-10-14.
Before you install
- Every call runs as the token’s identity; an organisation token with a read-only role limits what the agent can see.
- neo-bridge can start billed Neo tasks that change infrastructure or open pull requests; deny it in your client (in Claude Code, add mcp__pulumi__neo-bridge to permissions.deny) to stay read-only.
- A remote server sees whatever the assistant sends it. Sign in with the narrowest access the service offers. See how to choose a safe server.
Why it’s listed
Why we list it
Pulumi’s own hosted server gives an assistant live stack, resource and Registry data, with clear guidance on keeping it read-only.
Related
More MCP servers
- Cloudflare Documentation MCP ServerLets an assistant search the current Cloudflare developer documentation through a free hosted server that needs no sign-in.
- Vercel MCPLets an assistant search Vercel docs, manage projects and deployments, read runtime logs and query Web Analytics in your Vercel account.
- Netlify MCP ServerLets an assistant create, build, deploy and manage Netlify projects, environment variables, forms and extensions in plain language.
- Supabase MCP ServerLets an assistant manage Supabase projects: list tables, run SQL and migrations, read logs, deploy Edge Functions and search the docs.
- AWS Knowledge MCP ServerLets an assistant search and read current AWS documentation, check regional availability of services and load AWS agent skills.
- Azure MCP ServerLets an assistant work with more than 45 Azure services, from Storage and Key Vault to AKS, Cosmos DB and Monitor, using your Azure sign-in.
All MCP serversMCP config generatorGuide: MCP servers in Claude CodeGuide: what is MCP?