apolo-mcp

apolo-mcp is a local stdio Model Context Protocol server for typed Apolo platform operations. It is a thin adapter over apolo-sdk: it never shells out to the CLI and uses the configured Apolo identity, permissions, and defaults. Local sessions normally come from apolo login; isolated jobs may use APOLO_PASSED_CONFIG.

The server exposes bounded context discovery and typed platform operations. Every operational tool accepts explicit cluster, org, and project inputs where the SDK supports them; explicit inputs never modify the user's saved context. Secret values and one-time credentials are intentionally outside the model-visible interface.

Installation

Follow the installation and client configuration guide for prerequisites, server and skill installation, Codex and Claude Code registration, per-session policy selection, and verification. Local stdio is the only supported transport; shared-credential remote service operation is unsupported.

See the Apolo MCP documentation for prerequisites, safety controls, the capability matrix, generated tools and skills catalogs, and task-oriented guides.

Development

make setup
make lint
make test
make build

Dependencies are locked with uv.lock. Tests use an ApoloClientProvider fake and do not require credentials. Integration tests, when added, must be opt-in and target an isolated non-production project.

Wheel and source-distribution files are generated release artifacts and must not be committed. Tagged releases build them in CI and publish the exact outputs to PyPI via Trusted Publishing; local dist/ contents are disposable. Maintainers should follow RELEASE.md for changelog, validation, signing, and publication.

Release versions use YY.MM.NN: the two-digit year, the month without a leading zero, and a zero-based release sequence within that month. For example, v26.7.0 is the first July 2026 release, and its Python package version is 26.7.0.

Safety configuration

The server defaults to APOLO_MCP_POLICY_MODE=read-only. Use managed to create resources and manage only their exact journaled lifecycles, or full to permit mutations of any exact-context resource. Policy never grants Apolo permissions or replaces Apolo RBAC, and it is not a security boundary against an agent with direct CLI or SDK access. Never run full with a personal administrator, owner, or other broadly privileged Apolo account. Use a dedicated least-privileged service account and follow the full-mode service-account guide. Select policy per launch rather than permanently storing managed or full; the installation guide contains the client-specific configuration. Read the generated safety model before enabling writes, and consult the capability matrix for the complete current contract.

Licensed under Apache-2.0. See SECURITY.md for private reporting.