Datum MCP

An MCP server for Datum Cloud. Gives an agent tools to manage organizations/projects, networking (domains, HTTP proxies/routes, gateways, traffic protection policies, DNS), compute workloads, IP address management, Galactic VPC, IAM/billing/services, audit/activity search, and a generic escape hatch for any other Datum-managed resource. For load balancers, networks, compute, DNS and activity it also mounts each service's own diagnosis tools and skills - the same ones Datum's in-product assistant uses. Auth is OAuth 2.1 (PKCE) with system-keychain token storage. Speaks MCP over stdio or streamable HTTP.

See docs/TOOLS.md for the full tool-by-tool reference, toolsets, and prompts.

Install the binary

Homebrew (macOS/Linux):

brew tap datum-cloud/tap
brew install datum-mcp
# upgrade later with: brew upgrade datum-mcp

Install script (macOS/Linux):

curl -fsSL https://github.com/datum-cloud/datum-mcp/releases/latest/download/install.sh | sh

Or download a binary directly from the latest release (macOS/Linux/Windows, amd64/arm64), rename it to datum-mcp (datum-mcp.exe on Windows), and put it on your PATH.

Build from source instead: go build ./cmd/datum-mcp

Register with your MCP client

Claude Code:

claude mcp add --scope user datum-mcp -- datum-mcp

(--scope user registers it for all projects; drop it to register for the current project only.)

Claude Desktop — add to your MCP config:

{
  "datum-mcp": {
    "command": "datum-mcp",
    "args": []
  }
}

Cursor:

Windows — point your client's config at the full install path, e.g. command: "<path>\\datum-mcp.exe".

Toolsets

To keep the tool list small, only the core tools plus the alb, dns and network toolsets load at startup (39 tools). Everything else (activity, billing, compute, iam, ipam, resource, search, services, vpc) is one call away: the agent loads what a task needs with the toolsets tool, mid-session. See every toolset and what it covers with datum-mcp --list-toolsets. Set DATUM_MCP_ENABLE_TOOLSETS (e.g. dns,compute, or all) to change what loads at startup, and DATUM_MCP_DISABLE_TOOLSETS to rule a toolset out entirely; see Toolsets.

Auth

On first use, the server opens a browser for OAuth (PKCE) and stores credentials in the system keychain; later calls reuse/refresh the token automatically. For CI or headless use, see "Running fully non-interactively" in docs/TOOLS.md.

Recommended workflow

1. context → check what's already set up
2. organizations → list, then set active org
3. projects → list for the org, then set active project
4. Use any resource tool for CRUD, or apis to inspect CRD schemas

(Or just use the onboard-to-project prompt for steps 1-3.)

Claude Code skill: when to use Patch instead

This repo ships a Claude Code skill that teaches an agent when an open-ended diagnostic question or a risky/multi-resource change is better handled by Patch — Datum Cloud's own AI assistant, shipped as a datumctl plugin (datumctl plugin install assistant) — instead of datum-mcp's own resource tools. Copy .claude/skills/datum-cloud-assistant/ into your own project's (or ~/.claude/skills/ for a global) skills directory to pick it up anywhere you use datum-mcp.

License

datum-mcp is licensed under the Apache License, Version 2.0. See the LICENSE file for details.