MCP server

kumo mcp serve runs a read-only Model Context Protocol server, so Claude Desktop, Claude Code or any other MCP client can look up your workspaces, resources, connections, search results and costs.

Applies to: BothPlan: Team

What it does What you need Configure your MCP client Tools Keep it safe

What it does

kumo mcp serve starts an MCP server that speaks over standard input and output. Your AI assistant starts it as a local process and calls its tools to answer questions such as "which databases does the payments workspace have?" or "what's connected to this load balancer?".

The server only reads. It has no tool that changes anything in Kumo.io. It calls the Kumo.io API with an API token, so the assistant sees exactly what the token's owner can see and nothing more.

What you need

The kumo CLI on the machine where your AI assistant runs.
An API token. Create one under Settings › API Tokens. API access is part of the Team plan and above on hosted Kumo.io.
Your API base URL and account ID. API tokens explains where to find both.

The server always talks to a Kumo.io API. It won't start without an API URL.

Configure your MCP client

Point your client at the kumo command with the mcp serve arguments, and give it the three settings as environment variables. The exact file and format depend on your client. This example is in the mcpServers format several clients use:

{
  "mcpServers": {
    "kumo": {
      "command": "kumo",
      "args": ["mcp", "serve"],
      "env": {
        "KUMO_API_URL": "https://kumo.example.com",
        "KUMO_API_TOKEN": "kum_<…>.<secret>",
        "KUMO_ACCOUNT": "<account id>"
      }
    }
  }
}

You can pass the same values as arguments instead: kumo mcp serve --api-url <url> --token <token> --account <account id>. Environment variables are safer for the token, because arguments can show up in process lists.

When the server starts it writes one line to standard error naming the account and API it's serving. Standard output carries only the MCP protocol.

Tools

Tool	What it returns
`kumo_list_workspaces`	The account's workspaces: id, name and created date
`kumo_list_sources`	A workspace's sources: provider, name and sync status. Can filter by provider: `aws`, `azure`, `gcp` or `kubernetes`
`kumo_list_environments`	A workspace's environments
`kumo_list_views`	An environment's diagram views
`kumo_list_resources`	Resources in a workspace at the latest revision. Can filter by type, for example `compute.instance`
`kumo_get_resource`	One resource's full detail, by resource id or canonical key
`kumo_resource_connections`	A resource's connections to and from other resources
`kumo_list_graph_revisions`	A workspace's graph revisions, for "what changed when" questions
`kumo_search`	Full-text search across resources, environments and views. Can filter by workspace, provider, type and region
`kumo_cost`	Cost for a workspace: `summary`, `waste`, `recommendations` or `forecast`. The window defaults to the last 30 days

List tools return 50 rows by default. The assistant can ask for up to 500.

Keep it safe

Create a dedicated token for the assistant, with an expiry, so you can revoke it on its own.
The token carries its creator's permissions. Give the assistant a Read Only API token so it can look but never change anything. If you want it to see less as well, create the token as someone with a narrower role. Read Roles and permissions.
Your assistant's provider may receive the tool results the assistant reads. Treat what you connect accordingly.