U Uncloud
Get Started
uncloud cli · v0.8 · one binary, no daemon

Two commands
to your whole cloud.

Install it, run uncloud login — the browser opens, you approve, the token lands on your machine. From there every uncloud primitive — apps, droplets, Postgres, volumes, domains, TLS — answers to your terminal, and to Claude Code holding the same token.

$npm i -g uncloud-cli
~6 MB · macOS + Linux · Intel & Apple Silicon · installs the agent skill too
Wire up your agent
Runs inside
Claude Code Codex opencode Any agent with a shell
~/work/orbit-api live
Setup · about ninety seconds

Three steps, then never
touch a dashboard again.

The CLI keeps one file — ~/.uncloud/config, mode 0600 — holding your API URL and token. Everything else is stateless.

01

Install the binary

A single static Go binary — no runtime, no daemon, no agent to babysit. macOS and Linux, Intel and Apple Silicon, ~6 MB. Installs the agent skill into Claude Code, Codex, and opencode at the same time, for whichever you already run.

$ npm i -g uncloud-cli
added 1 package · binaries for darwin + linux bundled
uncloud: agent skill installed for Claude Code, Codex
02

Sign in through the browser

No token to copy. uncloud login opens the console on a loopback callback, you approve once, and the token is written to ~/.uncloud/config. Point it elsewhere with -api if you self-host.

$ uncloud login
Opening https://uncloud.club/cli/auth
Waiting for you to authorize… done

  api      https://api.uncloud.club
  project  proj_default
  token    uck_8f31a0c2… (saved to ~/.uncloud/config)
03

Teach your agent the verbs

Drop the uncloud skill into Claude Code. It carries the command grammar, the monorepo conventions, and the failure table — so the agent knows uncloud db add exists before it guesses.

$ mkdir -p ~/.claude/skills/uncloud && curl -fsSL \
    https://uncloud-cli.vercel.app/dl/skill.md \
    -o ~/.claude/skills/uncloud/SKILL.md
$ claude
› deploy this repo and give it a production Postgres
Claude Code & Codex × uncloud

Say the thing.
The cloud does the thing.

The agent doesn't wrap a toy subset. It holds the same token your terminal does, which means the whole control plane — build, provision, attach, scale, expose — is in reach of a sentence.

Nothing to wire up: installing the CLI drops the skill into Claude Code, Codex, and opencode — whichever of them you already run, and none that you don't. Re-run it any time with uncloud skill install, or check what's where with uncloud skill status.

Claude Code

Anthropic
installs to
~/.claude/skills/uncloud/
command
uncloud skill install
then say
deploy this repo and attach a production postgres

Codex

OpenAI
installs to
~/.codex/skills/uncloud/
command
uncloud skill install
then say
ship this and give me the URL

The skill file, if you'd rather place it yourself

One markdown file. It carries the command grammar, the exit codes an agent branches on, and the failure tables — so the agent fixes a broken build or an expired token itself instead of handing you the error. Drop it in the skills directory above.

Download skill.md
you

Ship this repo. It's a monorepo — api, web, worker.

uncloud runs uncloud deploy all -project proj_default → 3 apps created · 3 builds submitted
you

Give the api a production Postgres and write the .env.

uncloud runs uncloud db add -workload production -storage 20 → 3 replicas · pooler · DATABASE_URL written
you

Spin me two 4-vCPU boxes in the Mumbai region.

uncloud runs POST /api/v1/droplets ×2 → dpl_9fa2, dpl_9fa3 · provisioning → active
you

Put api.myapp.com on it with TLS.

uncloud runs POST /api/v1/apps/{id}/domains → ACME issued · cert stapled · live
you

Why did the last build fail?

uncloud runs GET /api/v1/apps/{id}/build-log → step 4: missing lockfile · patch suggested
you

Attach a 100 GB volume to the worker and back it up nightly.

uncloud runs POST /api/v1/volumes · POST /api/v1/backup/policies → vol_31c8 mounted · policy 02:00 IST
Command surface

Small vocabulary.
Whole platform behind it.

A dozen verbs cover the daily loop, and every control-plane resource takes the same five — list, get, create, update, delete. Anything left over is uncloud api, same token, same REST surface.

commandwhat it doesruns from
uncloud loginOpen the console, approve once, write the token to ~/.uncloud/configanywhere
uncloud deployCheck what would break, fix what is safe to fix, build, and wait until the URL answersproject root
uncloud doctorThe same pre-deploy checks on their own — Dockerfile, ignore rules, port, environmentproject root
uncloud deploy allRead .uncloud-apps and deploy every listed path in one passrepo root
uncloud redeployRoll out the current spec without rebuildingproject root
uncloud logsContainer logs, unwrapped so they pipe like any other streamproject root
uncloud envRead the environment, or merge KEY=value into itproject root
uncloud scale NSet the replica count and roll it outproject root
uncloud domain addAttach a hostname and print the DNS record to createproject root
uncloud db addProvision Postgres — -workload dev|production, -storage GB — and print the .envproject root
uncloud openPrint the app's public URL and open itproject root
uncloud <resource>24 of them — apps, droplets, volumes, buckets, pipelines, IAM — each with the same five verbsanywhere
uncloud apiAny method, any path, for whatever the verbs don't coveranywhere
uncloud skill installPut the agent skill into Claude Code, Codex, opencodeanywhere
REST surface · /api/v1

Everything the console
can do, the token can do.

There is no privileged dashboard path. The web console is a client of the same API your agent is holding — so nothing is locked behind a UI.

Apps

Tarball or Git builds, replicas, env, domains.

Compute

KubeVirt VMs on your own metal.

Databases

Postgres — dev single, production HA.

Storage

S3-compatible buckets and block volumes.

/apps

Apps

Git or tarball builds, replicas, env, domains, build logs.

/droplets

Compute

KubeVirt VMs on your own metal, plans and regions.

/databases

Databases

Postgres as a StatefulSet — dev single, production HA + pooler.

/volumes

Block storage

PVCs you attach, resize, snapshot and detach.

/buckets

Object storage

S3-compatible buckets, objects, presigned URLs.

/clusters

Clusters

Register providers, add nodes, provision capacity.

/pipelines

Pipelines

Build and deploy stages with per-step runs.

/cronjobs

Cron

Scheduled workloads with history and alerts.

/backup/policies

Backup

Policies and jobs across volumes and databases.

/iam/users

IAM

Users, groups, roles, project-scoped access.

/webhooks

Webhooks

Event rules and deliveries with replay.

/ssh-keys

SSH keys

Keys pushed into droplets at provision time.

Account validation

One token. Scoped,
hashed, revocable.

Signing in to the console is how you prove you're you. Minting a token is how you lend that proof to a machine — with a smaller blast radius and a kill switch.

whereuncloud login, or mint one by hand in Settings → API tokens
scopeOne project. Cross-project calls are rejected, not filtered.
at restsha256:… server-side. The plaintext is shown once.
on disk~/.uncloud/config, mode 0600
on the wireAuthorization: Bearer … + X-Project-ID
revokeDelete it in the console. The next request is a 401.
# the CLI is a convenience — the API is the contract
$ curl -s https://api.uncloud.club/api/v1/apps \
    -H "Authorization: Bearer $UNCLOUD_API_TOKEN" \
    -H "X-Project-ID: proj_default" | jq '.apps[] | .name'

"orbit-api"
"orbit-web"
"orbit-worker"
Questions

The obvious ones,
answered plainly.

01Does the agent need MCP?+
No. The uncloud CLI is a plain binary, so any agent that can run a shell command can drive it — Claude Code, Cursor, Codex, your own script. The skill file simply teaches the agent the vocabulary so it stops guessing flags.
02How does uncloud login actually work?+
The CLI opens a one-shot HTTP server on a random loopback port and sends your browser to uncloud.club/cli/auth with that callback and a random state nonce. You're already signed in there, so approving mints a project-scoped token and redirects it back to 127.0.0.1. The console refuses any callback that isn't loopback, and the CLI refuses any callback that doesn't carry back the exact nonce it generated — so the token only ever travels between two processes on your own machine.
03Can the agent delete production?+
It can do whatever the token can do — so scope tokens per project and mint a separate one for agent work. Every call lands in the audit log with the token that made it, and revoking is instant.
04Where does the code actually run?+
On your cluster. uncloud is a Kubernetes-native control plane: apps become Deployments, databases become StatefulSets, droplets become KubeVirt VMs, volumes become PVCs. SQLite holds intent, Kubernetes holds truth, and a sync loop reconciles the two every fifteen seconds.
05Monorepos?+
Drop a .uncloud-apps file at the repo root — one path per line — and uncloud deploy all walks it. Each app keeps its own .uncloud/config.json with its app id, so subsequent deploys from a subfolder just work.
06Self-hosted API?+
Point UNCLOUD_API_URL at your own control plane — http://localhost:8080 in development. The CLI has no hard-coded host.
Ninety seconds from here

Stop clicking. Start telling.

Install the binary, mint a token, and let the agent do the provisioning while you keep writing code.

Install the CLI Open the console