[Blog](https://cohesivity.ai/blog)

MCP

Published Jul 12, 2026·Updated Aug 30, 2026

![](https://cohesivity.ai/authors/shouryamaan.webp)![](https://cohesivity.ai/authors/anshu.webp)[Shouryamaan](https://www.linkedin.com/in/shouryamaanjain/) and [Anshu](https://www.linkedin.com/in/aanshuaggrawal120/)

# How AI Agents Can Safely Manage Cloud Infrastructure Through MCP

[Read as Markdown](https://cohesivity.ai/blog/how-ai-agents-safely-manage-cloud-infrastructure-through-mcp.md)

Agent

MCP guard

MCP

Cloud

An AI agent can manage cloud infrastructure through MCP when planning and execution are separate, credentials are scoped, consequential actions require approval, writes reconcile safely, every effect is traced, and recovery is tested. Tool discovery alone provides none of those controls.

The safest first capability is read-only inventory. Add mutation only after the plan and policy paths work against a disposable environment.

## Separate plan from apply

A plan should identify the exact tenant, environment, resources, dependencies, permission changes, cost, and irreversible effects. Applying that plan should require a separate tool or approval token bound to the plan digest.

Do not let one general tool accept `dryRun: false` after the model composed the payload. A distinct apply capability makes the transition visible to the client and policy layer.

Infrastructure-as-code tools already use this review pattern. MCP should preserve it rather than compress planning and execution into one model turn.

## Scope identity at every layer

The MCP server authenticates the client and represented user. Policy restricts the visible or callable infrastructure tools. The provider credential is limited to the target account, project, environment, and actions. The provider then authorizes the final resource.

Cloudflare's [MCP authorization architecture](https://blog.cloudflare.com/building-ai-agents-with-mcp-authn-authz-and-durable-objects/) separates identity and authorization from agent session state. The [MCP authentication guide](https://cohesivity.ai/blog/mcp-authentication-and-authorization-guide) applies the current protocol requirements around token audience and passthrough.

Do not run development tools under an organization-owner token. If the provider cannot express the needed scope, put a narrow control plane in front of it.

## Treat every write as an operation

Assign one operation ID and idempotency key to the approved change. Store the plan digest, caller, target resources, attempts, provider request IDs, status, and result. A retry must refer to the same operation.

After a timeout, inspect provider and operation state before repeating the call. Unknown outcomes are common when the provider completes work but the client loses the response.

The [agent recovery guide](https://cohesivity.ai/blog/ai-agent-failure-recovery-retries-checkpoints-human-approval) covers checkpoints and outcome reconciliation beyond infrastructure.

## Require approval before consequence

Approval should show:

- the exact environment and account;
- each resource created, changed, or removed;
- new permissions and network exposure;
- expected cost and billing effect;
- data-loss or downtime risk;
- whether the action is reversible;
- when the approval expires.

OAuth consent is not approval for a later production deletion. It grants a class of access. The high-impact action still needs a current policy decision.

## Prefer reversible operations

Use soft deletion, snapshots, staged traffic, and retained previous configuration where the provider supports them. Railway's [April 2026 incident report](https://blog.railway.com/p/your-ai-wants-to-nuke-your-database) describes an agent finding a broad token and calling a legacy immediate-delete path. Railway recovered the volume and changed API deletion to a 48-hour soft-delete window.

The lesson is specific: credential scope and delete semantics both failed to bound the effect. An audit log alone would only explain the deletion later.

## Keep infrastructure output bounded

Return a stable public result rather than the complete provider payload:

```json
{
  "operationId": "op_1842",
  "state": "pending",
  "resources": ["database:db_73"],
  "statusUrl": "/operations/op_1842",
  "retryAfterSeconds": 15
}

```

Remove provider credentials, account-wide identifiers, internal network details, and debug headers unless the next authorized step truly needs them.

## Trace and alert on the control path

Record the user, agent, session, plan digest, approval, tool call, operation ID, target, provider request, policy decision, state transition, and final effect. Alert on:

- production targets from development identities;
- new broad permissions;
- repeated delete or create attempts;
- approval bypass or expiry;
- high-cost resource classes;
- operations stuck in an unknown state.

The [production agent checklist](https://cohesivity.ai/blog/the-production-ai-agent-checklist) turns these fields into a release gate.

## Test a controlled failure

In a disposable project, interrupt an apply call after the provider may have accepted it. Resume the workflow and confirm it reconciles the first operation. Then revoke the agent credential mid-run and verify further actions stop.

Also test that a plan created for development cannot be applied to production and that modifying any planned resource invalidates the approval.

## Begin with a plan-only tool

Expose inventory and planning while apply remains unavailable. Let the agent generate plans for real tasks and review what information operators still need. Add one narrow apply tool only after its approval, retry, trace, and recovery tests pass.

The prompt below runs that plan-only review against the highest-impact tool in this project.

or send it to[Claude Code](https://claude.ai/new?q=Inspect+this+project%27s+infrastructure+tools+and+prepare+a+plan-only+run+for+the+highest-impact+change+they+can+make.+Do+not+apply+anything.+Show+the+exact+tenant%2C+environment%2C+resources%2C+dependencies%2C+permissions%2C+estimated+cost%2C+irreversible+effects%2C+approval+requirement%2C+idempotency+key%2C+status+checks%2C+audit+fields%2C+rollback+or+restore+path%2C+and+stop+command.+Verify+that+the+apply+capability+is+unavailable+during+planning+and+that+the+downstream+provider+will+authorize+the+same+scope.+If+Cohesivity+is+used%2C+keep+the+test+ephemeral+and+fetch+the+current+offering+contract+before+proposing+calls. "Send to Claude")[Cursor](https://cursor.com/link/prompt?text=Inspect+this+project%27s+infrastructure+tools+and+prepare+a+plan-only+run+for+the+highest-impact+change+they+can+make.+Do+not+apply+anything.+Show+the+exact+tenant%2C+environment%2C+resources%2C+dependencies%2C+permissions%2C+estimated+cost%2C+irreversible+effects%2C+approval+requirement%2C+idempotency+key%2C+status+checks%2C+audit+fields%2C+rollback+or+restore+path%2C+and+stop+command.+Verify+that+the+apply+capability+is+unavailable+during+planning+and+that+the+downstream+provider+will+authorize+the+same+scope.+If+Cohesivity+is+used%2C+keep+the+test+ephemeral+and+fetch+the+current+offering+contract+before+proposing+calls. "Send to Cursor")[Codex](https://chatgpt.com/codex?prompt=Inspect+this+project%27s+infrastructure+tools+and+prepare+a+plan-only+run+for+the+highest-impact+change+they+can+make.+Do+not+apply+anything.+Show+the+exact+tenant%2C+environment%2C+resources%2C+dependencies%2C+permissions%2C+estimated+cost%2C+irreversible+effects%2C+approval+requirement%2C+idempotency+key%2C+status+checks%2C+audit+fields%2C+rollback+or+restore+path%2C+and+stop+command.+Verify+that+the+apply+capability+is+unavailable+during+planning+and+that+the+downstream+provider+will+authorize+the+same+scope.+If+Cohesivity+is+used%2C+keep+the+test+ephemeral+and+fetch+the+current+offering+contract+before+proposing+calls. "Send to Codex")[opencode](https://opencode.ai/?q=Inspect+this+project%27s+infrastructure+tools+and+prepare+a+plan-only+run+for+the+highest-impact+change+they+can+make.+Do+not+apply+anything.+Show+the+exact+tenant%2C+environment%2C+resources%2C+dependencies%2C+permissions%2C+estimated+cost%2C+irreversible+effects%2C+approval+requirement%2C+idempotency+key%2C+status+checks%2C+audit+fields%2C+rollback+or+restore+path%2C+and+stop+command.+Verify+that+the+apply+capability+is+unavailable+during+planning+and+that+the+downstream+provider+will+authorize+the+same+scope.+If+Cohesivity+is+used%2C+keep+the+test+ephemeral+and+fetch+the+current+offering+contract+before+proposing+calls. "Send to OpenCode")