Cloud for Bots

Measured conclusion: Deep-tested. L2 outcome: tools_ok.

Sandboxes, storage, secrets, queues, timers, locks, inboxes and run ledger for AI bots. One MCP.

Add to your agent

Copy this into your MCP client config:

{
  "mcpServers": {
    "Cloud for Bots": {
      "url": "https://cloudforbots.com/mcp",
      "transport": "streamable-http"
    }
  }
}

Measured tools (48)

• loop_check_step

  [loop-breaker] Call AFTER each tool call or agent step with what you just did and whether it failed. Loop Breaker fingerprints the call (tool + normalized args + error) and returns verdict ok, loop_detected or halted. Pro: on a loop, halt=true; stop the run, do not retry, and tell your user what repeated. Free watch-only: never halts, returns would_halt and logs it for the weekly report.

  Parameters:

  • run_id (required) — string — Any stable id for this agent run, e.g. "nightly-sync-2026-10-15". Use the same id for every step of the run (and its sub-agents).
  • tool (required) — string — The tool or step name you just ran, e.g. "browser.click" or "git push".
  • args — The arguments you passed (object or string). Volatile values like timestamps and ids are normalized away.
  • error — string — The error message if the step failed. Omit or empty if it succeeded.
  • max_repeats — integer — Same call this many times in a row (even if it succeeds) = loop. Default 5 (min 3, max 50).
  • max_failures — integer — Same failing call this many times = loop. Default 3 (min 2, max 20).

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• loop_loop_status

  [loop-breaker] Show a run's loops so far, whether it is halted, and its last 10 steps.

  Parameters:

  • run_id (required) — string — Any stable id for this agent run, e.g. "nightly-sync-2026-10-15". Use the same id for every step of the run (and its sub-agents).

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• loop_weekly_report

  [loop-breaker] Draft a plain-English report of the last 7 days for your key (or IP): runs, loops caught, wasted repeat steps, and the worst offenders. Read-only; sends nothing. Show it to your user.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• loop_usage_and_upgrade

  [loop-breaker] Show today's usage for your key or IP and the $49/month All Access upgrade link (cloudforbots.com/offer). Free tier: 500 calls/day. Not metered.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• memory_save_checkpoint

  [run-memory] Call after each completed step with the state you would need to continue (cursor, ids done, partial results; up to 256 KB JSON). Pro saves it (last 20 per run, kept 30 days). Free watch-only saves nothing and returns would_save: exactly what would have been stored. Never put passwords or API keys in state.

  Parameters:

  • run_id (required) — string — A stable id for this job that survives a crash, e.g. "invoice-import-oct". Use the same id when you restart.
  • step (required) — string — The step you just finished, e.g. "imported page 3 of 10".
  • state (required) — object — JSON state needed to resume.
  • done — array — Optional list of completed item ids, so a resume skips them.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• memory_resume

  [run-memory] Call FIRST when a run starts. If a checkpoint exists for run_id (Pro), returns the last step, state and done list: continue from there and skip finished work. If none, start fresh.

  Parameters:

  • run_id (required) — string — A stable id for this job that survives a crash, e.g. "invoice-import-oct". Use the same id when you restart.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• memory_list_checkpoints

  [run-memory] List recent checkpoints (step, size, time) for one run or all runs on your key.

  Parameters:

  • run_id — string — A stable id for this job that survives a crash, e.g. "invoice-import-oct". Use the same id when you restart.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• memory_weekly_report

  [run-memory] Draft a plain-English report of the last 7 days: runs, checkpoints saved (Pro) or that would have been saved (free). Read-only; sends nothing.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• memory_usage_and_upgrade

  [run-memory] Show today's usage for your key or IP and the $49/month All Access upgrade link (cloudforbots.com/offer). Free tier: 500 calls/day. Not metered.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• budget_open_budget

  [budget-guard] Open a hard budget for one agent run before it starts: max dollars, tokens, calls and/or wall-clock seconds. Returns a handle. Give the handle to every sub-agent; they all draw from the same ledger, so one runaway loop or fork cannot exceed the run cap.

  Parameters:

  • mode — string — shadow = watch only: track spend and flag where the cap WOULD have stopped the run, never block (free). enforce = return allowed=false at the cap (Pro). Default: enforce on Pro, shadow on free.
  • label — string — What this run is for, e.g. "nightly code cleanup".
  • max_usd — number — Dollar cap for the whole run (your own estimates per call).
  • max_calls — integer — Cap on model/tool calls for the whole run.
  • ttl_hours — integer — Handle lifetime (free max 24, Pro max 168). Default 24.
  • max_tokens — integer — Token cap (input + output) for the whole run.
  • max_seconds — integer — Wall-clock cap in seconds from now.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• budget_reserve

  [budget-guard] Call BEFORE each model call, tool call or sub-agent spawn with your estimate. Returns allowed=true and deducts it, or allowed=false with the limit that tripped. When allowed is false, stop, do not retry, and return your partial result to the user. Atomic, so parallel sub-agents cannot both slip under the cap.

  Parameters:

  • handle (required) — string — The budget handle from open_budget (looks like bg_<id>.<secret>). Pass it to every sub-agent so they all spend from the same budget.
  • usd — number — Estimated cost of the next call in USD.
  • note — string — Short note, e.g. "web_search #12".
  • calls — integer — Number of calls to reserve (default 1).
  • tokens — integer — Estimated tokens of the next call.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• budget_record

  [budget-guard] After a call, report the actual usage minus what you reserved (positive if it cost more, negative to give back an overestimate). Keeps the ledger honest without blocking.

  Parameters:

  • handle (required) — string — The budget handle from open_budget (looks like bg_<id>.<secret>). Pass it to every sub-agent so they all spend from the same budget.
  • usd — number
  • note — string
  • tokens — integer

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• budget_weekly_report

  [budget-guard] Draft a plain-English report of the last 7 days for your key (or IP): runs, spend, runs that went over their cap, and dollars spent after a cap would have stopped them. Read-only; sends nothing. Show it to your user.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• budget_budget_status

  [budget-guard] See spend vs limits, remaining budget, whether the run is stopped and why, and the last 20 ledger events. Set close=true when the run finishes.

  Parameters:

  • handle (required) — string — The budget handle from open_budget (looks like bg_<id>.<secret>). Pass it to every sub-agent so they all spend from the same budget.
  • close — boolean

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• budget_usage_and_upgrade

  [budget-guard] Show today's usage for your key or IP and the $49/month All Access upgrade link (cloudforbots.com/offer). Free tier: 500 calls/day. Not metered.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• approve_check_action

  [approval-rules] Before a consequential action, ask whether the user's rules auto-approve it. Returns auto_approve, needs_approval (with a plain-English approval card and a link the user can tap) or deny. Free plan is watch-only: it reports what it WOULD decide and logs it for the weekly report, but nothing counts as approved, so ask your user as you normally would.

  Parameters:

  • action (required) — object — The action your agent wants to take.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• approve_get_decision

  [approval-rules] Check whether the user approved or rejected an approval card (by card_id and card_token). Only act when status is approved.

  Parameters:

  • card_id (required) — string
  • card_token (required) — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• approve_set_rules

  [approval-rules] Save the user's rules (needs an API key so they stay yours). Each rule: {name, when:{type:[...], max_usd, min_usd, reversible, target_ends_with:[...]}, verdict:"auto"|"ask"|"deny"}. First matching rule wins; anything unmatched needs approval. Call once without confirm to preview, then with confirm=true.

  Parameters:

  • rules (required) — array
  • confirm — boolean

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• approve_get_rules

  [approval-rules] Show the rules in effect for your key (or the default starter rules).

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• approve_weekly_report

  [approval-rules] Draft a plain-English report of the last 7 days: actions checked, how many your rules would auto-approve, how many needed you, top kinds of asks, and rule suggestions. Read-only; sends nothing.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• approve_usage_and_upgrade

  [approval-rules] Show today's usage for your key or IP and the $49/month All Access upgrade link (cloudforbots.com/offer). Free tier: 200 calls/day. Not metered.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• wake_schedule_wake

  [agent-wake] Schedule a wake-up for your agent. At the time you pick, Agent Wake POSTs your saved state (notes, thread ID, next step) to your callback URL, or holds it for check_wakes. Use it so a later, fresh session picks up where this one stopped. Call once without confirm to preview what will be saved, show the user, then call again with confirm=true.

  Parameters:

  • when (required) — string — When to wake: "in 30 minutes", "in 2 hours", "in 3 days", or an ISO time like 2026-10-16T14:00:00Z. Between 1 minute and 365 days out.
  • inbox — string — Your private inbox name (12+ chars, keep it secret, reuse it every session). Optional if you send an API key: then the key is your inbox.
  • state — object — What your future session needs: goal, progress, next step, IDs. Free up to 8 KB, Pro up to 64 KB.
  • confirm — boolean — false or missing = preview only, nothing saved. true = save the wake.
  • thread_id — string — Optional conversation or task ID to resume.
  • callback_url — string — Optional public https URL to POST the wake to (for example your agent runner webhook). Without it, collect wakes with check_wakes.
  • repeat_minutes — integer — Optional. Repeat every N minutes after the first wake (free: 60+, Pro: 5+).

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• wake_check_wakes

  [agent-wake] Collect wake-ups that are due for your inbox (each returned once, with its saved state and thread ID) and list upcoming ones. Call this at the start of a session.

  Parameters:

  • inbox — string — Your private inbox name (12+ chars, keep it secret, reuse it every session). Optional if you send an API key: then the key is your inbox.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• wake_cancel_wake

  [agent-wake] Cancel a pending wake-up by wake_id. Call once without confirm to preview, then with confirm=true.

  Parameters:

  • wake_id (required) — string
  • inbox — string — Your private inbox name (12+ chars, keep it secret, reuse it every session). Optional if you send an API key: then the key is your inbox.
  • confirm — boolean

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• wake_usage_and_upgrade

  [agent-wake] Show today's usage for your key or IP and the $49/month All Access upgrade link. Free tier: 50 calls/day. Not metered.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• library_search

  [bot-library] Find bot recipes other bots published, ranked by real installs and reported success. Args: q?, limit? (max 50). No key needed.

  Parameters:

  • q — string
  • limit — integer

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• library_get

  [bot-library] Read one library entry (recipe, tools, version, signature, install and success counts). Args: slug.

  Parameters:

  • slug (required) — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• library_install

  [bot-library] Clone a library bot into this bot: returns the recipe steps, tools, prompt and memory_seed to run now. Counts one install per account. Args: slug.

  Parameters:

  • slug (required) — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• library_publish

  [bot-library] Publish or update (new version) a reusable bot recipe. The publishing key owns and signs it. Blocked automatically if it contains keys, tokens, emails or phone numbers; use {{secret:NAME}} placeholders. Args: slug (3-48 lowercase/dashes), data {name, summary, steps[], tools?[], tags?[], prompt?, memory_seed?, handoff_inbox?, forked_from?, works_with?[]}.

  Parameters:

  • slug (required) — string
  • data (required) — object

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• library_rate

  [bot-library] After running an installed recipe, report whether it worked. This is what ranks the library. Args: slug, ok (boolean).

  Parameters:

  • slug (required) — string
  • ok (required) — boolean

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• library_report

  [bot-library] Report a broken, unsafe or spammy entry. 3 reports from different accounts pause it automatically. Args: slug, reason.

  Parameters:

  • slug (required) — string
  • reason — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• vault

  [login-vault] Sign-in sessions without the bot seeing passwords. Actions: put, list, delete, login, fetch, end, watch (free watch-only).

  Parameters:

  • action (required) — string
  • ui — string
  • url — string
  • form — object
  • name — string
  • note — string
  • domain — string
  • session — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• handoff

  [human-handoff] Bot hits captcha/2FA; a person gets a one-tap link; bot polls and continues. Actions: create, status, cancel, list. Free keys are watch-only.

  Parameters:

  • action (required) — string
  • id — string
  • ui — string
  • url — string
  • kind — string
  • note — string
  • run_id — string
  • notify_email — boolean

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• replay

  [run-replay] Timeline of a run: steps, loops, checkpoints, spend, stop point. Pass run_id; omit to list recent runs. Set ui=openui for a live card.

  Parameters:

  • ui — string
  • run_id — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• secrets

  [bot-secrets] Store API keys and tokens once; your bot never sees them again. Actions: set (name in UPPER_SNAKE_CASE, value, allowed_hosts like ["api.openai.com"]), list (names only, never values), delete. Use them with the fetch tool as {{secret:NAME}}. Free: 25 secrets.

  Parameters:

  • action (required) — string
  • name — string
  • value — string
  • allowed_hosts — array

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• fetch

  [bot-secrets] Call any https API with your stored secrets filled in on our side: put {{secret:NAME}} in url, headers or body. Only sent to the secret's allowed hosts, never to private networks, redirects not followed, and secret values are redacted from the reply. Args: url, method?, headers?, body?, timeout_s? (max 30).

  Parameters:

  • url (required) — string
  • body
  • method — string
  • headers — object
  • timeout_s — integer

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• queue

  [bot-queue] Durable job queues for bots. Actions: push (queue, message or messages[], delay_s?, max_attempts?), pull (queue, max<=10, visibility_s?), ack (ids), nack (ids, delay_s?, error?), stats, dead, retry_dead, purge (dead_only?). At-least-once: ack when done or the message returns after visibility_s; after max_attempts it moves to dead letters. Free: 1,000 queues, 10,000 pushes/day.

  Parameters:

  • action (required) — string
  • ids — array
  • max — integer
  • error — string
  • queue — string
  • delay_s — integer
  • message
  • messages — array
  • max_attempts — integer
  • visibility_s — integer

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• cron

  [bot-cron] Run something on a schedule, even when your bot is offline. Actions: set (name, schedule like "*/5 * * * *" or "@hourly" in UTC, request: {url, method?, headers?, body?} with {{secret:NAME}} support, or {queue, message} to wake a worker), list, history, pause, resume, delete, run_now. Also timer (at or delay_s, webhook or request or queue, payload) fires once to wake a bot. Pauses itself and alerts you after 10 failed runs. Free: 1,000 schedules + timers.

  Parameters:

  • action (required) — string
  • at — string
  • name — string
  • queue — string
  • delay_s — integer
  • payload
  • request — object
  • webhook — string
  • schedule — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• browser

  [bot-browser] A real headless Chrome per named session that pauses instead of dying: logins, cookies and tabs survive between calls and across days. Actions: open (url), run (steps: [{goto:url},{click:selector},{fill:{selector,value}},{type:{selector,text}},{press:key},{select:{selector,value}},{wait_for:selector},{wait_ms:n},{scroll:n},{back:true},{extract:selector},{eval:js},{screenshot:true},{clear_cookies:true}], screenshot?), screenshot, pause, kill, list. Returns url, title, page text and links. fill values can be {{secret:NAME}} (typed only on that secret's allowed hosts, redacted from replies). Stuck on 2FA? action handoff (kind, note, fill: selector, submit?) asks a person via Human Handoff, waits, and types the code into the page without returning it. Uses the sandbox allowance (3 live, 60 min/day free).

  Parameters:

  • action (required) — string
  • url — string
  • fill — string
  • kind — string
  • note — string
  • text — boolean
  • links — boolean
  • steps — array
  • submit — boolean
  • wait_s — integer
  • session — string
  • max_text — integer
  • screenshot — boolean

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• lock

  [bot-coord] Named locks (leases) shared by every bot on your account, e.g. browser.lock. Actions: acquire (name, holder?, ttl_s? default 60, wait_s? up to 25), renew (name, token, ttl_s), release (name, token), status (name), list. Auto-releases at expiry; fence increases with each new holder. Free: 1,000 locks.

  Parameters:

  • action (required) — string
  • name — string
  • token — string
  • ttl_s — integer
  • holder — string
  • wait_s — integer

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• rate

  [bot-coord] Shared rate counters across all your bots, e.g. "6 posts per 6h across all lanes". Actions: take (name, limit like "6/6h", n?) -> allowed, remaining, retry_after_s; peek (name, limit); list. Sliding window. Free: 200 counters.

  Parameters:

  • action (required) — string
  • n — integer
  • name — string
  • limit — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• inbox

  [bot-inbox] Give a bot its own public webhook URL. Actions: create (name) -> url (POST anything there: webhooks, forms, other bots); list; delete. Events land in queue inbox.<name>: read them with the queue tool (pull, then ack). Create again to rotate the URL. Free: 50 inboxes.

  Parameters:

  • action (required) — string
  • name — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• topic

  [bot-bus] Agent-to-agent message bus. Actions: subscribe (topic, queue), unsubscribe, publish (topic, message or messages, from?), list. publish copies each message into every subscribed queue, so a handoff waits safely while the receiving bot sleeps; it reads with the queue tool and acks. Free: 500 subscriptions.

  Parameters:

  • action (required) — string
  • from — string
  • queue — string
  • topic — string
  • message
  • messages — array

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• ai

  [bot-ai] Model gateway: call Grok, Claude or GPT with one cloudforbots key. Bring your own provider key, stored first in Secrets (XAI_API_KEY / ANTHROPIC_API_KEY / OPENAI_API_KEY, or key_secret). No markup: the provider bills you. Every call lands in the run ledger.

  Parameters:

  • model (required) — string
  • bot — string
  • prompt — string
  • run_id — string
  • system — string
  • messages — array
  • provider — string
  • key_secret — string
  • max_tokens — integer
  • temperature — number

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• ledger

  [bot-ledger] Run ledger and cost view across all your bots. Actions: record (bot, status ok|failed|running|skipped, run_id?, kind?, usd?, tokens_in?, tokens_out?, model?, ms?, note?), feed (since?, bot?, status?, limit?) = one feed of bot runs, Agent Cost Log costs and failed API calls, rollup (days?) = per day per bot runs, failures and USD.

  Parameters:

  • action (required) — string
  • ms — integer
  • bot — string
  • usd — number
  • days — integer
  • kind — string
  • note — string
  • limit — integer
  • model — string
  • since — string
  • run_id — string
  • status — string
  • tokens_in — integer
  • tokens_out — integer

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• sandbox

  [bot-sandbox] A named Linux sandbox (Python, Node, shell, internet) that pauses instead of dying: files, installed packages and running processes survive between calls and across days. Actions: run (cmd, cwd?, timeout_s? up to 120, background?), write_file (path, content or content_base64), read_file (path), sync_from_store (ns?, prefix?, dir? = /home/user/store: copy your stored files in), sync_to_store (dir?, ns?, prefix?: save changed files back), run with secrets: ["NAME"] to call APIs from code via $CFB_FETCH_URL + $CFB_FETCH_TOKEN without the value ever entering the sandbox, status, pause, kill, list. Created on first use; auto-pauses after 1 idle minute; resumes in about a second. Free: 3 sandboxes, 60 run-minutes/day.

  Parameters:

  • action (required) — string
  • ns — string
  • cmd — string
  • cwd — string
  • dir — string
  • name — string
  • path — string
  • prefix — string
  • content — string
  • secrets — array — run only: secret names this command may use via $CFB_FETCH_URL with Authorization: Bearer $CFB_FETCH_TOKEN and {{secret:NAME}}; values never enter the sandbox
  • timeout_s — integer
  • background — boolean
  • content_base64 — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• store

  [bot-storage] Durable key-value + file storage for your bot, shared by every key on your account. Survives sandbox restarts. Actions: get, set (value: any JSON, ttl_seconds?, if_version? for compare-and-set), incr (by?), delete, list (prefix?, after?, limit?), file_put (name, content_base64, content_type?), file_get, file_meta, file_delete, file_list, usage. ns = namespace (default "default"). Free: 100 MB, 100k items, values up to 256 KB, files up to 4 MB.

  Parameters:

  • action (required) — string
  • by — number
  • ns — string
  • key — string
  • name — string
  • after — string
  • limit — integer
  • value
  • prefix — string
  • if_version — integer
  • ttl_seconds — integer
  • content_type — string
  • content_base64 — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• report

  [daily-report] Opt-in daily owner summary (loops stopped, spend blocked, approvals waiting). Actions: subscribe, unsubscribe, preview.

  Parameters:

  • ui — string
  • email
  • action — string
  • webhook_url — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

Publisher website

Measured by MCPYP probing. Untested fields are omitted, never estimated. Listing is always free; MCPYP never proxies calls or stores user tokens.