MCP server
Connect Cursor, Claude, VS Code, or any MCP client to ZopNight. Ask about cost, resources, schedules and recommendations in plain language.
The ZopNight MCP server lets an AI assistant read your workspace directly. Ask Claude “which EC2 instances sat idle last week and what would stopping them save?” and it queries your live resources, costs and recommendations instead of guessing.
It speaks the Model Context Protocol over Streamable HTTP, so any MCP-capable client works — Cursor, Claude, VS Code, Codex, Devin, ChatGPT and more.
Before you start
Enable MCP for the organisation
Open Settings → Organisation, scroll to the MCP Server section, and switch the toggle on. The badge changes from Inactive to Active and the server URL appears. Only a user with the Organisation Update permission sees the toggle.
Copy your server URL
Your server URL is
https://api.zop.dev/mcp-server— it’s the same for every organisation. Auth negotiates the org, so you don’t need to look it up in the app.
Choose how to sign in
You have two ways to authenticate. Pick one — every client below supports both.
OAuth
Recommended. No token to copy, no secret to store. Sign in once in a browser window, then your client is connected. Sessions appear on Developer Settings → Connected Apps and can be revoked any time.
Personal Access Token
For CI, servers, or clients that can’t open a browser. You mint a long-lived token in Developer Settings and pass it as an Authorization: Bearer header.
Option 1 — OAuth (recommended)
Nothing to configure up front. Just point your client at https://api.zop.dev/mcp-server and let it prompt on the first tool call. A browser tab opens to ZopNight, you approve the connection once, and the client stores refreshable tokens itself.
Option 2 — Personal Access Token
Open Developer Settings
Click your profile avatar at the bottom-left of the sidebar, then Developer Settings.
Create the token
Under API Tokens, click Create Token, name it after the client that will use it (“Cursor” or “Claude Code”), choose an expiry, and confirm.
Copy it once
The token is shown only once. Copy it straight into your secret manager, never into a committed file. The blocks below call it
MCP_PAT.
A token carries your identity, not a narrower one. Every call resolves your live role at the moment it is made, so mint it as the person with the narrowest role that does the job.
Set up your client
Find your client below and follow the steps for it. Every card walks through both OAuth (the recommended one-click sign-in) and Personal Access Token (for CI, servers, and clients that can’t open a browser) — pick whichever tab matches how you want to authenticate.
Configure your MCP client to connect to your workspace.
Install in one click:
Add to CursorOr set it up manually:
Open the MCP servers panel
In Cursor, open Customize → MCPs → New MCP server. Cursor opens
~/.cursor/mcp.jsonfor editing.Paste the config
Pick OAuth (recommended) or a Personal Access Token — the tabs below toggle the config.
OAuth (recommended) {"mcpServers": {"zopdev": {"url": "https://api.zop.dev/mcp-server","transport": "streamable-http"}}}Personal Access Token {"mcpServers": {"zopdev": {"url": "https://api.zop.dev/mcp-server","transport": "streamable-http","headers": { "Authorization": "Bearer MCP_PAT" }}}}For PAT, swap
MCP_PATfor the token you copied at Developer Settings → API Tokens.Save and enable
Save the file. Back on the MCPs panel, click the newly-added zopdev entry and turn the User (
~/.cursor/mcp.json) toggle on.Reload and authenticate
Click Reload on the zopdev entry. OAuth opens a browser window to sign in — approve to finish. PAT users skip this: the token authenticates every call. The tools appear inside Cursor on the next call.
Add the server
Inside a Claude Code session, pick OAuth (recommended) or a Personal Access Token — the tabs below toggle the command. The
-t httpflag is required, otherwise Claude records the URL as a program to execute.OAuth (recommended) claude mcp add zopdev https://api.zop.dev/mcp-server -t httpPersonal Access Token claude mcp add zopdev https://api.zop.dev/mcp-server -t http -H "Authorization: Bearer MCP_PAT"For PAT, swap
MCP_PATfor the token you copied at Developer Settings → API Tokens.Restart Claude
Quit Claude Code and start a fresh session with
claude. The new MCP server is picked up on startup.Authenticate
In the session, run
/mcp, find the zopdev entry, and select Authenticate. OAuth opens a browser window to sign in — approve to finish. PAT users skip this: the header authenticates every call.
Open the custom connector form
In Claude, click your profile → Settings → Connectors → Add → Add custom connector.
Fill in the details
- Name:
zopdev - Remote MCP Server URL:
https://api.zop.dev/mcp-server
Then click Continue.
- Name:
Add and connect
Claude shows a few security-verification prompts — accept each one, then click Add to save the connector. Finally click Connect: OAuth opens a browser window to sign in — approve to finish.
Open the custom connector form
In Claude Desktop, click your profile → Settings → Connectors → Add → Add custom connector.
Fill in the details
- Name:
zopdev - Remote MCP Server URL:
https://api.zop.dev/mcp-server
Then click Continue.
- Name:
Add and connect
Claude Desktop shows a few security-verification prompts — accept each one, then click Add to save the connector. Finally click Connect: OAuth opens a browser window to sign in — approve to finish.
Open the custom connector form
In Grok on the web, open Skills & Connectors → Connectors → New Connector → Add Custom.
Fill in the details
- Name:
zopdev - Remote MCP Server URL:
https://api.zop.dev/mcp-server
- Name:
Add and connect
Click Add Connector. On the next tool call, OAuth opens a sign-in window — sign in with your ZopNight account and approve.
Install in one click:
Add to VS CodeOr set it up manually:
Open the MCP config file
In VS Code (1.99+), open the Command Palette (
Cmd + Shift + Pon macOS,Ctrl + Shift + Pon Windows/Linux), typeMCP, and pick the command that opens your user MCP config file (labelled something like MCP: Open User Configuration). To scope the server to one project instead, create.vscode/mcp.jsonin the workspace root.Paste the config
Pick OAuth (recommended) or a Personal Access Token — the tabs below toggle the config.
OAuth (recommended) {"servers": {"zopdev": {"url": "https://api.zop.dev/mcp-server","type": "http"}}}Personal Access Token {"servers": {"zopdev": {"url": "https://api.zop.dev/mcp-server","type": "http","headers": { "Authorization": "Bearer MCP_PAT" }}}}For PAT, swap
MCP_PATfor the token you copied at Developer Settings → API Tokens.Save and authenticate
Save the file. VS Code starts the server automatically and shows a ✓ Running · Stop · Restart · More… inlay hint above the
zopdeventry. On the first tool call, OAuth opens a browser window to sign in — approve to finish. PAT users skip this: the header authenticates every call.You can also manage the server from Extensions → MCP Servers - Installed → zopdev.
Add the server
Inside a Codex CLI session, pick OAuth (recommended) or a Personal Access Token — the tabs below toggle the command.
OAuth (recommended) codex mcp add zopdev --url https://api.zop.dev/mcp-serverPersonal Access Token export ZOPDEV_MCP_PAT=<your token>codex mcp add zopdev --url https://api.zop.dev/mcp-server --bearer-token-env-var ZOPDEV_MCP_PATGrab
<your token>from Developer Settings → API Tokens and export it in the shell before Codex launches — Codex reads the env var by name at connect time.Authenticate
Run
codex mcp login zopdevand follow the prompts — OAuth opens a browser window to sign in, approve to finish. PAT users skip this: the bearer env var authenticates every call.
Open the MCP servers panel
Click your profile → Settings → Plugins → MCP → Add → Add MCP Server.
Fill in the form
- Name:
zopdev - Type: Streamable HTTP
- URL:
https://api.zop.dev/mcp-server
Click Save.
- Name:
Authenticate
Back on the MCP list, find the zopdev entry and click Authenticate. A browser window opens for OAuth sign-in — approve to finish.
Open the Plugins page
Sign in to ChatGPT on the web, then go to Settings → Plugins and click Add (labelled New plugin in connections on some plans).
Fill in the plugin form
Paste your ZopNight MCP server URL and name the plugin.
- Name:
zopdev - MCP Server URL:
https://api.zop.dev/mcp-server
ChatGPT will show one or more “I understand” security acknowledgements — tick every one before continuing.
- Name:
Add and sign in
Click Add. On the next new chat, OAuth opens a sign-in window — sign in with your ZopNight account and approve.
Open the MCP config file
Launch Antigravity IDE with a workspace open (a “No workspace window available” error means you need to open a folder first). Go to Settings → Open Antigravity IDE User Settings → Customize, find the Installed MCP Servers section, and click Open MCP Config — Antigravity opens its raw JSON config file for editing.
Paste the config
Pick OAuth (recommended) or a Personal Access Token — the tabs below toggle the config.
OAuth (recommended) {"mcpServers": {"zopdev": {"serverUrl": "https://api.zop.dev/mcp-server"}}}Personal Access Token {"mcpServers": {"zopdev": {"serverUrl": "https://api.zop.dev/mcp-server","headers": {"Authorization": "Bearer MCP_PAT"}}}}The field must be
serverUrl— Antigravity does not accepturlorhttpUrl. For PAT, swapMCP_PATfor the token you copied at Developer Settings → API Tokens.Save and refresh
Save the JSON file. Go back to the Installed MCP Servers panel and click Refresh. Antigravity does not hot-reload — a correct-but-unrefreshed config looks identical to a wrong one.
Authenticate
OAuth users: Antigravity displays a code — sign in and paste that code into the Antigravity prompt to complete authentication. PAT users skip this: the header authenticates every call.
Add the server
Pick OAuth (recommended) or a Personal Access Token — the tabs below toggle the command. Use
--scope userso the server survives across projects.For PAT, swapOAuth (recommended) gemini mcp add --scope user --transport http zopdev https://api.zop.dev/mcp-serverPersonal Access Token gemini mcp add --scope user --transport http zopdev https://api.zop.dev/mcp-server --header "Authorization: Bearer MCP_PAT"MCP_PATfor the token you copied at Developer Settings → API Tokens.Start Gemini
Launch a session with
gemini. From an untrusted workspace, add--skip-trust— Gemini 0.58+ suppresses MCP servers (even user-scoped ones) in untrusted folders otherwise.Authenticate
In the session, run
/mcp auth zopdev. OAuth opens a browser window to sign in — approve to finish. PAT users skip this: the header authenticates every call. Alternatively, just invoke a zopdev tool (“using zopdev, list my organizations”) — Gemini fires the same OAuth flow on the first call.
Open the Devin MCP marketplace
Click your profile → Devin Settings → Configuration → MCP Servers to open the Devin MCP Marketplace.
Add a custom MCP
Click Add Custom MCP and paste one of these configs. Pick OAuth (recommended) or a Personal Access Token — the tabs below toggle the config.
OAuth (recommended) {"mcpServers": {"zopdev": {"url": "https://api.zop.dev/mcp-server"}}}Personal Access Token {"mcpServers": {"zopdev": {"url": "https://api.zop.dev/mcp-server","headers": {"Authorization": "Bearer MCP_PAT"}}}}For PAT, swap
MCP_PATfor the token you copied at Developer Settings → API Tokens. Click Save.Connect
Go back to Devin Customization → MCP → Installed, find the newly-added zopdev entry, and click Connect. OAuth opens a browser window to sign in — approve to finish. PAT users skip this: the header authenticates every call.
Open the MCP settings
In GitHub Copilot Desktop, go to Customization → MCP → Add.
Add the server
Click Add MCP Server, then fill in:
- Name:
zopdev - URL:
https://api.zop.dev/mcp-server - Type:
HTTP
Click Add Server.
- Name:
Sign in
Back on the MCP page, find the zopdev row and click Sign in. A browser window opens to sign in — approve immediately and switch straight back to Copilot Desktop; the local callback listener is short-lived. Copilot’s row flips to signed-in once the code is delivered.
Add the server
Inside a Grok session, pick OAuth (recommended) or a Personal Access Token — the tabs below toggle the command.
OAuth (recommended) grok mcp add --transport http zopdev https://api.zop.dev/mcp-serverPersonal Access Token grok mcp add --transport http zopdev https://api.zop.dev/mcp-server --header "Authorization: Bearer MCP_PAT"For PAT, swap
MCP_PATfor the token you copied at Developer Settings → API Tokens.Restart Grok
Quit Grok and start a fresh session with
grok. The new MCP server is picked up on startup.Authenticate
In the session, run
/mcp, find the zopdev entry, and select Authenticate. OAuth opens a browser window to sign in — approve to finish. PAT users skip this: the header authenticates every call.
Add the server
Inside a Copilot session, pick OAuth (recommended) or a Personal Access Token — the tabs below toggle the command.
OAuth (recommended) copilot mcp add --transport http zopdev https://api.zop.dev/mcp-serverPersonal Access Token copilot mcp add --transport http zopdev https://api.zop.dev/mcp-server --header "Authorization: Bearer MCP_PAT"For PAT, swap
MCP_PATfor the token you copied at Developer Settings → API Tokens.Restart Copilot
Quit Copilot and start a fresh session with
copilot. The new MCP server is picked up on startup.Authenticate
In the session, run
/mcp, find the zopdev entry, and select Authenticate. OAuth opens a browser window to sign in — approve to finish. PAT users skip this: the header authenticates every call.
Open the MCP servers panel
Click your profile → Settings → Agents → MCP Servers → Add.
Paste the config
Pick OAuth (recommended) or a Personal Access Token — the tabs below toggle the config.
OAuth (recommended) {"mcpServers": {"zopdev": {"url": "https://api.zop.dev/mcp-server"}}}Personal Access Token {"mcpServers": {"zopdev": {"url": "https://api.zop.dev/mcp-server","headers": { "Authorization": "Bearer MCP_PAT" }}}}For PAT, swap
MCP_PATfor the token you copied at Developer Settings → API Tokens.Save and connect
Save the server. OAuth opens a browser on the first tool call — approve to finish. PAT users skip this: the header authenticates every call.
Install Goose and pick an LLM provider
If you don’t have Goose yet:
Terminal window curl -fsSL https://github.com/block/goose/releases/download/stable/download_cli.sh | bashThen run
goose configureand choose Configure Providers — Goose can’t start agoose sessionuntil it has at least one LLM provider (Anthropic, OpenAI, Databricks, Google Gemini, Ollama, etc.). Skip this if Goose is already set up.Add the extension (pick one path)
Either run
goose configure→ Add Extension → Remote Extension (Streamable HTTP) and fill in:- Name:
zopdev - URI:
https://api.zop.dev/mcp-server - Timeout:
300 - Environment variables:
No
or edit
~/.config/goose/config.yamldirectly and add:Terminal window extensions:zopdev:name: ZopDevtype: streamable_httpuri: https://api.zop.dev/mcp-serverenabled: truetimeout: 300Goose uses OAuth with Dynamic Client Registration for remote extensions — no PAT/header field is needed (or supported today).
- Name:
Authenticate on first tool call
Start a session with
goose session. The first time the model calls a zopdev tool, Goose opens a browser to sign in — approve to finish. Tokens are refreshed automatically after that. The OAuth callback uses an ephemeral127.0.0.1port; setGOOSE_OAUTH_CALLBACK_PORTto pin it if your authorization server requires a fixed redirect URI.
Open the MCP config file
In Kiro, open the Command Palette (
Cmd + Shift + Pon macOS,Ctrl + Shift + Pon Windows/Linux), typeMCP, and pick the command that opens your user MCP config file at~/.kiro/settings/mcp.json(labelled something like MCP: Open User Configuration). To scope the server to one project instead, create.kiro/settings/mcp.jsonin the workspace root — Kiro silently ignores any other filename or location.Paste the config
Pick OAuth (recommended) or a Personal Access Token — the tabs below toggle the config.
OAuth (recommended) {"mcpServers": {"zopdev": {"url": "https://api.zop.dev/mcp-server"}}}Personal Access Token {"mcpServers": {"zopdev": {"url": "https://api.zop.dev/mcp-server","headers": { "Authorization": "Bearer MCP_PAT" }}}}For PAT, swap
MCP_PATfor the token you copied at Developer Settings → API Tokens.Save and authenticate
Save the file. Back in Kiro, click Kiro in the sidebar, expand MCP Servers, find the zopdev entry, and click Authenticate. A browser window opens for OAuth sign-in — approve to finish. PAT users skip this: the header authenticates every call.
Open the MCP servers panel
Click your profile → Settings → General → MCP Server → Configure → Add Server → Add Remote Server.
Fill in the details
- Server Name:
zopdev - Server URL:
https://api.zop.dev/mcp-server
Click Save.
- Server Name:
Authenticate
Back on the MCP Server panel, find the zopdev entry and click Authenticate. A browser window opens for OAuth sign-in — approve to finish.
Open the MCP settings
In Trae, go to Settings → MCP → Add → Create Manually.
Paste the config
Pick OAuth (recommended) or a Personal Access Token — the tabs below toggle the config.
OAuth (recommended) {"mcpServers": {"zopdev": {"url": "https://api.zop.dev/mcp-server"}}}Personal Access Token {"mcpServers": {"zopdev": {"url": "https://api.zop.dev/mcp-server","headers": { "Authorization": "Bearer MCP_PAT" }}}}For PAT, swap
MCP_PATfor the token you copied at Developer Settings → API Tokens. Click Confirm.Authenticate
Back on the MCP page, find the zopdev entry and click Authenticate. A browser window opens for OAuth sign-in — approve to finish. PAT users skip this: the header authenticates every call.
Use the plugin builder
In Kimi Code Desktop, start a new chat and paste this prompt (swap
https://api.zop.dev/mcp-serverfor the URL from Settings → Organisation → MCP Server in the ZopNight app):Terminal window /plugin-builder connect the zopdev plugin with https://api.zop.dev/mcp-serverKimi adds the plugin automatically.
Install and authorise
Go to Plugin → Personal → zopdev, click Install, then click Authorize. A browser window opens for OAuth sign-in — approve to finish.
Add the server
In your terminal, pick OAuth (recommended) or a Personal Access Token — the tabs below toggle the command.
OAuth (recommended) vibe mcp add zopdev --transport streamable-http --url https://api.zop.dev/mcp-serverPersonal Access Token # 1. Export your PATexport ZOPDEV_MCP_TOKEN="MCP_PAT"# 2. Register the server, telling Vibe which env var holds the tokenvibe mcp add zopdev --transport streamable-http --url https://api.zop.dev/mcp-server --api-key-env ZOPDEV_MCP_TOKENFor PAT, swap
MCP_PATfor the token you copied at Developer Settings → API Tokens. Vibe writes the config to~/.vibe/config.toml.Authenticate
Start a Vibe session with
vibe, then run/mcp login zopdev. OAuth opens a browser window to sign in — approve to finish. PAT users skip this: the env var authenticates every call.
Install OpenCode (if you haven't)
Terminal window curl -fsSL https://opencode.ai/install | bashInstalls to
~/.opencode/bin/opencode; the script updates your shell PATH. Open a new terminal after installation.Add the server
In a regular terminal (not inside the
opencodeTUI — that treats the line as a chat message and sends it to the model instead of running the CLI), pick OAuth (recommended) or a Personal Access Token — the tabs below toggle the command.OAuth (recommended) opencode mcp add zopdev --url https://api.zop.dev/mcp-serverPersonal Access Token opencode mcp add zopdev --url https://api.zop.dev/mcp-server --header "Authorization=Bearer MCP_PAT"For PAT, swap
MCP_PATfor the token you copied at Developer Settings → API Tokens. The config is written to~/.config/opencode/opencode.jsonc.Authenticate
OAuth users: in the same regular terminal, run:
Terminal window opencode mcp auth zopdevA browser window opens to sign in — approve to finish. Running
opencode mcp auth …INSIDE theopencodeTUI chat prompt won’t work — OpenCode treats it as a message for the LLM and returns a provider-key error; the CLI subcommand must be invoked from the shell. Verify withopencode mcp list— status flips toready. PAT users skip this: the header authenticates every call.
Install the Droid CLI (if you haven't)
Terminal window curl -fsSL https://app.factory.ai/cli | shFactory’s installer drops
droidin~/.local/bin/and updates PATH. Factory Desktop bundles the same binary if you already have that.Add the server
In a regular terminal (not inside the
droidsession — thedroidREPL doesn’t run CLI subcommands), pick OAuth (recommended) or a Personal Access Token — the tabs below toggle the command.OAuth (recommended) droid mcp add zopdev https://api.zop.dev/mcp-server --type httpPersonal Access Token droid mcp add zopdev https://api.zop.dev/mcp-server --type http --header "Authorization: Bearer MCP_PAT" --no-oauthFor PAT, swap
MCP_PATfor the token you copied at Developer Settings → API Tokens.Authenticate
Start a session with
droid, then run/mcpand pick zopdev → Authenticate. A browser window opens to sign in — approve to finish. PAT users skip this: the header authenticates every call. Rundroid mcp listin the outer shell to confirm status flipped toready.
Add the server
In LM Studio: ⚙ Settings → Connected MCP Servers → Add Custom MCP. Fill in:
- Name:
zopdev - Connection: Web address
- Server address:
https://api.zop.dev/mcp-server - Authentication: Automatic (OAuth, recommended) or Access token (PAT — paste the token you copied at Developer Settings → API Tokens)
Click Add MCP.
- Name:
Complete authentication
OAuth users: LM Studio opens a browser window to sign in — approve to finish. Access-token users skip this: the token authenticates every call. The zopdev entry flips from “Sign-in failed” to a green Connected dot; hit Try again if it doesn’t refresh automatically.
Install Kimi Code (if you haven't)
Terminal window curl -fsSL https://code.kimi.com/kimi-code/install.sh | bashInstalls to
~/.kimi-code/bin/kimi; the script updates your shell PATH. Sign in with/loginon first launch (Moonshot account or Kimi Platform API key) — Kimi Code CLI needs an LLM provider before any tool call.Add the server
Create
~/.kimi-code/mcp.json(or edit the project-level.kimi-code/mcp.json) and add:For PAT, swapOAuth (recommended) {"mcpServers": {"zopdev": {"url": "https://api.zop.dev/mcp-server"}}}Personal Access Token {"mcpServers": {"zopdev": {"url": "https://api.zop.dev/mcp-server","headers": { "Authorization": "Bearer MCP_PAT" }}}}MCP_PATfor the token you copied at Developer Settings → API Tokens.Authenticate
Start Kimi with
kimi, then in the TUI run/mcp-config login zopdev— a browser window opens to sign in, approve to finish. PAT users skip this: the header authenticates every call. Verify with/mcp— the zopdev entry flips toconnected.
Open your client's MCP config
Any client that speaks the standard MCP JSON config works. Find its config file or MCP settings UI in its docs.
Check the field names
Some clients use
serverUrlinstead ofurl, ortypeinstead oftransport. The URL and header values below stay the same — only the surrounding key names change.Paste one of these configs
Pick OAuth (recommended) or a Personal Access Token — the tabs below toggle the config.
OAuth (recommended) {"mcpServers": {"zopnight": {"url": "https://api.zop.dev/mcp-server","transport": "streamable-http"}}}Personal Access Token {"mcpServers": {"zopnight": {"url": "https://api.zop.dev/mcp-server","transport": "streamable-http","headers": { "Authorization": "Bearer MCP_PAT" }}}}For PAT, swap
MCP_PATfor the token you copied at Developer Settings → API Tokens.Save and connect
Save the config and restart the client. On the first tool call, OAuth opens a browser to sign in — approve to finish. PAT users skip this: the header authenticates every call.
Confirm it works
Start a fresh session and ask:
List my organisationsA working connection calls list_organisations and reads back your organisations by name. Run this before asking anyone for help: it isolates the connection from everything else, because list_organisations is the only tool that needs no arguments, and every other tool takes the org_id it returns.
If it fails, the usual causes are the transport flag, an expired token, the organisation toggle still being off, or (for OAuth) refusing the browser prompt.
What the tools cover
The MCP catalogue is 289 tools (165 read + 124 write), grouped by area below with a few examples of each:
| Area | Covers | For example |
|---|---|---|
| Organisations & permissions | The organisations you can reach, their settings, and what your own token may do | list_organisations, get_my_permissions, check_eligibility |
| Resources & discovery | Resources across AWS, GCP and Azure, one-call resource overviews, valid filter values, blast radius, cloud accounts | get_resource_overview, list_resources, get_resource_filters, get_blast_radius |
| Cost & billing | Spend by provider, resource, team and tag, trends over time, anomalies, billing sync health, AI Gateway spend | get_cost_overview, get_cost_trends, get_anomalies, get_cost_by_team |
| Budgets | Budgets with spend and status, health summaries, and creating or changing an alerting threshold | list_budgets, get_budget_spend, create_budget |
| Recommendations | Optimisation findings with savings and severity, and the remediation inbox | get_recommendations, get_recommendation_summary, list_workflows |
| Schedules, groups & overrides | Start/stop schedules and their windows, resource groups, and temporary overrides | list_schedules, get_override_candidates, create_schedule, create_override |
| Actions & history | Scheduler events, state transitions, action outcomes, and starting or stopping a resource | get_state_history, list_events, start_resource, stop_resource |
| Teams, users & roles | Teams and their members and resources, users, and role definitions | list_teams, list_team_resources, list_roles |
| Tagging & smart tags | Tagging policies, the tags ZopNight derives, and accepting them into cost attribution | list_tagging_policies, list_smart_tags, accept_smart_tag |
| Audit & notifications | Audit entries, and the Slack, Teams, Chat and webhook channels configured | list_audit_logs, list_notification_channels |
For the authoritative list, call tools/list or ask your assistant what tools it has. It is filtered to what your token and role allow, so it is the answer for you rather than the whole catalogue.
Two tools are worth leading with: get_cost_overview answers “where is the money going” in one call, and get_resource_overview answers everything about one resource, including its metrics, cost history and recommendations. Both replace a handful of narrower calls.
Reads and writes
Most tools read. A smaller set writes: it changes a schedule, sets a budget, accepts a tag, starts or stops a resource.
How much an agent may change is one setting per organisation, Write access, in Settings → Organisation. The levels are cumulative, so choosing one admits everything below it:
| Write access | Admits | For example |
|---|---|---|
| Read-only | Nothing. Read tools only. | — |
| Metadata only | ZopNight’s own records. No cloud state, no cost. | Budgets, recommendation status, smart-tag acceptance |
| Reversible changes | Bounded blast radius, may affect cost. | Schedules, overrides, tagging policies |
| Irreversible changes | No undo, or incurs cost. | Starting and stopping resources |
Some capabilities are excluded at every level, and no setting adds them: roles and permissions, user management, organisation deletion, cloud-account deletion, credentials, and bulk actions. Each has read-only coverage at most.
An agent can never exceed the permissions of the person whose token it holds. Your role is resolved on every call, so revoking someone’s access in the app takes effect on their next tool call, and every write is recorded in the audit trail.
Where to next
- Authentication — token expiry, rotation, and the other ways in.
- Scopes — how roles and permissions resolve, and what lands in the audit trail.