runpod-mcp

Runpod MCP

The Runpod MCP server exposes Runpod's control plane as structured tool calls, so an MCP-capable agent can manage infrastructure without shelling out. It is the same Runpod REST API that runpodctl uses. Pick MCP when its tools are connected (typed params, structured errors, no shell quoting).

This skill owns the MCP side: it connects and authenticates the server, sets the tool-use rules, routes each request to the journey skill that carries its procedure (Route by intent), and owns the answer contract below, which every reply follows. Lane choice (MCP vs runpodctl vs flash) belongs to the router.

For a multi-step job, read the worked example before calling tools: tool calls are easy to issue in the wrong order. The golden paths (index) cover what order to do a whole job in; the journey skills cover procedure within one journey.

Connect

With a user present, connect the hosted server with OAuth ("Sign in with Runpod"; no key on disk). That's the default from the onboarding guide at https://agents.runpod.io/:

claude mcp add --transport http runpod -s user https://mcp.runpod.io/

OAuth signs in the MCP only. When a task later needs runpodctl or flash, get a RUNPOD_API_KEY at that point. With no user in the loop, or a client whose OAuth callback the server rejects (redirect_uri is not allowed), send the key as a header instead: --header "Authorization: Bearer $RUNPOD_API_KEY". Local stdio runs the server as a subprocess with your key. Other clients and the key-vs-OAuth tradeoff: reference/connect.md. After connecting, reconnect the client (in Claude Code, /mcp) so the tools load.

Verify it's live (do this before relying on MCP): in Claude Code run /mcp. runpod should show Connected, not Needs authentication (if it's the latter, sign in there first; the bundled plugin server registers the URL but stays inert until you authenticate). Confirm a real call works by asking for list-endpoints. If the runpod tools aren't present at all, the server isn't connected: (re)run the install above, or fall back to runpodctl for this task.

Check the server version (which REST API it drives): the MCP initialize handshake returns it in serverInfo.version. /mcp in Claude Code shows it, or probe the hosted server directly:

printf '%s\n' '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"probe","version":"0"}}}' \
| curl -s -X POST https://mcp.runpod.io/ \
    -H "Content-Type: application/json" \
    -H "Accept: application/json, text/event-stream" \
    -H "Authorization: Bearer $RUNPOD_API_KEY" -d @-

The server is the source of truth

Once connected, read the server. Do not reason about its tools from memory.

1. The tool list and every parameter come from the client's own view of the connected server: /mcp in Claude Code, or tools/list. Each tool carries its own parameter descriptions, generated from Runpod's REST v2 contract. Check there before concluding a capability exists or doesn't. When a journey skill's tool binding disagrees with the live tool list, the live list wins. Some large create/update tools (create-pod, create-endpoint, create-template and others; the listing says so) list only their call shape: call describe-tool with the tool name for the full argument schema before the first use.
2. The server serves these same skills from this plugin's release: read-guide (start with read-guide runpod-mcp) and the runpod://guides/<id> resources. With this plugin installed, the journey skills below are the procedure; the server's guides are the same text for an agent without the plugin. A skill's reference/<name>.md link is guide id <skill>/<name> (e.g. runpod-serverless-deploy/error-handling).
3. The wire contract is the Runpod v2 OpenAPI document at https://api.runpod.io/v2/openapi.json, for fields beyond the tool surface.

For concepts (pods vs serverless, GPU selection, storage), read ../runpod-usage/.

Use MCP vs runpodctl

• Use this lane for infra CRUD, browsing/deploying an existing Hub listing, or a serverless job call the connected server exposes; the router capability matrix picks the lane per operation. Cap large job/log output to a file.
• Use runpodctl instead for what these tools lack (see Capability boundaries), for any shell-only agent, or when the user wants a reproducible command.
• Pin the CUDA floor on every GPU create: gpu.minCudaVersion on create-pod and create-endpoint ("12.8" by default, "13.0" only for a CUDA-13 image), allowedCudaVersions on create-template. Without a floor a modern image can land on a host too old to run it (why).
• Set timeout (ms) on every create-endpoint: omitted, v2 returns "timeout": 0 (live-verified 2026-10-29). After deploy-hub-repo, read timeout back and set it with update-endpoint if it is 0 (details).
• Pod creates: create-pod takes one GPU type (gpu.id; check the live schema before assuming, and watch for a _warning on an otherwise-successful create), so a multi-GPU priority list means one create per type, retried in order on a capacity error. A CPU pod sends a cpu object ({id, vcpuCount} from list-cpu-types) in place of gpu. templateId works for GPU and CPU pods: each field you pass replaces the template's value (fields you omit come from it: image, args, ports and disk in the 2026-10-29 run), except env, which merges per key with yours winning; the pod keeps no template link, and a CPU pod skips the template's persistent mount and CUDA constraint (template + CPU live-verified 2026-10-29, even with an NVIDIA-category template). The CLI issues this same v2 call, so switching to it does not help.
• Not this lane: authoring a template project or Hub listing files (→ runpod-build-template); writing/deploying your own Python with Flash (→ runpod-flash); downloading models or building/pushing images (→ runpod-companion-clis).

Route by intent

The user wants to…	Journey skill
Know what GPUs/workers/endpoints exist, what fits a model, what it costs	runpod-discovery
Create/inspect/update/delete pods, endpoints, templates, network or global volumes, account secrets, SSH keys, clusters; inventory of the account; who changed what (audit log) or who is in the organization	runpod-lifecycle-crud
Stand up a serverless endpoint for a model/workload and verify it with a real job	runpod-serverless-deploy
Host a ComfyUI workflow (workflow.json, custom Civitai models/LoRAs) as an endpoint	runpod-serverless-deploy, then its ComfyUI reference
Serve an LLM with vLLM (Hub worker-vllm endpoint, load-balancing endpoint on a vLLM image, or a Pod), or fix a vLLM deployment that will not boot	runpod-vllm
Rent/configure an interactive GPU pod; create a pod then pause/stop it for later	runpod-pod-deploy
Diagnose a broken/misbehaving pod (0 GPUs, CUDA, crashes, 502s)	runpod-pod-doctor
Operate an existing endpoint: jobs, scaling, workers, logs	runpod-endpoint-ops
Understand or reduce spend; billing breakdowns	runpod-cost-audit
Something the tools may not cover (file transfer, a command inside a Pod)	Capability boundaries below

Capability boundaries — state them, never fake them

This interface manages infra through the Runpod MCP tools. It does NOT do: SSH sessions, file transfer to/from pods, local image builds, model downloads to volumes, or interactive terminals. When a task needs one of those, say that it is not available through these tools and name the lane that does it: runpodctl for file transfer (send/receive), SSH key setup, doctor setup, model cache and model uploads; SSH or the console web terminal for commands inside a Pod; the Flash SDK for code-first Serverless deploys; the console for Pod migration. Never improvise a fake capability or silently drop that part of the task.

Check the served tool list before calling anything a gap: account secrets and Instant Clusters were console-only once and are served tools now. The workaround for each gap, and the discipline for answering one, are in reference/api-boundary.md.

Live reads before mutations

A template id, a GPU's stock or price, or a resource's state is confirmed with a list- or get- tool before you act on it, even when a guide or an earlier session named it.

The answer contract

Every Runpod reply follows these rules. Journey skills add journey-specific rules and report templates; they never weaken these.

Facts come from tool reads, stated as facts.

• Name the read behind each fact in the answer itself ("from the templates read", "from list-hub-repos", "from the pod's logs"): an image, a price or a stock figure stated without its read is not evidence, however correct.
• Quote real figures, names, and IDs from the reads you just made, not from memory and not rounded into vagueness. IDs verbatim.
• State current stock/status definitively ("RTX 4090 in EU-RO-1: available now"), never "should be", "probably", or "check later". The read you just did IS the check.
• Never contradict your own data: if your table says a card is available, the summary cannot call it out of stock.

Commit; don't hedge, don't defer.

• Diagnosis means ONE most-likely cause plus its concrete fix, chosen from the evidence, rather than a menu of possibilities or "run these commands and tell me".
• If the account state makes the question moot (nothing deployed, zero spend), say exactly that in one sentence and stop. An honest empty answer is complete.
• Never ask the user for information a tool could have given you. Push on with the tools you have; ask only when the user is the sole source: their credentials, their intent on a destructive step, a product choice.
• create-cluster always waits for an explicit go: never call it until the user has seen the shape (nodes, GPUs per node, data center) and the total hourly price from the catalog read and has said go in this conversation. A request to create a cluster asks for that plan and its price; the create waits for the go.
• When the request fixes a class but not the item ("a small model", "a 24 GB card", an image named without its settings), choose the documented default, state the choice in one line, and proceed. A setting the user did not mention is never a reason to stop; stop only when a wrong guess would spend heavily or destroy data.
• A request to deploy, set up or create something is the go for that create. Quote the hourly price from the catalog read in the same reply and make the call; never end the turn on "want me to go ahead?". Two things wait for an explicit go: a cluster (above), and a standing charge the user did not ask for by name, such as a warm worker. For those, create the part that bills nothing while idle, then quote the standing charge per hour and per month and offer it.

Mutations bind to what this conversation created or the user named.

• You may stop, update, or delete a resource created by your own tool calls in this conversation. You may also change the one resource the user named in the request by its id or an unambiguous name (a setting on one endpoint, one job on its queue), but only the change they asked for: a user-named resource is deleted only when the user asked for that delete. The user's instruction is the authority for that one resource, so do the change rather than handing them console steps. Otherwise, provenance comes from your create outputs, never from a name you found by listing. A disposable-looking name, an auto-generated slug, or a familiar prefix is not attribution.
• A cleanup or cost-cutting instruction does not extend that authority, however urgently it is phrased. For anything you cannot attribute to this conversation, the complete answer is the audit: what you checked, what qualifies, the ids, and the exact actions for the USER to take. That is a full answer, not a deferral. The commit-don't-hedge rule never licenses mutating a resource that isn't yours.
• When nothing this conversation created remains, say exactly that and touch nothing.
• Every write is checked by a fresh read. After a create or update, read the resource back and confirm the fields you set; after a delete, read again and confirm it is gone; after a job cancel or a queue purge, read the job or the queue again. For a settings change, also read the current values before the write, so the answer gives before and after, both from reads. The write call's own response is not that read, and the final message quotes what the read showed.
• A permission error on a resource you did not create is a correct answer, not an obstacle: report it as out of scope. Never retry it or advise re-running from a less-restricted session or key to get around it.

The final message stands alone.

• Close with a summary the user can act on without scrolling back: the ids, URLs, prices, and commands the task produced belong in it. No "the link above" and no pointer to an earlier turn.

Carry the work as far as the tools allow.

• Prefer a server-side wait (wait parameters) over handing the user a poll loop; check state between holds. When a wait outlasts what the tools can hold, report the evidenced state (what was created, what was submitted, what the worker states show) and the recommended next step. Offering to keep watching is fine; silently stopping mid-wait is not.

Honest failure beats fabricated success.

• Report failures with the observed evidence (the error body, the worker state, the log line). Never report a success without the artifact that proves it (the output the job returned).
• A missing credential or capability is reported as exactly that, with what you did to confirm it and what the user must supply.

Use only the tools you were given.

• If a tool is not available in this session, work with the ones that are; reads you already made can be analyzed directly. Never stall the task requesting new tool access.

Report habits (inventory, cost, deployment reports):

• Enumerations read best as tables carrying each resource's name and id.
• Every dollar figure comes from a billing/pricing read made this turn; give totals beside per-item figures, and show empty categories rather than silently dropping them.
• Lead the user to the number or verdict they asked for.

Source & docs

• Server source: https://github.com/runpod/runpod-mcp
• Package (npm): https://www.npmjs.com/package/@runpod/mcp-server
• Hosted endpoint: https://mcp.runpod.io/
• Docs: https://docs.runpod.io