Cloud Use

Cloud Use is a capability of Qoder Cloud Agents that lets a cloud-resident agent operate your Alibaba Cloud resources under a governed identity, completing tasks end-to-end in the cloud. This page walks you through setup and a few typical cloud-use scenarios.

​

1. How it works

Setup takes two steps: in the console, authorize the Alibaba Cloud OpenAPI MCP via OAuth, and import official Alibaba Cloud skills from the Skill marketplace as needed. After that, in a cloud session the agent uses a platform-injected machine identity to call the Alibaba Cloud OpenAPI through MCP and complete tasks with those skills. Because the agent runs in the cloud, it can run long-term, be triggered in real time by events, and every cloud action is recorded server-side. Typical use: ops and incident response, data analytics, data processing, and cost governance — tasks that need an agent to run long-term, trigger in real time, and operate Alibaba Cloud resources under a governed identity.

​

2. Connect to Alibaba Cloud (OAuth · in the console)

Cloud Use operates the cloud through the Alibaba Cloud OpenAPI MCP, authenticated with OAuth in the console. The five steps below are all done in the console. Step 1 · Get your MCP URL Open the MCP onboarding page of the Alibaba Cloud OpenAPI portal, and choose the domain for your account's site:

• China site: https://api.aliyun.com/mcp
• International site: https://api.alibabacloud.com/mcp

On the page, select Streamable HTTP Endpoint and copy your dedicated MCP server URL. Step 2 · Install the official app in Alibaba Cloud RAM Open the RAM console's OAuth Applications (Public Preview) page for your site:

• China site: https://ram.console.aliyun.com/applications?activeTab=ThirdParty
• International site: https://ram.console.alibabacloud.com/applications?activeTab=ThirdParty

Then go to OAuth Applications (Public Preview) → Install official app → select OpenAPI MCP Server to finish installation. Step 3 · Create a Vault and authorize in the console In the Cloud Agents console → Vault → create a credential:

• Credential type: MCP OAuth
• MCP server: select the pinned "Alibaba Cloud · Cloud Use" from the dropdown (or choose "Custom URL" and paste the address from Step 1). If you're unsure of the URL, click "Get the Alibaba Cloud Cloud Use MCP URL" and follow the guide.

Save, then complete the one-time OAuth redirect; the credential status changes to "Authorized". Step 4 · Bind the MCP on your agent In the agent's MCP Servers settings, select the MCP OAuth credential created in Step 3 (recommended: pick an existing credential from the Vault so you don't re-enter the URL). Step 5 · Link the Vault when creating a session When starting a session, choose this agent and link the corresponding Vault. The platform automatically injects the OAuth token into the MCP call chain, and the agent calls tools under the authorized Alibaba Cloud identity.

​

3. Import cloud-use skills

In the console under Skills → Create → Import from Skill marketplace:

• Pick the pinned "Cloud Use" category to see the curated cloud-use skills;
• Or search for official Alibaba Cloud skills (e.g., RAM Permission Diagnosis, DataWorks Data Development, Quick BI NL2SQL) and import them;
• After Import, the skill appears in your Skills list and can be used in your agent right away.

​

4. Typical scenarios

Incident Response

• Outcome: on alert → locate root cause → controlled mitigation → fix PR.
• Key permissions: logs / monitoring read-only allow; restart / scale / shift traffic (mitigation) ask; delete / release deny.
• Recommended skills: RAM Permission Diagnosis & Policy Generator, CloudMonitor 2.0 Lifecycle Management, Elasticsearch Cluster Diagnosis & Repair.
• Trigger: event-driven (alert webhook, real time).

Data Analytics

• Outcome: natural-language question → explore schema → generate and run SQL → chart → attribution explanation.
• Key permissions: query / run SQL (read-only) allow; write operations deny.
• Recommended skills: Smart-Q Data Analytics (Quick BI), NL2SQL Engine (DMS, 60+ sources), Data Visualization.
• Trigger: real-time Q&A; optional daily digest at 08:00.

Data Processing

• Outcome: read source → rule-based clean / transform / aggregate → write to target dataset → validate row count and schema.
• Key permissions: read source allow; write back to target table / OSS ask; delete source data deny. Tasks must be idempotent and re-runnable.
• Recommended skills: DataWorks Data Development, ClickHouse Data Migration, MaxCompute Metadata Analysis.
• Trigger: daily batch at 02:00 (cron configurable).

Cost Governance (FinOps)

• Outcome: pull bills and utilization → top cost items, each with "estimated monthly savings + a one-line fix".
• Key permissions: bills / utilization (read-only) allow; stop idle / downsize / lifecycle ask.
• Recommended skills: EMR Cluster Lifecycle Management (cost tags), MaxCompute Metadata (task cost tracking), DAS Database Autonomy.
• Trigger: daily at 09:00 (cron configurable).

​

5. FAQ

Q: How is this different from using a local Coding Agent + Alibaba Cloud MCP? A: With Cloud Use, the agent runs in the cloud, so it can run 24/7 long-term and be triggered in real time by events (such as alert webhooks) without depending on your local machine being online. Cloud operations run under an authorized machine identity, with credentials hosted and injected by the platform — they never touch your local machine. Every cloud action is recorded server-side and auditable. Q: During authorization I see "application not authorized to install, please re-initiate the authorization flow". A: Go back to Setup Step 2 and confirm the OpenAPI MCP Server official app is installed in Alibaba Cloud RAM under OAuth Applications (Public Preview), then re-initiate OAuth. Q: Where do I find the bills for the Alibaba Cloud usage? A: Cloud Use consumption is billed to whichever Alibaba Cloud account you authorized — the Alibaba Cloud account that completed the OAuth authorization for the MCP is the one that incurs the API calls and resource consumption, and its bills live under that account. View them in the Billing Center of the corresponding Alibaba Cloud account. Q: Are there differences between the China site and the International site? A: Yes. The Alibaba Cloud MCP onboarding portal and the RAM console are each split by China site / International site (see Step 1 for the onboarding page and Step 2 for the RAM console). Pick the domain that matches your account's site. Q: Can multiple sessions of the same agent share the same authorization? A: Yes. Authorization and connection live in the Vault; agents just reference (mount) it. Configure it once and reuse it in many places.