Cloud
Step-by-step connection and configuration for AWS CloudWatch, AWS SQS / SNS, Azure Monitor, Google Cloud Logging, Cloudflare and Vercel.
The platform layer: logs, metrics, queues and deployments belonging to the cloud provider rather than to your application.
AWS CloudWatch
aws-cloudwatch · runs awslabs.cloudwatch-mcp-server via uvx.
Create an IAM user with CloudWatchReadOnlyAccess (and
CloudWatchLogsReadOnlyAccess if you want log queries), then generate an access key.
Fill the form. All AWS integrations share this credential shape.
| Field | Required | What to put |
|---|---|---|
| AWS access key ID | yes | AKIA… |
| AWS secret access key | yes | |
| Region | yes, defaults us-east-1 | Log groups and alarms are per-region. Add a second instance for a second region. |
| Session token | no | Only for temporary (STS) credentials. |
Verify. Start-checked only — no health check runs. The first tool call is what proves the credential.
AWS SQS / SNS
aws-sqs-sns · runs awslabs.amazon-sns-sqs-mcp-server via uvx · same credential
fields as CloudWatch above.
Create an IAM user with AmazonSQSReadOnlyAccess and AmazonSNSReadOnlyAccess.
Fill the form — access key ID, secret access key, region, optional session token, exactly as above. The region must be the one the queues and topics live in.
Verify. Start-checked only.
Azure Monitor
azure-monitor · runs the official @azure/mcp server via npx, narrowed to the
monitor namespace and started with its --read-only flag.
Covers Log Analytics and Application Insights KQL queries, the activity log, table metadata, metric definitions and metric queries.
Register an app in Entra ID → App registrations → New registration. Note its Directory (tenant) ID and Application (client) ID.
Create a client secret under Certificates & secrets → New client secret. Note the expiry date — these expire silently and the resulting failure looks like a bad credential.
Grant the service principal two roles: Monitoring Reader on the subscription, and Log Analytics Reader on the workspaces you want to query. Without these the sign-in succeeds and every query fails.
Fill the form.
| Field | Required | What to put |
|---|---|---|
| Tenant ID | yes | The app registration's Directory (tenant) ID. |
| Client ID | yes | The same registration's Application (client) ID. |
| Client secret | yes | |
| Subscription ID | yes | The subscription to query. |
Verify. Health check lists Log Analytics workspaces, which fails on a bad secret and on a subscription the principal was never granted.
| If it reports | It usually means |
|---|---|
AADSTS7000215, invalid client secret | The secret expired, or the three ids don't all come from the same app registration. |
AuthorizationFailed / 403 | Signed in, but no role on the subscription. Grant Monitoring Reader, plus Log Analytics Reader on the workspaces. |
subscription not found | Wrong id, or the principal lives in a different tenant. |
Google Cloud Logging
gcp-logging · runs @google-cloud/observability-mcp via npx · every tool is
read-side, so there is no write mode to disable.
Covers Cloud Logging entries, log names, buckets and sinks; Cloud Monitoring metric descriptors, time series and alert policies; Cloud Trace; and Error Reporting.
Enable the APIs on the project: Cloud Logging API and Cloud Monitoring API. Enablement takes a minute to propagate.
Create a service account with exactly Logs Viewer (roles/logging.viewer) and Monitoring Viewer (roles/monitoring.viewer), and download its JSON key.
Place the key on the machine running Triagic, at an absolute path the desktop app
can read, e.g. /opt/triagic/gcp-sa.json.
Fill the form.
| Field | Required | What to put |
|---|---|---|
| Project ID | yes | The project whose logs you want. API usage is billed and quota-checked against it. |
| Service account key path | no | Absolute path to the JSON. Blank falls back to Application Default Credentials on that machine. |
Verify. Start-checked only: every tool requires a project-scoped argument, so there is no fixed call that could serve as a health check.
| If it reports | It usually means |
|---|---|
Could not determine credentials | No Google credentials on that machine — set the key path, or run gcloud auth application-default login there. |
has not been used in project, SERVICE_DISABLED | The API isn't enabled on the project. |
403 / permission denied | Missing Logs Viewer or Monitoring Viewer. |
Cloudflare
cloudflare · a hosted endpoint — the desktop talks HTTPS to Cloudflare's Workers
Observability MCP server. Nothing runs locally, so this needs outbound network access
rather than an installed runtime.
All three tools are query-side: logs and analytics, plus field and value discovery.
Create an API token at dash.cloudflare.com → My Profile → API Tokens (or Account → API Tokens for an account-scoped one), with the permission Account → Workers Observability → Read, scoped to the account whose Workers you want to query.
A Global API Key is not accepted — it must be an API token.
Fill the form.
| Field | Required | What to put |
|---|---|---|
| API token | yes | The token above. |
Verify. Start-checked only. Both of the server's cheap tools require a structured query argument with its own time range, and a guessed shape would report a working integration as broken.
| If it reports | It usually means |
|---|---|
401 / error 10000 | Token rejected — check it is an API token, not a Global API Key. |
403 / error 9109 | Valid token, missing permission. Add Workers Observability → Read. |
Vercel
vercel · a hosted endpoint at https://mcp.vercel.com, reached with your Vercel
access token as the bearer. Nothing runs locally.
Covers deployments, build and runtime logs, projects, teams, Web Analytics and documentation search.
Writes are not blocked here
A remote server takes no flags, and Vercel MCP's authenticated tools include project and deployment management. The token's own scope is the only boundary.
Vercel documents OAuth for this endpoint
Vercel's published guidance for mcp.vercel.com is a browser authorization flow, and
it states the endpoint supports only AI clients Vercel has reviewed. This integration
sends a personal access token as the bearer instead, because the OAuth flow needs a
browser and callback URL the desktop app does not have.
If Vercel refuses that token, the integration reports degraded with a 401 on its
first sync rather than failing quietly — and there is no field that fixes it. Treat
this entry as provisional until you have seen it come back running.
Create an access token at vercel.com/account/tokens → Create Token. Set its Scope to the team that owns the projects you want readable — a token scoped to your personal account cannot see a team's projects. Set an expiry you are willing to rotate on.
Optionally find the project scope. The team-and-project pair from the dashboard
URL, e.g. acme-inc/storefront. Setting it scopes the session to that one project;
leaving it blank reaches everything the token can see.
Fill the form.
| Field | Required | What to put |
|---|---|---|
| Access token | yes | vcp_… |
| Project scope | no | acme-inc/storefront. Leading and trailing slashes are tolerated. |
Verify. Health check lists teams — an authenticated call, deliberately not the documentation search, which Vercel serves publicly and would pass for a token that reaches nothing.
| If it reports | It usually means |
|---|---|
401 / invalid_token | Wrong or expired token — or the endpoint requires OAuth, per the callout above. |
403 | Token scoped to a personal account rather than the owning team. |
404 | Project scope doesn't resolve. Use the team-and-project pair from the dashboard URL, or leave it blank. |