> For the complete documentation index, see [llms.txt](https://docs.apolo.us/index/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.apolo.us/index/apolo-mcp/getting-started/safety.md).

# Safety and operation types

Apolo MCP uses the identity established by `apolo login` and cannot elevate that user's Apolo permissions. Tool annotations help MCP clients request appropriate approval; they are not authorization controls.

The user who launches the local stdio server controls `APOLO_MCP_ENABLE_HIGH_RISK`. Setting it to `true` enables high-risk tools at the MCP policy layer, but does not approve an operation or bypass Apolo RBAC. `APOLO_MCP_POLICY_FILE` can point to a local JSON policy file containing an `enable_high_risk` boolean. The environment variable takes precedence.

Always verify the explicit cluster, organization, and project before a write. Never put tokens, secret values, cookies, or service-account credentials in prompts or tool arguments. Tools that accept or retrieve sensitive material use protected local sources and sinks instead.

Apolo MCP can create service accounts. The generated one-time token is sent directly to a new protected local file or a named Apolo secret and is never included in the tool result. This is a high-risk credential-creation operation even though the credential value remains outside the model-visible interface.

The tools below are grouped by the skill that guides their use, then by their MCP operation type. Read-only operations inspect state. Platform-mutating Write and Destructive operations require explicit approval, the local user's `APOLO_MCP_ENABLE_HIGH_RISK` opt-in, and the user's existing Apolo permissions. Local App planning appears under Write but is marked separately: it creates review files without mutating Apolo resources and does not require the high-risk opt-in.

## [Apolo Platform User Context](/index/apolo-mcp/capabilities/skills.md#apolo-platform-user-context)

Tools used by the `apolo-platform-user-context` skill.

### Read-only operations

* [`get_apolo_context`](/index/apolo-mcp/capabilities/tools/context.md#get_apolo_context) — Return selected context and safe local metadata; never tokens or cookies.
* [`list_clusters`](/index/apolo-mcp/capabilities/tools/context.md#list_clusters) — List clusters visible to the authenticated user (bounded to 100).
* [`list_organizations`](/index/apolo-mcp/capabilities/tools/context.md#list_organizations) — List organizations for an explicit or selected cluster.
* [`list_projects`](/index/apolo-mcp/capabilities/tools/context.md#list_projects) — List projects for explicit context without changing saved selection.
* [`list_presets`](/index/apolo-mcp/capabilities/tools/context.md#list_presets) — List bounded compute preset capabilities for a cluster.
* [`resolve_resource_uri`](/index/apolo-mcp/capabilities/tools/context.md#resolve_resource_uri) — Resolve a short resource reference under explicit, non-persisted context.

### Write operations

*None.*

### Destructive operations

*None.*

## [Apolo Research Job](/index/apolo-mcp/capabilities/skills.md#apolo-research-job)

Tools used by the `apolo-research-job` skill.

### Read-only operations

* [`list_jobs`](/index/apolo-mcp/capabilities/tools/jobs.md#list_jobs) — List jobs using context and bounded status/name/tag/owner/time filters.
* [`get_job`](/index/apolo-mcp/capabilities/tools/jobs.md#get_job) — Get one job and its resolved context.
* [`wait_for_job`](/index/apolo-mcp/capabilities/tools/jobs.md#wait_for_job) — Poll until terminal state, always bounded by timeout\_seconds.
* [`get_job_logs`](/index/apolo-mcp/capabilities/tools/jobs.md#get_job_logs) — Read a bounded log prefix with explicit timeout and truncation metadata.
* [`get_job_telemetry`](/index/apolo-mcp/capabilities/tools/jobs.md#get_job_telemetry) — Collect a bounded telemetry summary and optionally bounded raw samples.

### Write operations

* [`run_job`](/index/apolo-mcp/capabilities/tools/jobs.md#run_job) — Start an approved job; direct secret values are forbidden.
* [`bump_job_life_span`](/index/apolo-mcp/capabilities/tools/jobs.md#bump_job_life_span) — Extend a job lifespan; requires enabled high-risk server policy.
* [`send_job_signal`](/index/apolo-mcp/capabilities/tools/jobs.md#send_job_signal) — Send the SDK's graceful job signal; requires high-risk policy.
* [`save_job_image`](/index/apolo-mcp/capabilities/tools/jobs.md#save_job_image) — Save a job filesystem as an image; requires high-risk policy.

### Destructive operations

* [`kill_job`](/index/apolo-mcp/capabilities/tools/jobs.md#kill_job) — Kill a job (destructive); requires enabled high-risk server policy.

## [Apolo Flow Workloads](/index/apolo-mcp/capabilities/skills.md#apolo-flow-workloads)

Tools used by the `apolo-flow-workloads` skill.

### Read-only operations

* [`flow_live_list`](/index/apolo-mcp/capabilities/tools/flow.md#flow_live_list) — List Flow live jobs within explicit context and local path scope.
* [`flow_live_get`](/index/apolo-mcp/capabilities/tools/flow.md#flow_live_get) — Resolve one logical Flow job, with a bounded multi-job result.
* [`flow_live_logs`](/index/apolo-mcp/capabilities/tools/flow.md#flow_live_logs) — Read bounded Flow live logs with MCP-side credential redaction.
* [`flow_live_wait`](/index/apolo-mcp/capabilities/tools/flow.md#flow_live_wait) — Wait a bounded time for a Flow live job to terminate.
* [`flow_bake_list`](/index/apolo-mcp/capabilities/tools/flow.md#flow_bake_list) — List bakes and bounded task state in one explicit context.
* [`flow_bake_get`](/index/apolo-mcp/capabilities/tools/flow.md#flow_bake_get) — Get structured bake, attempt, and bounded task state.
* [`flow_bake_logs`](/index/apolo-mcp/capabilities/tools/flow.md#flow_bake_logs) — Read bounded bake task logs with MCP-side credential redaction.
* [`flow_bake_wait`](/index/apolo-mcp/capabilities/tools/flow.md#flow_bake_wait) — Wait a bounded time for a bake attempt to terminate.

### Write operations

* [`flow_live_run`](/index/apolo-mcp/capabilities/tools/flow.md#flow_live_run) — Start a configured Flow live job after explicit approval and policy.
* [`flow_bake_start`](/index/apolo-mcp/capabilities/tools/flow.md#flow_bake_start) — Start a bake only through FlowAPI BatchRunner orchestration.

### Destructive operations

* [`flow_live_kill`](/index/apolo-mcp/capabilities/tools/flow.md#flow_live_kill) — Kill a Flow live job after explicit approval and policy.
* [`flow_live_kill_all`](/index/apolo-mcp/capabilities/tools/flow.md#flow_live_kill_all) — Kill all jobs in exactly one explicit Flow context.
* [`flow_bake_cancel`](/index/apolo-mcp/capabilities/tools/flow.md#flow_bake_cancel) — Cancel a bake attempt after explicit approval and policy.
* [`flow_bake_restart`](/index/apolo-mcp/capabilities/tools/flow.md#flow_bake_restart) — Restart a bake through BatchRunner after approval and policy.

## [Apolo Applications](/index/apolo-mcp/capabilities/skills.md#apolo-applications)

Tools used by the `apolo-applications` skill.

### Read-only operations

* [`list_app_templates`](/index/apolo-mcp/capabilities/tools/applications.md#list_app_templates) — List templates in an explicitly resolved context, bounded to 100.
* [`list_app_template_versions`](/index/apolo-mcp/capabilities/tools/applications.md#list_app_template_versions) — List bounded versions of one Apps template.
* [`get_app_template`](/index/apolo-mcp/capabilities/tools/applications.md#get_app_template) — Get the exact template version and current input schema.
* [`list_apps`](/index/apolo-mcp/capabilities/tools/applications.md#list_apps) — List Apps with state filtering and a strict result bound.
* [`get_app`](/index/apolo-mcp/capabilities/tools/applications.md#get_app) — Get one App and verify it belongs to the resolved context.
* [`wait_for_app`](/index/apolo-mcp/capabilities/tools/applications.md#wait_for_app) — Wait a bounded time for an App to reach a terminal health state.
* [`get_app_logs`](/index/apolo-mcp/capabilities/tools/applications.md#get_app_logs) — Read bounded UTF-8 logs with timeout and explicit truncation metadata.
* [`get_app_events`](/index/apolo-mcp/capabilities/tools/applications.md#get_app_events) — Return bounded, credential-redacted App status events.
* [`get_app_output`](/index/apolo-mcp/capabilities/tools/applications.md#get_app_output) — Return bounded, credential-redacted output for one App.
* [`get_app_input`](/index/apolo-mcp/capabilities/tools/applications.md#get_app_input) — Return bounded App input with likely credential values redacted.
* [`list_app_revisions`](/index/apolo-mcp/capabilities/tools/applications.md#list_app_revisions) — List bounded configuration revisions after verifying App context.

### Write operations

* [`plan_app_install`](/index/apolo-mcp/capabilities/tools/applications.md#plan_app_install) — **Local planning; does not mutate Apolo resources.** Write exact install YAML plus atomic plan.json/PLAN.md for review.
* [`plan_app_configure`](/index/apolo-mcp/capabilities/tools/applications.md#plan_app_configure) — **Local planning; does not mutate Apolo resources.** Seed exact YAML with SDK get\_input, patch it, and write a review plan.
* [`plan_app_rollback`](/index/apolo-mcp/capabilities/tools/applications.md#plan_app_rollback) — **Local planning; does not mutate Apolo resources.** Write a no-YAML rollback plan bound to current and target revisions.
* [`plan_app_uninstall`](/index/apolo-mcp/capabilities/tools/applications.md#plan_app_uninstall) — **Local planning; does not mutate Apolo resources.** Write a no-YAML uninstall plan bound to exact App/current revision.
* [`install_app`](/index/apolo-mcp/capabilities/tools/applications.md#install_app) — Apply one approved, unexpired, unchanged install plan exactly once.
* [`configure_app`](/index/apolo-mcp/capabilities/tools/applications.md#configure_app) — Apply one approved, unchanged configure plan after revision drift check.

### Destructive operations

* [`rollback_app`](/index/apolo-mcp/capabilities/tools/applications.md#rollback_app) — Apply an approved rollback plan; server high-risk policy must allow it.
* [`uninstall_app`](/index/apolo-mcp/capabilities/tools/applications.md#uninstall_app) — Apply an approved uninstall plan; server high-risk policy must allow it.

## [Apolo Resource Management](/index/apolo-mcp/capabilities/skills.md#apolo-resource-management)

Tools used by the `apolo-resource-management` skill.

### Read-only operations

* [`list_storage`](/index/apolo-mcp/capabilities/tools/storage.md#list_storage) — List a bounded storage directory; the response marks truncation.
* [`stat_storage`](/index/apolo-mcp/capabilities/tools/storage.md#stat_storage) — Return metadata for one exact storage path.
* [`read_text`](/index/apolo-mcp/capabilities/tools/storage.md#read_text) — Read a UTF-8 text prefix under a strict byte cap.
* [`list_disks`](/index/apolo-mcp/capabilities/tools/disks.md#list_disks) — List persistent disks under a strict result bound.
* [`list_image_repositories`](/index/apolo-mcp/capabilities/tools/images.md#list_image_repositories) — List repositories in one exact context under a strict output bound.
* [`list_image_tags`](/index/apolo-mcp/capabilities/tools/images.md#list_image_tags) — List tags for one exact repository under a strict output bound.
* [`inspect_image`](/index/apolo-mcp/capabilities/tools/images.md#inspect_image) — Inspect exact tag metadata: digest and aggregate layer size only.
* [`list_buckets`](/index/apolo-mcp/capabilities/tools/buckets.md#list_buckets) — List bucket metadata under a strict result bound.
* [`get_bucket`](/index/apolo-mcp/capabilities/tools/buckets.md#get_bucket) — Get safe metadata for one exact bucket ID or name.
* [`get_bucket_disk_usage`](/index/apolo-mcp/capabilities/tools/buckets.md#get_bucket_disk_usage) — Scan bounded usage; complete=false means the object cap was reached.
* [`stat_bucket_blob`](/index/apolo-mcp/capabilities/tools/buckets.md#stat_bucket_blob) — Return metadata only for one exact blob key.
* [`list_bucket_blobs`](/index/apolo-mcp/capabilities/tools/buckets.md#list_bucket_blobs) — List blob metadata under an SDK-enforced and result-enforced bound.
* [`list_secrets`](/index/apolo-mcp/capabilities/tools/secrets.md#list_secrets) — List names, owners, and context only; never retrieve secret values.
* [`list_service_accounts`](/index/apolo-mcp/capabilities/tools/service-accounts.md#list_service_accounts) — List accounts whose defaults match one exact resolved context.
* [`get_service_account`](/index/apolo-mcp/capabilities/tools/service-accounts.md#get_service_account) — Get safe service-account metadata in one exact default context.

### Write operations

* [`write_text`](/index/apolo-mcp/capabilities/tools/storage.md#write_text) — Write a small UTF-8 text object; requires high-risk server policy.
* [`make_directory`](/index/apolo-mcp/capabilities/tools/storage.md#make_directory) — Create an exact directory; requires high-risk server policy.
* [`create_disk`](/index/apolo-mcp/capabilities/tools/disks.md#create_disk) — Create and ledger a bounded disk; requires high-risk server policy.
* [`push_image`](/index/apolo-mcp/capabilities/tools/images.md#push_image) — Push a local Docker image to one exact Apolo repository and tag.
* [`pull_image`](/index/apolo-mcp/capabilities/tools/images.md#pull_image) — Pull one exact Apolo image into the MCP host's local Docker engine.
* [`create_bucket`](/index/apolo-mcp/capabilities/tools/buckets.md#create_bucket) — Create and ledger a bucket after policy and client approval.
* [`import_external_bucket`](/index/apolo-mcp/capabilities/tools/buckets.md#import_external_bucket) — Import using bounded JSON credentials from a protected internal source.
* [`set_bucket_public_access`](/index/apolo-mcp/capabilities/tools/buckets.md#set_bucket_public_access) — Set public state for one exact immutable bucket ID.
* [`create_bucket_signed_url`](/index/apolo-mcp/capabilities/tools/buckets.md#create_bucket_signed_url) — Create a short-lived blob URL; no persistent credentials are returned.
* [`upload_bucket_file`](/index/apolo-mcp/capabilities/tools/buckets.md#upload_bucket_file) — Upload one bounded workspace file without serializing object bytes.
* [`download_bucket_file`](/index/apolo-mcp/capabilities/tools/buckets.md#download_bucket_file) — Download one bounded blob to a new file below the workspace root.
* [`get_secret_to_file`](/index/apolo-mcp/capabilities/tools/secrets.md#get_secret_to_file) — Write a secret to a new mode-0600 workspace file; never return its value.
* [`create_secret_from_source`](/index/apolo-mcp/capabilities/tools/secrets.md#create_secret_from_source) — Create a secret without accepting or returning its value.
* [`create_service_account`](/index/apolo-mcp/capabilities/tools/service-accounts.md#create_service_account) — Create an account and sink its token without returning token material.

### Destructive operations

* [`delete_storage_path`](/index/apolo-mcp/capabilities/tools/storage.md#delete_storage_path) — Delete one exact path; recursive deletion removes its entire subtree.
* [`delete_disk`](/index/apolo-mcp/capabilities/tools/disks.md#delete_disk) — Delete one exact disk ID after approval, or exact ledger-owned cleanup.
* [`remove_image`](/index/apolo-mcp/capabilities/tools/images.md#remove_image) — Remove an exact tag digest after approval and server policy checks.
* [`delete_bucket_blob`](/index/apolo-mcp/capabilities/tools/buckets.md#delete_bucket_blob) — Delete one exact blob key; recursive/prefix deletion is not exposed.
* [`delete_bucket`](/index/apolo-mcp/capabilities/tools/buckets.md#delete_bucket) — Delete one exact empty bucket ID, optionally as ledger-owned cleanup.
* [`delete_secret`](/index/apolo-mcp/capabilities/tools/secrets.md#delete_secret) — Delete one exact secret key after policy and client approval.
* [`delete_service_account`](/index/apolo-mcp/capabilities/tools/service-accounts.md#delete_service_account) — Delete one exact immutable account ID after context verification.